PII-Guard, an open-source detector for personal data in Russian text, has been released by NLP researcher Andrey Ivanov from the R&D laboratory of red_mad_robot. The system addresses the growing need to protect sensitive information when users and companies send working texts to language models.
Personal data such as names, phone numbers, document numbers and addresses frequently accompany prompts. Companies therefore build masking pipelines that anonymize text before model inference. However, simple masking destroys semantic links, forcing models to answer questions about “**** called ****” without knowing how many people are involved or who called whom.
The new requirement is reversible pseudonymization: real values must be replaced by structured placeholders that models can process naturally, after which the original data is restored in the final answer.
From regex to hybrid detection
The first prototype relied on regular expressions. While telephone numbers, INN, SNILS and card numbers have predictable length and structure, real-world text contains spaces, dashes, typos and extra characters that break rigid patterns. Moreover, a 16-digit sequence could be either a bank card or an order ID, and a 10-digit string could match both INN and passport formats.
Control-sum verification was added next. Bank cards use the Luhn algorithm, INN and SNILS employ weighted sums, and OMS policies again apply Luhn. Additional structural checks cover BIK prefixes and postal-index ranges. These filters reduced false positives, yet arithmetic validation alone cannot distinguish a genuine document from a coincidental numeric string that happens to satisfy the checksum.
Context windows were introduced to look for nearby cue words such as “паспорт”, “ИНН” or “полис”. Positive keywords must lie within type-specific distance limits; negative keywords such as “биржевой” can veto an index match regardless of distance. When multiple candidates compete, the system selects the highest-confidence match after ordering document types from most distinctive (birth certificates, military IDs) to most ambiguous (simple six- or ten-digit sequences).
Adding semantic understanding
Names, addresses and telephone numbers lack rigid formats, so rules cannot locate them reliably. The team therefore annotated their own datasets and fine-tuned a ruBert-base NER model. The model handles semantic entities such as person names and addresses while also capturing documents missed by rules because of typos or irregular spacing.
The final architecture runs two independent streams. The rule-based stream normalizes text, extracts candidates, validates checksums and applies keyword context. The model stream processes the entire text and returns its own spans. An arbitration module merges results: when spans overlap but labels differ, rules win; when only the model finds an entity, its prediction is accepted; non-overlapping spans from both streams are retained.
Pseudonymization and grammatical restoration
Detected entities are replaced by XML-style tags containing type, numeric ID and, for persons, grammatical gender inferred by a Russian morphology library. The tag format was chosen to avoid accidental collisions with ordinary text or other system markup. After the model returns its answer, real values are substituted back, with morphological analysis ensuring correct case for names and addresses.
Evaluation was performed on four public datasets, one of which is the team’s own. On the intersection of entity types supported by all compared systems, PII-Guard achieved the highest micro-F1 scores under both strict span matching and type-overlap criteria. The project, datasets and code are publicly available.
