gliner-multi-pii-onnx

gliner-multi-pii-onnx is an ONNX export of urchade/gliner_multi_pii-v1 (a GLiNER span NER model over microsoft/mdeberta-v3-base), packaged as an offline, multilingual named-entity recognizer for PII detection. The upstream model ships only PyTorch weights; this repo packages an ONNX graph plus the tokenizer so it can run under ONNX Runtime in any language. Produced for AgentGuard (the AgentGuard.Onnx PII NER recognizer, used via RedactPiiWithNer()) but usable standalone.

What it does

Detects entity spans - by default person, location, organization, date (mapped by AgentGuard to PERSON / LOCATION / ORGANIZATION / DATE_TIME). GLiNER is zero-shot: the candidate labels are part of the runtime input, not a frozen taxonomy, so the integrator chooses the label set per call. There is no prefix.json (unlike the frozen-taxonomy content-safety export) - the input is assembled at inference time.

The word-level input [<<ENT>> label1 … <<ENT>> labelN <<SEP>> word1 … wordM] is subword-tokenized (is_split_into_words) into [CLS] (<<ENT>> label-subwords)×N <<SEP>> word-subwords… [SEP], with a words_mask marking the first subword of each text word. The span model enumerates every (start, start+w) word span up to max_width and scores it against every label, emitting logits[batch, num_words(L), max_width(K), num_classes(C)]. Decode: sigmoid → keep ≥ threshold and valid (start+w < L) → flat-greedy non-overlap → map word spans back to character offsets.

Files

Inputs: input_ids, attention_mask, words_mask, text_lengths ([batch, 1]), span_idx ([batch, num_spans, 2]) - all int64 - and span_mask (bool, [batch, num_spans]). Output: logits (float, [batch, num_words, max_width, num_classes]). Special ids: [CLS]=1, [SEP]=2, <<ENT>>=250103, <<SEP>>=250104, pad=0; max_width=12.

Usage

The simplest standalone path is the gliner library's ONNX loader (uses the bundled gliner_config.json / tokenizer.json):

from gliner import GLiNER

model = GLiNER.from_pretrained(
    "filip-w/gliner-multi-pii-onnx",
    load_onnx_model=True,
    onnx_model_file="model_fp16.onnx",  # or model.onnx for fp32
)

text = "Contact Jane Doe in Berlin at ACME Corp on March 3rd."
labels = ["person", "location", "organization", "date"]
print(model.predict_entities(text, labels, threshold=0.5, flat_ner=True))
# [{'text': 'Jane Doe', 'label': 'person', ...}, {'text': 'Berlin', 'label': 'location', ...}, ...]

For non-Python runtimes (e.g. .NET via ONNX Runtime), assemble the input from config.json + spm.model and reproduce the flat-greedy span decode as described above. AgentGuard's GlinerModelSession is a reference implementation; see eng/gliner-eval/README.md for the full assembly + decode and id-for-id parity notes.

Tokenization note for non-Python runtimes: SentencePiece-encode each word independently (each word gets its own ▁ dummy prefix, which reproduces HF's is_split_into_words ids), and insert the [CLS] / <<ENT>> / <<SEP>> / [SEP] ids manually - do not let the tokenizer auto-prepend a BOS token.

Threshold

Default 0.5 (shipped in config.json) - the micro-F1 optimum on CoNLL-2003 validation. Raise it for a precision-leaning deployment, lower it to favor recall. PERSON is strong across the range (F1 ≈ 0.92); ORGANIZATION / LOCATION are weaker, partly real and partly an exact-span scoring penalty. See AgentGuard's eng/gliner-eval/RESULTS.md.

Positioning

This is an offline / sovereign multilingual NER guard for PII redaction - it catches the span entities (names, places, organizations, dates) that regex and checksum recognizers cannot, and adds genuine non-English coverage that English-leaning NER pipelines lack. Coverage targets whitespace-segmented scripts (Latin / Cyrillic / Arabic / Devanagari); CJK is out of practical scope for the whitespace word splitter. It complements regex/checksum PII recognizers; it is not a replacement for a full document-understanding pipeline.

Attribution

Derivative of urchade/gliner_multi_pii-v1 (Apache-2.0) using Microsoft's mdeberta-v3-base SentencePiece tokenizer (MIT). ONNX export and fp16 conversion by AgentGuard (Apache-2.0); the model weights are unchanged. Please cite the original GLiNER paper if you use this model.

Citation

@inproceedings{zaratiana-etal-2024-gliner,
    title = "{GL}i{NER}: Generalist Model for Named Entity Recognition using Bidirectional Transformer",
    author = "Zaratiana, Urchade and Tomeh, Nadi and Holat, Pierre and Charnois, Thierry",
    booktitle = "Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL 2024)",
    year = "2024",
    url = "https://aclanthology.org/2024.naacl-long.300/",
}