pleno-anonymize

PII analysis and redaction for Japanese and English text.

• pleno-anonymize server — HTTP API with /api/analyze, /api/redact, and OpenAI / Anthropic / Gemini proxies that mask PII before forwarding to upstream providers.
• pleno-anonymize Python package — SDK and CLI (uvx pleno-anonymize scan .). See packages/sdk.
• pleno-presidio-extras package — optional Presidio extensions installed separately (e.g. JevContextFilter false-positive filtering). See packages/presidio-extras.
• pleno_anonymize_ja / pleno_anonymize_en models — spaCy NER models for Japanese and English PII.

Endpoint: https://pleno-anonymize.fly.dev (API reference at /docs). Playground: https://plenoai.com/pleno-anonymize/playground

For scanning SaaS sources or filesystems for PII, use pleno-dlp. It talks to this server's /api/analyze endpoint over HTTP.

Use the CLI

# one-shot scan via uvx (no install) — fail CI on any finding
uvx pleno-anonymize scan . --fail-on-findings

# analyze / redact stdin in-process (downloads the NER wheel on first run)
echo "連絡先 山田太郎 090-1234-5678" | uvx pleno-anonymize analyze --language ja
echo "連絡先 山田太郎 090-1234-5678" | uvx pleno-anonymize redact  --language ja

Defaults to local execution (Presidio + pleno_anonymize_{ja,en} in-process). Add --base-url https://pleno-anonymize.fly.dev to offload to the hosted server. Full flag reference: packages/sdk.

Use the API

curl -X POST https://pleno-anonymize.fly.dev/api/analyze \
  -H "content-type: application/json" \
  -d '{"text":"連絡先 山田太郎 090-1234-5678","language":"ja"}'

POST /api/redact also redacts images: presidio's ImageRedactorEngine OCRs the image with Tesseract and blacks out detected PII text (the banner above is real output — location-revealing text on the photo is OCR-detected and covered).

# black-box OCR-detected PII text in a photo
curl -X POST https://pleno-anonymize.fly.dev/api/redact \
  -H "content-type: application/json" \
  -d "{\"image\":\"data:image/webp;base64,$(base64 -i photo.webp)\",\"language\":\"en\"}"

Route chat traffic through the LLM proxy to mask PII before the request reaches the upstream provider; original values are restored in the response.

Use the SDK

from pleno_anonymize import PlenoAnonymize, scan_paths

# default: local engine, auto-downloads pleno_anonymize_ja on first call
engine = PlenoAnonymize()
engine.analyze("山田太郎 090-1234-5678", language="ja")
engine.redact("Contact [email protected]", language="en")

# walk paths, aggregate findings per entity
summary = scan_paths(engine, ["src", "docs"], language="ja")
print(summary.by_entity, summary.total_findings)

# remote mode — same surface, no local model footprint
PlenoAnonymize(base_url="https://pleno-anonymize.fly.dev").analyze("...")

Full API surface: packages/sdk.

Detection backends

# default — builtin Presidio + pleno_anonymize_ja
pleno-anonymize analyze 'Alice Johnson, [email protected]'

# OPF (downloads ~3GB checkpoint to ~/.opf/privacy_filter on first call)
pleno-anonymize analyze --engine openai-privacy-filter --language en \
  'Alice Johnson, [email protected]'

OPF adds a SECRET class not covered by the builtin engine.

Quality

Both models are spaCy tok2vec NER trained on ai4privacy/pii-masking-300k (EN) and 0xhikae/pii-masking-300k-ja (JA). In-distribution F1 ≈ 0.96–0.97. On real-text news (CoNLL-2003 EN F1 ≈ 0.57, stockmark JP Wikipedia F1 ≈ 0.47) the models trail spaCy's *_core_web_lg baselines because they are tuned for form- and record-style PII, not narrative prose. For higher recall on English prose, use the openai-privacy-filter engine. Full numbers, CIs, and methodology: docs/benchmark-pleno-anonymize-en.md, docs/benchmark-pleno-anonymize-ja.md.

Detected entities

The APPI Art. 2(3) 要配慮個人情報 (special care-required personal information) row covers categories that Japan's Act on the Protection of Personal Information regulates more strictly than ordinary PII. These are context-dependent attributes — the same vocabulary (e.g., a disease name) is only tagged when it describes a specific individual, not in general medical or legal commentary. OpenAI Privacy Filter has structurally zero coverage for these categories.

APPI Art. 2(3) per-subtype quality (DeBERTa v2 base, 10 epochs, held-out test set):

Self-host

docker build -t pleno-anonymize .
docker run -p 8080:8080 pleno-anonymize

fly.toml is included. flyctl deploy --local-only ships the same image to fly.io.

FAQ

Why doesn't the OPF engine support Apple MPS (Metal)?

OPF's 128-expert sparse MoE layer relies on Triton JIT kernels for GPU-accelerated inference. Triton only targets NVIDIA CUDA — it cannot compile for Apple Metal. Without Triton, OPF falls back to a pure-PyTorch codepath that dispatches many small per-expert matrix multiplications. On Apple M3, we measured this fallback on MPS at 1,848 ms/doc vs 1,151 ms/doc on CPU (n = 300, sequential runs) — MPS is 38 % slower because the kernel launch overhead for many small ops exceeds the compute benefit. Use --opf-device cpu on macOS (the default) or a CUDA GPU for production throughput. Full methodology: docs/benchmark.md §5.1a.

License

Apache-2.0 · Privacy Policy · DPIA