# rizzo-pii ### Local, reversible PII anonymization for Italian legal text **_Use frontier models without giving up your data._**

**📄 [Read the full technical report (PDF)](https://github.com/Rizzo-AI-Academy/rizzo-pii/blob/HEAD/report/rizzo-pii-report.pdf)** — model, dataset, method and experiments in detail

_{🪟 **Windows installer** · 🍎 **macOS** (Apple Silicon) · 🐧 **Linux AppImage** — all available now}

rizzo-pii:0.3B is a lightweight, CPU-friendly, Italian-first token-classification model (≈0.3B parameters, mmBERT / ModernBERT backbone) that detects 22 categories of personal data — including the Italian-legal identifiers (codice fiscale, partita IVA, dati catastali) that no other open model covers — and drives a fully reversible anonymization workflow:

It is built for law firms, accountants, notaries and anyone bound by the GDPR who wants to keep using ChatGPT / Claude / Gemini on sensitive documents without ever sending the real data out.

| ≈0.3B | ~0.5 GB | 22 | 0.989 | |:---:|:---:|:---:|:---:| | parameters (mmBERT-base) | RAM footprint, CPU | PII categories | micro-F1 (real IT validation) | The hedgehog mascot does one job: it grabs your document, blacks out every identifier, and **stays inside the EU** while doing it.

The problem: convenience is leaking your data

People summarize contracts, draft replies and ask legal questions simply by pasting the document in. It is fast and useful — and it quietly moves enormous amounts of personal and confidential data off the user's device. Names, addresses, tax codes, IBANs, health details, unsigned-contract clauses: all of it crosses the network to servers the user does not control, where it may be logged, cached, retained or exposed in a breach. For a law firm or a hospital this is not hypothetical; under the GDPR it can be a direct compliance failure.

The intuitive fix is to stop sending data out and run an open model locally — but a frontier-grade open model is large and expensive to serve (€9,000–€10,000 of hardware), and the small models that fit a normal laptop are not in the same league on the hard tasks (legal reasoning, dense contracts, long official documents) — exactly where Italian professionals need the most help.

The trade-off we actually want: keep the frontier model and remove the data from the equation. Anonymize the document locally on a CPU, send only placeholders to the cloud, and restore the real values locally from the answer. The sensitive content never leaves the machine.

rizzo-pii in one picture

The workflow has three local steps and one remote step. Locally, rizzo-pii tags every span of personal data and replaces each one with a stable, type-aware placeholder ([FULLNAME_1], [IBAN_1], [CF_1]), recording the mapping placeholder → real value in a dictionary that stays on disk. Identical values share the same placeholder, so the frontier model still sees a coherent text and can reason about it. The anonymized text is sent to ChatGPT / Claude / Gemini; when the answer comes back, a local pass swaps the placeholders for the true values. The cloud provider never receives a single real name, code or number.

Everything except the frontier query happens on the user's CPU; only placeholder text crosses the boundary, and the answer is re-identified locally.

Why this is different: privacy that is actually private

This is not "yet another PII detector". It is an architecture for using powerful models without surrendering data, built so the privacy guarantee is structural rather than a promise:

• The data never leaves the device. Detection and re-identification run locally on a CPU. No API key, no telemetry, no upload. What the cloud receives is already stripped of identifiers.
• GDPR by design. The workflow implements data minimization (Art. 5) almost literally: the third-party processor only ever sees pseudonymized text, so the most common reason a cloud LLM call is unlawful (transferring identifiable data to a third party without a basis) is removed at the source.
• Aligned with the EU AI Act. Keeping personal data under local control and out of third-party model pipelines supports the Act's emphasis on data governance.
• Accessible to everyone. The model is ≈0.3B parameters and runs on a CPU in well under 1 GB of RAM — the privacy layer costs nothing extra in hardware. A normal laptop is enough.
• Reversible, not destructive. Classic redaction throws information away. rizzo-pii pseudonymizes: the answer from the frontier model is reconstructed with the real values, so the tool is useful in real work, not just compliance theater.

How it compares

The differentiators are Italian-legal coverage, a smaller memory footprint, and a checksum-backed safety net (mod-97 for IBAN, Luhn for cards, the official CF/PIVA algorithms) that the larger generic models do not provide.

Concrete example. Take "Il Sig. Mario Rossi, C.F. RSSMRA85H12F205Y, P.IVA 12345678903, è titolare dell'immobile al Foglio 12, particella 345, sub. 6." rizzo-pii tags FULLNAME, CF, PIVA and CATASTO and rewrites it as "Il Sig. [FULLNAME_1], C.F. [CF_1], P.IVA [PIVA_1], è titolare dell'immobile al [CATASTO_1]." A generic English-first model has no label for the fiscal code, the VAT number or the cadastral reference — the three most sensitive identifiers in the sentence — and would leave them in the clear.

The taxonomy: 22 tags, and why

rizzo-pii predicts 22 entity types in BIO format (a B-/I- label per tag, plus O). The raw datasets are left untouched; the mapping to these 22 tags is applied at load time through a single TAG_MAP in train_pii.py, so the taxonomy can be changed in one place without re-annotating anything. Details in docs/TASSONOMIA_TAG.md.