Detection and Masking
What Is Named-Entity Recognition (NER) for PII?
- Names and places
- Free text
- Local model
Short answer
Named-entity recognition (NER) is a machine-learning method that reads text and labels the spans that name people, places, dates or conditions. For PII, NER finds personal data that has no fixed format, such as a name or a street address in a sentence, where a pattern or checksum has nothing to match. It works best alongside deterministic detectors, not instead of them.
Maskflare Engineering Updated
What does NER do that a pattern can't?
Take this line from a clinic note: "Patientin Anna Müller wohnt in Bern und leidet an Diabetes." There is no digit to validate and no keyword like "IBAN:" in front of the values. A person reading it sees a name, a city and a health condition at once. A regular expression sees ordinary words.
NER models are trained on many labelled sentences, so they pick up the cues a reader uses: capitalisation, the word before a name, the verb that follows a place. The output is a list of spans, each with a start, an end, a label (name, location city, condition) and a confidence score.
| Kind of value | Example | Best detected by |
|---|---|---|
| Fixed format with a check | IBAN, payment card, AHV number | Pattern plus checksum validation |
| Fixed format, no check | Email address, many phone numbers | Pattern plus context |
| Your own records | A customer called "Ada Lovelace" | Exact Data Match |
| Free text, no format | A name, a street, "diagnosed with asthma" | NER model |
How does Maskflare use NER?
Maskflare keeps the deterministic engine as the source of truth for structured identifiers. The model is an addition for what the engine can't see. The labels it is asked for are names, addresses, streets and cities, postcodes, dates of birth and other dates, ages, health conditions, and the special categories of GDPR Article 9 such as religion, ethnicity and political opinion.
- Local. The model is a GLiNER-style span model (GLiNER paper) that is baked into the service image. It makes no network calls at runtime and works in an air-gapped install.
- Rule-aware. A span only counts if the organization has the matching rule switched on. The model is never asked for a label whose rules are all off, so it can add to what your policy masks but can't widen it.
- Same actions. A name found by the model is masked, redacted, hashed or blocked exactly like a name found by a dictionary, and it is restored the same way by rehydration.
- Explained. The console playground shows which detector matched, so a model-found value isn't a black box. See the detection engine.
What happens when the model is slow or unavailable?
A language model takes longer than a regex, and an AI request is waiting. In the gateway the model gets a short time budget and a limit on how much new text it reads. Past either limit, the request is masked by the deterministic engine alone, or with the model's spans for the part it did read, and the traffic event records what the model missed. This is fail soft by default: protection from patterns, checksums and your own data still applies.
An organization that treats the model as mandatory can say so. Then a timeout or an unreachable model counts as a masking failure and follows the failure action you chose, for example blocking the request. That is the same trade-off described in fail closed vs fail open.
The median latency on the default rules is about 2 ms (median for a 10 KB request on the default rules, before the named-entity layer). The model costs more than that, and how much depends on text length and hardware, which is why the budget exists.
How accurate is NER for PII?
It depends on language, domain and the label. Models over-reach on dates and bare place names, and they sometimes tag public names that identify nobody, such as a federal agency. Maskflare raises the score threshold for dates and cities, trims form labels that the model pulls into a name, and ignores a list of public terms.
Our one published figure comes from a Swiss benchmark we built: 228 cases with 708 sensitive values in synthetic Swiss-context text. The full engine, deterministic detectors plus the NER layer, found 100% of those values with 0 false positives. It is a test of our own, on synthetic Swiss data, for one configuration. It says nothing certain about your languages, your document types or other vendors, so test on a sample of your own text before you rely on it.
When is NER the wrong tool?
- For identifiers with a checksum. A validator is exact and cheap. A model can only guess, so Maskflare leaves IBANs, cards and national IDs to the deterministic detectors.
- For your own customer list. A model doesn't know which names are your customers. A name like "Rose Hill" may be a person, a street or a flower shop. Exact Data Match knows.
- Where you need a guarantee. NER returns probabilities. If missing a value is unacceptable, pair it with blocking rules and review.
For where NER sits in the wider redaction process, read what is PII redaction.
Frequently asked questions
What does NER stand for?
Named-entity recognition. It is the task of finding spans in text that name entities such as people, organizations, places and dates, and labelling each with its type.
Does Maskflare send my text to a third-party AI service for NER?
No. The named-entity model runs inside Maskflare as a local service, with no network access at runtime and no third-party AI service involved.
What if the NER model is too slow?
By default the request is masked by the deterministic engine alone, or with the model's spans for the part it read, and the event records what the model missed. Organizations that require the model can make a timeout follow their masking-failure action instead.
Is NER enough on its own to find PII?
No. Models return probabilities and can miss or over-tag values. Structured identifiers are better caught by patterns and checksums, and your own records by Exact Data Match.
Does a 100% result on a benchmark mean nothing will be missed?
No. The published Swiss benchmark is Maskflare's own test set of a fixed number of cases in Swiss languages and English. It shows how that configuration did on those cases, not how any system will do on other data.