Introducing GLiNER2-Guardrails-PII-Multi - a multilingual multi-task small language model for safety moderation and privacy filtering.
By: Urchade Zaratiana and Mary Newhauser
Last updated:
Today, we’re releasing GLiNER2-Guardrails-PII-Multi, a multilingual multi-task small language model that performs safety moderation and privacy filtering in a single forward pass.
Both safety moderation and privacy filtering are critically important in agentic systems but are currently treated as two separate tasks, requiring two separate models, increasing both cost and latency. Building on the success of both GLiGuard and GLiNER2-PII, we trained a model to perform both guardrail and PII extraction tasks, using the same compact encoder architecture. The combined model matches the performance of the individual models, effectively cutting inference time and memory consumption in half, all at size of 0.3B parameters.
GLiNER2-Guardrails-PII-Multi is available as an open-source model under the Apache 2.0 license on Hugging Face.
Our motivation: Training a single small model for two critical tasks
The idea to train GLiNER2-Guardrails-PII-Multi was born out of the success of our two previously released models: GLiGuard and GLiNER2-PII. The former is a zero-shot lightweight guardrail model that filters user queries and model responses according to an extensive safety policy, similar to that of QwenGuard. The latter is a zero-shot privacy filter model fine-tuned to detect 42 different types of personally identifiable information. Combined, both models charted over 80,000 downloads within the first six weeks of releasing the models on the Hugging Face Hub, a clear signal of the appetite for open source solutions for guardrail and PII models.
Given the popularity of both models, taken together with the fact that the GLiNER2 model architecture inherently supports both classification and extraction tasks, we decided to combine these into a single model by retraining a new multi-task model on an enhanced version of the original datasets. Furthermore, these two use cases tend to overlap: if you’re screening for leaked PII, typically you may also want to screen for unsafe content, particularly in user-facing applications.
In this blog post, we’ll briefly summarize the model’s multi-task architecture, explain what tasks the models can perform, and outline how we trained and evaluated the model.
Four-task safety moderation and 42-type PII extraction in a single forward pass
Multi-task architecture
GLiNER2-Guardrails-PII-Multi is based on GLiNER2, a compact encoder-based architecture that unifies entity recognition, structured extraction, and text classification, allowing all tasks to be performed in a single forward pass.
The model encodes both the candidate labels and the input text as vectors, then computes dot-product similarity between them to score how well each label matches a given span of text, where a higher score indicates a stronger match. For extraction tasks, a small multilayer perceptron predicts the number of instances to return. Because the task definitions are joined with separators and prepended to the input text, the model evaluates all tasks in a single forward pass rather than requiring a separate pass for each.
By treating PII identification as an extraction task and safety moderation as a classification task, GLiNER2 proes to be the most capable model architecture to unify these two critical tasks.
Filters user queries and model responses for safety violations
GLiNER2-Guardrails-PII-Multi maintains the same safety policy as GLiGuard, filtering both user queries and model responses for jailbreak, harm, and refusal detection as well as applying an overall safety label.
Task | Labels | Applied to |
|---|---|---|
Safety classification | Safe, Unsafe | Prompts, Responses |
Jailbreak strategy detection | 11 fine-grained categories | Prompts |
Harm category detection | 14 fine-grained categories | Prompts, Responses |
Refusal detection | Compliance, Refusal | Responses |
All four tasks are performed by the model simultaneously, with inputs and potential class labels provided at inference, and assigned labels and probability scores provided as output.
Detects over 42 types of personally identifiable information
Like GLiNER2-PII, the model was trained to identify and extract 42 types of personally identifiable information, divided into seven different categories.
Category | Labels |
|---|---|
Personal Identity | Person, Full Name, First Name, Middle Name, Last Name, Date of Birth |
Contact and Location | Email, Phone Number, Address, Street Address, City, State or Region, Postal Code, Country |
Government and Tax Identifiers | Government ID, National ID Number, Passport Number, Driver License Number, License Number, Tax ID, Tax Number |
Banking and Payment | Bank Account, Account Number, Routing Number, IBAN, Payment Card, Card Number, Card Expiry, Card CVV |
Digital Identity | Username, IP Address, Account ID, Sensitive Account ID |
Secrets and Credentials | Password, Secret, API Key, Access Token, Recovery Code |
Sensitive Dates | Sensitive Date, Document Date, Expiration Date, Transaction Date |
All four safety tasks and PII extractions occur in a single forward pass, eliminating the need to run inference twice on the same text with two different models.
How we trained GLiNER2-Guardrails-PII-Multi
Generating synthetic training data with Pioneer
Data curation is a core challenge of fine-tuning any model. This challenge, however, is exacerbated when the downstream task involves highly sensitive data. PII is sensitive by nature, so genuine training data is hard to come by. Existing PII datasets tend to be small, narrow in scope, and heavily overused in training, and even where they exist, the ethics of using them are questionable. Guardrail datasets are different: plenty of good open source options exist, but they tend to cover only a specific category of harm rather than the full range of safety concerns.
To overcome these challenges, we used the Pioneer API to generate diverse, multilingual, multi-task synthetic data to train the model.
For safety moderation, we built on WildGuardTrain, which already has human labels for prompt safety, response safety, and refusal detection, using the Pioneer API to extend it with labels for jailbreak strategy detection.
For privacy filtering, we used the same API along with a constraint-driven framework to generate a synthetic corpus of annotated PII, spanning 42 entity types across a range of document types and languages.
The final result is a multilingual dataset spanning over 42 types of labeled PII examples and safety moderation data covering a diverse four-task safety policy.
How we evaluated GLiNER2-Guardrails-PII-Multi
We evaluated GLiNER2-Guardrails-PII-Multi against both original models: GLiGuard and GLiNER2-PII. The combined model maintains competitive performance on both tasks.
On PII extraction, GLiNER2-Guardrails-PII-Multi and GLiNER2-PII reach equivalent average F1 (47.2 vs 47.1). The primary tradeoff is precision vs recall: GLiNER2-Guardrails-PII-Multi gains precision across both domains (+1.4 legal, +2.8 medical) at the cost of recall (-7.5 legal, -5.6 medical).
On harmfulness detection, GLiNER2-Guardrails-PII-Multi holds onto the original GLiGuard's performance. Prompt harmfulness average F1 is essentially unchanged (87.4 vs 87.7), and response harmfulness improves slightly (83.1 vs 82.7). Every individual benchmark stays within range of the original.
These results show that joint training for safety moderation and PII extraction preserves both capabilities in aggregate. While there is a reduction in PII extraction recall, this can be addressed by tuning the confidence threshold at inference time for applications in circumstances where where full PII coverage matters most.
Conclusion
GLiNER2-Guardrails-PII-Multi effectively and efficiently combines two critical tasks into a single model: safety moderation and privacy filtering. And because the model performs both tasks in a single pass without an increase in model size, inference latency is reduced by roughly half relative to running GLiGuard and GLiNER2-PII sequentially, while maintaining the performance of each the original models on each task. We're releasing it to the open source community because the demand for capable, lightweight safety models is clear, and we think the best ones should be small and open.
Try GLiNER2-Guardrails-PII-Multi in Pioneer
GLiNER2-Guardrails-PII-Multi is now available for inference on Pioneer.