Rizzo-AI-Academy/rizzo-pii

Local-first privacy guard: anonymize your documents before sharing with LLMs.

rizzo‑pii – Local, reversible PII anonymisation for Italian legal text

What it is – A tiny (~0.3 B parameters) Italian‑first token‑classification model built on the mmBERT backbone that detects 22 categories of personal data (including Italian‑specific identifiers such as codice fiscale, partita IVA and cadastral references). The model runs on a normal CPU (≈0.5 GB RAM) and is packaged as a desktop app (Windows installer, macOS DMG, Linux AppImage). It is designed to sit in front of any “frontier” LLM (ChatGPT, Claude, Gemini) so that only pseudonymised placeholders are sent to the cloud, then the real values are restored locally.

Key ideas

Idea Why it matters
100 % local detection & re‑identification No API key, no telemetry – the sensitive spans never leave the user’s machine.
Reversible placeholders The app replaces each PII span with a stable tag like [FULLNAME_1] and stores a local dictionary, allowing the original values to be re‑inserted after the LLM returns its answer.
Italian‑legal coverage 22 entity types, explicitly covering codice fiscale, partita IVA, cadastral data, act identifiers, etc., which generic English‑first models miss.
Checksum‑backed safety net For structured identifiers (IBAN, CF, PIVA, credit‑card numbers) a deterministic regex + mod‑97/Luhn check overrides the neural tagger, guaranteeing mathematically correct detection.
Tiny CPU‑friendly footprint ≈0.3 B dense parameters, ~0.5 GB RAM, runs on any 64‑bit CPU – no GPU required for inference.

How it works (the workflow)

  1. Local tagging – The model scans the document, outputs BIO tags for the 22 categories, and a deterministic regex/checksum layer catches the structured IDs.
  2. Placeholder substitution – Each span is replaced by a type‑aware placeholder ([IBAN_1], [CF_1], …) and the mapping is saved on disk.
  3. Send to frontier LLM – Only the placeholder‑only text is sent to the remote model (ChatGPT, Claude, Gemini, …). The LLM can still reason about the document because repeated placeholders preserve coherence.
  4. Local restore – The LLM’s answer is post‑processed: placeholders are swapped back for the real values using the saved dictionary.

The privacy guarantee is structural: the third‑party processor never sees any real personal data.

Technical snapshot

  • Model: mmBERT‑base (ModernBERT) fine‑tuned for token classification, 0.3 B dense parameters, fp32 checkpoint ~1.2 GB, quantised to ~0.5 GB for CPU inference.
  • Training data: ~745 k labelled rows (≈45 % Italian) from real sources (Ai4Privacy, DeepMount) plus synthetically generated legal prose with mathematically valid identifiers. Single‑epoch fine‑tuning on a 16 GB consumer GPU (≈2 h).
  • Performance: micro‑F1 = 0.989, token accuracy = 0.998 on a 7 k real‑Italian hold‑out; all five Italian‑legal tags achieve perfect 1.000 scores.
  • Categories: 22 BIO tags (FULLNAME, AGE, GENDER, DATE, TIME, STREET, BUILDINGNUM, ZIPCODE, CITY, PROVINCE, EMAIL, TELEPHONENUM, CF, PIVA, ID_DOC, IBAN, CREDITCARDNUMBER, AMOUNT, TARGA, ORG, DOCID, CATASTO) + a regex‑only URL tag.
  • Packaging: Desktop UI built with Tauri, a lightweight Flask “side‑car” backend, and a simple HTTP API for programmatic use.

Typical use‑cases

  • Law firms & notaries – redact contracts, judgments, or client letters before feeding them to a powerful LLM for summarisation or drafting, while keeping names, tax codes, and cadastral data private.
  • Accountants & tax consultants – anonymise invoices, tax returns, or financial statements before using AI‑assisted analysis tools.
  • Healthcare administrators – strip patient identifiers (CF, IBAN, etc.) from medical reports before querying a LLM for coding assistance.
  • Any GDPR‑bound organisation – meet data‑minimisation requirements by ensuring that only pseudonymised text leaves the premises.

Getting started

  1. Download – Grab the pre‑built installer/AppImage from the Releases page (Windows, macOS Apple Silicon, Linux).
  2. Run – Launch the app; drag‑and‑drop a PDF, .txt or .md file, or paste raw text.
  3. Anonymise – Click Anonymise; the UI shows coloured tags and a downloadable dictionary.
  4. Query LLM – Copy the placeholder‑only text into your favourite LLM UI (ChatGPT, Claude, Gemini, etc.).
  5. Restore – Paste the LLM’s answer back into the app and press Restore; the original identifiers reappear.

For developers who want to rebuild or extend the model:

  • Clone the repo, set up a Python 3.11 venv, install requirements.txt (PyTorch + CUDA 12.8 if you have a Blackwell GPU, otherwise CPU‑only).
  • Run the data‑generation scripts (src/data_pipeline/*) to recreate the synthetic corpus.
  • Fine‑tune with src/training/train_pii.py (subset for quick tests, --type full for the full 745 k rows).
  • The web service can be started with python src/app/app.py (exposes http://127.0.0.1:5005).

Limitations & caveats

  • Language focus – Optimised for Italian legal text; performance on other languages is not guaranteed (the model does support a few additional languages but with reduced accuracy).
  • Structured ID reliance – The regex/checksum layer is essential for perfect detection of IBAN, CF, PIVA, etc.; if a document contains malformed identifiers they will be missed.
  • No GPU acceleration needed for inference, but training does require a modest GPU (≈16 GB VRAM).
  • Placeholder collisions – Identical values share the same placeholder, which is intentional for LLM coherence but means the system cannot distinguish two different occurrences of the same value.

Bottom line

rizzo‑pii provides a practical, GDPR‑by‑design privacy layer that lets Italian‑speaking professionals harness powerful cloud LLMs without ever exposing personal identifiers. Its tiny CPU footprint, reversible pseudonymisation, and legal‑specific entity coverage make it a rare example of a usable, open‑source privacy‑preserving AI tool.