sano-shield-1-multilingual

Sano Shield 1.2

Sano Shield 1.2 is Sano AI's local privacy model for finding sensitive spans in German and English before text reaches an external AI provider. Its stable technical model ID is sano-shield-1-multilingual.

Shield 1.2 was optimized for a deliberately narrow product goal: reduce false positives without giving back required protection. Compared with Shield 1.1 on the same frozen German and English product suites, unknown false positives fall by 17.0% while more required spans are protected in both languages.

Availability: This Hugging Face repository publishes the model card for transparency. Model weights, tokenizer files, ONNX artifacts, and training data are not publicly distributed or downloadable from this repository.

Evaluation scope: All reported quality suites are internal and synthetic. They were held out from training, but they are not a substitute for independently sourced, human-reviewed, domain-specific evaluation. These results do not establish a global state-of-the-art claim.

Model details

What changed in 1.2

Shield 1.2 starts from the private Shield 1.1 checkpoint and applies targeted continuation training on Sano Shield v0.7. The selected release is a weight interpolation:

Shield 1.2 = 0.25 × Shield 1.1 + 0.75 × targeted continuation

The continuation used seed 20260824. Embeddings and the first four encoder layers were frozen, and a Shield 1.1 teacher supplied a small preservation loss. Candidate selection required separate German and English quality gates, privacy-span preservation, hard-negative behavior, ONNX parity, the current desktop product pipeline, and document usability.

The strongest raw continuation reduced more synthetic false positives, but was not selected for deployment because it failed frozen organization and per-type product preservation. The interpolated release is the strongest tested artifact that passes every release gate.

Intended use

Shield 1.2 is designed as one component in a reversible privacy pipeline:

1. identify supported sensitive spans in German and English text;
2. combine contextual findings with deterministic recognizers for structured values;
3. let the user review or choose what should remain readable;
4. replace selected values locally before external inference; and
5. restore the original values only inside the trusted local boundary.

Production deployments should retain deterministic recognizers, overlap resolution, user-visible review, monitoring, and fail-closed handling. Organization names remain user-selectable but are reported separately from mandatory natural-person PII in the product release policy.

Do not use the model as the sole basis for legal-compliance decisions, medical decisions, identity verification, employee monitoring, or irreversible actions affecting a person.

Evaluation

1. Neural model-only benchmark

The frozen Sano Shield v0.7 test split contains 5,000 German and English records. This benchmark isolates the neural model; it does not include deterministic recognizers or the desktop's overlap-resolution logic.

Overall, Shield 1.2 produces 562 fewer false positives and 434 fewer false negatives. The largest targeted F1 gains are AUTH_SECRET (+0.271), PERSON_ALIAS (+0.213), CONTACT_HANDLE (+0.183), ACCOUNT_IDENTIFIER (+0.130), and DOCUMENT_REFERENCE (+0.116).

The model-only benchmark also exposes regressions that remain important even though the complete product pipeline passes:

2. Current product-pipeline benchmark

The release-relevant benchmark runs the exact deployment artifact through Sano's current judge-free desktop pipeline. It uses paired held-out synthetic stress suites with 3,000 records per language and includes deterministic recognizers and overlap resolution.

The product result is the basis for promotion: 42 more required spans are protected and unknown false positives fall by 99 (-17.0%). Every frozen German, English, mandatory-type, organization-preservation, Tier-A, and aggregate false-positive gate passes.

3. Document usability

The current no-judge benchmark contains 30 mixed-format documents covering TXT, Markdown, CSV, JSON, DOCX, XLSX, PPTX, text-layer PDF, and OCR-derived PDF text.

The historical 29/30 Shield 1.1 figure used a now-retired plausibility judge and is not a valid baseline for the current architecture. Both versions above were replayed through the same current pipeline.

4. macOS CPU runtime

Runtime figures are medians of three fresh processes per model on the same 14-core macOS host with ONNX Runtime 1.27.0 and the CPU execution provider. Build time is excluded.

All six protected-copy runs completed with placeholders and zero selected-original leaks. The PDF fixture is a performance and smoke-test corpus, not a labeled accuracy corpus.

5. Deployment parity

The FP16-embedding ONNX artifact was compared with its FP32 reference on 512 held-out v0.7 test records (23,662 active tokens):

• token-label agreement: 100%;
• agreement at the desktop's 0.5 confidence floor: 100%;
• maximum absolute probability drift: 0.01136; and
• maximum raw-logit drift (diagnostic only): 0.11517.

Metric definitions

• Entity F1 uses exact entity boundaries and exact entity type.
• Privacy-span recall counts a gold span as protected when a predicted sensitive span covers it, even if the exact type or boundary differs.
• Required-span recall is the product-policy metric for natural-person PII and secrets marked for protection after the complete pipeline runs.
• Unknown false positives are protected predictions that the frozen product scorer cannot match to required PII or separately reported optional business data.
• Zero-touch document means the benchmark's predicted protection set needs no labeled addition, removal, or boundary adjustment.

Training

• Parent and teacher: private Sano Shield 1.1 checkpoint
• Corpus: Sano Shield v0.7 synthetic continuation corpus
• Training seed: 20260824
• Schedule: one epoch, 7.5e-7 learning rate, 5% warmup
• Sequence length: 160 tokens
• Preservation: frozen embeddings, first four encoder layers frozen, 0.15 teacher distillation weight at temperature 2.0
• Class weighting: square-root inverse frequency, clipped to [0.5, 2.5], outside-label weight 1.25
• Selected release: 0.75 targeted continuation / 0.25 Shield 1.1 interpolation
• Training hardware: NVIDIA H100 80 GB, CUDA 12.8, bfloat16

Training targets come from Sano's versioned synthetic corpus, not predictions copied from a separate evaluator. Customer content and real personal data are not accepted into the training repository.

Limitations

• German and English are the only release-policy target languages.
• Locations remain the largest contextual error family and the clearest target for future improvement.
• Unseen document types, OCR errors, adversarial formatting, code switching, uncommon names, and ambiguous context can produce missed or extra spans.
• The model's 160-token inference windows require careful overlap handling for long documents.
• Structured values such as phone numbers, email addresses, IBANs, cards, bank accounts, and identifiers should retain deterministic recognition rather than relying only on the model.
• No statistical detector can guarantee that every sensitive value is found.
• Span recognition does not determine whether processing is lawful or satisfy a particular compliance regime.
• High-risk deployments require domain-specific, legally usable, human-reviewed evaluation.

Distribution and contact

This public page documents the model's purpose, lineage, evaluation, and limitations. It does not grant access to the checkpoint or corpus, and no public redistribution license for those private artifacts is granted here.

• Product: Sano Work
• Organization: SanoAI on Hugging Face
• Contact: [email protected]