arabic-pii-guardrail

PII Intent Classifier — Arabic & English

A fine-tuned XLM-RoBERTa-large model that detects intent to share personally identifiable information (PII), not just its presence. Built with a focus on Arabic (Gulf dialect + MSA) and English, with support for code-switched and Arabizi text.

The model answers: is this person sharing, requesting, or exposing PII? — not simply does this text contain a recognizable PII pattern?

---

Supported Entity Types

---

What the Model Understands

PII = True (sharing intent detected)

• Direct sharing: "رقمي 0532..." / "my number is 0532..."
• Third-party referral: "تكلم مع خالد الشمري، رقمه..." / "ask for Ahmed, call him at..."
• Coded / evasion patterns: "find me on the gram @handle", spaced digits "0 5 3 2...", Arabizi names
• Future intent: "I'll send you my number tomorrow"
• Conditional: "if we agree I'll share my address"
• Reluctant sharing: "ما أبي بس رقمي هو..." / "I don't want to but here's my number"
• Requesting: "وش رقمك؟" / "what's your number?"
• Honorific + full name in referral: "راجع الدكتور محمد العنزي" / "speak to Dr. Mariam Abdullah"

PII = False (no sharing intent)

• Order / tracking numbers: "your order ORD-784321"
• Scam warnings with no real data: "احذر من محتالين يتصلون بأرقام مجهولة"
• Celebrity / public figure names: "Elon Musk announced...", "صرّح محمد بن سلمان بأن..."
• Statistics and prices: "follower count hit 532,000", "1250 SAR"
• Non-contact numbers: room numbers, postal codes, temperatures, time
• Reporting a violation: "someone sent me their number, I'm reporting it"
• Hypothetical / sarcastic: "my number is 00000000000 lol"

---

Arabic Language Support

Arabic is the primary focus of this model. It handles the full spectrum of how Arabic speakers actually write online — not just formal text.

Dialects covered

• Gulf Arabic (خليجي) — including markers like والله, بس, خيي, صاحبي, يو, ابعتلي
• Modern Standard Arabic (فصحى) — اسمي, تواصل مع, يُعرف بـ, يُدعى

Script variations

• Native Arabic script
• Arabizi (Latin + numbers): A7med, F6oum, 7amada, Kh@led
• Code-switched sentences: Arabic sentence with English PII value or vice versa

Arabic-specific intent signals the model recognizes

---

Usage

Note: This model is designed for the second stage of a two-stage pipeline. An upstream system (regex, NER, or a rules engine) first extracts candidate entities from the text. This model then classifies whether the intent behind each extracted entity is PII sharing. The entity and entity_type arguments must be provided by the upstream stage. Use entity="NONE" when the sharing intent is implicit and no specific entity string is present in the text (e.g. "I'll send you my details later").

from transformers import AutoTokenizer, AutoModelForSequenceClassification
import torch
import torch.nn.functional as F

model_name = ""
tokenizer = AutoTokenizer.from_pretrained(model_name)
model = AutoModelForSequenceClassification.from_pretrained(model_name)
model.eval()

def classify_pii(context: str, entity: str, entity_type: str) -> dict:
    """
    Args:
        context:     Full message text
        entity:      The specific entity string (use "NONE" if implicit)
        entity_type: One of PHONE | EMAIL | SOCIAL_MEDIA | IBAN | ADDRESS |
                     URL | CREDIT_CARD | CRYPTO_ADDRESS | OFF_PLATFORM_ATTEMPT | NAME

    Returns:
        dict with is_pii (bool), label (str), confidence (float)
    """
    text = f"{context} </s> {entity} | {entity_type}"
    inputs = tokenizer(
        text,
        max_length=256,
        padding="max_length",
        truncation=True,
        return_tensors="pt"
    )

    with torch.no_grad():
        outputs = model(**inputs)
        probs = F.softmax(outputs.logits, dim=-1)
        pred = torch.argmax(probs, dim=-1).item()
        confidence = probs[0][pred].item()

    return {
        "is_pii":      pred == 1,
        "label":       "PII" if pred == 1 else "NOT_PII",
        "confidence":  round(confidence, 4)
    }

Examples

# True cases
# NONE entity — implicit sharing intent, no entity string present
classify_pii("I'll send you my details later, just DM me", "NONE", "PHONE")
# → {'is_pii': True, 'label': 'PII', 'confidence': 0.9134}

# When you know the entity type context (more reliable)
classify_pii("سأبعثلك رقمي بكرة", "NONE", "PHONE")
# → {'is_pii': True, 'label': 'PII', 'confidence': 0.8287}

# When entity type is also unknown (use with caution — out of training distribution)
classify_pii("سأبعثلك رقمي بكرة", "NONE", "NONE")
# → {'is_pii': True, 'label': 'PII', 'confidence': 0.7803}

classify_pii("check my bio, everything is there", "NONE", "SOCIAL_MEDIA")
# → {'is_pii': True, 'label': 'PII', 'confidence': 0.9056}

# NONE entity — vague mention, no actual sharing intent
classify_pii("I wish I had someone's number to call right now", "NONE", "PHONE")
# → {'is_pii': False, 'label': 'NOT_PII', 'confidence': 0.8821}

classify_pii("اسمي محمد العنزي وأبي أتواصل معاك", "محمد العنزي", "NAME")
# → {'is_pii': True, 'label': 'PII', 'confidence': 0.9814}

classify_pii("my number is 0532 1234567, call me anytime", "0532 1234567", "PHONE")
# → {'is_pii': True, 'label': 'PII', 'confidence': 0.9923}

classify_pii("find me on the gram @secret_handle", "@secret_handle", "SOCIAL_MEDIA")
# → {'is_pii': True, 'label': 'PII', 'confidence': 0.9761}

# False cases
classify_pii("your order ORD-784321 has been shipped", "ORD-784321", "PHONE")
# → {'is_pii': False, 'label': 'NOT_PII', 'confidence': 0.9502}

classify_pii("Elon Musk announced new features today", "Elon Musk", "NAME")
# → {'is_pii': False, 'label': 'NOT_PII', 'confidence': 0.9388}

---

Training Details

Base Model

FacebookAI/xlm-roberta-large — 550M parameters, multilingual transformer.

Dataset

• 41,427 samples across 9 original entity types — balanced PII / NOT-PII
• +2,500 samples added for NAME entity type (Arabic Gulf + MSA + English + Mixed)
• Languages: Arabic (Gulf dialect + MSA), English, code-switched, Arabizi

Training Configuration

Input Format

The model expects a specific input format that combines context, entity, and entity type:

{context} </s> {entity} | {entity_type}

---

Evaluation

Evaluated on a curated benchmark of 2,094 samples across 14 slices covering core capability, adversarial cases, regression tests, and cross-entity confusion.

Overall

Per Entity Type

Per Language

Notable Benchmark Slices

---

Limitations

The model currently leans toward false positives. With an overall FPR of 28.8%, it occasionally flags non-PII content as PII — particularly when a recognizable entity (phone number, email, name) appears in a clearly non-sharing context (news mentions, statistics, celebrity references). This is a precision-recall tradeoff: the model is tuned to almost never miss a genuine PII sharing event (FNR = 3.1%), at the cost of some over-triggering.

Specific known gaps:

• Cross-lingual content — Mixed-language messages have an elevated FPR (50.8%). Code-switched text is sometimes treated as suspicious regardless of intent.
• Context-flip accuracy — Only 25% of minimal context-flip pairs (same entity, different context) are classified correctly in both directions.

These limitations will be addressed in the next release through targeted hard-negative training data and threshold calibration.

---

Intended Use

• Content moderation systems that need to detect PII leakage in user-generated content
• Automated flagging of PII in Arabic and English social media, chat, and forum data
• Privacy compliance pipelines requiring intent-aware (not just pattern-based) PII detection

Out-of-Scope Use

• Standalone PII redaction without human review (given the current FPR)
• Languages other than Arabic and English
• Document-level or structured data PII extraction (the model is designed for conversational, short-form text)