Measured, not claimed

Public score

Exact-span F1 on two pinned public PII corpora. A prediction counts only when the type, the start, and the end all match gold. A one-character shift is a miss, because one character is enough to break a mask.

The two corpora

Key	Corpus	License	Role
`nemotron-pii`	NVIDIA Nemotron-PII, test split	CC-BY-4.0	In domain. The `en-closed` checkpoint trains on this distribution
`gretel-finance-en`	Gretel synthetic PII, finance, English test split	Apache-2.0	Out of domain. Finance documents and SWIFT messages

Each corpus is pinned by commit revision, byte count, and sha256. A download that does not match stops the run, because a moved file makes an old score unreadable.

Results

Corpus	Preset	Docs	Gold	P	R	F1	F2	Leaks
`nemotron-pii`	`rules`	2,000	5,890	0.653	0.266	0.378	0.301	589
`nemotron-pii`	`en-closed`	500	1,343	0.710	0.987	0.826	0.916	2
`gretel-finance-en`	`rules`	2,891	7,397	0.260	0.119	0.163	0.133	424
`gretel-finance-en`	`en-closed`	400	982	0.093	0.255	0.136	0.189	38

The rules lane finds no name, so PERSON and ADDRESS score zero for that lane by construction. Those two types need a model lane.

Per type

Type	nemotron rules	nemotron en-closed	gretel rules	gretel en-closed
`PERSON`	0.000	0.995	0.000	0.048
`ADDRESS`	0.000	0.383	0.000	0.123
`EMAIL`	0.998	0.994	0.450	0.431
`PHONE`	0.644	0.633	0.351	0.410
`PAYMENT`	0.091	0.691	0.236	0.232
`GOV_ID`	0.000	1.000	0.000	0.321
`SECRET`	0.438	0.891	0.189	0.291
`IP_ADDRESS`	0.817	0.737	0.886	0.813
`USERNAME`	0.000	1.000	0.000	0.143

The finding that matters

The en-closed checkpoint scores 0.995 on PERSON in domain and 0.048 out of domain. It learned where a name sits in a synthetic persona note, not what a name is. The model card reports F1 0.9628 on its own test split, and that number alone would have shipped the lane.

This is why the harness exists. Read the full analysis in the first public score.