Model · text privacy
Proximate Pseudonymizer 0.6B: swap identifying details for close, consistent substitutes
Rewrites a text with its names, places, organisations, dates and contacts swapped for close, plausible substitutes, the same one every time. Proof of concept: it still leaves 9.3% of identifying details unchanged.
About the model
Text in, text out. "I'm Daniel and I live in Jerusalem" becomes "I'm David and I live in Tel Aviv". Each detail gets one substitute, used every time it recurs, and the rest of the text is left alone.
It is not a redactor. There are no [NAME] tags, so the text still reads naturally and can be shared with an AI tool, a forum or a dataset without pointing at the real people and places.
Substitutes are meant to be proximate: same gender, culture, country and kind of place or organisation. Dates move a little and keep their year. Countries and public figures are kept.
This is a proof of concept. On 295 held-out texts it leaves 9.3% of identifying details unchanged, about 1 in 11. Do not run it unsupervised. Check every output before you share it.
Which file should I download?
safetensors (Transformers) 1.19 GB
Python on CPU or GPU, at full precision. Use the exact system prompt from the model card; it is the one the model was trained with.
Run with Hugging Face Transformers Download safetensors (Transformers) →Results
Proof of concept, run pp-r2, evaluated 21 October 2026. Scored on 295 held-out synthetic texts. Leak is the share of identifying details still present word for word in the output; lower is better. The other rows are shares; higher is better.
| Test set | Untrained Qwen3-0.6B, one example | Fine-tune pp-r2 |
|---|---|---|
| Leak: identifying details left unchanged (lower is better) | 85.6% | 9.3% |
| Consistency: texts where each changed detail got one substitute | 0.997 | 0.990 |
| Rest of the text preserved (non-identifying words kept) | 0.791 | 0.998 |
| Texts with no details returned unchanged | 0.308 | 0.962 |
- A 9.3% leak is fine for a demonstration and not fine for privacy. Names, dates and ages leak most.
- Suggested targets: 1% or less with a human reviewing every output; about 0.1% or less without one, and then only for low-stakes text. This checkpoint is far from both.
- Whether a substitute is proximate is not scored automatically.
- The untrained model scores higher on consistency because it changes little; its leak is 85.6%.
Training
- Full fine-tune of Qwen/Qwen3-0.6B: run pp-r2, 3 epochs, learning rate 5e-05, cosine schedule, effective batch 16, bf16, one NVIDIA L4 on Modal, about 38 minutes of training.
- 4,280 synthetic texts with replacement lists, written by Claude Haiku 5.5. Code checked every list for consistency and for substitutes that were too close to the original; flagged swaps were re-picked or the text was dropped. The training target is computed by applying the list, so every target is consistent by construction.
- Training length was the main lever. The first run (2 epochs, learning rate 2e-05) left 26.5% of details unchanged; the same model and data trained longer at a higher rate reached 9.3%.
- Training is paused at this checkpoint. Next steps: longer training, a larger base such as Qwen3-4B-Instruct, and a swap-list output mode (already in the repo) where code applies the substitutes.
Training data
The training data is not published. It is 4,280 synthetic texts, described under Training.
Checkpoints and roadmap
Where the model is now and the checkpoints still to come. Planned stages are the current plan, not promises.
- pp-r2 Done 21 October 2026
Proof of concept: leak 9.3%, consistency 0.99, rest of text 0.998 preserved.
- Leak at or below 1% Planned
The target for use with a human reviewing every output. Training is paused.
Limitations
- About 1 in 11 identifying details survives. It is not safe to run without review.
- Substitutes can collide: in one test, two different surnames both became "Moran". Some come out too close to the original.
- Trained on synthetic texts only. 80% are English, weighted towards Israel, Ireland and the US; other languages work less well.
- The replacement policy is one person's choice: big cities are replaced, countries and public figures are kept.