Today, we’re releasing GLiNER2-Guardrails-PII-Multi, a multilingual multi-task small language model that performs safety moderation and privacy filtering in a single forward pass.

If you're looking for an open-source model that handles both content safety moderation and PII detection, GLiNER2-Guardrails-PII-Multi is a 0.3B parameter small language model that covers both in a single forward pass. Safety moderation and privacy filtering are critically important in agentic systems but are typically treated as separate tasks, requiring two separate models and doubling both cost and latency. Building on GLiGuard and GLiNER2-PII, we trained a single model to handle both guardrail and PII extraction tasks using the same compact encoder architecture. It matches the performance of each individual model while cutting inference time and memory consumption in half.

Our motivation: Training a single small model for two critical tasks

The idea to train GLiGuard-PII-Multi was born out of the success of our two previously released models: GLiGuard and GLiNER2-PII. The former is a zero-shot lightweight guardrail model that filters user queries and model responses according to an extensive safety policy, similar to that of QwenGuard. The latter is a zero-shot privacy filter model fine-tuned to detect 42 different types of personally identifiable information. Combined, both models charted over 52,000 downloads within the first six weeks of releasing the models on the Hugging Face Hub, a clear signal of the public’s appetite for open source solutions for guardrail and PII models.

Given the popularity of both models, taken together with the fact that the GLiNER2 model architecture inherently supports both classification and extraction tasks, we decided to combine these into a single model by retraining a new multi-task model on an enhanced version of the original datasets. Furthermore, these two use cases tend to overlap: if you’re screening for leaked PII, typically you may also want to screen for unsafe content, particularly in user-facing applications.

In this blog post, we’ll briefly summarize the model’s multi-task architecture, explain what tasks the models can perform, and how we trained and evaluated the model.

Four-task safety moderation and 42-type PII extraction in a single forward pass

Multi-task architecture

GLiGuard-PII-Multi is based on GLiNER2, a compact encoder-based architecture that unifies entity recognition, structured extraction, and text classification, allowing all tasks to be performed in a single forward pass.

The model encodes both the candidate labels and the input text as vectors, then computes dot-product similarity between them to score how well each label matches a given span of text, where a higher score indicates a stronger match. For extraction tasks, a small multilayer perceptron predicts the number of instances to return. Because the task definitions are joined with separators and prepended to the input text, the model evaluates all tasks in a single forward pass rather than requiring a separate pass for each.

By treating PII identification as an extraction task and safety moderation as a classification task, GLiNER2 proves to be a strong architecture for unifying these two tasks in a single model.

Filters user queries and model responses for safety violations

GLiGuard-PII-Multi maintains the same safety policy as GLiGuard, filtering both user queries and model responses for jailbreak, harm, and refusal detection as well as applying an overall safety label.

All four tasks are performed by the model simultaneously, with inputs and potential class labels provided at inference, and assigned labels and probability scores provided as output.

Detects over 42 types of personally identifiable information

Like GLiNER2-PII, our current model was trained to identify and extract 42 types of personally identifiable information, divided into seven different categories.

All four safety tasks and PII extractions occur in a single forward pass, eliminating that need to run inference twice on the same text with two different models.

How we trained GLiGuard-PII-Multi

Generating synthetic training data with Pioneer

Data curation is a core challenge of fine-tuning any model. This challenge, however, is exacerbated when the downstream task involves highly sensitive data. PII is sensitive by nature, so genuine training data is hard to come by. Existing PII datasets tend to be small, narrow in scope, and heavily overused in training, and even where they exist, the ethics of using them are questionable. Guardrail datasets are different: plenty of good open source options exist, but they tend to cover only a specific category of harm rather than the full range of safety concerns. To overcome these challenges, we used the Pioneer API to generate diverse, multilingual, multi-task synthetic data to train our model.

For safety moderation, we built on WildGuardTrain, which already has human labels for prompt safety, response safety, and refusal detection, using the Pioneer API to extend it with labels for jailbreak strategy detection.

For privacy filtering, we used the same API along with a constraint-driven framework to generate a synthetic corpus of annotated PII, spanning 42 entity types across a range of document types and languages.

The final result is a multilingual dataset spanning over 42 types of labeled PII examples and safety moderation data covering a diverse four-task safety policy.

How we evaluated GLiGuard-PII-Multi

We evaluated GLiGuard-PII-Multi against both original models: GLiGuard and GLiNER2-PII. The combined model maintains competitive performance on both tasks.

On PII extraction, GLiGuard-PII and GLiNER2-PII reach equivalent average F1 (47.2 vs 47.1). The primary tradeoff is precision vs recall: GLiGuard-PII gains precision across both domains (+1.4 legal, +2.8 medical) at the cost of recall (-7.5 legal, -5.6 medical).

On harmfulness detection, GLiGuard-PII-Multi holds onto the original GLiGuard's performance. Prompt harmfulness average F1 is essentially unchanged (87.4 vs 87.7), and response harmfulness improves slightly (83.1 vs 82.7). Every individual benchmark stays within range of the original.

These results show that joint training for safety moderation and PII extraction preserves both capabilities in aggregate. Where full PII coverage matters most, the recall tradeoff can be addressed by tuning the confidence threshold at inference time.

Conclusion

GLiNER2-Guardrails-PII-Multi combines safety moderation and PII detection into a single 0.3B parameter model, cutting inference latency roughly in half compared to running GLiGuard and GLiNER2-PII sequentially, with no loss in aggregate performance on either task. For teams evaluating open-source options for content moderation or PII detection, this is a practical alternative to closed-source APIs. We're releasing it to the open-source community under Apache 2.0 license because the best safety models should be small and open.

Try GLiGuard-PII-Multi in Pioneer

GLiGuard-PII-Multi is now available for inference on Pioneer.

Additional resources

• GLiGuard release blog post

• GLiGuard arXiv paper

• GLiGuard model weights (Hugging Face)

• GLiNER2-PII release blog post

• GLiNER2-PII arXiv paper

• GLiNER2-PII model weights (Hugging Face)