LLM Guardrails and PII Detection,
Open Source
A 300M-parameter multilingual model that runs LLM safety moderation and
PII detection in a single forward pass. Cutting latency by half with no drop in accuracy.
2-in-1
LLM safety
& PII checks
~50%
lower
latency
0.3B
params
encoder
RESEARCH
Two Safety Models. One forward pass.
Two jobs, one checkpoint. Run schema-conditioned safety moderation and span-level PII extraction without loading separate models - classification and extraction in one pass.
Learn more
Composable schema at inference. Pass any subset of the 42 PII labels or the safety tasks you need at inference time. No retraining, no prompt redesign.
Learn more
No regression on either task. The combined model matches GLiGuard on safety benchmarks and GLiNER2-PII on the SPY PII benchmark.
Deploy GLiNER2-Guardrails-PII-Multi
EFFICIENCY
Smaller, faster, built to self-host
Half the inference latency
Both tasks run in one pass on a shared encoder, roughly half the latency of running GLiGuard and GLiNER2-PII in sequence.
Multilingual coverage
Safety moderation and PII detection across seven languages: English, French, Spanish, German, Italian, Portuguese, and Dutch.
Stay on your infrastructure
Open weights. Run on-prem, air-gapped, or CPU-first for fast local inference, or deploy with Pioneer.
0.3B
Parameters,
one shared encoder
~50%
Lower latency
vs. two-model pipeline
42
PII entity types,
7 categories
7
Languages supported
![](data:image/svg+xml,<svg display="block" role="presentation" viewBox="0 0 1130 232" xmlns="http://www.w3.org/2000/svg"><path d="M 223.21 3.766 L 234.545 2.013 L 534.483 35.731 L 558.025 0 L 571.975 0 L 595.517 35.731 L 895.455 2.013 L 906.79 3.766 M 223.21 3.766 L 231.057 44.371 M 223.21 3.766 L 470.833 40.764 L 231.057 44.371 M 231.057 44.371 L 102.886 46.299 M 102.886 46.299 L 469.09 50.829 L 112.477 101.33 M 102.886 46.3 L 112.477 101.33 M 0 117.258 L 13.079 120.278 M 0 117.258 L 26.157 217.406 M 0 117.258 L 112.477 101.33 M 13.079 120.278 L 534.483 57.874 M 13.079 120.278 L 40.979 232 M 534.484 57.874 L 558.026 128.833 M 534.484 57.874 L 534.484 161.041 M 558.026 128.833 L 558.026 166.577 M 558.026 128.833 L 571.976 128.833 M 906.79 3.766 L 898.943 44.371 M 906.79 3.766 L 659.167 40.764 L 898.943 44.371 M 898.943 44.371 L 1027.11 46.299 M 1027.11 46.299 L 660.91 50.829 L 1017.52 101.33 M 1027.11 46.3 L 1017.52 101.33 M 1130 117.258 L 1116.92 120.278 M 1130 117.258 L 1103.84 217.406 M 1130 117.258 L 1017.52 101.33 M 1116.92 120.278 L 595.517 57.874 M 1116.92 120.278 L 1089.02 232 M 595.517 57.874 L 571.975 128.833 M 595.517 57.874 L 595.517 161.041 M 571.975 128.833 L 571.975 166.577" fill="transparent" height="231.99999987792967px" id="epMph3ju2" stroke-dasharray="" stroke-linecap="round" stroke-linejoin="round" stroke-width="1" stroke="rgb(229, 218, 213)" width="1130.0000439453124px"/></svg>)
GLiNER2-Guardrails-PII-Multi Benchmark Results
When evaluated against the two models it replaces, GLiGuard and GLiNER2-PII, GLiNER2-Guardrails-PII-Multi holds competitive performance while reducing latency.
Task
Benchmark
Specialist Model
GLiNER2-Guardrails-PII-Multi
Safety
Prompt harmfulness, avg F1
87.7 (GLiGuard)
87.4
Safety
Response harmfulness, avg F1
82.7 (GLiGuard)
83.1
PII
SPY legal Q&A, F1
47.5 (GLiNER2-PII)
47.0
PII
SPY medical, F1
46.7 (GLiNER2-PII)
47.5
PII
SPY average, F1
47.1 (GLiNER2-PII)
47.2