EdgeDeID: A 0.6B Clinical De-identifier Trained Without Real Patient Data

Sina Daneshgar; Raya Namazi; Amirali Khosravi; Pouria Rouzrokh; Bardia Khosravi

cs.CLOct 24, 2026

EdgeDeID: A 0.6B Clinical De-identifier Trained Without Real Patient Data

Authors: Sina Daneshgar, Raya Namazi, Amirali Khosravi, Pouria Rouzrokh, Bardia Khosravi

Organizations: Sharif University of Technology · Department of Radiology, Mayo Clinic · Department of Radiology and Biomedical Imaging, Yale University

Abstract

De-identifying clinical notes with a hosted language model discloses the information the step is meant to protect. We present EdgeDeID, a 0.6B-parameter decoder-only de-identifier that runs locally and is trained without real patient text: three LLM teachers write synthetic notes, a single labeler re-annotates them into one convention, and the model learns to emit a typed XML schema of the identifiers it finds. On a 100-note synthetic in-domain benchmark with manually verified annotations it reaches 0.994 micro-F1 and leaves no missed identifier in 99% of notes, against 0.857 and 12% for the strongest of eight off-the-shelf systems. Quantized, it runs on CPU in 615 MB. Of three additions to supervised training, only a verifier adapter helps: it separates complete from incomplete outputs of other systems at 0.94 AUROC, whereas reinforcement learning with a recall-weighted reward and a rule-based post-processing layer leave in-domain results unchanged. On MIMIC ICU nursing notes F1 falls to 0.48. The errors follow two properties our synthetic notes lack, telegraphic style and low identifier density, and three hand-written in-context examples recover 0.08 F1 without annotated target data.

Figures & tables

Figure 1: Overview of EdgeDeID . The solid boxes are the configuration we recommend, which uses SFT alone. The dashed boxes are the three additions we tested on top of it: GRPO with its self-assessment tag (Section 3.3 ), and the rule-based QC layer and the learned verifier (Section 3.4 ).

	Self-assess. tag	QC layer	Verifier
Judge	the extractor	rules and spaCy NER	LoRA adapter
When	same pass	after generation	second pass
Training	GRPO reward	none	SFT, then GRPO
Result	verdict	edited annotation	$P(\text{incomplete})$ , review
Other systems	no	yes	yes

Table 1: The three reliability mechanisms. “Other systems”: whether the mechanism can be applied to the output of another de-identifier.

System	Params (M)	P	R	F1	F 2	Macro-F1	Zero-leak	Parse
OPF	1,500 †	0.983	0.760	0.857	0.796	0.852	0.12	1.00
GLiNER	195.2	0.916	0.681	0.782	0.718	0.617	0.05	0.99
Presidio	–	0.764	0.569	0.652	0.600	0.545	0.05	1.00
Stanford-deid	108.9	0.646	0.554	0.597	0.570	0.366	0.02	1.00
spaCy	–	0.764	0.459	0.573	0.499	0.514	0.02	0.99
OpenMed-PII	434.1	0.672	0.345	0.456	0.382	0.390	0.00	1.00

Table 2: Results on the 100-note in-domain benchmark. External systems are sorted by F1. Every system is scored with the protocol of Section 4.3 , and a category a system cannot produce still counts against its recall and zero-leak rate. Parse is the share of outputs that parse after conversion to our schema. Bold marks the best value in each column. † Mixture of experts with about 50M active parameters.

Verifier	Synth. val	Benchmark	MIMIC
Zero-shot (no adapter)	0.537	0.600	0.658
SFT adapter	0.813	0.987	0.661
SFT + GRPO adapter	0.809	0.989	0.661

Table 3: AUROC of the verifier for detecting incomplete annotations. Synth. val:

800

held-out synthetic candidates. Benchmark: outputs of the

11

systems of Table 2 on the

100

notes,

80\%

of them incomplete. MIMIC: outputs of

11

systems on

2{,}434

notes,

18\%

of them incomplete.

System	P	R	F1	SH-R	Leak
RoBERTa-i2b2	0.597	0.777	0.675	0.854	87
Stanford-deid	0.445	0.654	0.529	0.362	281
BERT-i2b2	0.616	0.458	0.525	0.266	314
GLiNER	0.387	0.614	0.475	0.599	201
OPF	0.539	0.331	0.410	0.298	314
OpenMed-PII	0.246	0.564	0.342	0.756	138

Table 4: MIMIC ICU nursing notes (

2{,}434

notes) scored against the human gold standard. External systems are sorted by F1 and followed by our configurations, which are zero-shot unless marked few-shot (three hand-written example notes in the prompt); + QC adds the rule-based layer. SH-R is recall on the

823

Safe Harbor spans, where a span counts as caught if a prediction of any type covers it. Leak is the number of the

399

notes containing Safe Harbor PHI in which at least one such span is missed (lower is better). Best value per column in bold, second best underlined.

System	GPU	CPU	RSS
Stanford-deid	8	124	1,222
BERT-i2b2	9	119	1,233
RoBERTa-i2b2	14	335	2,118
GLiNER	18	192	2,418
OpenMed-PII	26	476	2,285
OPF	24	12,413	4,778

Table 5: Median latency in ms per note (

20

benchmark notes, processed one at a time after warm-up) on an NVIDIA L40S GPU and on

8

threads of an AMD EPYC 9354 CPU, with peak resident memory in MB for the CPU run. “Ours” is EdgeDeID (SFT); baselines run in PyTorch. Q4 is 4-bit (Q4_K_M) GGUF quantization. The CPU host was shared, so CPU figures are conservative.

Appendix figures & tables15 assets

Supplementary material from the paper’s appendix.

Appendix

Hyperparameter	Value
Base model	Qwen3-0.6B-Base (labeler: Qwen3-1.7B-Base)
Precision	bfloat16
Epochs	1
Per-device batch size	2
Gradient accumulation	8
Optimizer	AdamW

Appendix

Table 6: Supervised fine-tuning.

Hyperparameter	Value
Initialization	SFT checkpoint, full fine-tuning (no LoRA)
Precision	bfloat16
Learning rate	$1\times 10^{-5}$
Prompts per step	1
Completions per prompt ( $G$ )	8
Per-device batch size	1

Appendix

Table 7: GRPO.

Hyperparameter	Value
Base	EdgeDeID SFT checkpoint (frozen)
Adapter	LoRA, rank 16, $\alpha$ 32, dropout 0.05
Training data	$8{,}000$ synthetic training notes; corrupted gold annotations and outputs of BERT-i2b2, GLiNER, Presidio, and RoBERTa-i2b2
SFT stage	$6{,}655$ candidates, 1 epoch, lr $1\times 10^{-4}$ , batch $2\times 8$
SFT label balance	26% incomplete
GRPO stage	$2{,}142$ candidates, 300 steps, lr $5\times 10^{-6}$ , $G=8$ , gradient accumulation 4, temperature 1.0, no KL term

Appendix

Table 8: Verifier adapter.

Claimed	Actual	$r_{\mathrm{qc}}$
complete	complete	1.0
incomplete	incomplete	1.0
incomplete	complete	0.5
complete	incomplete	0.0
(tag missing)	any	0.0

Appendix

Table 9: The calibration reward. Claiming completeness after a miss is the safety-critical error and scores zero.

	Benchmark			MIMIC
Step	P	R	F1	P	R	F1
None	0.990	0.999	0.994	0.407	0.580	0.478
+ Repair	0.990	0.999	0.994	0.278	0.617	0.383
+ Patterns	0.989	0.999	0.994	0.280	0.626	0.387
+ NER fallback	0.989	0.999	0.994	0.280	0.626	0.387

Appendix

Table 10: The QC layer step by step on EdgeDeID SFT (GRPO is identical on the benchmark). MIMIC is scored against the human gold standard.

Test set	Comparison ( $B-A$ )	$\Delta$ Recall	$\Delta$ Precision	$\Delta$ F1	$\Delta$ Zero-leak
Bench.	GRPO $-$ SFT	$0.000$	$0.000$	$0.000$	$0.000$
		[ $0.000$ , $0.000$ ]	[ $0.000$ , $0.000$ ]	[ $0.000$ , $0.000$ ]	[ $0.000$ , $0.000$ ]
Bench.	QC $-$ none, on GRPO	$0.000$	$-0.001$	$0.000$	$0.000$
		[ $0.000$ , $0.000$ ]	[ $-0.003$ , $0.000$ ]	[ $-0.001$ , $0.000$ ]	[ $0.000$ , $0.000$ ]
MIMIC	GRPO $-$ SFT	$-0.052$	$+0.112$	$+0.046$	$-0.022$
		[ $-0.083$ , $-0.022$ ]	[ $+0.084$ , $+0.146$ ]	[ $+0.021$ , $+0.074$ ]	[ $-0.029$ , $-0.016$ ]

Appendix

Table 11: Paired bootstrap differences with

95\%

intervals. An interval that excludes zero marks a significant difference. Because GRPO and SFT have identical scored predictions on the benchmark, QC on SFT gives the same row as QC on GRPO. Few-shot uses three hand-written example notes in the prompt; MIMIC rows are scored against the human gold standard over all categories.

Category	Presidio	GLiNER	RoBERTa	BERT	OpenMed	Stanford	spaCy	OPF	Base	EdgeDeID
			-i2b2	-i2b2	-PII	-deid			0-shot	SFT
Name	0.990	0.842	0.647	0.616	0.646	0.983	0.982	0.986	0.352	0.996
Age	–	0.756	0.987	0.987	0.987	–	–	–	0.280	0.987
Date	0.452	0.973	0.039	0.024	0.004	0.990	0.446	0.986	0.110	0.998
Place	–	0.868	0.000	0.000	0.000	0.221	0.629	–	0.000	0.972
Address	0.000	0.000	0.000	0.000	0.000	–	0.000	0.938	0.128	1.000

Appendix

Table 12: Per-category F1 on the in-domain benchmark. GRPO’s predictions are identical to SFT’s.

Category	RoBERTa	Stanford	BERT	GLiNER	OPF	OpenMed	Presidio	spaCy	Base	EdgeDeID	EdgeDeID
	-i2b2	-deid	-i2b2			-PII			0-shot	SFT	GRPO
Name	0.854	0.768	0.741	0.597	0.574	0.638	0.226	0.231	0.019	0.541	0.598
Date	0.745	0.090	0.172	0.547	0.205	0.269	0.066	0.058	0.030	0.509	0.589
Place	0.481	0.710	0.396	0.370	0.000	0.008	0.000	0.015	0.000	0.456	0.422
Phone	0.561	0.389	0.541	0.302	0.468	0.604	0.349	0.000	0.000	0.175	0.267
Age	0.000	0.000	0.036	0.032	0.000	0.047	0.000	0.000	0.000	0.048	0.045

Appendix

Table 13: Per-category F1 on MIMIC against the human gold standard. Ages are near zero for every system that predicts them because MIMIC annotates only ages of

90

and above (

4

gold spans), so almost every predicted age is a false positive.

System	Tool ref.	Human gold	Untyped
RoBERTa-i2b2	0.571	0.675	0.708
Stanford-deid	0.435	0.529	0.535
BERT-i2b2	0.398	0.525	0.560
Ours, GRPO	0.442	0.523	0.542
Ours, SFT	0.423	0.478	0.500
GLiNER	0.410	0.475	0.486

Appendix

Table 14: MIMIC F1 against the rule-based tool’s output, against the human gold standard, and against the human gold standard ignoring entity type. “Ours” is EdgeDeID .

Safe Harbor PHI ( $823$ )
Class of gold span	Spans	Missed
		Ours	RoB.
date (month/day)	482	113	57
patient or relative name	231	87	40
city, town, region, street	56	49	3
patient or family phone	42	18	11

Appendix

Table 15: MIMIC gold spans by Safe Harbor status, with the number left uncovered by any prediction, of any type, of EdgeDeID SFT (Ours) and of RoBERTa-i2b2 (RoB.). The table counts the

1{,}779

spans as annotated; two overlapping Location spans are merged into one for scoring, giving the

1{,}778

spans used elsewhere.

Whole-note failures
Measurement	Value
Misses in notes with empty or unparseable output	155 / 200
output parseable but empty	103
output unparseable	52
Benchmark notes with such output	0 / 100
Miss rate in notes with normal output	8.1%

Appendix

Table 16: Analysis of missed Safe Harbor names and dates on MIMIC (SFT model). Applying the reverse edits to benchmark notes (lower-case names, year-less dates, upper-case notes, ICU shorthand) leaves benchmark recall between

99.5\%

and

100\%

Profile	P	R	F1	Zero-leak
Clean	0.992	0.996	0.994	0.96
Surface	0.992	0.996	0.994	0.96
Register	0.986	0.983	0.985	0.85
Both	0.984	0.955	0.969	0.75

Appendix

Table 17: EdgeDeID (SFT) under synthetic perturbations of the benchmark.

Test set	Verifier	Base rate	AUROC	ECE	Flagged	Caught	Flag precision	Residual
Synthetic val ( $800$ )	zero-shot	0.301	0.537	0.024	0.105	0.154	0.441	0.285
	SFT		0.813	0.013	0.204	0.556	0.822	0.168
	SFT + GRPO		0.809	0.134	0.163	0.506	0.939	0.178
Benchmark ( $1{,}100$ )	zero-shot	0.795	0.600	0.531	0.160	0.199	0.989	0.758
	SFT		0.987	0.139	0.746	0.931	0.991	0.215
	SFT + GRPO		0.989	0.213	0.574	0.722	1.000	0.518

Appendix

Table 18: Verifier results, pooled over systems. Base rate: share of (note, annotation) pairs that are incomplete. Flagged: share sent to review. Caught: share of incomplete pairs that are flagged. Residual: share of unflagged pairs that are incomplete.

System	Device	Runtime	Precision	Median ms	p90 ms	Peak RSS (MB)
spaCy	CPU	spaCy	fp32	35	47	1,319
Presidio	CPU	spaCy/regex	fp32	51	70	1,536
BERT-i2b2	CPU	transformers	fp32	119	187	1,233
Stanford-deid	CPU	transformers	fp32	124	166	1,222
GLiNER	CPU	transformers	fp32	192	294	2,418
RoBERTa-i2b2	CPU	transformers	fp32	335	466	2,118

Appendix

Table 19: Single-note latency (median and 90th percentile over

20

notes after warm-up) and peak resident memory. GPU: NVIDIA L40S. CPU: AMD EPYC 9354 limited to

8

threads on a shared server. With

100

concurrent requests, vLLM serves

31

notes per second at bf16 and

17

at Q4_K_M. Quantized variants score

0.994

F1 on the benchmark with a zero-leak rate of

0.98

(Q4_K_M) or

0.99

(Q8_0, FP8).

System	Checkpoint or configuration
Presidio	Microsoft Presidio analyzer, default recognizers
spaCy	en_core_web_lg NER
GLiNER	urchade/gliner_mediumv2.1 , prompted with our type names
Stanford-deid	StanfordAIMI/stanford-deidentifier-base
RoBERTa-i2b2	obi/deid_roberta_i2b2
BERT-i2b2	obi/deid_bert_i2b2

Appendix

Table 20: Baseline systems.

Privacy-Preserving Language Models

Privacy-preserving language models protect sensitive data during training, inference, personalization, and information sharing.

See all 178 papers

MedDeID enables locally governed clinical-text de-identification from real or synthetic training data
Sep 9, 2026Stig Hellemans, Tom Stroobants, Elyne Scheurwegs +3Clinical NLP PII Detection
Adrem Data Lab, Department of Computer Science, University of Antwerp, Antwerp, Belgium · Antwerp University Hospital (UZA), Edegem, Belgium · Laboratory of Experimental Medicine and Pediatrics (LEMP), University of Antwerp, Antwerp, Belgium
SHIELD: A Diverse Clinical Note Dataset and Distilled Small Language Models for Enterprise-Scale De-identification
May 5, 2026Jose D. Posada, David Love, Somalee Datta +1Healthcare Clinical Information Extraction
Technology & Digital Solutions Stanford Medicine · Stanford Medicine
TIDE 2.0: an open, model-agnostic engine for keyed de-identification of clinical notes
Oct 5, 2026Jose D. Posada, Somalee Datta, Priya DesaiPII Detection
Technology & Digital Solutions, Stanford Medicine, Stanford, CA, USA

Sep 9, 2026J/K move · Enter open · S save

MedDeID enables locally governed clinical-text de-identification from real or synthetic training data

Stig Hellemans, Tom Stroobants, Elyne Scheurwegs, Pieter Meysman+2

Adrem Data Lab, Department of Computer Science, University of Antwerp, Antwerp, Belgium · Antwerp University Hospital (UZA), Edegem, Belgium · Laboratory of Experimental Medicine and Pediatrics (LEMP), University of Antwerp, Antwerp, Belgium

Clinical NLP PII Detection

Open paper AskPDF arXiv

Clinical notes contain personally identifiable information (PII), restricting reuse for research and medical AI, especially when data cannot leave an institution. We developed MedDeID, an on-premises framework combining in-house annotation and synthetic-note generation with model training, inference, pseudonymisation and evaluation. On an independently annotated, adjudicated 300-note Dutch hospital benchmark, a hospital-trained compact transformer detected 98.9% of identifying text while redacting 0.24% of text outside annotated identifiers; a synthetic-only counterpart detected 96.1%. On 100 primary-care notes, the synthetic-trained model achieved higher recall than the hospital-trained model (90.3% versus 87.0%) and greater robustness to identifier-format perturbations. An English instantiation trained without real text detected 99.7% and 98.9% of annotated identifier characters on two external synthetic benchmarks. These results demonstrate transfer of the workflow to another language, but not clinical English performance. MedDeID provides a route to locally governed de-identification using real or synthetic training data.

Abstract

Privacy-Preserving Language Models

Explore similar work

MedDeID enables locally governed clinical-text de-identification from real or synthetic training data

SHIELD: A Diverse Clinical Note Dataset and Distilled Small Language Models for Enterprise-Scale De-identification

TIDE 2.0: an open, model-agnostic engine for keyed de-identification of clinical notes