Research note / 23 September 2026
This note draws on the project's recorded training runs from July 2026, its evaluation reports and document-extraction work. These are internal experiments, not an independent benchmark or a claim of production readiness.
- 01 / Early model38 / 40
Negative rows flagged
The positive-only smoke run predicted identifiers where none were labelled.
- 02 / Add negative examples0 / 40
The same holdout
Adding training negatives removed those false positives, but clean-test F1 fell.
- 03 / Larger baseline12,000
Synthetic training rows
The next baseline combined model predictions with deterministic rules.
- 04 / Document preparation1,829
Extracted document rows
Material for further evaluation, not a completed accuracy benchmark.
The question
Before sending text to a model, can we remove identifying details while keeping enough meaning to do the task? Missing an identifier exposes information. Removing ordinary business text makes the request less useful. Bowden has to be evaluated for both failures.
The initial scope centres on Swiss identifiers and business text. The work includes deterministic validators, synthetic training data, a small token-classification model and a hybrid runtime. Broader language and document coverage remains an evaluation question.
Start with what can be checked
Structured identifiers often have constraints that code can check. The implemented rules include Swiss AHV and UID checks, IBAN validation and selected contact or network identifiers. A valid format still does not tell us everything about the surrounding text.
The dataset builder creates synthetic profiles with labelled character spans. It separates training and evaluation profiles, includes noisy variants and uses held-out template groups where practical. Dataset validation checks offsets and profile separation before training.
That preparation matters as much as the model. If the training and test data repeat the same easy patterns, a good score tells us little about an unfamiliar document.
Learning what to leave alone
An early five-epoch MiniLM run learned to recognise positive examples, but also predicted identifiers in 38 of 40 negative-control rows. Those rows contained no labelled target entities. The model had learned to redact too readily.
The next run added 200 training-only negative examples and kept the negative evaluation set held out. It predicted no entities in any of those 40 rows. That addressed the immediate failure, but did not settle the whole problem: its clean-test F1 fell from about 0.676 to 0.635.
The following iterations broadened templates, added noisy email examples and varied name boundaries. Structured-identifier noise and confidence-threshold sweeps followed. Each change exposed a different trade-off. Better results on one slice did not guarantee better results everywhere.
These figures come from the stored smoke-run reports. They describe those experiments, not current performance on arbitrary documents. Read the extracted evidence summary.
Rules and a model together
The hybrid runtime combines rule detections with model predictions. Structured rule spans take precedence when detections overlap, while the model can contribute less rigid categories such as names and addresses. Conflict counts help explain what the merge layer changed.
The larger baseline used 12,000 synthetic training rows and three epochs on local Apple MPS. In its balanced hybrid report, all 240 clean-test rows and 240 noisy-test rows matched the expected label counts. All 160 negative-control rows remained free of predicted entities. The curated 120-row stress set also matched the expected label counts.
Matching label counts is not the same as redacting the correct text. This evaluator compares the number of each entity label per row. A prediction can have the right label counts and still select the wrong character boundaries. The reported hybrid F1 of 1.0 on those positive test slices is therefore not a claim of perfect detection or zero leakage.
The evaluations also informed successive development decisions. They are useful regression checks, but they do not replace a fresh, independently annotated test set.
From templates to documents
The project then investigated public-document sources in German, French and Italian. Source review covered forms, official guidance and legal or administrative text. The plan separates negative controls from material intended for synthetic identifier insertion and records reuse decisions.
A document bridge now extracts permitted local HTML and PDF sources into traceable rows. The stored extraction and validation reports record 1,829 rows. Each row can retain the source URL, checksum and extraction metadata.
That is data preparation, not a multilingual accuracy result. The validation report has no entity labels for these extracted rows. An empty annotation list must not be read as proof that a public document contains no personal information.
Some sources also led to form-entry pages instead of the forms themselves. Browser capture and follow-through work were needed to make those sources useful. A downloaded page is not automatically a usable test document.
What remains open
- Annotate realistic documents and test exact entity boundaries and missed private terms.
- Measure German, French, Italian and English separately before claiming comparable language coverage.
- Evaluate OCR damage, mixed-language text and unfamiliar document layouts.
- Check how replacement changes the usefulness of the downstream task.
- Test mapping storage, logs and error paths as well as the detector itself.
Bowden remains a developer preview. Local replacement can reduce exposure, but it does not guarantee anonymisation. The surrounding context and the separate original-value mapping still need attention.
Evidence and project links
The source review covered the implementation log, larger-training plan, saved neural and hybrid reports, the hybrid evaluator and public-document validation outputs. No training or model evaluation was rerun for this article.
Download the aggregate evidence summary. It includes report filenames and SHA-256 hashes for traceability, without source documents or personal records.