A single prompt to an AI assistant can carry a customer record, a clause from an unsigned contract, and medical data in one paragraph of ordinary English. None of it looks like a credit card number. All of it is sensitive. The tools most enterprises use to catch sensitive data in motion were built for a different problem, finding fixed patterns in structured content, and they read a paragraph like that and see nothing.
We built NER-D, short for Named Entity Recognition, Double-pass to close that gap: it identifies sensitive information in AI conversations by determining meaning. Take the word “Paris.” Depending on the sentence, it is a city, a celebrity, or a type of plaster. A person resolves that ambiguity without thinking. NER-D resolves it at live conversation speed, using a method that outside reviewers judged strong enough for ACL 2026, the flagship peer-reviewed conference in natural-language processing.
The shape assumption
Two decades of data-loss prevention (DLP) rest on the assumption that sensitive data can be recognized by its shape. A credit card has sixteen digits. A US Social Security number runs three digits, two, then four. Catalog the shapes and scan for them.
For data with rigid mechanics and structured data, this works. The trouble starts at the edges. Try to cover national identifiers worldwide and you write one regex for the US, another for Brazil, another for Japan and Germany and so on, until your pattern library matches most seven-to-fourteen-digit strings, including drivers license numbers, patient ID numbers, and insurance IDs. Overwhelming false positives. Analysts then spend their days dismissing alerts, while data with no specific shape – a prescription drug name or a trading strategy – sail through unexamined because they have no shape to match. The pattern library also ages badly. Every new drug name, ID format, and code secret pattern has to be added by hand, and the world produces them faster than any team can keep up.
What first generation NER got right, and where it stopped
Named entity recognition moved detection forward in a real way. NER models learned categories that defeat a regular expression: names, addresses, prescription drugs. Detection started to grasp the meaning of a string.
Then it hit a ceiling, and the ceiling was model size. Real-time inspection has a latency budget, and the only models fast enough to fit it were small ones that carry very little knowledge of the world. Ask a small model to enforce a rule like “flag trading strategies” and it simply does not know the thousands of valid variants of stock trading strategies across markets and languages. Adding a new data type meant collecting labeled examples and fine-tuning, a project measured in weeks. Accuracy on unfamiliar data was poor across the board; the strongest publicly available zero-shot models average below 50 F1 (the standard accuracy score balancing precision and recall) on a 20-benchmark suite.
The obvious answer was a large language model, which does carry that world knowledge. But generative LLMs write their answers one token at a time. For live traffic they are slow and expensive, and they occasionally invent entities that were never in the text. So the industry settled into an uncomfortable choice between fast-but-shallow and smart-but-slow.
The double pass
The second challenge is that a word itself, without context, doesn’t contain enough information to determine the meaning. Back to Paris vs Paris. NER-D’s name describes the technique used to quickly gather context. LLMs normally read left to right, so when the model encounters an early token it has no idea what comes later in the sentence, and later context is often exactly what disambiguates. NER-D passes the input through the model twice. On the second pass, every token gets classified with the whole sentence already in view. Classification happens directly, in parallel, with no token-by-token generation step, which is where the speed comes from.
NER-D beats the strongest prior method on zero-shot detection benchmarks by 7.9 at the time the paper was published, and it wins on all 20 datasets of an extended suite that spans biomedical text, social media, and multiple languages. The latest model surpasses even that by double digits. As for speed, it runs over 20x faster than comparable generative methods; in one like-for-like test on a single A100 GPU, our smaller model variant finished a benchmark workload in about 90 seconds that took generative baselines half an hour, and scored higher accuracy on the same data. And because the backbone is a full LLM, the model already recognizes national ID formats, pharmaceutical compounds, and trading concepts from its training. A detection rule can name a concept and rely on the model to know the variants.
Here is the same nine-digit string in three sentences. “This person’s ID number is 123-45-6789” contains an identifier. “The invoice total was 123456789” does not. “My password is 123456789” is a third thing entirely. A pattern matcher fires on all three, which is where alert floods come from. NER-D reads the surrounding text and fires once.
Defining a data type in a sentence
Extending coverage used to be the expensive part: labeled examples, a fine-tune, a deployment window. With NER-D you write a plain-English definition, “detect weapons,” and the model applies it at inference time. No training, tuning, or model deployment.
One nuance from our own testing is worth passing along. Definition quality matters. A rule that spells out inclusions, exclusions, and a couple of examples performs better than a one-liner, and when detection is off, the fix is editing the sentence. That is the entire tuning loop.
What changes for a security program
Coverage extends to data that has no format, which in most enterprises is the data with the highest breach cost. False-positive volume drops, because a number that looks like an ID but reads like an invoice total gets left alone, and analyst hours follow the alert volume down. The maintenance treadmill largely goes away, since a concept-level rule like “prescription medications” keeps working when 150 new drugs reach the market this year. On that last point, precision matters: NER-D does not learn or self-correct in production. Its coverage comes from world knowledge acquired during training, applied at inference time, and that knowledge is broad enough that the rules rarely need touching.
All of this runs inline, inside the conversation flow, at the latency real-time enforcement requires. Detection you find out about in next month’s audit is a different and much less useful product.
Where it fits
NER-D complements DLP rather than replacing it. Structured data with fixed formats is a solved problem, and your existing controls solve it. What they cannot see is the concept-level, context-dependent content that now moves through AI conversations, and that is the specific job NER-D takes on. Inside the WitnessAI platform it adds to the 100-plus data types already detected and feeds the same workflows teams run today, including redaction and tokenization.
A scope note for technical readers: NER-D processes a doubled input sequence, so very long content gets chunked into segments for inspection. We would rather state that plainly than have you discover it in a proof of concept.
The research
The method is documented in “Just Pass Twice: Efficient Token Classification with LLMs for Zero-Shot NER” by WitnessAI researchers Ahmed Ewais, Ahmed Hashish, and Amr Ali, accepted at ACL 2026. The model shipping in the platform extends the published method, and its benchmark results come from the same evaluation suite, measured against the same named baselines, so every number above can be checked.
NER-D will be available in the WitnessAI platform in the coming months. To see context-aware detection run against your own data categories, book a demo.