NLP for military intelligence report processing: entity extraction, summarization and classification

By Corvus Intelligence Engineering Team · About the team →

June 25, 2026 12 min read

Military intelligence analysts are buried in text. A modern all-source fusion cell receives hundreds of reports daily — HUMINT cables from source handlers, SIGINT transcriptions and traffic-analysis products, OSINT aggregations from partner feeds, and imagery exploitation reports from UAV and satellite sensors. Each report must be read, assessed for relevance, key entities extracted, priority assigned, and the result routed to the appropriate analyst queue or decision-maker. This workflow, performed manually at scale, is the most significant throughput bottleneck in the intelligence cycle. The bottleneck is not analytical capability: it is reading time.

Natural language processing addresses this bottleneck directly. The core tasks in intelligence report processing — recognizing named entities (who, what, where), extracting relationships between them, identifying events and their participants, summarizing lengthy documents into concise intelligence products, and classifying reports by discipline and urgency — are precisely the tasks NLP is designed to automate. A well-engineered NLP pipeline can process a 2,000-word HUMINT cable in under one second, extracting dozens of structured data points and generating a 150-word summary with provenance links to source sentences. Deployed alongside real-time multi-source intelligence fusion, these capabilities transform the intelligence cycle from a serial reading process to a parallel structured-data pipeline.

This article covers the seven technical components of a production NLP pipeline for military intelligence report processing, from corpus annotation through to deployment in classified air-gapped environments.

The intelligence report processing bottleneck

The volume problem in military intelligence is not new, but it has grown by orders of magnitude with the proliferation of sensor systems and digital reporting. A single tactical SIGINT collection platform generates hundreds of intercepted signals per day. UAV-based ISR missions produce continuous video and imagery streams alongside written exploitation reports. HUMINT source handlers submit cables that may run to thousands of words before redaction. Partner intelligence sharing in multinational environments adds reporting in multiple languages. The aggregate daily intake for a brigade-level intelligence cell in a high-intensity environment can exceed a thousand distinct report items.

Human analysts process text sequentially at roughly 200–250 words per minute for reading comprehension adequate for triage. A 2,000-word HUMINT cable takes eight to ten minutes to read carefully enough to extract all relevant entities and assign accurate priority. At a thousand items per day, full manual processing would require over 130 analyst-hours — more than a full analyst shift for a staff of twenty people, leaving no time for the synthesis and production work that generates actionable intelligence assessments.

NLP addresses this bottleneck by parallelizing the read-and-extract step. An NLP pipeline processes all incoming items simultaneously rather than sequentially, applying named entity recognition, relation extraction, event extraction, and classification in parallel across the entire queue. The analyst's workload shifts from reading raw reports to reviewing structured extractions, correcting errors, and making judgments that require contextual understanding beyond what current models provide. This shift in cognitive task — from reading comprehension to structured review and judgment — is where human analyst capacity is most productively applied.

The enabling technology is the transformer architecture. Pre-trained encoders — BERT, RoBERTa, DeBERTa, and their successors — learn contextual representations of text that capture syntax and semantics across long-range dependencies, enabling downstream NLP tasks to be solved by fine-tuning on relatively small domain-specific datasets. For military intelligence text, the domain shift from pre-training corpora (news, Wikipedia, web text) is significant but manageable: core linguistic structure transfers, while domain-specific vocabulary (unit designators, equipment names, military phonetic terminology, grid reference systems) requires fine-tuning on annotated military corpora to reach production-ready accuracy.

Named entity recognition for military reports

Named entity recognition (NER) is the foundation of intelligence text processing. It identifies and classifies entity spans — contiguous sequences of tokens — in report text according to a predefined taxonomy. General-purpose NER models recognize four entity types (person, location, organization, miscellaneous), which are insufficient for military intelligence applications. Military NER requires a domain-specific schema:

UNIT — tactical unit designators at any echelon (3rd Armored Brigade, 1-77 Armor, Alpha Company)
EQUIPMENT — weapon systems, vehicle types, aircraft designators, electronic systems (T-72B3, BMP-3, Pantsir-S1)
LOCATION — place names, administrative divisions, geographic features, and grid references (MGRS, UTM, decimal degrees)
PERSON — commanders, sources, political figures, and named individuals with operational relevance
EVENT — named operations, named exercises, and specific engagements referenced by designation
DATE-TIME — explicit dates, times, and relative temporal expressions (yesterday, H-hour minus two, 0347Z)
ORG — headquarters elements, government agencies, ministries, and coalition bodies

Fine-tuning for military NER begins with a pre-trained encoder — DeBERTa-v3-base for English, mDeBERTa-v3-base for multilingual requirements. A token classification head with output dimensions equal to the number of BIO-tagged classes (2N+1 for N entity types, where the extra class is the Outside tag) is added on top of the encoder and trained from random initialization while the encoder is fine-tuned at a low learning rate (2e-5 to 5e-5 with linear warmup and cosine decay).

The critical resource is the annotated training corpus. Military NER models require 10,000–20,000 annotated sentences drawn from report types matching the deployment target: the linguistic structure of a HUMINT cable differs substantially from a SIGINT report, and a model trained only on one type will underperform on the other. Annotation quality requires consistent schema application: inter-annotator agreement (Cohen's kappa) should exceed 0.80 before training begins, as label noise degrades model performance more severely than label scarcity.

Active learning is the most effective technique for reducing annotation cost. After an initial batch of 2,000 annotated examples, the partially-trained model is applied to the unannotated corpus, and its lowest-confidence predictions — where the model is most uncertain — are prioritized for human annotation. This approach typically achieves the same NER F1 as random sampling with 30–40% fewer total labeled examples. Production military NER fine-tunes reach entity-level F1 of 0.88–0.93 for LOCATION and DATE-TIME types and 0.78–0.85 for UNIT and EQUIPMENT, where domain-specific vocabulary is densest.

Implementation note: Military unit designators present a particular challenge because they are highly abbreviation-dense and context-dependent. "1-77" is meaningless without battalion/regiment context; "Bravo" is a company designator within some units and a SIGINT term in others. Training data must cover multiple designation systems and their abbreviation conventions to achieve reliable UNIT recall.

Relation extraction: who did what where when

Entity recognition produces a list of extracted spans; relation extraction connects them into a structured graph. Where NER answers "what entities appear in this report," relation extraction answers "how are these entities related to one another?" In military intelligence text, the most operationally significant relation types are:

LOCATED-AT — a unit or equipment observed at a location (subject: UNIT/EQUIPMENT, object: LOCATION)
ATTACKED-BY — a target engaged by a force (subject: UNIT/LOCATION, object: UNIT)
COMMANDS — a person in command of a unit (subject: PERSON, object: UNIT)
EQUIPPED-WITH — a unit fielding a specific equipment type (subject: UNIT, object: EQUIPMENT)
MOVED-TO / MOVED-FROM — unit repositioning with directional endpoints (subject: UNIT, objects: LOCATION pair)
OBSERVED-AT — ISR observation of an entity at a time and location (subject: UNIT/EQUIPMENT, object: LOCATION)

The standard architecture for relation extraction is a span-pair classifier built on a transformer encoder. For each candidate entity pair in a sentence, the encoder processes the sentence with the two entity spans marked using special boundary tokens inserted around each span. A classification head over the concatenated representations of both entity spans predicts the relation type, with a no-relation class for pairs that are co-present but unrelated. This approach scales to sentences with several entity spans by enumerating all pairs, though pairs beyond a distance threshold (typically 80–100 tokens) are pruned as unlikely to express a direct relation.

Annotating relation training data manually is expensive — each sentence with N entity pairs requires evaluating N(N-1)/2 candidate pairs. Distant supervision addresses this by using an existing structured knowledge base (an order-of-battle database, a known unit-equipment table) to automatically label sentences where both entities of a known relation co-occur. A sentence mentioning both "3rd Guards Tank Army" and "T-80BV" is automatically labeled as a positive example of EQUIPPED-WITH because this association appears in the structured database. This generates 30,000–50,000 automatically labeled training examples at low cost. The noise inherent in distant supervision — sentences where co-occurrence does not express the target relation — is mitigated through multi-instance learning, which trains over bags of sentences per entity pair rather than individual labeled sentences.

Event extraction for order-of-battle tracking

Event extraction goes beyond identifying that entities exist and are related: it identifies that something happened, characterizes what type of event it was, and extracts the participants, location, time, and outcome. This is the NLP capability most directly applicable to order-of-battle maintenance and threat indications-and-warnings tracking.

The standard representation for events in NLP is the trigger-argument structure. A trigger is the word or phrase that signals the event — typically a verb (attacked, repositioned, engaged, observed, destroyed) or a nominalization (attack, movement, observation). Each trigger belongs to an event type, and each event type has a set of argument roles that characterize the event's participants and circumstances. For a military ATTACK event:

Event type: ATTACK
Trigger roles:
  Trigger      → "engaged" (verb), "struck" (verb), "attack on" (nominalization)

Argument roles:
  Attacker     → UNIT or PERSON entity
  Target       → UNIT, LOCATION, or EQUIPMENT entity
  Location     → LOCATION entity (where the event occurred)
  Time         → DATE-TIME entity
  Weapon       → EQUIPMENT entity
  Outcome      → classified: DESTROYED / DAMAGED / REPELLED / UNKNOWN
            

Event extraction is a two-step pipeline. The first step, trigger identification, is a sequence labeling task similar to NER: a BIO-tagged classifier identifies which tokens are event triggers and classifies each trigger by event type. The second step, argument role classification, takes each identified trigger and each entity span in the sentence and predicts which argument role (if any) that entity fills for that trigger. Both steps use fine-tuned transformer encoders and are typically trained jointly to allow the models to share contextual representations.

Event coreference resolution is required when the same real-world event is described in multiple sentences or across multiple reports. Two mentions of "the engagement at Grid 4417 on Tuesday" and "the attack on the logistics depot yesterday" may refer to the same event. Coreference models cluster event mentions by matching on location, time, event type, and participant overlap. Across-document event coreference is substantially harder than within-document coreference because temporal expressions must be normalized to absolute times, location references must be grounded to geographic coordinates, and entity aliases must be resolved. For AI situation awareness C2 applications, across-document event coreference is essential: it prevents the same engagement from being counted as multiple distinct events in an operational picture, which would inflate threat assessments and generate duplicate alerts.

Extractive vs abstractive summarization for intelligence

Intelligence analysts do not read raw source reports in final intelligence products — they read synthesized assessments that compress multiple reports into concise, structured summaries. NLP summarization automates the first step of this synthesis: producing a condensed version of a single source report that captures the key entities, events, and assessed significance.

Extractive summarization selects sentences directly from the source document and concatenates them into a summary. No new text is generated; the output consists entirely of original source sentences, which guarantees that each statement in the summary is verbatim from the source. This high fidelity is valuable for intelligence applications where provenance and accuracy are paramount. BERT-based extractive summarizers score each sentence in the document using a regression head fine-tuned on report-summary pairs, then apply maximum marginal relevance (MMR) to select a diverse set of high-scoring sentences that cover different topics without redundancy. The analyst can click any sentence in the extractive summary to jump to its location in the source document — a provenance feature that is not available with abstractive approaches.

Abstractive summarization generates new text that synthesizes and paraphrases source content. T5, BART, and small language models such as Phi-3-mini can be fine-tuned on source-summary pairs to produce fluent, compact summaries that integrate information from multiple sentences and reduce repetition. The risk is hallucination: the model may generate statements not present in the source, which is unacceptable in intelligence products where analytical claims must be grounded in sourced reporting. Mitigation techniques include copy mechanisms (rewarding generation of tokens from the source), faithfulness scoring using an NLI model (flagging generated sentences classified as CONTRADICTION relative to source), and strict length constraints that limit generation to a tight paraphrase of the extractive output rather than free synthesis.

For production intelligence NLP, a hybrid approach is standard: extractive selection of the top 5–8 sentences, followed by abstractive compression of that extractive summary to target length. The compression step operates on a much smaller input than the full document, dramatically reducing hallucination risk. Generated text is flagged with a visual indicator different from verbatim-extracted text, and the analyst always has access to the full source document.

Length constraints for intelligence products are strict and product-specific:

Spot report insert: 75–150 words (one paragraph)
Watch officer triage summary: 150–250 words
Situation report contribution: 200–400 words with structured sections
Intelligence assessment annex: 500–1,000 words with source attribution

Summarization quality is evaluated on ROUGE-1, ROUGE-2, and ROUGE-L scores against analyst-written reference summaries, supplemented by faithfulness scores (what percentage of generated sentences are classified as ENTAILMENT by an NLI model relative to the source) and analyst preference ratings. ROUGE scores alone are insufficient for intelligence summarization evaluation because they measure lexical overlap without testing whether generated text contains unsupported claims.

Automatic report classification and routing

Incoming intelligence reports must be classified along two dimensions before entering analyst queues: intelligence discipline (what type of source produced this report?) and urgency (how quickly does it require action?). Automatic classification enables intelligent routing: FLASH-priority SIGINT intercepts route directly to the watch officer's screen; routine HUMINT cables route to the appropriate analyst's queue; IMINT products route to the imagery exploitation team. Without automatic classification, routing depends on human reading of report headers — which is both slow and prone to error when volume is high.

Intelligence discipline classification assigns reports to categories: HUMINT (human source reporting), SIGINT (signals intelligence), IMINT (imagery intelligence), MASINT (measurement and signature intelligence), and OSINT (open-source intelligence). Each discipline has characteristic vocabulary, structure, and metadata. HUMINT cables contain source-handling language ("source with access to…", "credibility assessed as…"), meeting narratives, and assessed reliability ratings. SIGINT reports contain emitter metadata (frequency, bearing, identifier), intercept text or technical parameters, and traffic-analysis products. IMINT reports reference sensor platforms, resolution, collection time, and contain structured imagery annotation. A fine-tuned DeBERTa text classifier achieves F1 above 0.93 on this five-class task with 3,000–5,000 labeled examples, because the vocabulary of each discipline is highly distinctive — even truncated to the first 512 tokens, discipline classification is rarely ambiguous.

Urgency classification assigns reports to priority tiers: FLASH (act immediately), IMMEDIATE (act within the hour), PRIORITY (act within the day), and ROUTINE (process within 48 hours). This classification is harder than discipline classification because urgency depends on semantic content — the significance of the reported activity — rather than structural vocabulary. Temporal proximity markers (tonight, at H-hour, within the next two hours), threat category indicators (force massing, air defense activation, command-post movement), and location proximity to current operations all contribute to urgency assessment. A separate fine-tuned urgency classifier using the full report body achieves F1 of 0.82–0.87 across tiers, with FLASH recall being the most critical metric — a missed FLASH classification has operational consequences that a false positive does not.

Routing rules integrate the classifier outputs with organizational structure. An intelligence management system maps (discipline, urgency, geographic area of interest, topic keyword) tuples to specific analyst queue assignments. A PRIORITY-urgency SIGINT report mentioning a specific emitter type routes to the SIGINT analyst with that emitter coverage assignment; an IMMEDIATE-urgency HUMINT cable about force movements in a specific grid square routes to the all-source analyst assigned that geographic sector. Routing rules are maintained by the G2/J2 staff and updated without model retraining, since they are applied as post-processing logic on top of classifier outputs.

Deployment in classified environments

The deployment requirements for NLP systems processing classified intelligence text are fundamentally different from those for commercial NLP applications. Classified documents cannot be transmitted to cloud API endpoints. Inference must occur entirely within the accredited network boundary. Model updates must enter the system through a controlled pipeline with security review. These requirements constrain technology choices and architecture in ways that significantly affect system design.

On-premise inference infrastructure for classified NLP runs ONNX Runtime or TensorRT locally on servers within the accredited environment. Transformer encoder models (DeBERTa-base, RoBERTa-base) export cleanly to ONNX with dynamic batching support; the ONNX Runtime inference session runs entirely from local model files with no external calls. For GPU-accelerated inference on a server with NVIDIA T4 or A100 GPUs, TensorRT provides higher throughput through layer fusion and precision reduction. A production NER + relation + classification pipeline on a single A100 GPU handles 200–400 documents per minute at DeBERTa-base scale — sufficient for the throughput requirements of a brigade-level intelligence cell without requiring GPU clustering.

Classification marking detection must run before any document enters the NLP pipeline. A regex-based classifier identifies the document's overall classification marking from the banner line and portion markings from paragraph prefixes. The detected classification determines which inference endpoint is authorized to process the document: unclassified documents can be processed on a lower-accreditation server; classified documents must route to the appropriately accredited system. Portion marking detection enables processing of mixed-classification documents with appropriate controls: classified portions are withheld from outputs that cross to lower-accreditation systems.

PII and source protection detection adds a further filtering layer before any NLP output is logged or transmitted across system boundaries. Intelligence documents often contain source-identifying information (case officers' operational pseudonyms, contact methods, source access descriptors) that must be redacted from logs and summaries that cross compartment boundaries. A PII/sensitive-field detector — itself an NER model fine-tuned on annotated examples of protected source language — flags these spans before the summarization step so they are not included in generated summaries.

Air-gapped model update pipeline is required because deployed models need to be updated as new report corpora become available, analyst feedback accumulates, and domain vocabulary evolves. In an air-gapped environment, updated model weights are delivered on encrypted removable media, verified against a SHA-256 hash maintained in a model registry, evaluated automatically on a held-out validation set, and submitted for operational approval before deployment. The approval step may be automated (accept if F1 does not regress by more than 0.02 from the baseline) or require human signoff depending on the classification level and operational sensitivity of the system. Previous model versions are retained with their evaluation records for rollback, and every inference is logged with the model version that produced it — enabling post-hoc analysis of any incident attributed to model behavior.

The NLP pipeline described here integrates naturally with computer vision defense systems in a joint all-source processing architecture where structured data from imagery exploitation reports feeds the same entity database that text NLP populates, and the combined structured data drives the common operational picture. The technical foundation — transformer fine-tuning, ONNX deployment, structured output schemas, and immutable audit logging — is identical across both modalities.

Discuss Your Project

We build NLP pipelines for defense intelligence processing — fine-tuned NER, relation and event extraction, extractive and abstractive summarization, and classification systems deployable in air-gapped classified environments integrated with Corvus Sense and Corvus Quantum platforms.

Edge AI Development → Corvus Sense →

This analysis was prepared by Corvus Intelligence engineers who build mission-critical software for defense and government organizations. Learn about our team →

Frequently Asked Questions

What is named entity recognition and why does it matter for military intelligence reports?

Named entity recognition (NER) is an NLP technique that automatically identifies and classifies structured information — people, locations, organizations, dates, and equipment — within unstructured text. In military intelligence reports, NER extracts operationally significant entities from prose narratives: unit designators, geographic coordinates, equipment types, commanders' names, and event dates. Rather than an analyst manually scanning a 3,000-word HUMINT cable for these data points, a fine-tuned NER model extracts them in milliseconds with high recall. The extracted entities feed directly into databases, order-of-battle tracking systems, and situation displays, eliminating manual data entry and reducing transcription errors. Military NER must handle domain-specific terminology — military phonetic alphabets, grid references, equipment designators — that general-purpose NER models trained on news corpora do not recognize.

How is NER fine-tuned for military domain text?

General-purpose transformer NER models (BERT, RoBERTa, DeBERTa) are pre-trained on news and Wikipedia text that shares vocabulary with military reporting but lacks domain-specific entity types. Fine-tuning for military NER requires a labeled training corpus of annotated military reports — ideally 10,000–20,000 sentences with entity spans marked — covering the target entity types: UNIT, EQUIPMENT, LOCATION, PERSON, EVENT, DATE, and GRID. The pre-trained model's encoder weights are retained and updated during fine-tuning at a low learning rate (2e-5 to 5e-5), with only the token classification head trained from scratch. Active learning, where the model flags its lowest-confidence predictions for analyst review, dramatically reduces annotation cost — typically 30–40% fewer labeled sentences needed to reach target F1.

What is relation extraction and how does it differ from NER in intelligence processing?

NER identifies entity spans in text; relation extraction identifies semantic relationships between those entities. In military reporting, a relation might be (Unit-A, ATTACKED, Grid-4417) or (Commander-X, COMMANDS, Battalion-Y). Relation extraction is more complex than NER because it requires understanding sentence context spanning the subject, predicate, and object — which may not be adjacent in the text. Transformer models encode the full sentence and attend to both entity spans simultaneously, with a classification head predicting the relation type. Distant supervision is commonly used when manual annotation is expensive: entity pairs that appear together in a structured database (order of battle, known affiliations) are automatically labeled as related in sentences where both co-occur, generating noisy but large-scale training data that supplements small manually annotated sets.

What are the main event types extracted from military reports?

Military event extraction focuses on a taxonomy of operationally relevant event types: ATTACK (kinetic engagement between forces), MOVEMENT (unit repositioning, convoy activity, force concentration), OBSERVATION (ISR sighting of enemy forces or equipment), LOGISTICS (resupply, fuel, ammunition activity), COMMAND-ACTIVITY (headquarters movement, commander meetings, communications), and DECEPTION (activity inconsistent with established patterns suggesting concealment). Each event type has associated argument roles — for an ATTACK event: Attacker, Target, Location, Time, Weapon, and Outcome. Event extraction models must identify both the trigger word and the argument spans that fill each role. Events expressed across multiple sentences require additional cross-sentence coreference resolution to correctly attribute arguments that appear in adjacent sentences.

What is the difference between extractive and abstractive summarization for intelligence?

Extractive summarization selects and concatenates the most informative sentences directly from the source document; the output contains only original text, which makes it highly faithful and easy to verify but sometimes awkward in flow. BERT-based extractive models score each sentence by relevance and select the top-K sentences, often using a coverage constraint to prevent redundancy. Abstractive summarization generates new text that paraphrases and synthesizes source content, producing more fluent and compact summaries but with a risk of hallucination — generated statements not present in the source. For intelligence products where fidelity to source is paramount, hybrid approaches are preferred: extractive selection of key sentences followed by light abstractive compression that stays within tight paraphrase distance of the source, with generated text flagged differently from verbatim-extracted text.

How are intelligence reports classified into HUMINT, SIGINT, and IMINT categories automatically?

Automatic intelligence discipline classification uses a text classifier trained on labeled report headers, stylistic features, and content vocabulary. HUMINT reports contain source-handling language, meeting narratives, and assessed credibility fields. SIGINT reports contain emitter and intercept metadata, technical parameter language, and frequency or callsign references. IMINT reports reference sensor platforms, resolution, cloud cover, and imagery annotation terminology. A fine-tuned DeBERTa classifier achieves F1 above 0.93 on this task with a corpus of a few thousand labeled examples, because discipline-specific vocabulary is highly distinctive. Urgency classification — FLASH, IMMEDIATE, PRIORITY, ROUTINE — is a separate classifier that operates on the report body and looks for time-sensitive language and temporal proximity markers relative to reported activity.

Why must NLP models for classified intelligence run on-premise rather than in the cloud?

Classified intelligence text cannot be transmitted to commercial cloud API endpoints, regardless of encryption in transit, because classification authority requirements prohibit processing classified information on infrastructure not accredited to the appropriate classification level. NLP inference for classified reports must run entirely within the accredited environment — on-premise servers, SCIF-internal networks, or air-gapped tactical systems. This means models must be deployed using local inference runtimes (Hugging Face Transformers with a local model path, ONNX Runtime, TensorRT for GPU-accelerated inference) and updated through a controlled model import pipeline that includes hash verification of model weights and behavioral review before deployment into the classified environment.

What is event coreference resolution and why is it hard in military text?

Event coreference resolution is the task of determining that event mentions in different sentences or different documents refer to the same real-world event. In military reporting, the same engagement may be described in a HUMINT source report, a SIGINT intercept from the aftermath, and an IMINT assessment of the site — each using different entity references and temporal expressions. Resolving that these three document passages describe the same event requires matching on location, time, and event type. This is hard in military text because unit references use aliases and phonetic designations that vary between sources, grid reference systems may differ (MGRS vs decimal degrees), and reporting delays mean temporal expressions do not directly correspond to event time.

How does distant supervision reduce annotation cost for military relation extraction?

Distant supervision assumes that if two entities are known to be related in a structured database, then sentences in a text corpus that mention both entities likely express that relation. For military NLP, a known order-of-battle database lists unit-equipment associations, command hierarchies, and location assignments. Distant supervision automatically labels sentences from report corpora where both entities co-occur as positive examples of the relation, without manual annotation of each sentence. This generates a large noisy training set at low cost. The noise is managed through multi-instance learning, which trains on bags of sentences rather than individual sentences, reducing the effect of individual false labels. In practice, distant supervision with 50,000 auto-labeled sentences and 2,000 manually annotated corrections outperforms pure manual annotation of 5,000 sentences.

What classification marking detection is needed for NLP processing of military text?

Before any NLP processing of a military document, the system must detect and respect the document's classification markings — both the overall document classification and any portion markings on individual paragraphs. Classification marking detection uses regex-pattern matching for standard banner lines (SECRET/NOFORN, TOP SECRET//SCI, UNCLASSIFIED//FOUO) and paragraph portion marks. The detected classification determines which inference endpoint — and thus which accredited system — is permitted to process the document. Portion marking detection enables selective processing: a mixed-classification document can have its unclassified portions processed by a lower-accreditation system while classified portions are held for the appropriate higher-accreditation pipeline. PII detection adds an additional filtering layer before any output is logged or transmitted across system boundaries.