← Back to feed

OpenAI released Privacy Filter on April 22 under the Apache 2.0 license — available immediately on Hugging Face and GitHub. The model detects and redacts personally identifiable information in text, runs locally without a network connection, and processes long documents in a single forward pass.

Specs

• Parameters: 1.5B total, 50M active
• Context: 128,000 tokens
• Benchmark: 97.43% F1 on corrected PII-Masking-300k (96.79% precision, 98.08% recall)
• Architecture: Bidirectional token classifier with span decoding via constrained Viterbi procedure; starts from an autoregressive pretrained checkpoint

The model labels an input sequence in one pass rather than generating token by token, making it significantly faster than inference-based redaction approaches for high-throughput workflows.

What It Detects

Eight PII categories: names, addresses, email addresses, phone numbers, URLs, dates, account numbers, and secrets including passwords and API keys. Detection is context-aware rather than regex-based — the model uses surrounding text to distinguish, for example, a date in a scheduling context from a date of birth in a medical record.

Intended Use

OpenAI says it uses a fine-tuned version of Privacy Filter internally for its own privacy-preserving workflows. The public release targets three primary use cases: scrubbing training data before it enters model pipelines, sanitising logs and monitoring outputs, and pre-processing user inputs before they reach more capable models.

The local-execution design is the key differentiator. PII masking is completed on the user’s machine; the redacted version is the only thing that travels downstream. OpenAI framed the release as infrastructure for AI safety — making it easier for developers to build privacy protections in from the start rather than bolting them on.

Limitations

OpenAI was explicit: Privacy Filter is not an anonymisation tool, not a compliance certification, and not a substitute for policy review. At 97.4% F1, roughly one in 40 sensitive spans will be missed or over-redacted. Performance is uneven across languages and degrades on unusual identifiers. The benchmark result uses a corrected version of PII-Masking-300k after OpenAI identified annotation issues in the original dataset; the raw benchmark score is 96% F1.

Competitive Context

The release stakes out territory that has been occupied by smaller specialised players — Presidio (Microsoft, open-source), Amazon Comprehend (managed), and various regex-based scanners. Privacy Filter’s combination of 128K context, single-pass speed, local execution, and Apache 2.0 licensing puts it ahead of most open alternatives on practical deployment criteria. The 1.5B parameter count keeps it runnable on consumer hardware without GPU acceleration.

The timing is notable. The same week OpenAI launched Privacy Filter, the company also published data showing LLMs de-anonymise users at a 68% match rate from writing style alone — a finding that underscores how far redaction alone falls short of true anonymisation, and which Privacy Filter’s own documentation acknowledges by stating it explicitly is not an anonymisation tool.