PII redaction that runs on your machine: meet OpenAI Privacy Filter!

Hey everyone, I'm Shiichan! Today I found a fun little announcement about privacy: a small new model built to keep personal data on your device.

OpenAI News openai.com

What was announced?

From OpenAI's News comes a new model called OpenAI Privacy Filter! It's an open-weight model for detecting and redacting personally identifiable information (PII) in text, masking or removing it. And even though it's small, its detection ability is frontier-level, which is pretty amazing.

OpenAI says it uses a fine-tuned version of Privacy Filter in its own privacy-preserving workflows. They built it because they believe that with the latest AI capabilities, they could raise the standard for privacy beyond what was already on the market.

Why it matters

Traditional PII detection tools often relied on deterministic rules for fixed formats like phone numbers and email addresses. Those work well for narrow cases, but they tend to miss more subtle personal information and struggle with context.

Privacy Filter is built with deeper language and context awareness, so it can catch a wider range of PII in unstructured text, even cases where the right call depends on context. It also tries to tell apart information that should be kept because it is public from information about a private individual that should be masked.

The key part: because it's small, it can run locally. Data that hasn't been filtered yet can stay on your device instead of being sent to a server for de-identification, which lowers the risk of exposure.

What changes

Developers can run Privacy Filter directly in their own environments and fine-tune it to their own use cases. You can build stronger privacy protection into training, indexing, logging, and review pipelines.

It ships under the Apache 2.0 license, so experimentation, customization, and commercial deployment are all fine. I love that privacy infrastructure is being shared in a form you can run, adapt, and improve.

Dive Deep

Let's look under the hood. Privacy Filter is a bidirectional token-classification model with span decoding. It starts from an autoregressive pretrained checkpoint and is adapted into a token classifier over a fixed taxonomy of privacy labels. Instead of generating text token by token, it labels the input sequence in a single pass and then decodes coherent spans with a constrained Viterbi procedure.

That design gives it some handy properties:

• Fast and efficient: all tokens are labeled in one forward pass
• Context aware: the language prior lets PII spans be detected from surrounding context
• Long-context: it supports up to 128,000 tokens
• Configurable: you can tune the operating point to trade off recall and precision

Size-wise, it has 1.5B total parameters with 50M active parameters. It predicts spans across eight categories: private_person / private_address / private_email / private_phone / private_url / private_date / account_number / secret. The account_number label masks many kinds of account numbers like credit card and bank account numbers, while secret masks things like passwords and API keys. Labels are decoded with BIOES span tags so masking boundaries come out clean.

Performance is strong too. On the PII-Masking-300k benchmark it reaches an F1 of 96% (94.04% precision, 98.04% recall). On a corrected version that accounts for annotation issues found during review, F1 climbs to 97.43% (96.79% precision, 98.08% recall). Fine-tuning on even a small amount of data quickly boosts domain-specific accuracy, raising F1 from 54% to 96%. Secret detection in codebases and stress tests across multilingual, adversarial, and context-dependent examples are detailed in the model card.

A few caveats, though. Privacy Filter is not an anonymization tool, a compliance certification, or a substitute for policy review in high-stakes settings; it's one component in a broader privacy-by-design system. With short sequences it can over- or under-redact when context is limited, and OpenAI clearly notes that in high-sensitivity domains like legal, medical, and financial workflows, human review plus domain evaluation and fine-tuning still matter.

The model is available today under Apache 2.0 on Hugging Face and GitHub.

Wrap-up

• OpenAI released Privacy Filter, an open-weight small model that detects and redacts PII in text
• It's a bidirectional token classifier with span decoding: 1.5B total / 50M active parameters and up to 128,000 tokens of context
• It detects eight PII categories with context, and runs locally so data can stay on your device
• It scores F1 96% on PII-Masking-300k (97.43% corrected) and is available under Apache 2.0 on Hugging Face / GitHub
• A great fit for developers who want to bake privacy protection into their own pipelines and teams that need to handle PII locally