OpenAI's Privacy Filter Brings On-Device PII Redaction at 97% Accuracy
OpenAI released a 1.5B-parameter open-weight token classifier that detects and redacts PII locally, scoring 96% F1 with a 128K context window.
PRO- OpenAI open-sourced Privacy Filter, a 1.5B-parameter bidirectional token classifier for PII detection under Apache 2.0.
- Only 50M parameters are active per token via mixture-of-experts, enabling browser and laptop inference.
- Supports a 128,000-token context window using banded attention, no chunking required.
- Detects 8 categories: names, addresses, emails, phones, URLs, dates, account numbers, and secrets.
- Scores 96% F1 on PII-Masking-300k out of the box, 97.43% on a corrected version.
- Built by converting a
gpt-oss-style autoregressive checkpoint into a token classifier with Viterbi decoding.
OpenAI shipped something unusual for it: a small, open-weight, on-device model with no chat interface. Privacy Filter is a bidirectional token classifier that finds and masks personally identifiable information in text before it ever leaves your machine, released under Apache 2.0 on both Hugging Face and GitHub.
People paste personal data into ChatGPT and similar tools constantly, and OpenAI says it uses a fine-tuned version of this model in its own privacy-preserving workflows. Regex sweeps miss context, cloud-hosted redaction services require handing raw data to a third party, and existing NER models tend to be either too narrow or too large to run at the edge. Privacy Filter targets that gap.
What the model tags
Privacy Filter labels every token in an input sequence with one of eight sensitive-data categories, or marks it as background. The account_number class covers credit cards and bank accounts, while secret catches passwords, API keys, and tokens. The full taxonomy:
private_person- namesprivate_address- physical addressesprivate_email- email addressesprivate_phone- phone numbersprivate_url- URLsprivate_date- dates tied to a personaccount_number- credit cards, bank accountssecret- passwords, API keys, tokens
Each category is expanded with BIOES boundary tags (Begin, Inside, End, Single), giving 33 total per-token classes. Rather than taking an independent argmax per token, the model runs a constrained Viterbi decode over the whole sequence so spans stay coherent even in messy, mixed-format text.
An encoder grown from a decoder
Privacy Filter did not start as a fresh masked-language model. According to the official repo
This story is for Pro members
You've reached the end of the free preview. Upgrade to AlphaSignal Pro to read the full article - and everything else behind the paywall.
Comments
