---
title: "OpenAI's Privacy Filter Brings On-Device PII Redaction at 97% Accuracy"
subtitle: "OpenAI released a 1.5B-parameter open-weight token classifier that detects and redacts PII locally, scoring 96% F1 with a 128K context window."
url: "https://alphasignal.ai/news/openai-s-privacy-filter-brings-on-device-pii-redaction-at-97-accuracy"
author: "AlphaSignal Newsroom"
author_url: "https://alphasignal.ai/editorial-team"
company: "OpenAI"
company_url: "https://alphasignal.ai/company/openai"
published: "2026-04-17T21:38:35.000Z"
updated: "2026-08-22T02:17:15.291Z"
type: "Model"
topics:
  - "Security"
  - "Open Source"
subtopics:
  - "Content Moderation"
upvotes: 193
source_url: "https://huggingface.co/openai/privacy-filter"
comments: 0
truncated: true
---

# OpenAI's Privacy Filter Brings On-Device PII Redaction at 97% Accuracy

> OpenAI released a 1.5B-parameter open-weight token classifier that detects and redacts PII locally, scoring 96% F1 with a 128K context window.

OpenAI shipped something unusual for it: a small, open-weight, on-device model with no chat interface. [Privacy Filter](https://huggingface.co/openai/privacy-filter) is a bidirectional token classifier that finds and masks personally identifiable information in text before it ever leaves your machine, released under Apache 2.0 on both Hugging Face and GitHub.

People paste personal data into ChatGPT and similar tools constantly, and OpenAI says it uses a fine-tuned version of this model in its own privacy-preserving workflows. Regex sweeps miss context, cloud-hosted redaction services require handing raw data to a third party, and existing NER models tend to be either too narrow or too large to run at the edge. Privacy Filter targets that gap.

## What the model tags

Privacy Filter labels every token in an input sequence with one of eight sensitive-data categories, or marks it as background. The `account_number` class covers credit cards and bank accounts, while `secret` catches passwords, API keys, and tokens. The full taxonomy:

* `private_person` \- names
* `private_address` \- physical addresses
* `private_email` \- email addresses
* `private_phone` \- phone numbers
* `private_url` \- URLs
* `private_date` \- dates tied to a person
* `account_number` \- credit cards, bank accounts
* `secret` \- passwords, API keys, tokens

Each category is expanded with BIOES boundary tags (Begin, Inside, End, Single), giving 33 total per-token classes. Rather than taking an independent argmax per token, the model runs a constrained Viterbi decode over the whole sequence so spans stay coherent even in messy, mixed-format text.

## An encoder grown from a decoder

Privacy Filter did not start as a fresh masked-language model. According to the [official repo](https://github.com/openai/privacy-filter)

_Preview only. Full text requires an AlphaSignal Pro account._

## Sources

- [openai/privacy-filter on Hugging Face](https://huggingface.co/openai/privacy-filter)
- [OpenAI Privacy Filter GitHub Repository](https://github.com/openai/privacy-filter)
- [Introducing OpenAI Privacy Filter](https://openai.com/index/introducing-openai-privacy-filter/)
- [OpenAI Just Open-Sourced a Tool That Scrubs Your Secrets](https://decrypt.co/365139/openai-privacy-filter-open-source-pii-masking-model)
- [OpenAI tackles a bad habit people have when interacting with AI](https://www.helpnetsecurity.com/2026/04/23/openai-privacy-filter-personally-identifiable-information/)