Privacy Parser Flips OpenAI's Privacy Filter to Expose Personal Data

Every defensive tool has an offensive shadow. A developer just made that shadow explicit for OpenAI's PII scrubber, releasing Privacy Parser, a project that runs the same 1.5B checkpoint OpenAI shipped for redaction and flips the output. Rather than replacing names and account numbers with <REDACTED> tags, it returns them as structured spans with labels and character offsets. Same weights, same taxonomy, opposite intent.

OpenAI's Privacy Filter was pitched as a data sanitization tool. The model carries 1.5B total parameters but only 50M active at inference, thanks to a sparse MoE feed-forward design with 128 experts and top-4 routing per token, making it lightweight enough to run in a browser or on a laptop. Privacy Parser keeps that architecture untouched and just reads its outputs differently.

Flipping the mask into a map

The original model does token classification, not text generation. Privacy Filter is pretrained autoregressively to a checkpoint similar to gpt-oss, then converted into a bidirectional token classifier and post-trained with supervised classification loss. Rather than generating text, it labels an input sequence in a single forward pass and decodes coherent spans using a constrained Viterbi procedure. For each token the model outputs a probability distribution over an 8-class privacy taxonomy.

That taxonomy is what makes the inversion trivial. Privacy Filter was already emitting labeled spans internally, then masking them on the way out. Privacy Parser skips the masking step and hands you the spans directly, with the label attached. The categories are the same eight OpenAI ships: