---
title: "Privacy Parser Flips OpenAI's Privacy Filter to Expose Personal Data"
subtitle: "A developer inverted OpenAI's Privacy Filter to extract structured PII spans from any text pile, using the same 1.5B weights and taxonomy."
url: "https://alphasignal.ai/news/privacy-parser-flips-openai-s-privacy-filter-to-expose-personal-data"
author: "AlphaSignal Newsroom"
author_url: "https://alphasignal.ai/editorial-team"
company: "AlphaSignal"
company_url: "https://alphasignal.ai/company/alphasignal"
published: "2026-04-23T16:48:36.000Z"
updated: "2026-08-22T07:45:19.622Z"
type: "Repo"
topics:
  - "Security"
  - "Open Source"
subtopics:
  - "Red Teaming"
  - "Prompt Injection"
upvotes: 1990
source_url: "https://github.com/chiefautism/privacy-parser"
comments: 0
truncated: true
---

# Privacy Parser Flips OpenAI's Privacy Filter to Expose Personal Data

> A developer inverted OpenAI's Privacy Filter to extract structured PII spans from any text pile, using the same 1.5B weights and taxonomy.

Every defensive tool has an offensive shadow. A developer just made that shadow explicit for OpenAI's PII scrubber, releasing [Privacy Parser](https://github.com/chiefautism/privacy-parser), a project that runs the same 1.5B checkpoint OpenAI shipped for redaction and flips the output. Rather than replacing names and account numbers with `<REDACTED>` tags, it returns them as structured spans with labels and character offsets. Same weights, same taxonomy, opposite intent.

OpenAI's [Privacy Filter](https://openai.com/index/introducing-openai-privacy-filter/) was pitched as a data sanitization tool. The model carries 1.5B total parameters but only 50M active at inference, thanks to a sparse MoE feed-forward design with 128 experts and top-4 routing per token, making it lightweight enough to run in a browser or on a laptop. Privacy Parser keeps that architecture untouched and just reads its outputs differently.

## Flipping the mask into a map

The original model does token classification, not text generation. Privacy Filter is pretrained autoregressively to a checkpoint similar to gpt-oss, then converted into a bidirectional token classifier and post-trained with supervised classification loss. Rather than generating text, it labels an input sequence in a single forward pass and decodes coherent spans using a constrained Viterbi procedure. For each token the model outputs a probability distribution over an 8-class privacy taxonomy.

That taxonomy is what makes the inversion trivial. Privacy Filter was already emitting labeled spans internally, then masking them on the way out. Privacy Parser skips the masking step and hands you the spans directly, with the label attached. The categories are the same eight OpenAI ships:

_Preview only. Full text requires an AlphaSignal Pro account._

## Sources

- [chiefautism/privacy-parser](https://github.com/chiefautism/privacy-parser)
- [Introducing OpenAI Privacy Filter](https://openai.com/index/introducing-openai-privacy-filter/)
- [OpenAI Releases Privacy Filter (MarkTechPost)](https://www.marktechpost.com/2026/04/28/openai-releases-privacy-filter-a-1-5b-parameter-open-source-pii-redaction-model-with-50m-active-parameters/)
- [OpenAI Open-Sources Privacy Filter (HackerNoon)](https://hackernoon.com/openai-open-sources-privacy-filter-a-tiny-model-that-scrubs-pii-without-an-api-call)
- [openai/privacy-filter on Hugging Face](https://huggingface.co/openai/privacy-filter)