OpenAI just released a new model designed to find and redact your personal information from text before it ever leaves your computer. It's called OpenAI Privacy Filter, and it's a small, specialized model for detecting and masking personally identifiable information (PII). The key feature? It runs locally, so you don't have to send raw documents to an external server. It's available now under the Apache 2.0 license on GitHub and Hugging Face.
Introducing OpenAI Privacy Filter | OpenAI
OpenAI-Privacy-Filter-Model-Card.pdf
The filter targets eight categories of sensitive info: names, addresses, email addresses, phone numbers, URLs, dates, account numbers, and confidential items like passwords and API keys.
Under the hood, it's based on a pre-trained autoregressive model that's been converted into a bidirectional token classification model. Instead of generating text token by token, it labels the entire input in a single inference pass. It then uses BIOES tags for named entities and constrained Viterbi decoding to clean up contiguous redaction ranges. This lets it handle long documents quickly and work with a context window of up to 128,000 tokens. The total model size is 1.5 billion parameters, but only 50 million are active at runtime.
Traditional PII detection tools are good at spotting structured formats like phone numbers and emails, but they often miss context-dependent or ambiguous cases. OpenAI Privacy Filter is designed to combine language understanding with contextual awareness, aiming to better distinguish between information that's okay to leave public and private details that should be hidden.
On performance, it scored a 96% F1 score (balancing missed detections and false positives) on the PII-Masking-300k benchmark, with 94.04% precision and 98.04% recall. In a version where OpenAI corrected annotation issues, the F1 score reached 97.43%, with 96.79% precision and 98.08% recall. It was also tested on CredData for detecting credentials in codebases, where the corrected version achieved an 84.4% token-level F1 score.
On the SPY dataset, which simulates legal and medical consultations, the model's F1 score jumped from 54.5% before fine-tuning to 96.2% after training on just 10% of the data. OpenAI highlights this as evidence of how easy it is to fine-tune for specific domain policies.
OpenAI also conducted language-specific evaluations. On PII-Masking-300k, it reported results for English, Dutch, French, German, Italian, and Spanish. In an additional multilingual synthetic evaluation, it was tested on Japanese, Chinese, Korean, Hindi, Arabic, and Russian. For Japanese, it showed 86.6% recall, 89.7% precision, and an 88.1% F1 score.
However, OpenAI Privacy Filter isn't being pitched as a fully multilingual model. The model card states its primary language is English. OpenAI cautions that "performance may degrade on non-English text, non-Latin scripts, or notations that differ from the training distribution."
OpenAI also makes it clear that you shouldn't treat this tool as a guarantee of anonymization or regulatory compliance. The Privacy Filter is just one component of privacy protection. Organizations with different masking policies may need to fine-tune it, and performance can drop for non-English languages or out-of-distribution text. In high-risk fields like healthcare, legal, finance, or government, OpenAI says you should still keep human review in the loop. This release comes as OpenAI continues to expand its toolkit, following recent updates like ChatGPT Images 2.0 and milestones for its coding assistant, Codex.