OpenAI Introduces Privacy Filter

OpenAI has released Privacy Filter. It is an open-weight model that detects and masks personally identifiable information (PII) in text, and it can run in local environments so that data doesn't need to leave the server.

This model is designed for high-throughput privacy workflows that process long inputs quickly, and it identifies sensitive information within unstructured text in one pass while reflecting context. OpenAI stated that it also uses a fine-tuned version of this model in its own privacy-preserving workflows.

The core specifications are as follows.

• 1.5B total parameters, 50M active parameters
• long-context support of up to 128,000 tokens
• bidirectional token-classification + constrained Viterbi span decoding
• BIOES span tags that produce cleaner masking boundaries

There are a total of 8 detection categories.

• private_person
• private_address
• private_email
• private_phone
• private_url
• private_date
• account_number
• secret

In particular, account_number helps mask various account numbers such as credit cards or bank accounts, while secret helps mask sensitive information such as passwords and API keys. Unlike simple rule-based tools, it looks at context together and focuses on distinguishing public information from private personal information.

In terms of performance, it achieved F1 96% on the PII-Masking-300k benchmark, and in a corrected version reflecting annotation issues confirmed by the authors, it rose to F1 97.43%. Precision and recall were 94.04%/98.04% respectively, and 96.79%/98.08% in the corrected version.

The training process can be summarized in three stages.

• First designing a privacy taxonomy to define the detection categories
• Converting a pretrained language model into a token-classifier and post-training with a supervised objective
• Training on a mix of public data and synthetic data, with missing labels supplemented through model-assisted annotation and review

Also, fine-tuning showed large effects even with a small amount of domain data. On a domain-adaptation benchmark, it improved from F1 54% → 96%, and performance quickly approached saturation.

However, this model is neither an anonymization tool nor a compliance certification, and it does not replace policy review in high-risk environments. Performance can vary depending on language, script, naming conventions, and domain, and over-masking/under-masking can also occur in short contexts.

In terms of deployment, it was released under the Apache 2.0 license on Hugging Face and GitHub. OpenAI explained that it can be used for experimentation, customization, and commercial deployment, and it was provided together with the architecture, label taxonomy, decoding controls, evaluation setup, and known limitations.