OpenAI released Privacy Filter, an open-weight model for detecting and redacting personally identifiable information in text. It scores 97.43% F1 on the PII-Masking-300k benchmark (corrected for annotation issues), with 96.79% precision and 98.08% recall. OpenAI already runs a fine-tuned version of it internally in their own privacy workflows.
The model has 1.5B total parameters but only 50M active parameters, and it runs locally — meaning unfiltered data never has to leave the machine. It supports up to 128,000 tokens of context and processes inputs in a single forward pass using a constrained Viterbi decoder. That architecture makes it fast enough for high-throughput pipelines like training data preprocessing, logging, and document indexing.
Privacy Filter covers eight label categories: private_person, private_address, private_email, private_phone, private_url, private_date, account_number, and secret. That last category is notable — it’s designed to catch passwords and API keys, not just contact info. The model distinguishes between public figures (whose names shouldn’t be masked) and private individuals (whose names should), which is where rule-based tools typically fail.
TIP
Fine-tuning on a small domain-specific dataset moves the needle fast. OpenAI’s own evaluation showed F1 jumping from 54% to 96% on a domain-adaptation benchmark with minimal fine-tuning data.
OpenAI is explicit that this is not a compliance tool or anonymization guarantee — it’s infrastructure. For developers building RAG pipelines, logging systems, or any workflow that touches user-generated text, it’s a practical drop-in for PII scrubbing that doesn’t require sending data to an external API. The model is open-weight and fine-tunable, so teams with specific redaction policies can adapt it without starting from scratch.