On April 22, 2026, OpenAI announced the Privacy Filter and posted its weights on Hugging Face under Apache 2.0. It is a token-classification model that detects and masks personally identifiable information in text, aimed at high-throughput, on-premises data sanitization workflows, with inference and deployment code open-sourced on GitHub.
Why it matters: filtering sensitive data locally before it ever reaches an external API is a hard prerequisite for many enterprise LLM deployments. That slot has usually been filled by regex rules or generic NER models; OpenAI has now shipped an open-source option that runs in your own data center — or in the browser — and stated its positioning plainly: it is an aid, not a compliance guarantee.
What the Privacy Filter Is
The model is a bidirectional token classifier: raw text goes in, and per-token logits over 33 classes come out — 8 PII categories (account numbers, private addresses, private emails, person names, phone numbers, private URLs, dates, and secrets), each with BIOES tags, plus a single background class. An entire sequence is labeled in one forward pass, and a constrained Viterbi decoder with transition biases then shapes the discrete tags into coherent, legal spans. Runtime parameters let teams trade precision against recall and tune span length to their pipeline.
A 1.5B-Parameter MoE With 50M Active
The architecture has a twist. The base checkpoint was pretrained autoregressively (structurally similar to a smaller gpt-oss), then converted into a bidirectional classifier with supervised post-training. The specs: 1.5B total parameters but only 50M active per token — a sparse MoE that routes each token to 4 of 128 experts. The stack runs d_model 640, 8 transformer blocks, 14 query heads and 2 KV heads (group size 7), rotary embeddings, and banded attention with a band size of 128 for an effective window of 257 tokens including self. Context length is 128K, and the safetensors weights ship at roughly 2.8 GB, with community quantizations available.
One Forward Pass, Viterbi-Decoded Labels
The most interesting design choice is that detection and policy are split into separate layers. The model only emits a per-token distribution; span formation belongs to the Viterbi decoder, where background-persistence, span-entry, span-continuation, and boundary-handoff biases constrain the output to well-formed label sequences. One set of weights can therefore behave differently per workload — recall-first for coarse screening pipelines, precision-first for automatic masking — without any retraining.
Where It Runs: Browser to SageMaker
Deployment surface is unusually wide. In Transformers it loads with a one-line pipeline; Transformers.js runs it directly in the browser on WebGPU with q4 quantization — the official demo tags “Harry Potter” as private_person (confidence ~0.999996) and an email address as private_email (~0.999999). ONNX and SageMaker deployments are supported as well, and a hosted demo Space on Hugging Face lets you paste text and inspect the output.
Positioning and Limits: an Aid, Not a Guarantee
The model card is refreshingly blunt about limits: this is “a redaction and data minimization aid, not an anonymization, compliance, or a safety guarantee.” The label policy is static — changing what gets tagged requires finetuning, not configuration. Known failure modes include missing uncommon names and regional writing conventions, and over-redacting public entities or benign high-entropy strings. Medical, legal, financial, HR, education, and government use cases are explicitly told to keep a human in the loop. In other words, the model can raise a flag, but the accountability for what ships still sits with the team that deployed it.
What It Means for Engineering Teams
Three practical takeaways. First, PII filtering now has a self-hostable open-source baseline, so the first gate before data leaves the premises can live in your own rack — or in the user’s browser. Second, with 50M active parameters, inference is cheap enough to sit on the hot path of a high-throughput scanning pipeline, and the 128K context window means long documents do not need chunking gymnastics. Third, the interface design is worth copying — splitting detection from decision-making and exposing behavior through decoder parameters is a sturdier engineering pattern than promising one model that does everything.
Sources
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.