Summary: Privacy Filter landed on April 22, 2026, when OpenAI released the model and pushed its weights to Hugging Face under the Apache 2.0 license. One: PII filtering finally has an open-source baseline teams can self-host; the initial gate data passes through before leaving the premises can sit in your own rack or the user’s browser. Two: 50M active parameters keep inference light enough to ride the hot path of a scanning pipeline that runs at high throughput, while the 128K context window means long documents skip the chunking gymnastics.
Privacy Filter landed on April 22, 2026, when OpenAI released the model and pushed its weights to Hugging Face under the Apache 2.0 license. A token-classification model at heart, it spots and masks personally identifiable information in text, targeting high-throughput, on-premises data sanitization workflows; its inference and deployment code is open on GitHub too.
Why it matters: plenty of enterprises can adopt LLMs only if sensitive data is screened locally before it ever heads for an external API. Regex rules and generic NER models have long held that post; OpenAI now supplies an open-source option ready to run in your own data center — or even in a browser — and states its role without dressing it up: an aid, not a compliance guarantee.
Inside the Model
At its core is a bidirectional token classifier. Raw text goes in, and every token comes back with logits spanning 33 classes: the 8 PII categories — account numbers, private addresses, private emails, person names, phone numbers, private URLs, dates, and secrets — and each one carries BIOES tags, while the single remaining class covers background. One forward pass labels an entire sequence; from there, a constrained Viterbi decoder, transition biases in hand, turns the discrete tags into spans that are both coherent and legal. Runtime parameters give teams a dial — balance precision against recall, or tune how long spans run.
Sparse MoE: 1.5B Total, 50M per Token
The architecture holds a clever twist. The base checkpoint was first pretrained autoregressively (a structure close to a downsized gpt-oss), then reshaped into a bidirectional classifier and put through supervised post-training. On paper: 1.5B parameters in total, yet each token activates only 50M of them — sparse MoE, choosing 4 experts out of 128 per token. The stack uses d_model 640 and 8 transformer blocks, pairing 14 query heads with 2 KV heads (group size 7) and adding rotary embeddings; attention is banded (band 128, giving an effective window of 257 tokens counting self). The context window spans 128K. Weights come as safetensors, about 2.8 GB, and community-made quantized versions also exist.
How Labels Take Shape: One Forward Pass, Then Viterbi
Splitting tagging from decision-making is the design’s most noteworthy move. The model itself emits nothing more than a per-token class distribution; how a span forms is entirely up to the Viterbi decoder, steered by background-persistence, span-entry, span-continuation, and boundary-handoff biases that together keep the output to well-formed label sequences. Thanks to that split, a single set of weights adapts per workload — a recall-first coarse screening pipeline and a precision-first automatic masking flow run on the very same checkpoint.
From the Browser to SageMaker
The list of places it runs is long. A one-line pipeline loads the model in Transformers; through Transformers.js it executes right inside the browser, WebGPU-powered and paired with q4 quantization — in the official demo, “Harry Potter” surfaces as private_person (confidence ~0.999996), while an email address shows up as private_email (around 0.999999). ONNX and SageMaker paths are supported too, and Hugging Face also runs a hosted demo Space where pasting in text shows the output on the spot.
Stated Position and Known Limits
On limits, the model card is unusually frank: it is “a redaction and data minimization aid, not an anonymization, compliance, or a safety guarantee.” Tagging policy is fixed by design — what gets flagged changes only through finetuning, never through configuration. Known failure modes run in two directions: uncommon names and regional writing conventions can slip past it, while public entities or benign high-entropy strings can be over-redacted. For medical, legal, financial, HR, education, and government settings, the card explicitly asks for a human in the loop. Put differently: the model raises the flag, and accountability for whatever ships stays with the deploying team.
Three Takeaways for Engineering Teams
In practice, three conclusions stand out. One: PII filtering finally has an open-source baseline teams can self-host; the initial gate data passes through before leaving the premises can sit in your own rack or the user’s browser. Two: 50M active parameters keep inference light enough to ride the hot path of a scanning pipeline that runs at high throughput, while the 128K context window means long documents skip the chunking gymnastics. Three: the interface design is worth borrowing — detection split from decision-making, behavior tuned through decoder parameters. That pattern holds up better than leaning on a single model to do everything.