OpenAI's Privacy Filter: Open-Weight PII Redaction Model
07 Jul 2026
OpenAI has released Privacy Filter, an open-weight model built to detect and redact personally identifiable information (PII) in text. The release positions the model for high-throughput privacy workflows that can run locally, rather than depending on a hosted API — a notable departure from OpenAI's usual closed-model distribution.
What Privacy Filter does
Privacy Filter predicts PII spans across eight categories: private_person, private_address, private_email, private_phone, private_url, private_date, account_number, and secret. OpenAI says it uses a fine-tuned version of the model internally in its own privacy-preserving workflows.
On the technical side, the model is compact: 1.5B total parameters with only 50M active parameters, and it supports context windows up to 128,000 tokens — enough to process long documents in a single pass.
Reported performance
OpenAI cites two benchmark results on the PII-Masking-300k dataset:
- 96% F1 score (94.04% precision, 98.04% recall) on the original benchmark
- 97.43% F1 score (96.79% precision, 98.08% recall) on a "corrected" version of the same benchmark
The report does not explain what the correction to the benchmark entailed, so the exact reason for the score difference is unclear.
OpenAI also reports a fine-tuning result: training on a small amount of domain-specific data raised the F1 score from 54% to 96% — a substantial jump that suggests the base model may need adaptation for specialized domains.
What's missing
Several practical details are not yet available:
- No licensing terms, availability timeline, or download location for the model weights
- No specification of which languages or domains were part of the training distribution
- No pricing or hardware/compute requirements for local deployment
- No benchmark comparisons against other PII detection or redaction tools
Risks to weigh
OpenAI is explicit that Privacy Filter is not a certified anonymization or compliance tool, and it is not a substitute for policy review in high-stakes or regulated settings. Using it as such could create legal or privacy exposure. Performance may also degrade on languages, scripts, naming conventions, or domains that differ from the training data — raising the risk of missed or incorrect redactions. Relying on a single vendor's open-weight model for privacy-critical workflows could also introduce dependency risk and undisclosed failure modes.
Why founders should care
For early-stage teams building products that touch sensitive text data, this release could plausibly lower the barrier to running PII redaction locally rather than through third-party cloud services — a potentially attractive option for startups prioritizing data control or low latency. The reported fine-tuning gains (54% to 96% F1) suggest that founders with domain-specific data might be able to adapt the model for specialized use cases, such as industry-specific document formats or internal naming conventions.
At the same time, the explicit disclaimer that Privacy Filter is not a compliance tool likely means founders in regulated industries (healthcare, finance, legal) would still need additional legal or compliance layers before relying on it in production. Teams operating across multiple languages or non-English markets should probably validate performance on their own data first, given the acknowledged risk of degraded accuracy outside the training distribution.
Bottom line
Privacy Filter looks like a meaningful entrant in the open-weight PII tooling space, with strong reported benchmark numbers and a design suited to local, high-throughput use. But with licensing, availability, and training-data details still unclear, founders should treat the current numbers as a promising signal rather than a production-ready guarantee — and plan to test the model against their own data and compliance requirements before betting critical workflows on it.