OpenAI Blog
Apr 22
Introducing OpenAI Privacy Filter
OpenAI Privacy Filter is an open-weight model for detecting and redacting personally identifiable information (PII) in text with state-of-the-art accuracy
Model Card for OpenAI Privacy Filter
The OpenAI Privacy Filter is a 1.5‑billion‑parameter, bidirectional token‑classification model that detects and redacts personally identifiable information and secrets in unstructured text. It is built from an autoregressive checkpoint, converted into a banded‑attention classifier, and uses a constrained Viterbi decoder to produce coherent spans across eight privacy categories in a single forward pass. The model supports configurable precision‑recall tradeoffs, a 128,000‑token context window, and is designed for efficient local deployment and domain‑specific fine‑tuning as a data‑minimization component within layered privacy workflows.
Related stories
arXiv AI
Aug 7
OpenAI Privacy Filter: A Cross-Lingual, Cross-Domain PII Evaluation Across 32 Benchmarks
arXiv:2608. 02616v2 Announce Type: replace-cross Abstract: We present what is, to our knowledge, the first systematic evaluation of OpenAI's Privacy Filter (OPF), a 1.
Hugging Face Blog
Apr 27
How to build scalable web apps with OpenAI's Privacy Filter
arXiv Machine Learning
Aug 20
On the Robustness of Vision-Language Models in Zero-shot Privacy Classification
The paper investigates whether large, instruction‑following Vision‑Language Models (VLMs) can reliably perform zero‑shot image privacy classification. It compares three open‑source VLMs to specialized privacy models on two public benchmarks, evaluating accuracy, robustness to image degradations (compression, lighting changes, noise), inference speed, and parameter count. The findings show that while VLMs remain robust to perturbations, they are less accurate and significantly slower than smaller, purpose‑built privacy models, indicating that scaling alone does not guarantee effective privacy classification.
arXiv AI
Aug 5
Evaluating OpenAI's Privacy Filter: Cross-Lingual, Cross-Domain PII Detection Across 42 Benchmarks
arXiv:2608. 02616v1 Announce Type: cross Abstract: We present the first independent, systematic evaluation of OpenAI's Privacy Filter (OPF), a 1.
arXiv Computation and Language
Oct 19
Veil-Then-Reveal: Protecting PII Privacy via Reversible Pseudo-Anonymization in Zero-Trust User--LLM Interaction
The paper introduces Veil-then-Reveal (VtR), a user-side framework that pseudo‑anonymizes personally identifiable information (PII) in prompts sent to large language models (LLMs) under a zero‑trust model. VtR replaces detected PII with realistic, same‑type surrogates using format‑preserving encryption for structured data and a keyed‑hash dictionary for semantic data, while preserving linguistic and structural cues. The system achieves high detection recall (97.9%), strong protection of detected values (95.2%), and near‑perfect round‑trip restoration (99.9%) across three datasets.
arXiv AI
Sep 25
ASIRF: An Agentic Framework for Context-Dependent Sensitive Information Redaction
ASIRF (Agentic Sensitive Information Redaction Framework) is a system that retrieves domain‑specific definitions of sensitive information from a flexible knowledge base at inference time, eliminating the need for retraining when adapting to new domains. It offers two architectures—a three‑call multi‑agent pipeline and a single‑agent variant—and has been evaluated on ten small open‑weight models across eight datasets, including out‑of‑distribution fictional domains. In 68 of 80 model‑domain combinations (85 %), ASIRF’s recall surpasses that of the OpenAI Privacy Filter, with most shortfalls limited to the filter’s training‑distribution domains.
arXiv AI
Oct 2
Tokenized Key-Gated Adapter Routing: A Secure Access Control Mechanism Against Private Data Leakage in LLMs
Tokenized Key-Gated Adapter Routing (Locket) is a framework that embeds fine‑grained, policy‑driven access control into large language models by training lightweight LoRA adapters for different privacy policies. A gating module associates a learned keyed entry token with a specific adapter, allowing authorized tokens to unlock private knowledge while invalid or missing tokens trigger privacy‑preserving adapters that redact or sanitize sensitive content. Experiments on datasets such as Enron, ECHR, and Yelp with models like Qwen3, Llama‑3.2, and Gemma‑2‑2B show that Locket maintains perplexity comparable to fine‑tuning when the correct token is provided, and significantly reduces PII leakage when the token is absent or invalid, without sacrificing utility.
arXiv AI
Jun 9
Vision Language Model Helps Private Information De-Identification in Vision Data
arXiv:2606. 09132v1 Announce Type: new Abstract: Visual Language Models (VLMs) have gained significant popularity due to their remarkable ability.
arXiv AI
Jul 2
NeuroFilter: Activation-Based Guardrails for Privacy-Conscious LLM Agents
arXiv:2601. 14660v2 Announce Type: replace-cross Abstract: Agentic Large Language Models (LLMs) are models able to reason, plan, and execute tools over unstructured data.
arXiv Machine Learning
Oct 8
Efficient Provably Private Classification with a Tabular Foundation Model
Efficient Provably Private Classification with a Tabular Foundation Model introduces PrivTab, a tabular foundation model that embeds differential privacy directly into its architecture. Pretrained on simulated datasets, PrivTab uses in-context learning to convert sensitive rows into compact, provably private summaries, enabling a single forward pass for classification. The model outperforms private linear and neural‑network baselines under moderate-to-strong privacy, shows negligible membership leakage, maintains well‑calibrated predictions, and reduces dataset fitting time by 10,000×.
arXiv Machine Learning
Aug 4
Defending Membership Inference Attacks via Privacy-aware Sparsity Tuning
arXiv:2410. 06814v2 Announce Type: replace Abstract: Over-parameterized models are typically vulnerable to membership inference attacks, which aim to determine whether a specific sample is included in the training of a given model.