OpenAI Releases Privacy Filter: 1.5B-Parameter On-Premises PII Detection Model with 128K Context

OpenAI has released Privacy Filter, a 1.5B-parameter bidirectional token classification model designed for detecting and masking personally identifiable information (PII) in text. The model is available under Apache 2.0 license and can run on-premises, including in web browsers.

Technical Architecture

Privacy Filter uses 1.5 billion total parameters with 50 million active parameters through a sparse mixture-of-experts architecture. According to OpenAI, the model was first pretrained autoregressively similar to GPT-OSS, then converted into a bidirectional token classifier with supervised classification training.

The architecture includes:

• 8 transformer blocks with grouped-query attention (14 query heads, 2 KV heads)
• Sparse mixture-of-experts feed-forward blocks (128 experts total, top-4 routing)
• Bidirectional banded attention with band size 128 (effective 257-token attention window)
• 640-dimensional residual stream width

Unlike autoregressive models that generate text token-by-token, Privacy Filter labels entire input sequences in one forward pass, then decodes coherent spans using a constrained Viterbi procedure.

Detection Capabilities

The model detects 8 privacy categories:

• Account numbers
• Private addresses
• Private emails
• Private persons (names)
• Private phone numbers
• Private URLs
• Private dates
• Secrets

For token-level classification, each category expands into BIOES (Begin, Inside, Outside, End, Single) boundary tags, producing 33 total output classes per token.

Context and Performance

Privacy Filter supports a 128,000-token context window, enabling processing of long documents without chunking. The model includes runtime controls for configuring precision-recall tradeoffs through adjustable operating points that modify span detection aggressiveness.

The sequence decoder uses six transition-bias parameters controlling background persistence, span entry, continuation, closure, and boundary handoff to produce coherent span boundaries rather than per-token independent predictions.

Deployment Options

OpenAI states the model can run in web browsers via WebGPU using Transformers.js with quantization (q4), or on laptops and on-premises infrastructure. The model is available through Hugging Face Transformers with standard pipeline API support.

The Apache 2.0 license permits commercial deployment and fine-tuning on specific data distributions.

Limitations Disclosed

OpenAI explicitly states Privacy Filter is "not an anonymization, compliance, or a safety guarantee" and warns against over-reliance. The model only identifies PII matching its trained taxonomy of 8 categories, which may not cover all privacy use cases or regulatory requirements. OpenAI recommends using it as one layer in a broader privacy-by-design approach rather than a standalone solution.

What This Means

This release addresses a specific enterprise need: fast, on-premises PII detection for data sanitization workflows where cloud APIs are unsuitable due to data residency or throughput requirements. The 128K context window and single-pass labeling design prioritize throughput over the iterative accuracy of larger models. The Apache 2.0 license and small parameter count make it accessible for fine-tuning on domain-specific PII patterns, though organizations must validate it meets their specific privacy requirements rather than treating it as a compliance checkbox.