Model Card for OpenAI Privacy Filter

Charles de Bourcy; Sahra Ghalebikesabi; Avi Schwarzschild; Alex Gorbachev; Mihai Maruseac; Annie Chu; Vol Kyrylov; Tong Mu

cs.CRAug 18, 2026

Model Card for OpenAI Privacy Filter

Authors: Charles de Bourcy, Sahra Ghalebikesabi, Avi Schwarzschild, Alex Gorbachev, Mihai Maruseac, Annie Chu, Vol Kyrylov, Tong Mu,

Organizations: OpenAI

Abstract

OpenAI Privacy Filter is a compact, bidirectional token-classification model for detecting and redacting personally identifiable information (PII) and secrets in unstructured text. The model is derived from an autoregressively pretrained checkpoint and converted into a bidirectional, banded-attention classifier that labels an input sequence in a single forward pass. A constrained Viterbi decoder produces coherent spans across eight privacy categories and exposes configurable operating points for precision-recall tradeoffs. Privacy Filter has 1.5 billion total parameters, 50 million active parameters per token, and a 128,000-token context window. It is designed for efficient local deployment and domain-specific fine-tuning. Privacy Filter is intended as a configurable data-minimization component within layered privacy workflows, not as an anonymization or compliance guarantee.

Figures & tables

Panel of Figure 1 — Figure 1: Illustrative chat-style interaction showing Privacy Filter redacting PII from raw user text.

Benchmark Dataset	Scope	Precision (tokens)	Recall (tokens)	F1 (tokens)	F1 (spans)
PII-Masking-300k (baseline)	All labels	0.940	0.980	0.960	0.926
PII-Masking-300k (corrected)	All labels	0.968	0.981	0.974	0.942
CredData (baseline)	secret	0.747	0.965	0.842	0.617
CredData (corrected)	secret	0.750	0.965	0.844	0.624

Table 1: Privacy Filter performance on benchmark datasets.

Train Fraction	Best Epoch	Precision (tokens)	Recall (tokens)	F1 (tokens)
0%	0	0.414	0.795	0.545
1%	13	0.888	0.871	0.879
10%	39	0.963	0.960	0.962
50%	18	0.983	0.982	0.983

Table 2: Fine-tuning results on fractions of the SPY training dataset.

ID_NUM	$\to$	account_number
ADDRESS	$\to$	private_address
EMAIL	$\to$	private_email
NAME , USERNAME	$\to$	private_person
PHONE_NUM	$\to$	private_phone
URL	$\to$	private_url

Table 3: Mapping from SPY lables to Privacy Filter labels.

Prefix:	This is my home landline number: 442 222 47571
Suffix:	442 222 47571 is my home landline number.
Omitted:	442 222 47571

Table 4: Examples of PII with and without contextual clues.

	Precision			Recall
Category	PII only	Clue $+$ PII	PII $+$ Clue	PII only	Clue $+$ PII	PII $+$ Clue
account_number	0.750	0.894	0.737	0.797	1.000	0.916
private_address	0.821	0.989	0.940	0.214	0.414	0.368
private_date	1.000	1.000	1.000	0.220	0.894	0.496
private_email	0.969	0.975	0.974	0.962	1.000	0.974
private_person	0.782	0.912	0.793	0.885	0.994	0.955

Table 5: Privacy Filter performance by PII category, with and without clues.

Language	Number of Examples	Recall	Precision	F1
Dutch	7,457	0.937	0.892	0.914
English	7,946	0.965	0.905	0.934
French	8,413	0.969	0.889	0.927
German	8,120	0.965	0.890	0.926
Italian	7,976	0.959	0.886	0.921
Spanish	7,816	0.968	0.901	0.933

Table 6: Privacy Filter performance on PII-Masking-300K data broken down by language.

Language	Number of Examples	Recall	Precision	F1
Bengali	953	0.875	0.851	0.863
Hausa	941	0.801	0.720	0.758
Hindi	968	0.889	0.882	0.886
Indonesian	957	0.897	0.877	0.887
Japanese	968	0.866	0.897	0.881
Korean	962	0.887	0.903	0.895

Table 7: Privacy Filter performance on multilingual synthetic data broken down by language.

Language	Number of Examples	Precision	Recall
English	1,181	0.962	0.956
Bengali	1,188	0.831	0.741
Hindi	1,193	0.887	0.790
Indonesian	1,189	0.801	0.718
Japanese	1,189	0.900	0.758
Mandarin Chinese	1,191	0.926	0.786

Table 8: Privacy Filter performance on category-clue-before-PII multilingual data broken down by language.

Figure 2: One hop reasoning results. Recall drops as the distance between the alias and its definition grows within the context window.

Panel of Figure 3 — Figure 3: Example showing how explicit line breaks in a URL can lead to fragmented false-positive private_person predictions. This whole span should be classified as private_url , but the line breaks lead to error.

account_number	This is a dice-roll sequence: 298212770451.	A customer’s gift card primary account number
private_email	For sending me the rehearsal schedule, use my personal email address below. This is a painting title: [email protected]	An email address.
private_date	This is a cheese-aging batch code: 07.08.2001 13:4O.	A real date and time.

Table 9: Examples of adversarial context.

Formatting Alternative	Description	Example
digit_words	Digits are spelled out as words.	If you need to reach me directly, my personal cell number is two six eight - seven two two - one zero four nine.
spacing	Extra or unusual spacing splits chunks or characters.	This is the compromised API access token from yesterday’s deploy, tok_ 7Qz .P9x 2Kj 8dL 3wV -QeR 1uT .ZxY 4bN _oP F, so rotate and invalidate it immediately.
line_breaks	The PII spans explicit newline breaks.	You can reach Emily directly at her personal email address: emily. carter @proton mail.com for scheduling the home visit.
symbol_substitution	Some characters or separators are swapped for visually similar non-ASCII characters or emoji.	Please list the package recipient’s full name as Sophia JOhnson.
emoji_word_replacement	One word-sized semantic chunk is replaced with a matching emoji.	For the lease paperwork, my home address is 482 Maple [road], Apt 3B, Brookside, OR 97401.
at_dot_obfuscation	Email or URL separators are replaced with worded or bracketed forms like [dot].	Check out Emily Ross’s personal website for her essays and travel photos at www[dot]emily-ross-journal[dot]com.

Table 10: Adversarial formatting alternatives used in evaluation.

Adversarial Axis	Number of Examples	Precision	Recall
confusion_category_eval_overall	178	0.728	0.687
spacing	270	0.699	0.631
symbol_substitution	247	0.824	0.907
line_breaks	219	0.453	0.812
digit_words	156	0.715	0.674
phonetic_alphabet	115	0.273	0.694

Table 11: Privacy Filter performance on adversarial formatting variants.

PII Detection

Personally identifiable information (PII) detection finds sensitive personal details in text, conversations, images, and other data.

See all 39 papers

Personal Information Parroting in Language Models
Feb 24, 2026Nishant Subramani, Kshitish Ghate, Mona DiabMemorization in Language Models Privacy Leakage in Language Models
♠Carnegie Mellon University - Language Technologies Institute · University of Washington
Privacy Guard & Token Parsimony by Prompt and Context Handling and LLM Routing
Mar 30, 2026Alessio LangiuPrivacy Protection for LLM Agents Privacy Leakage in Language Models
National Research Council of Italy - Institute of Marine Sciences (CNR-ISMAR)
NeuroFilter: Activation-Based Guardrails for Privacy-Conscious LLM Agents
Jan 21, 2026Saswat Das, Ferdinando FiorettoLLM Guardrails Privacy Leakage in Language Models
University of Virginia

Feb 24, 2026J/K move · Enter open · S save

Personal Information Parroting in Language Models

Nishant Subramani, Kshitish Ghate, Mona Diab

♠Carnegie Mellon University - Language Technologies Institute · University of Washington

Memorization in Language Models Privacy Leakage in Language Models PII Detection

Open paper AskPDF arXiv

Modern language models (LM) are trained on large scrapes of the Web, containing millions of personal information (PI) instances, many of which LMs memorize, increasing privacy risks. In this work, we develop the regexes and rules (R&R) detector suite to detect email addresses, phone numbers, and IP addresses, which outperforms the best regex-based PI detectors. On a manually curated set of 483 instances of PI, we measure memorization: finding that 13.6% are parroted verbatim by the Pythia-6.9b model, i.e., when the model is prompted with the tokens that precede the PI in the original document, greedy decoding generates the entire PI span exactly. We expand this analysis to study models of varying sizes (160M-6.9B) and pretraining time steps (70k-143k iterations) in the Pythia model suite and find that both model size and amount of pretraining are positively correlated with memorization. Even the smallest model, Pythia-160m, parrots 2.7% of the instances exactly. Consequently, we strongly recommend that pretraining datasets be aggressively filtered and anonymized to minimize PI parroting.

Abstract

PII Detection

Explore similar work

Personal Information Parroting in Language Models

Privacy Guard & Token Parsimony by Prompt and Context Handling and LLM Routing

NeuroFilter: Activation-Based Guardrails for Privacy-Conscious LLM Agents