OpenAI Privacy Filter • Hacker News Board

Re: OpenAI Privacy Filter

#41

Post by laserlight » Sun, Apr 26, 2026, 7:30 AM UTC

creesch wrote: post #40

ori_b wrote: post #24

Earlier quoted context omitted.

The advantage of computers was that they didn't make human errors; they did things repeatedly, quickly, and predictably. If I'm going to accept human error, I'd like it to come from a human.

> The advantage of computers was that they didn't make human errors; Sure they do, computers repeatedly, quickly, and predictably do what they are programmed to do. Which includes any human errors in that programming.

> predictably do what they are programmed to do

And now they predictably do what they are not programmed to do.

Re: OpenAI Privacy Filter

#42

Post by maciejzj » Sun, Apr 26, 2026, 7:31 AM UTC

On a side note, when I click the link it redirects me to machine-translated version of OpenAI website with completely botched meaning - the word “redacted” is translated to a false friend “redagować” which means to edit/refine text, not anonymize.

Re: OpenAI Privacy Filter

#43

Post by I_am_tiberius » Sun, Apr 26, 2026, 7:41 AM UTC

I assume they use this model to be able to train new models with user data.

Re: OpenAI Privacy Filter

#44

Post by I_am_tiberius » Sun, Apr 26, 2026, 7:42 AM UTC

I_am_tiberius wrote: post #43

I assume they use this model to be able to train new models with user data.

If they think they are respecting their users' privacy by doing so, they are very very wrong.

Re: OpenAI Privacy Filter

#45

Post by ares623 » Sun, Apr 26, 2026, 8:18 AM UTC

This looks actually useful. But can someone help me understand how you address the non-perfect scores: "Privacy Filter achieves an F1 score of 96% (94.04% precision and 98.04% recall)."

How would you actually use this if it can fail redacting 4% of the data. How do you reliably know which 4% failed?

Re: OpenAI Privacy Filter

#46

Post by usdogu » Sun, Apr 26, 2026, 8:59 AM UTC

Someone has created the reverse of it: https://github.com/chiefautism/privacy-parser

Re: OpenAI Privacy Filter

#47

Post by awestroke » Sun, Apr 26, 2026, 9:33 AM UTC

7777777phil wrote: post #8

> The model is available today under the Apache 2.0 license on Hugging Face (opens in a new window) and Github (opens in a new window). Bringing back the Open to OpenAI..

It's only open because nobody who's interested in this model would send their data to openai to be stripped of PII. If they thought otherwise, it would be closed-weights and API-only for "safety" reasons

Re: OpenAI Privacy Filter

#48

Post by Fraaaank » Sun, Apr 26, 2026, 9:42 AM UTC

hiAndrewQuinn wrote: post #2

I'm surprised nobody else has commented on this. This is a very straightforward and useful thing for a small locally runnable model to do.

From a compliance POV it's not enough. For example: " is president of the United States" is still identifiable even though the name has been redacted.

Since you can't be 100% certain that a filter redacts all personal data, you'd have to make sure that you have measures in place which allow OpenAI to legally process personal data on your behalf. Otherwise you'd technically have a data breach (from a GDPR pov).

And if OpenAI can legally process personal data on your behalf, why bother filtering if processing with filtering is also compliant?

Re: OpenAI Privacy Filter

#49

Post by stingraycharles » Sun, Apr 26, 2026, 10:37 AM UTC

fzxu22 wrote: post #37

Working on this: https://github.com/KevinXuxuxu/anon_proxy , a sort of anonymization proxy to use with LLM providers. It does model (OpenAI privacy filter) + regex PII detection, and replaces them back-and-forth for API requests and responses. With locally hosted detection model, no PII leaves your local environment. I find it very useful especially when you're working on sensitive documents (legal, tax, immigration…

How does it handle “unredaction” in responses? E.g. let’s say the LLM does something with the document. You redacted its input, so it emits redacted content. Now what?

Re: OpenAI Privacy Filter

#50

Post by LatencyKills » Sun, Apr 26, 2026, 10:38 AM UTC

yjftsjthsd-h wrote: post #29

LatencyKills wrote: post #18

Earlier quoted context omitted.

Couldn't this be used to locate private data in unstructured text without having to rely on other means of PII detection? 1. Pass the raw text through the filter to obtain the spans. 2. Map all the spans back to the original text. Now you have all the PII information.

If you have the redacted and unredacted versions, then you can diff them; that seems unsurprising? Unless I'm really misunderstanding "spans"?

> If you have the redacted and unredacted versions, then you can diff them; that seems unsurprising?

I'm suggesting that a model designed for high-accuracy redaction can also be used to find all PII in unredacted text. For example, if I don't already know how to find PII (e.g., regex, NLP, etc.) I can use OpenAI's Privacy Filter model to do the work for me.

And because each span has a type (PRIVATE_NAME, etc.) I don't even need to do any work to find only the specific information I am looking for; something that simple diffing wouldn't do.

I'm not saying it's an issue, I just think it is interesting that a tool designed to protect PII can also be used to find it with minimal effort. And it looks like someone already implemented it: https://github.com/chiefautism/privacy-parser.