OpenAI's privacy filter runs locally with just 50M active parameters, enabling 128k-token document scans

The Privacy Filter model isn’t another massive, resource-hungry beast. OpenAI shipped it as a 1.5B-parameter Apache 2.0 model, but the clever part is its architecture: only 50 million parameters are active at any time. That’s roughly the size of a modest BERT variant from a few years ago, and it means you can run full 128,000-token context windows without chunking documents or stitching results back together. The benchmark numbers back up the efficiency claims, with state-of-the-art performance on the PII-Masking-300k set. But benchmarks are lab conditions. The real test is in how it handles messy, real-world inputs.

The team built three open-source reference apps to prove it. Document Privacy Explorer lets you drop in a PDF or DOCX and see every detected piece of PII highlighted in-place, with category filters that toggle client-side instead of re-running the model. The Image Anonymizer uses Tesseract OCR to grab word-level bounding boxes, then runs the full text through Privacy Filter once to map character spans back to pixel rectangles for automatic redaction. And SmartRedact Paste gives you a shareable public URL for the scrubbed version while keeping a private reveal link. All three are built on gradio.Server, which acts as a consistent backend queueing layer across the projects.

What makes this more than a standard model release is how the apps handle the developer experience. The custom HTML/JS frontends aren’t constrained by Gradio’s component library. They use a single @server.api decorator to expose endpoints through Gradio’s queue, which handles ZeroGPU allocation and concurrent requests cleanly. The frontend for Document Privacy Explorer calls the backend with the same Gradio JS client you’d use in a notebook, but renders results in a reader view with serif fonts and client-side category toggles. There’s no page re-render when you filter by “private_email” because the heavy lifting already happened in that single 128k forward pass.

I’m most interested in whether the Image Anonymizer’s canvas approach catches on. The app doesn’t just slap black bars on detected regions; it lets you toggle bars by category, drag them around, or draw new ones for anything the model missed, then export at natural resolution with no server round-trip. That’s the kind of hybrid human-AI workflow that actually works in practice, rather than the fake-it-till-you-make-it demos that fall apart on the first edge case. The model handles eight PII categories—from account numbers to URLs—and the BIOES decoding keeps span boundaries clean through long, ambiguous text runs. That’s the sort of detail that prevents the “it works 90% of the time but the 10% is a nightmare” problem.