How to build scalable web apps with OpenAI's Privacy Filter
OpenAI released an open‑source PII detector called Privacy Filter, a 1.5B‑parameter model that labels text in eight categories within a single 128k‑token forward pass. Three demo applications built on gradio.Server showcase its use: a document reader that highlights PII spans, an image redaction tool that overlays black bars on detected PII, and a pastebin that returns redacted and original URLs. The server framework enables queued API calls, GPU allocation, and shared endpoints for browser and Python clients.
The Core Development
OpenAI released Privacy Filter on the Hub this week: an open-source personally-identifiable information (PII) detector that labels text across eight categories in a single forward pass over a 128k context. Model card . We spent a few hours building with it and landed on three apps that each reveals a different slice of what it can do.
All three are built on gradio.Server , which lets you pair custom HTML/JS frontends with Gradio's queueing, ZeroGPU allocation, and gradio_client SDK. In all these apps, gradio.Server plays the same backend role, and that consistency is exactly what makes it really powerful.
Privacy Filter is a 1.5B-parameter model with 50M active parameters, permissively licensed under Apache 2.0. PII categories are private_person , private_address , private_email , private_phone , private_url , private_date , account_number , secret . Context is 128,000 tokens. Achieves state-of-the-art performance on the PII-Masking-300k benchmark . Full numbers and methodology are in the official release blog .
Real-World Use Cases & Applications
What gr.Server does here. gr.ImageEditor supports layered annotation and is a reasonable starting point for image redaction. The workflow we wanted (per-bar category metadata, toggle all bars in a category at once, client-side PNG export at natural resolution with no server round-trip) was cleaner to build on a custom <canvas> frontend. gr.Server hands back pixel rectangles from one queued endpoint and lets the canvas own everything else:
Deployment & Availability
User problem. You want a pastebin that redacts before sharing. You paste a log line, an email, a support ticket. You get two URLs back. The public one serves the redacted version with <PRIVATE_PERSON> , <PRIVATE_EMAIL> , <ACCOUNT_NUMBER> placeholders, following the redaction convention from the official blog examples . The private one is gated by a token you keep and shows the original with spans highlighted.
Strategic Perspective & Ecosystem Impact
User problem. You want to read a PII-heavy document (a contract, a resume, an exported chat log) with every detected span highlighted by category, a filter in the sidebar, and a summary dashboard up top. The reading experience should feel like a normal document, not a form.
What Privacy Filter does here. The whole file goes through in a single 128k-context forward pass, so there's no chunking, no stitching, and span offsets line up directly with the rendered text. BIOES decoding keeps span boundaries clean through long ambiguous runs.
What gr.Server does here. You could wire this up in Blocks with gr.HighlightedText and a sidebar, and it would work. The reading experience we wanted (serif body, category filters that toggle CSS classes client-side instead of re-running the model, a summary dashboard that doesn't force a page re-render) was easier to hand-author than to compose. gr.Server lets us serve the reader view as a single HTML file and expose the model behind one queued endpoint:
Why it matters
The combination of a high‑performance, open‑source PII detector with a unified server framework demonstrates how AI models can be integrated into production workflows while maintaining privacy and efficiency, a key concern for AI‑driven applications.