OpenAI's Privacy Filter tops PII benchmarks but fails on non-Latin scripts

A new independent evaluation from researcher Rohith Uppala puts OpenAI's Privacy Filter (OPF) through its paces, and the results are a mixed bag for the 1.5B-parameter bidirectional PII detector. Across 42 synthetic benchmarks spanning 22 languages and 5 domains, OPF delivers strong zero-shot performance on structured data, hitting F1=0.855 on the AI4Privacy benchmark and beating established open-source tools like Presidio (0.431) and XLM-RoBERTa (0.269) on PII-annotated tasks. It also excels on synthetic structured PII (0.71 average F1) and customer support data (0.60), with particularly high scores on regex-friendly fields like email (0.78) and phone numbers (0.76).

But the model's weaknesses are stark. When PII is embedded in narrative prose, OPF's F1 drops to a range of 0.04–0.57 across NER benchmarks, and it nearly fails entirely on non-Latin scripts: Arabic scores just 0.04 and Cyrillic 0.03. XLM-RoBERTa leads OPF on all 13 Indic and non-Latin languages tested. Meanwhile, GPT-4o takes the crown on domain-specific PII, leading on medical (SPY: 0.643), legal, and financial (Gretel: 0.527) benchmarks. Error analysis reveals OPF is recall-biased on customer support and medical/legal PII, with precision ranging from 0.31–0.54 while recall hits 0.70–0.85, suggesting the filter catches more but cries wolf more often.

The study is the first independent, systematic look at a production PII detection system, and it highlights a critical gap: AI models that excel on clean, structured English data often stumble on real-world multilingual content. For developers piping user-generated text through OPF, the findings suggest complementing it with language-specific models or LLM-based fallbacks for non-Latin scripts and narrative contexts.