🛡️ 11 Open AI Projects That Actually Protect Your Privacy

These models remove names, disguise faces and voices, scan code for secrets, and keep sensitive prompts away from the cloud

In May, a repository posing as a privacy model climbed to the top of Hugging Face. It was an infostealer O.O

HiddenLayer found that Open-OSS/privacy-filter had copied OpenAI’s official model card almost word for word. The fake repository reported more than 200k downloads before Hugging Face removed it, and its loader.py fetched malware designed to steal credentials from Windows computers. A privacy tool that steals the secrets you downloaded it to protect. Yeah, very 2026 kind of..

That incident changed the way I approached this list because I searched Hugging Face and GitHub for open models whose main job is to protect personal data. I didn’t include a generic LLM simply because you can run it through Ollama, ok? Local inference protects the trip between your computer and a cloud API, which is useful, but the model itself has learned nothing about privacy.

“Open” also gets abused. Public weights can come with restrictions that prevent redistribution. A GitHub repository can publish its code while quietly depending on a remote service, so I looked for accessible weights or code, a clear privacy function, local execution, and enough documentation to understand what the project can’t do. The result is stranger and more useful than I expected.

1 - My first choice for English text is the official OpenAI Privacy Filter.

Released under Apache 2.0 in April 2026, it is a 1.5-billion-parameter mixture-of-experts model with only 50 million active parameters. It runs on a laptop or inside a web browser, accepts up to 128,000 tokens, and detects eight types of private information, including names, addresses, account numbers, dates and secrets such as API keys. Unlike a chat model, it labels the whole input in one pass.

Make sure the publisher is exactly openai, though! One missing word in the organization name can apparently cost you every password on your computer.

2 - The model that surprised me most was GLiNER2 Privacy Filter PII Multi.

It is smaller, at roughly 300 million parameters, yet it recognizes 42 entity types across English, French, Spanish, German, Italian, Portuguese and Dutch. On the SPY benchmark, which uses difficult legal and medical text, it reached an average exact-span F1 score of 0.477. OpenAI’s model scored 0.380 in the same comparison. Those numbers look low because the benchmark punishes even slightly wrong span boundaries, and they are a healthy reminder that no redaction model catches everything. For multilingual documents, this would be one of my first tests.

3 - AI4Privacy’s multilingual categorical anonymiser takes a different route.

It was trained on a 500,000-record PII masking dataset and supports eight languages, including Hindi and Telugu. The model can both locate personal data and tell you what it found, such as a surname, city, age or date, instead of replacing every match with the same black box. The MIT license makes it easy to build into another product. I also like that AI4Privacy publishes datasets alongside its models. Privacy models need synthetic personal data to learn their job without creating a fresh privacy problem during training.

4 - NVIDIA’s GLiNER-PII is the heavier specialist.

It has 570 million parameters and detects more than 55 PII and protected health information categories. NVIDIA trained it with Nemotron-PII, a synthetic dataset containing 100,000 records across more than 50 industries. That breadth makes it interesting for financial, legal and security logs where a small eight-label model will miss domain-specific identifiers. Its license is NVIDIA’s Open Model License rather than Apache or MIT, so read the terms before embedding it into a commercial product. Also test it on your own documents. Synthetic bank records are much cleaner than the PDF somebody scanned sideways in 2009.

5 - For health data, OpenMed is the project I would watch.

It isn’t a single model. It is a local-first runtime and a large catalog of medical models for clinical entity extraction and de-identification, with model-backed PII support for 33 languages. It can run through Python, Swift, Android or the browser after the model files are available. I appreciated one detail in its documentation: the authors plainly say that downloads, optional remote adapters and telemetry-enabled paths can still use the network, and that installing the SDK does not magically establish HIPAA compliance. That kind of honesty is rare in AI repositories.

Now some other options for you, not only models:

6 - Presidio deserves a place even though it is a framework rather than one model. It combines NLP, pattern matching and custom recognizers to find and transform private data in text, images and structured files. You can redact a name, hash an account number, encrypt a value or plug in one of the models above. The project started under Microsoft and now lives in the community-run Data Privacy Stack organization under an MIT license. Presidio is the plumbing. Less exciting than a new checkpoint on Hugging Face, perhaps, but plumbing is what keeps private data out of the wrong pipe.

7 - Source code has its own personal data problem too … StarPII was trained to find names, emails, usernames, IP addresses, passwords and secret keys inside code. Its annotated training set contains 20,961 secrets across 31 programming languages. This is a narrow job, and that is exactly why the model is useful before publishing a dataset or feeding a private repository into another model. I wouldn’t call StarPII truly open source, however. Access is gated, and its terms prohibit sharing the model or modified versions. Open access and open source are still different things, even on a platform that mixes the labels constantly.

8 - PAPILLON asks a more interesting question: what if your small local model could protect a prompt before asking a stronger cloud model for help? The local model sees the private information, rewrites or delegates only what the remote model needs, then assembles the final response. In the researchers’ evaluation, their best pipeline preserved response quality for 85.5% of queries while private information leaked in 7.5%. Seven and a half percent is far too high for real secrets, and the authors say the same thing in red letters: don’t ask it real private questions yet. I like the direction more than the current product. A local privacy model acting as a bouncer for cloud AI could become far more practical than forcing every user to run a huge model at home.

9 - Text receives most of the attention, but a face is a password you can’t reset. DeepPrivacy2 detects people in images and replaces their faces or entire bodies with synthetic humans generated by a GAN. Blurring often leaves enough shape, clothing and context for re-identification. Synthetic replacement gives researchers and video operators another option while keeping pose and scene utility. The code is mostly Apache 2.0, although the checkpoints inherit terms from their training datasets. It is also a 2023 research project with some installation complaints and broken-checkpoint reports in its issue tracker. Promising, yes. One-click consumer software, no.

10 - Fawkes protects a face before a recognition model learns it. Developed at the University of Chicago, it adds small pixel changes that humans barely notice but that can confuse models scraping photos for training. The idea still feels wonderfully rebellious. Its limits matter, though. Fawkes is aimed at future unauthorized training, not at removing a face already stored in Clearview AI, and facial recognition systems can adapt to adversarial cloaking. The code is restricted to personal privacy protection and academic research. I would use it as friction against scraping, never as an invisibility cloak.

11 - Voice is the forgotten biometric in most privacy discussions. VoicePAT is an Apache-licensed toolkit that changes the speaker identity in an audio recording and then measures whether the anonymized voice can still be recognized or transcribed. It grew out of the VoicePrivacy Challenges and includes pretrained components for speaker anonymization research. You will need Conda, configuration files and some patience. The project itself says the documentation is still under construction. Still, an open system that lets hospitals, call centers or researchers test voice anonymization is worth including because deleting a name from a transcript does nothing to anonymize the recording.

I left out Ollama, LocalAI, PrivateGPT and Open WebUI on purpose. I use some of them and they can keep prompts on hardware you control, but they are deployment tools. I also left out models that merely read privacy policies, since explaining a company’s data practices does not protect the person whose data the company already collected.

If I were building something today, I would start with OpenAI Privacy Filter for English text and test GLiNER2 beside it whenever multilingual recall matters. OpenMed is the better starting point for clinical records. Every choice still needs rules, sample documents and human review because one missed name can undo ten thousand correct redactions.

And check the organization name before downloading anything. A fake privacy filter stealing passwords sounds like satire, but 2026 managed to ship it as software.