A privacy filter reads a medical letter and blacks out anything identifying. Pick how big a model to use, and watch what it catches — and what it lets through.
Each one downloads into this tab and runs on your own machine. Nothing is sent anywhere. The download happens once and your browser keeps it.
All three are the same published detector, trained to spot 55 kinds of personal detail, at three sizes. The smallest is also squeezed to 8 bits a weight, which turns out to matter as much as the size, and it is small enough to live on this site, so it arrives from the same place the page did. The other two are fetched from a public model hub.
Drag it left and the filter grows paranoid — it stops missing things, and starts blacking out ordinary words. Drag it right and the page gets cleaner while private details slip through. There is no setting that does both.
Each sample letter has been marked up by hand: a person decided which stretches of text a redactor ought to black out. The model never sees those marks. It reads the plain letter, gives every word a probability of being sensitive, and the page compares the two.
Caught counts a marked passage as found if the model flagged any part of it. Missed is a marked passage it left alone. Blacked out needlessly is anything it flagged that was not marked. Scoring on overlap rather than exact boundaries is deliberate: for redaction what matters is whether the ink lands on the number, not whether it lines up perfectly with it.
The model is also judged only on whether it flagged something, not on what it called it. It frequently gets the category wrong — calling a medical record number a national ID — while still covering the right characters, and for this purpose that counts as a success.
All three come from a family of small privacy filters published between March and May 2026, trained on a public dataset of synthetic personal information and released under the MIT licence. They recognise 55 categories including medical record numbers, insurance identifiers, addresses and card numbers.
| Rung | Download | What is different |
|---|---|---|
| 17M compressed | 17.2 MB | The smallest model, 8 bits a weight — served from this site |
| 32M full | 128.5 MB | Twice the model, full precision |
| 68M full | 274 MB | Four times the model, full precision |
The ladder used to have a fourth rung: the 32M model squeezed to 8 bits, 32.5 MB, which let you compare the same model at two precisions. The repository it came from went private in September 2026, no public copy exists, and a build of our own would be too large to serve from this site. That comparison, and a 4-bit build that was larger than the 8-bit one and worse, live on only in these notes.
No, and that is worth saying plainly. A filter that finds nine identifiers out of ten is not a redaction tool, because the tenth one is the whole problem. Anything built for real use pairs a model like this with pattern rules, a review step, and a person who signs off.
What the ladder is good for is showing the shape of the trade-off — that accuracy costs megabytes, that the last few percent cost the most, and that the failures are quiet. A missed number does not look like an error. It looks like a clean document.
The model files are downloaded from Hugging Face the first time you pick a rung, the same way an image or a font is fetched. After that, your browser has them and the work happens on your machine.
Text you type or paste is never uploaded — there is nowhere for it to go. This page has no server of its own. That is not a promise about good behaviour; it is just how the page is built.