A privacy filter reads a medical letter and blacks out anything identifying. Pick how big a model to use, and watch what it catches — and what it lets through.
Each one downloads into this tab and runs on your own machine. Nothing is sent anywhere. The download happens once and your browser keeps it.
All four are the same published detector, trained to spot 55 kinds of personal detail. Two of them are the same model stored at different precision — which turns out to matter more than you would guess. The smallest is small enough to live on this site, so it arrives from the same place the page did.
Drag it left and the filter grows paranoid — it stops missing things, and starts blacking out ordinary words. Drag it right and the page gets cleaner while private details slip through. There is no setting that does both.
Each sample letter has been marked up by hand: a person decided which stretches of text a redactor ought to black out. The model never sees those marks. It reads the plain letter, gives every word a probability of being sensitive, and the page compares the two.
Caught counts a marked passage as found if the model flagged any part of it. Missed is a marked passage it left alone. Blacked out needlessly is anything it flagged that was not marked. Scoring on overlap rather than exact boundaries is deliberate: for redaction what matters is whether the ink lands on the number, not whether it lines up perfectly with it.
The model is also judged only on whether it flagged something, not on what it called it. It frequently gets the category wrong — calling a medical record number a national ID — while still covering the right characters, and for this purpose that counts as a success.
All three come from a family of small privacy filters published between March and May 2026, trained on a public dataset of synthetic personal information. They recognise 55 categories including medical record numbers, insurance identifiers, addresses and card numbers.
| Rung | Download | What is different |
|---|---|---|
| 17M compressed | 17.2 MB | Half the model, 8 bits each — served from this site |
| 32M compressed | 32.5 MB | Weights squeezed to 8 bits each |
| 32M full | 128.5 MB | The same model, full precision |
| 68M full | 274 MB | Twice the model, full precision |
There is a fourth build, squeezed to 4 bits, which is 85 MB — larger than the 8-bit one — and noticeably worse at the job. It is left off the ladder because it makes the shelf confusing, but it is a useful reminder that a bigger file is not automatically a better model.
No, and that is worth saying plainly. A filter that finds nine identifiers out of ten is not a redaction tool, because the tenth one is the whole problem. Anything built for real use pairs a model like this with pattern rules, a review step, and a person who signs off.
What the ladder is good for is showing the shape of the trade-off — that accuracy costs megabytes, that the last few percent cost the most, and that the failures are quiet. A missed number does not look like an error. It looks like a clean document.
The model files are downloaded from Hugging Face the first time you pick a rung, the same way an image or a font is fetched. After that, your browser has them and the work happens on your machine.
Text you type or paste is never uploaded — there is nowhere for it to go. This page has no server of its own. That is not a promise about good behaviour; it is just how the page is built.