docs: rewrite card — screenpipe's own model (not OpenAI Privacy Filter), ScreenLeak numbers, demo link

README.md

@@ -7,7 +7,7 @@ language:
   - it
   - es
   - nl
-library_name: opf
+library_name: transformers
 pipeline_tag: token-classification
 tags:
   - pii
@@ -19,8 +19,6 @@ tags:
   - agentic
   - screen-capture
   - screenpipe
-base_model:
-  - openai/privacy-filter
 metrics:
   - f1
   - recall
@@ -35,25 +33,24 @@ extra_gated_prompt: >-
 
 > A [screenpipe](https://screenpi.pe) project.
 
-A fine-tuned PII redactor for the **three surfaces an AI agent actually
-sees a user's machine through**:
+screenpipe's own PII redactor, purpose-built for the **three surfaces an
+AI agent actually sees a user's machine through**:
 
 1. **Accessibility-tree dumps** — the structured AX hierarchy macOS /
-   Windows expose to assistive tech. Short, structured, often containing
-   labels like `AXButton[Send to marcus@helios-ai.io]`.
-2. **OCR'd screen text** — what tools like screenpipe extract from
-   screen recordings. Mix of window-title-shaped artifacts, app chrome,
-   and occasional long-form (emails, docs).
+   Windows expose to assistive tech. Short, structured, full of labels
+   like `AXButton[Send to marcus@helios-ai.io]`.
+2. **OCR'd screen text** — what tools like screenpipe extract from screen
+   recordings: window-title-shaped artifacts, app chrome, and the
+   occasional long-form email or doc.
 3. **Computer-use traces** — what an agentic model (Claude Computer Use,
-   GPT operator, etc.) reads when it controls a desktop.
+   GPT operators, etc.) reads when it drives a desktop.
 
 These surfaces are short, sparse-context, and full of identifiers that
-slip past redactors trained on chat-style prose. This model is fine-tuned
-specifically for them — while still handling long-form text at
-competitive accuracy.
-
-Built on top of the [OpenAI Privacy Filter](https://github.com/openai/privacy-filter)
-(1.5B parameters, 50M active).
+slip past redactors trained on chat-style prose. This is a compact,
+multilingual token classifier trained in-house specifically for them.
+**It is not OpenAI's Privacy Filter, and it is not a fine-tune of one** —
+it's screenpipe's own model. 278 MB INT8 ONNX, ~9 ms p50 on CPU, runs
+fully offline.
 
 > **License: CC BY-NC 4.0** (non-commercial). For commercial use —
 > production redaction, SaaS / API embedding, AI-agent privacy
@@ -62,44 +59,31 @@ Built on top of the [OpenAI Privacy Filter](https://github.com/openai/privacy-fi
 
 ## Headline numbers
 
-|  | base OPF | **this model** |
-|---|---:|---:|
-| Accessibility / window-title PII zero-leak | 38.6% (33.6–43.8) | **79.1% (74.8–83.5)** |
-| Long-form PII zero-leak (English) | 14.0% (11.7–16.2) | **77.5% (74.5–80.3)** |
-| Long-form PII macro-F1 (English) | 0.591 | **0.934** |
-| Targeted secret-redaction (34 realistic shapes) | not measured | **31/34** |
-| p50 inference latency (CUDA) | ~23 ms | ~23 ms |
-
-95% bootstrap CIs in brackets. Zero-leak: % of cases where the model
-caught all gold spans (the metric that matters for privacy).
-
-## Why this exists (vs the base Privacy Filter)
-
-The OpenAI Privacy Filter (and most other public PII redactors) is
-trained on prose-shaped data. A typical accessibility-tree node, OCR'd
-window title, or computer-use log line looks nothing like that:
-
-```
-AXButton[Send to marcus@helios-ai.io]
-Welcome | Acme Corp | xAI Console
-[ScreenCapture 09:14] Slack — #compai-tessera (12 unread)
-```
-
-These are 30-character strings with one or two PII tokens and almost
-no surrounding context. A model trained on chat corpora will conflate
-brand names with people, miss `Arc | Marcus Chen` because it expects
-sentence context, and tag `Raycast` and `Claude` as people.
-
-If you're building an **agentic system that reads screen state** — a
-desktop-control agent, a memory layer for browsing, anything that
-streams accessibility / OCR / screen-capture data into an LLM — this
-is the redactor designed for that pipe.
+On [**ScreenLeak**](https://github.com/screenpipe/screenleak), our open
+benchmark for PII redaction on screen telemetry — n=422 hand-labelled
+desktop-telemetry strings, 13 categories, strict per-string zero-leak
+(every PII span in the string must be caught):
+
+| Model | Zero-leak | |
+|---|---:|---|
+| Gemini 3.1 Pro | 91.0% | cloud API |
+| GPT-5.5 | 90.7% | cloud API |
+| Claude Opus 4.7 | 87.8% | cloud API |
+| **this model** ⭐ | **86.7%** | **local · 278 MB · ~9 ms CPU · $0/call** |
+| Google Cloud DLP | 37.7% | cloud API |
+| Microsoft Presidio | 35.4% | local OSS |
+
+Within a few points of the frontier APIs, ~50 points above the flagship
+commercial PII products — at zero per-call cost, fully offline. Full
+methodology, confidence intervals, and per-framework (HIPAA / GDPR /
+PCI DSS / …) breakdowns:
+[github.com/screenpipe/screenleak](https://github.com/screenpipe/screenleak).
+**Try it in your browser:** [screenpipe.github.io/screenleak/demo](https://screenpipe.github.io/screenleak/demo/).
 
 ## What it does
 
-Span-level redaction. Given a string, returns `[(start, end, label, text)]`
-where each span is a region the model thinks is PII, classified into one
-of 12 canonical categories:
+Span-level redaction. Given a string, returns the regions it thinks are
+PII, each classified into one of **12 canonical categories**:
 
 ```
 private_person, private_email, private_phone, private_address,
@@ -110,80 +94,90 @@ private_channel, private_id, private_date, secret
 `secret` covers passwords, API keys, JWTs, DB connection strings,
 PRIVATE-KEY block markers, etc.
 
+> **Tip:** screenpipe redacts **each captured fragment independently**
+> (one AX node / OCR line / window title at a time) — that's the
+> distribution the model is tuned for. Feeding a giant multi-entity blob
+> in a single call degrades recall; split on natural boundaries first.
+
 ## Inference
 
-```python
-# pip install opf  (currently from source: github.com/openai/privacy-filter)
-from opf import OPF
-
-filt = OPF(model="./model", device="cuda")  # or "cpu"
-out = filt.redact("Welcome | Marcus Chen — Confluence")
-for span in out.detected_spans:
-    print(f"  [{span.start}:{span.end}] {span.label} = {span.text!r}")
-# -> [10:21] private_person = 'Marcus Chen'
+**Browser (transformers.js):**
+
+```js
+import { pipeline } from "@huggingface/transformers";
+const pii = await pipeline("token-classification", "screenpipe/pii-redactor", { dtype: "q8" });
+const out = await pii("export OPENAI_API_KEY=sk-proj-Ab12Cd34Ef56Gh78");
+// out: per-token tags; group consecutive B-/I- tags into spans
 ```
 
-See [`examples/inference.py`](examples/inference.py) for a longer example
-covering window titles, long-form text, and secrets.
+**Python (transformers):**
 
-## Multilingual
+```python
+# pip install transformers torch
+from transformers import AutoTokenizer, AutoModelForTokenClassification
+import torch
+
+tok   = AutoTokenizer.from_pretrained("screenpipe/pii-redactor")
+model = AutoModelForTokenClassification.from_pretrained("screenpipe/pii-redactor").eval()
+id2label = model.config.id2label
+
+def redact(text):
+    enc = tok(text, return_offsets_mapping=True, return_tensors="pt", truncation=True)
+    offsets = enc.pop("offset_mapping")[0].tolist()
+    with torch.no_grad():
+        pred = model(**enc).logits.argmax(-1)[0].tolist()
+    # decode BIO from offsets + argmax (aggregation_strategy is unreliable
+    # for this tokenizer — walk the offsets yourself)
+    spans, cur = [], None
+    for (s, e), p in zip(offsets, pred):
+        if s == e:                       # special token
+            cur = None; continue
+        lab = id2label[p]
+        if lab == "O":
+            cur = None; continue
+        base = lab.split("-", 1)[-1]
+        if cur and cur["label"] == base and not lab.startswith("B-"):
+            cur["end"] = e
+        else:
+            cur = {"start": s, "end": e, "label": base}; spans.append(cur)
+    return [(d["start"], d["end"], d["label"], text[d["start"]:d["end"]]) for d in spans]
+
+print(redact("export OPENAI_API_KEY=sk-proj-Ab12Cd34Ef56Gh78"))
+# -> [(..., ..., 'secret', 'sk-proj-Ab12Cd34Ef56Gh78')]
+```
 
-This model handles 6 languages. Performance on a public long-form PII
-benchmark (n=200 per language):
+Production INT8 ONNX weights are in [`onnx/`](onnx/) — load with
+`onnxruntime` on any platform (CoreML / DirectML / CUDA / CPU baseline);
+the same file ships everywhere.
 
-| Language | zero-leak |
-|---|---:|
-| English | 76.8% (70.1–83.1) |
-| Spanish | 73.2% (66.5–79.3) |
-| Italian | 70.8% (64.3–77.4) |
-| German | 70.6% (63.5–77.1) |
-| French | 68.1% (61.5–75.3) |
-| Dutch | 56.1% (48.9–63.3) |
+## Multilingual
 
-Romance + Germanic languages drop −3 to −9 pp from English.
-**Dutch is the weakest** — flagged as a known gap.
+Handles 6 languages (en, fr, de, it, es, nl). English is strongest;
+Dutch is the weakest and is flagged as a known gap. Validate on your
+locale before deploying.
 
 ## Limitations
 
-1. **Sudo / login password prompts leak.** Pattern like `[sudo]
-   password for alice: hunter2` results in the username being redacted
-   but the password surviving. One known hard miss in the targeted
-   secret probe; mitigate with an OS-level keystroke-suppression policy
-   alongside this model.
-2. **Dutch is the weakest language** at −20.7 pp from English. Indic,
-   Asian, African, Cyrillic scripts not evaluated at meaningful sample
-   sizes — don't deploy without a locale-specific eval pass.
-3. **Synthetic training data only.** No real user data was used during
-   fine-tuning. Validate on YOUR data before deploying.
-4. **Oversmash.** 7.8% on accessibility / window titles, 16.5% on
-   long-form text. The model over-redacts. Acceptable for privacy-first
-   deployments; flag if you need clean OCR text downstream.
-5. **Strict label-space evaluation.** The numbers above use a
-   12-class taxonomy and a strict per-example zero-leak metric.
-   Absolute values depend on the evaluator's label taxonomy and metric
-   choice; macro-F1 is a more lenient point of comparison.
-
-## Reproducing inference
-
-```bash
-git clone https://huggingface.co/screenpipe/pii-redactor
-cd pii-redactor
-git lfs pull
-pip install git+https://github.com/openai/privacy-filter.git
-python examples/inference.py
-```
-
-Reproducing the eval scores requires our held-out benchmark, which is
-not redistributed. Contact **louis@screenpi.pe** for benchmark access
-or commercial licensing.
+1. **Sudo / login password prompts can leak.** `[sudo] password for
+   alice: hunter2` may redact the username but survive the password.
+   Pair with an OS-level keystroke-suppression policy.
+2. **Multi-entity blobs degrade recall** — redact per captured fragment
+   (see tip above), not one giant concatenated string.
+3. **Synthetic training data only.** No real user data was used. Validate
+   on YOUR data before deploying.
+4. **Over-redaction (oversmash).** The model errs toward redacting — good
+   for privacy-first deployments; flag it if you need clean text
+   downstream.
+5. **Strict zero-leak metric.** Absolute numbers depend on the
+   evaluator's taxonomy and metric; macro-F1 is a more lenient lens.
 
 ## License
 
-[CC BY-NC 4.0](LICENSE) — non-commercial use only. The base model is
-Apache-2.0; obligations are preserved (see [`NOTICE`](NOTICE)).
+[CC BY-NC 4.0](LICENSE) — non-commercial use only. See [`NOTICE`](NOTICE)
+for third-party component attributions.
 
-For commercial licensing (production deployment, redistribution rights,
-SaaS / API embedding, custom fine-tunes for your domain): **louis@screenpi.pe**.
+For commercial licensing (production deployment, redistribution, SaaS /
+API embedding, custom fine-tunes for your domain): **louis@screenpi.pe**.
 
 ## Citation