opf-mlx

opf-mlx is a small Rust client for a persistent native MLX implementation of the OpenAI Privacy Filter. It tokenizes text in Rust, exchanges bounded binary messages with the helper process, applies the checkpoint's Viterbi calibration, and returns UTF-8 byte spans for detected privacy categories.

The crate does not compile or link MLX, Metal, C++, model weights, or native runtime code. Applications provide the separately built helper executable and model artifact when creating a client.

Platform status

The client targets Unix process and pipe APIs. The accompanying native helper currently targets Apple silicon and is distributed separately from this crate.

Example

use std::path::PathBuf;

use opf_mlx::{PrivacyFilter, ServerOptions};

let mut filter = PrivacyFilter::spawn(
    PathBuf::from("/path/to/opf-mlx-server"),
    PathBuf::from("/path/to/model.mlxfn"),
    ServerOptions::default(),
)?;
let detection = filter.detect("Contact alice@example.com")?;

for span in detection.spans {
    println!("{}: {}..{}", span.label.as_str(), span.start, span.end);
}

# Ok::<(), opf_mlx::Error>(())

Privacy boundary

Raw text remains in the caller. Only token IDs are sent to the local helper, and only BIOES labels are returned. The client validates protocol cardinality, size limits, timeouts, UTF-8 boundaries, and calibrated span decoding. Policy, overlap resolution, pseudonymization, and storage belong to the application.

License

Apache-2.0.