Inspiration
I kept watching people do the same thing before pasting something private into ChatGPT: delete the name, then hit send. A lawyer with a client file, someone with a medical note, an HR complaint. Taking the name out feels like enough. It isn't. A capable model reads everything that's left and puts the person back together from the rest. That bugged me enough to test it, and the test was ugly: I stripped the name off a short biography and GPT-5.6 still named the subject at 99.9% confidence. So the real question was never how to scrub a document. It's whether a document can be made safe for a given task at all, and most tools never ask. They say "clean" and move on.
What it does
admissible is a gate between your sensitive documents and the AI you want to use. You paste a document and say what you actually need the AI to do. Then it runs a real attack: only a sanitized copy crosses to a fixed GPT-5.6 attacker, which tries to identify the subject and has to cite the exact clues it used. A local controller checks every claim against the original before a single character changes. The guessed identity has to match ground truth; every quoted clue has to resolve to one exact span of text, so a made-up quote authorizes nothing. Clues that can be safely blurred get rewritten by a local model; the facts your task actually needs are protected and never traded away. Then it attacks again. At the end it rules: cleared, or held. On a hold it names the exact fact that blocked it and takes the copy button away. What clears, you take to any AI under stand-in names; paste the answer back and the real names come home exactly as they were.
How I built it
Codex wrote the codebase from scratch under my direction: the local controller, the privacy checks, the surrogate vault, the exact-restore path, the React UI, and the evaluation harnesses. It's a local FastAPI backend, a React front end, a small local model (Qwen 3.5 4B through Ollama) for the rewrites, and GPT-5.6 as the remote attacker. GPT-5.6 played two parts: the adversary inside the product, and the thing that kept proving my early versions wrong. Every design decision came out of watching the attacker win, so I built the answers one at a time: rank-one grounding, task-critical fact protection, rollback to the best tested state, natural surrogates instead of black boxes, and the honest hold. The rules are code, not prompts, so you can read them.
Challenges I ran into
The first version looked great and was quietly broken. It re-identified the subject 53% of the time and I nearly shipped it as a win. Running the GPT-5.6 attacker against each control is what caught it. The hard part was resisting the urge to declare victory; it's easy to build something that says "clean" and much harder to build something that admits when it can't. Grounding was another one: an attacker will happily quote text that isn't there, so I made every clue resolve to one exact span or count for nothing. And the honest tier stung. Against an attacker that also holds matching outside records, the gate clears nothing today, 0 of 5. I put that number on the first screen instead of hiding it.
Accomplishments that I'm proud of
The gate refuses. When protecting the subject would mean breaking the task, it stops and says so, instead of handing back something that looks safe and isn't. The restore is exact, every time. The whole thing runs locally, with the remote model as the only component that ever sees a sanitized copy, and a security review came back with nothing critical. And the 0/5 sits on the first screen, on purpose. A tool that tells you what it can't do is the one I'd actually trust with my own files.
What I learned
Whether a document exposes someone was never a property of the document. It depends on the reader and the task, which is why a scrubber that reports "clean" is answering a question the text can't answer. I learned to treat honesty as something you build, not a disclaimer you bolt on at the end: the refusal, the grounding, the 0/5 on screen. And I learned that an adversary you actually run beats any amount of self-assurance. Every real improvement in this project came from losing to the attacker first.
What's next for admissible
The primary tier is the open problem. Closing the gap against an attacker that has outside records is the whole next chapter, and it's where that honest 0/5 has to move. After that: more document types and languages, a way to tune how much a given task is allowed to give up, and getting this in front of the people who paste sensitive work into AI every day. admissible is chapter one of a simpler bet, that privacy tooling should stop selling assurance and start deciding.
Log in or sign up for Devpost to join the conversation.