Introducing Open Pseudonym: keep personal data away from AI models

Open Pseudonym is an open specification and SDK from the Atlas Research Lab. It keeps personal data away from AI models without making them worse at the task. Version 0.1.1 is on PyPI and npm, free for anyone.

What problem does it solve?

To help with an email, a model has to read the email. Names, addresses, phone numbers, dates and sometimes a one-time code travel with it. Swapping them for labels like [NAME_1] protects the data but makes the model worse: it loses track of who said what, and date maths stops working.

How does it work?

Before text reaches a model, Open Pseudonym swaps names, emails, phone numbers, dates and secrets for stand-ins chosen for the task at hand. The model works on the stand-ins. When it answers, the real values go back in on your side. The key that links the two never leaves your device, or your own server.

• It hides by task. A policy says what happens to each type of data for each kind of task. Scheduling keeps real dates so calendar maths works; a reply fakes the contact details. Code picks the policy and can only make it stricter. The model never picks.
• It keeps the model's context. The same person gets the same fake name everywhere, and dates move together by whole weeks, so Thursday stays Thursday.
• It proves what left. Before a request goes, its exact bytes are checked for every real value the vault knows. With receipts on, every request that goes gets a signed, hash-chained receipt you can check later.

What are secret handles?

Some values the model only needs to move, not read: a one-time code, a password, a card number. Open Pseudonym turns one into a handle such as {{OTP_1}} plus a short note, for example a 6-digit code from example.com. When an agent types the handle into a login box, a small local filler checks that the box is really on example.com, puts the real code in at the last moment and burns the handle. A prompt injection that asks for the code somewhere else gets a refusal.

What does it not do?

It is pseudonymisation, not anonymisation. What reaches the model is still personal data in law, and a careful reader can sometimes work out who a text is about from what is left. A name with no cue in free text can be missed by the rules, so apps should pass the names they already know. The README lists every known limit, and says which benchmark numbers are optimistic.

How do I try it?

Install it with pip install open-pseudonym or npm install open-pseudonym, then follow the quick start on the Open Pseudonym page. The specification, test vectors and both SDKs are on GitHub. A hand-written test set from someone other than the author is the most useful contribution anyone could make right now.