privfill is a Python package providing LLM-based local Differential Privacy (DP) mechanisms for text privatization via sentece infilling. It offers easy-to-use wrappers for fine-tuned Hugging Face models. This software was originally presented in the NAACL 2025 findings paper: On the Impact of Noise in Differentially Private Text Rewriting

Installation

Install the package locally in editable mode from your project's root directory:

pip install privfill

Core Prerequisites:

• Python $\geq$ 3.9
• PyTorch (CUDA recommended for faster inference)
• Transformers & NLTK

Basic Usage & Model Selection

Instead of typing Hugging Face repository paths, you can choose from the three built-in models using the SupportedModels enum.

import privfill

# Choose between FLAN_T5_BASE, FLAN_T5_LARGE, and BART_LARGE
engine = privfill.load_pipeline(privfill.SupportedModels.FLAN_T5_BASE, DP=True)

text = "This is a long private document ... which contains sensitive information and should be privatized,"
private_text = engine.privatize(text, epsilon=10)

print(private_text)

As described in the paper, we also create an analagous, non-DP variant of PrivFill. The usage is very similar:

engine = privfill.load_pipeline(privfill.SupportedModels.FLAN_T5_BASE, DP=False)
private_text = engine.privatize(text)

Available Models

Models

We make our three sentence infilling models public. They can be found at this link.

Comparison Code

We also include the LLMDP class code for DP-BART and DP-Prompt, as used in the paper.

X = LLMDP.DPPrompt()
# or
X = LLMDP.DPBart()

# then
X.privatize(text, epsilon)