[Feature]: PII Redaction via Local Models — Anonymize Sensitive User Data Before Sending to LLMs

Background

When users chat with cloud-hosted LLMs, their messages are sent verbatim to external servers — including any personal identifiable information (PII) they may have typed or pasted: national ID numbers, full names, phone numbers, home addresses, bank card numbers, email addresses, and more. Users working with contracts, medical records, HR documents, or financial data routinely paste content containing such information without realizing it will leave their device. Cherry Studio currently has no mechanism to detect or redact PII before transmission. Users who care about privacy must manually sanitize every message, which is error-prone and impractical for long documents.

Goal

Users can enable a PII redaction capability — powered by a local model from the plugin system's Local Models tier — that automatically detects and masks sensitive personal information (ID numbers, names, phone numbers, addresses, etc.) in outgoing messages before they reach the cloud LLM, with no sensitive data ever leaving the device.

Spec

• A new "PII Redaction" capability is available in Settings → Capability Tools (as part of the pluggable capability system, #14895). It has a master enable/disable toggle and runs entirely on-device using a local NER/PII model from the Local Models tier.
• When enabled, every outgoing user message is passed through the local PII detection model before being sent to the cloud LLM. Detected PII entities are replaced with type-tagged placeholders (e.g., "张三" → [NAME_1], "310101199001011234" → [ID_NUMBER_1], "13812345678" → [PHONE_1], "北京市朝阳区XX路XX号" → [ADDRESS_1]).
• Supported PII categories at minimum: person names, national ID numbers, phone numbers, home/office addresses, email addresses, bank card numbers. Additional categories (passport numbers, license plates, medical record numbers) can be extended via the local model's capabilities.
• The LLM receives only the redacted message. When the LLM's response references a placeholder (e.g., "The holder of [ID_NUMBER_1] should..."), the placeholder is restored to the original value in the displayed response — so the user sees the real data in the conversation UI, but it was never transmitted.
• Users can preview the redacted version before sending: a visual indicator (e.g., a shield icon on the input bar) shows that PII redaction is active, and clicking it reveals which entities were detected and masked, allowing the user to override specific detections.
• PII redaction applies to user-typed messages, pasted text, and text extracted from uploaded documents. File attachments (images, PDFs) sent directly to multimodal models are not redacted by this feature (that would require OCR + redaction, tracked separately).
• All PII detection and placeholder mapping runs locally — the mapping table (placeholder ↔ original value) is held only in memory for the duration of the conversation and is never persisted to disk or transmitted externally.

Verification

• User enables PII Redaction and has installed a local NER model (e.g., PII-detector-zh, 80MB). User types: "帮我写一封信给张三，身份证号310101199001011234，电话13812345678，住在北京市朝阳区建国路88号。" — the message sent to the LLM contains: "帮我写一封信给[NAME_1]，身份证号[ID_NUMBER_1]，电话[PHONE_1]，住在[ADDRESS_1]。" The user's conversation UI shows the original text with a small shield badge indicating redaction was applied.
• LLM responds: "Dear [NAME_1], regarding your ID [ID_NUMBER_1]..." — the displayed response in the conversation shows: "Dear 张三, regarding your ID 310101199001011234..." with placeholders seamlessly restored.
• User clicks the shield icon on the input bar before sending — a dropdown shows: "Detected: 张三 (Name), 310101199001011234 (ID Number), 13812345678 (Phone), 北京市朝阳区建国路88号 (Address)" with toggles to exclude specific items from redaction. User untogles "张三" — the name is sent in cleartext while other PII remains masked.
• User pastes a 2-page employment contract containing 5 names, 3 ID numbers, and 4 phone numbers — all are detected and masked within 1–2 seconds (local model inference). The shield icon shows "12 PII entities detected".
• User sends a message with no PII (e.g., "explain quantum computing") — the message is sent unmodified, no redaction applied, shield icon shows "No PII detected".
• PII Redaction is enabled but the required local model is not installed — the capability shows an inline warning: "Requires PII detection model (80MB). Install now?" Sending messages proceeds without redaction until the model is installed.
• User starts a new conversation — the placeholder mapping from the previous conversation is gone. Previous conversation's placeholders cannot be reverse-mapped, ensuring no cross-conversation PII leakage.
• User disables PII Redaction in settings — messages are sent verbatim to the LLM, no detection or masking occurs, shield icon disappears from the input bar.

Related

#14895