Velum 0.12.0: the right model for the file in front of it
Velum 0.12.0 is out. It adds a second detection model and, more usefully, stops pretending one model is right for everything.
Maximum is a budget, not an engine
Until now, picking Maximum picked a model. Now it picks a ceiling, and Velum chooses the engine from what it is actually looking at.
Source files go to OpenAI's Privacy Filter. Everything else goes to the full span model Velum already used.
The reason is a difference in how the two read. The older model re-runs itself with a prompt every thousand characters, so it slows down as a file grows. Privacy Filter reads the whole file in one pass. On a short fragment the older model is quicker. On a 5 KB source file, which is the size a coding agent actually opens, Privacy Filter is 3.4 times faster and finds the same amount: both leak nothing on our source-code corpus.
Documents stay on the older model, because there it is genuinely better. On prose it leaks 0.04% where Privacy Filter leaks 3.28%, mostly on Catalan and Spanish names.
Neither model is better. They are better at different things, which is why the setting now routes instead of choosing.
We wrote up the full comparison, including a result that reversed on us when we changed corpus, in a separate post.
Dates of birth were about to leak
Privacy Filter has no date-of-birth category. It reports birth dates as a generic private date, and Velum keeps generic dates by default, because masking every date in a contract destroys the document for no privacy gain.
Put those two behaviours together and every date of birth walks straight through. The model finds 99.7% of them and the policy then waves them past.
They now route to a type that is always masked. If you are wiring Privacy Filter into something yourself, this is the trap: the model is doing its job, the policy is doing its job, and the combination leaks.
Form headings are no longer treated as names
"T.C. Kimlik", "Vergi", "IBAN", "Póliza". The heading printed next to an identifier, not the identifier itself. These were being masked as if they were people's names.
Fixing it improved the tier most people actually run: at the High setting, over-masking dropped from 1.04% to 0.31%, with no change to what leaks. Less of your document destroyed for the same protection.
Also in 0.12.0
- Two detection models loading at the same time could each overwrite a shared path and then read back the other's directory, failing the mask on a cold start. Fixed.
- Windows support landed in the codebase. It is not built or signed yet, so there is no Windows download, but the platform-specific work is done.
- The benchmark page now publishes results from a corpus we did not write, alongside our own. The numbers are worse and the licence is permissive, so you can check them.
What it costs
The Maximum download is now about 2.9 GB across two models, up from 1.1 GB. The Privacy Filter half is optional: if that download fails, Maximum keeps using the older model for source files, which is what 0.11.0 did.
High is unchanged, still bundled, still offline, still the default. Privacy Filter is a roughly 2 GB resident engine and has no business in the tier that has to stay light.
Getting it
0.12.0 runs on macOS on Apple silicon. If you already have Velum it will offer the update on next launch.