> Source: https://www.ema.ai/blog/agentic-ai/hush-pii-redaction-model
> Title: Meet Hush: Ema's PII Redaction Model for Conversations
> Description: Hush, Ema's small language model for PII redaction, scores 97.7 F1 on PII-TRACE, 34 points ahead of GPT-5.6, and runs on a single GPU.

# Meet Hush: The Small Language Model That Beats Frontier AI at Protecting Customer Conversations

November 3, 2026, 7 min

Copy Link

[Craig Dewar](https://www.linkedin.com/in/craigdewar/) [Agentic AI](https://www.ema.ai/blog/agentic-ai)

[ai and data privacy](https://www.ema.ai/blog/tags/ai-and-data-privacy)[Trust and Security](https://www.ema.ai/blog/tags/trust-and-security)[contact center automation](https://www.ema.ai/blog/tags/contact-center-automation)3+

Listen to any customer service call and you will hear personal data arrive in pieces. A caller reads half a card number, pauses, then finishes it two turns later. A few minutes later, they spell out their surname for the agent, one letter at a time.

This is the raw material enterprises now hand to AI. Contact centers use it to score every call for quality, coach agents and catch compliance gaps. Before any of that can happen, the personal data has to come out. Miss one card number and a program meant to improve service becomes a privacy incident.

Every customer experience AI deployment depends on getting redaction right, and general-purpose AI is weak at it. Standard PII tools were designed for documents and forms, and frontier models are generalists. Neither was built for the way people talk on a call.

Today Ema is launching Hush, a PII redaction model built for conversations. It is the most accurate model we know of for this job, and it runs on a single GPU. Hush is also the first model from Ema's self-recursive pipeline: the AI builds and tests the next version of itself, and a person approves every release.

## Why conversations break standard privacy tools

Redacting a form is relatively easy. The name sits in the name field and the account number sits in the account field. A conversation has no fields. Personal details are scattered across turns, repeated, reformatted and sometimes corrected halfway through.

Illustrative transcript after redaction. Not a real customer call.

A detector that catches the first mention of a card number and misses the second has still leaked the card number. A useful detector has to find every mention, in every turn, in whatever format the person used.

That is what [PII-TRACE](https://r2cdn.perplexity.ai/research/PII-Trace-202609.pdf) measures. Perplexity released the benchmark in September 2026: more than 13,000 multi-turn conversations in 13 languages, built so the same identifiers recur across turns. This dataset was not used in Hush's training cycle, which makes it a fair test of how a model handles conversations it has never seen.

Hush leads PII-TRACE by 34 points over the best frontier model.

Hush has an F1 score of 97.7 out of 100: it finds 97.1% of the personal data in the benchmark, and 98.2% of what it masks really is personal data. The best general-purpose model in [Perplexity's published results](https://arxiv.org/pdf/2609.22200), GPT-5.6-sol, scores 63.2. Dedicated privacy tools trail further, with Microsoft's widely used open-source Presidio below 10.

Hush is 9.8 GB and runs on one L4 GPU, yet it finishes 34 points ahead of GPT-5.6-sol and 40 points ahead of Claude Sonnet 5. On a specialized task like this one, model size is a poor predictor of accuracy. It also holds up on written text it never saw in training. On Nemotron-PII, a benchmark of business documents, Hush outperforms OpenAI Privacy Filter, GLiNER-PII and Presidio.

## Accurate on real calls, affordable on every call

We also measured how Hush performs in production deployments, using 1,972 real calls that were never used in training. Hush found 91% of the personal details in those calls.

The gap holds on real calls, too. We ran a head-to-head on 500 calls from production deployments that none of the models had trained on. Hush scored 95.0 F1, against 53.5 for PII-Tracer and 46.4 for GPT-5.6-sol. The gap was widest on payment details and IDs: Hush found 90% of them, GPT-5.6-sol 50% and PII-Tracer 15%.

| By type of personal data | Score out of 100 |
| --- | --- |
| Person information | 95.2 |
| Payment credentials and government IDs | 93.9 |
| Transaction and contact details | 89.7 |

Over-masking is its own failure. When a model hides product names and order totals along with card numbers, the quality analysis that follows has little left to work with. Of the values Hush masks, 95% are genuinely personal data.

The seven languages are English, German, Portuguese, Hindi, Dutch, Spanish and French. Global contact centers rarely run in one language, and callers sometimes switch partway through a call. Hush handles those switches as well.

| By language | Score out of 100 |
| --- | --- |
| English | 94.9 |
| German | 92.9 |
| Portuguese | 92.6 |
| Hindi | 92.2 |
| Dutch | 92.0 |
| Spanish | 91.4 |
| French | 91.4 |
| Calls that switch language | 87.7 |

Hush is also cheap to run. On one L4 GPU, it processes 1,862 calls an hour. At that speed, a contact center can redact every call by default.

## A model that builds its own successor

Every update to our PII model used to take weeks of hand-labelling data, retraining and spot-checking results. Hush is the first model from Ema's new self-recursive pipeline instead, and the team can trace every step of each loop. One command runs a full improvement cycle, and a person approves each new version before it goes to production.

Each cycle has three stages, and an automatic check closes each one:

1.  Make the data. The pipeline studies the shape of current production traffic, then generates synthetic calls that match it in language, length and mix of personal data. The fake card numbers and IDs pass real validity checks, and the simulated callers say them the way real callers do: digit by digit, spelled out, or split across turns.
2.  Learn from mistakes. The current model works through each call. A stronger model reviews its reasoning, adds what it missed, fixes wrong labels and removes false alarms.
3.  Train and test. A new model trains on the corrected data, then faces every earlier test set plus the new ones. It moves forward only if no language and no type of personal data gets worse, and a person signs off before it goes to production. Otherwise the current model stays in place.

One full improvement cycle, with a person approving every release.

The pipeline also rejects any batch of synthetic calls that drifts from real traffic or repeats itself, and test calls never go into training.

Customer traffic shifts as new markets, products and languages come online. A full cycle lets Ema retrain Hush on that new traffic within a day, where manual updates took weeks. The release rule means no new version ships if it scores worse on any language or type of personal data.

## Privacy that keeps pace with your conversations

Every enterprise using AI in customer experience has to strip personal data from its conversations before the AI can use them. That redaction has to work in every language customers speak and leave intact the context the AI needs.

Hush, a 9.8 GB model built for conversations, outperforms leading general-purpose models by more than 34 points on a public benchmark for conversational PII. It scores 91 to 95 out of 100 in production deployments across seven languages.

Hush works on calls, chats, mixed text and business documents, and it can be enabled today for any business use case that doesn't need a real-time response. As enterprises hand more work to AI Employees, more of that work touches customer data, and each of those workflows needs redaction it can rely on.

Hush was built by Ema's ML team, led by Aniket Nikam and Abhishek Niranjan, with Rishabh Jain and Aryan Jain on product.

See how Hush protects customer data. [Book a demo](https://www.ema.ai/hire-ema).