{"article":{"slug":"introducing-rampart","title":"Introducing Rampart","subtitle":null,"summary":"The National Design Studio open sources Rampart, a 14.7 MB on-device PII filter for AI chat that runs in the browser. It pairs validated regular expressions for structured data like SSNs and card numbers with a small MiniLM model for names and addresses, and reports 98.4% private-term recall across seven languages.","content_type":"announcement","language":"en","canonical_url":"https://ndstudio.gov/posts/say-hello-to-rampart","author":{"name":"Tai Groot and Edward Coristine","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"National Design Studio","url":"https://ndstudio.gov/","listing_slug":null,"listing":null},"topics":[{"name":"Privacy","slug":"privacy","url":"https://listedarticles.com/topics/privacy"},{"name":"AI","slug":"ai","url":"https://listedarticles.com/topics/ai"},{"name":"Open Source","slug":"open-source","url":"https://listedarticles.com/topics/open-source"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":841,"reading_minutes":4,"published_at":"2026-06-22T13:00:00.000Z","added_at":"2026-10-10T17:08:16.723Z","updated_at":"2026-10-10T17:08:16.723Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/introducing-rampart","markdown_url":"https://listedarticles.com/articles/introducing-rampart.md","example":false,"citation":"Tai Groot and Edward Coristine, National Design Studio. \"Introducing Rampart.\" 22 Jun 2026. https://ndstudio.gov/posts/say-hello-to-rampart (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://ndstudio.gov/posts/say-hello-to-rampart"},"body_markdown":"When you type into a chatbot, you might reveal more about yourself than you intend. A request to clean up an email carries your name and your coworker’s; a question about a medical bill carries your address and account number; a vented frustration carries who you are and where you live. And whatever you type doesn’t stay with you — it travels to a remote server you have no way to inspect.\n\nOur core design principle is that the only personal information you can be sure is private is the information that never leaves your device.\n\nToday, we open source Rampart — a first-generation on-device personal information filtering system that is a strong first line of defense in ensuring your personal information never leaves your device. Rampart is a combination of a deterministic layer, based on regular expressions to catch SSNs and ID numbers, and MiniLM to catch names and street addresses.\n\n## Why we built Rampart\n\nOften times, doing PII removal means either trusting a remote server or downloading binaries to the client, which present a few key challenges:\n\n1. AI privacy guarantees are almost impossible to verify. From first principles, it is impossible to verify the privacy and security claims of AI vendors. A newly deployed version of an AI runtime may accidentally begin logging sensitive user information, and services carry unknown internal security risks such as zero-day vulnerabilities and insider threats.\n2. Most models for PII removal are gigantic, narrowing the group of users that can benefit from them. For example, OpenAI Privacy Filter is ~2.8GB, which would take approximately 38 minutes to download to a browser on a relatively poor connection (10mbps).\n\n## How it works\n\nEverything happens in the browser, in the moment between typing a message and sending it; there is no server in the loop.\n\nModel size, including tokenizer14.7MB\n\np50 runtime latency, in the browser (WebGPU)3.9ms\n\nPrivate-term recall, seven languages98.4%\n\nBefore the message goes anywhere, two readers look at it on your device.\n\nThe first is a set of rules. Regular expressions paired with real validations handle the information that has structure: Social Security numbers, credit cards, phone numbers, routing and account numbers, emails, IP addresses, government IDs. It is deterministic and fast.\n\nThe second is a small language model. Rules can’t anticipate every name or street address, so MiniLM reads the sentence for the personal information with a deeper understanding of the context of the sentence, then redacts information it finds within a specific category.\n\nFor example, say you type a sentence full of personal information into chat:\n\nRampart redacts PII on-device so it doesn’t have to leave your device\n\nThe browser stores relevant PII temporarily on your device to fill in the blanks\n\nMy name is [GIVEN\\_NAME] [SURNAME], my Social Security number is [SSN], and I make $1,950 a month. Can you help me find affordable housing?\n\nHi Maria,\n\nHere are affordable housing options in New York.\n\n![The Eliza, Inwood, Manhattan | Affordable homes](https://ndstudio.gov/dev/riverbend-apartments.webp)\n\n### The Eliza\n\nInwood, Manhattan | Affordable homes\n\n![Sendero Verde, East Harlem, Manhattan | Affordable homes](https://ndstudio.gov/dev/sendero-verde.webp)\n\n### Sendero Verde\n\nEast Harlem, Manhattan | Affordable homes\n\nMessage\n\nOriginal: My name is Maria Garcia, my Social Security number is 123-45-6789, and I make $1,950 a month. Can you help me find affordable housing?\n\nAfter redaction: My name is [GIVEN\\_NAME] [SURNAME], my Social Security number is [SSN], and I make $1,950 a month. Can you help me find affordable housing?\n\n## Benchmarks\n\nWe trained Rampart on AI4Privacy’s OpenPII 1.5M dataset and a synthetic generator that reinforces all 17 entity types with deliberately messy chat-style input. The headline numbers below come from a 30,000-row held-out OpenPII slice spanning seven Latin-script languages, scored end-to-end by the shipped pipeline.\n\nRampartDeterministic + model · 14.7 MB\n\n98.42%\n\n[OpenAI Privacy Filter↗(opens in new tab)](https://huggingface.co/openai/privacy-filter)Model · ~2.8 GB\n\n97.4%\n\nGLiNER small v2.1Model · ~600 MB\n\n94.2%\n\nCommunity BERT-small PIIModel · ~29 MB\n\n81.5%\n\nMicrosoft PresidioDeterministic + model · ~13 MB\n\n65%\n\nAWS Bedrock GuardrailsModel · Cloud\n\n63.8%\n\nPrivate-term recall on a 30,000-row held-out OpenPII test set across seven supported languages. Higher is better. [Benchmark↗(opens in new tab)](https://inference.ndstudio.gov/rampart/whitepaper.pdf)\n\n## Limitations\n\nRampart is an alpha product intended to be the first line of defense in a more thorough effort to manage personally identifiable information for AI chat experiences. It currently supports English, Spanish, French, German, Italian, Portuguese, and Dutch.\n\n## Get started\n\nDownload the model on HuggingFace, install the NPM library, or read the whitepaper.\n\nIf the work of building elegant and useful tools for Americans speaks to you, consider joining NDS.\n\nchat.ts\n\n```\nimport { createGuard } from \"@nationaldesignstudio/rampart\";\n\n\n\nconst guard = await createGuard();\n\n\n\nconst safe = await guard.protect(\n\n\"My name is John Wick. I live at 88 Cedar Lane, Brookvale, CT 06482.\",\n\n);\n\n\n\nconsole.log(safe.text);\n\n// \"My name is [GIVEN_NAME_1]. I live at [BUILDING_NUMBER_1] [STREET_NAME_1], Brookvale, CT 06482.\"\n\n\n\nconst reply = await llm(safe.text);\n\nconsole.log(guard.reveal(reply));\n\n\n\nasync function llm(text: string): Promise {\n\nreturn \"Thanks [GIVEN_NAME_1], Brookvale CT 06482 works for eligibility.\";\n\n}\n\n// \"Thanks John Wick, Brookvale CT 06482 works for eligibility.\"\n```\n\n[HuggingFace↗(opens in new tab)](https://huggingface.co/nationaldesignstudio/rampart)[NPM library↗(opens in new tab)](https://www.npmjs.com/package/@nationaldesignstudio/rampart)[Whitepaper↗(opens in new tab)](https://inference.ndstudio.gov/rampart/whitepaper.pdf)","body_html":"

When you type into a chatbot, you might reveal more about yourself than you intend. A request to clean up an email carries your name and your coworker’s; a question about a medical bill carries your address and account number; a vented frustration carries who you are and where you live. And whatever you type doesn’t stay with you — it travels to a remote server you have no way to inspect.

\n

Our core design principle is that the only personal information you can be sure is private is the information that never leaves your device.

\n

Today, we open source Rampart — a first-generation on-device personal information filtering system that is a strong first line of defense in ensuring your personal information never leaves your device. Rampart is a combination of a deterministic layer, based on regular expressions to catch SSNs and ID numbers, and MiniLM to catch names and street addresses.

\n

Why we built Rampart

\n

Often times, doing PII removal means either trusting a remote server or downloading binaries to the client, which present a few key challenges:

\n
  1. AI privacy guarantees are almost impossible to verify. From first principles, it is impossible to verify the privacy and security claims of AI vendors. A newly deployed version of an AI runtime may accidentally begin logging sensitive user information, and services carry unknown internal security risks such as zero-day vulnerabilities and insider threats.
  2. Most models for PII removal are gigantic, narrowing the group of users that can benefit from them. For example, OpenAI Privacy Filter is ~2.8GB, which would take approximately 38 minutes to download to a browser on a relatively poor connection (10mbps).
\n

How it works

\n

Everything happens in the browser, in the moment between typing a message and sending it; there is no server in the loop.

\n

Model size, including tokenizer14.7MB

\n

p50 runtime latency, in the browser (WebGPU)3.9ms

\n

Private-term recall, seven languages98.4%

\n

Before the message goes anywhere, two readers look at it on your device.

\n

The first is a set of rules. Regular expressions paired with real validations handle the information that has structure: Social Security numbers, credit cards, phone numbers, routing and account numbers, emails, IP addresses, government IDs. It is deterministic and fast.

\n

The second is a small language model. Rules can’t anticipate every name or street address, so MiniLM reads the sentence for the personal information with a deeper understanding of the context of the sentence, then redacts information it finds within a specific category.

\n

For example, say you type a sentence full of personal information into chat:

\n

Rampart redacts PII on-device so it doesn’t have to leave your device

\n

The browser stores relevant PII temporarily on your device to fill in the blanks

\n

My name is [GIVEN_NAME] [SURNAME], my Social Security number is [SSN], and I make $1,950 a month. Can you help me find affordable housing?

\n

Hi Maria,

\n

Here are affordable housing options in New York.

\n
\"The
\n

The Eliza

\n

Inwood, Manhattan | Affordable homes

\n
\"Sendero
\n

Sendero Verde

\n

East Harlem, Manhattan | Affordable homes

\n

Message

\n

Original: My name is Maria Garcia, my Social Security number is 123-45-6789, and I make $1,950 a month. Can you help me find affordable housing?

\n

After redaction: My name is [GIVEN_NAME] [SURNAME], my Social Security number is [SSN], and I make $1,950 a month. Can you help me find affordable housing?

\n

Benchmarks

\n

We trained Rampart on AI4Privacy’s OpenPII 1.5M dataset and a synthetic generator that reinforces all 17 entity types with deliberately messy chat-style input. The headline numbers below come from a 30,000-row held-out OpenPII slice spanning seven Latin-script languages, scored end-to-end by the shipped pipeline.

\n

RampartDeterministic + model · 14.7 MB

\n

98.42%

\n

OpenAI Privacy Filter↗(opens in new tab)Model · ~2.8 GB

\n

97.4%

\n

GLiNER small v2.1Model · ~600 MB

\n

94.2%

\n

Community BERT-small PIIModel · ~29 MB

\n

81.5%

\n

Microsoft PresidioDeterministic + model · ~13 MB

\n

65%

\n

AWS Bedrock GuardrailsModel · Cloud

\n

63.8%

\n

Private-term recall on a 30,000-row held-out OpenPII test set across seven supported languages. Higher is better. Benchmark↗(opens in new tab)

\n

Limitations

\n

Rampart is an alpha product intended to be the first line of defense in a more thorough effort to manage personally identifiable information for AI chat experiences. It currently supports English, Spanish, French, German, Italian, Portuguese, and Dutch.

\n

Get started

\n

Download the model on HuggingFace, install the NPM library, or read the whitepaper.

\n

If the work of building elegant and useful tools for Americans speaks to you, consider joining NDS.

\n

chat.ts

\n
import { createGuard } from "@nationaldesignstudio/rampart";\n\n\n\nconst guard = await createGuard();\n\n\n\nconst safe = await guard.protect(\n\n"My name is John Wick. I live at 88 Cedar Lane, Brookvale, CT 06482.",\n\n);\n\n\n\nconsole.log(safe.text);\n\n// "My name is [GIVEN_NAME_1]. I live at [BUILDING_NUMBER_1] [STREET_NAME_1], Brookvale, CT 06482."\n\n\n\nconst reply = await llm(safe.text);\n\nconsole.log(guard.reveal(reply));\n\n\n\nasync function llm(text: string): Promise<string> {\n\nreturn "Thanks [GIVEN_NAME_1], Brookvale CT 06482 works for eligibility.";\n\n}\n\n// "Thanks John Wick, Brookvale CT 06482 works for eligibility."
\n

HuggingFace↗(opens in new tab)NPM library↗(opens in new tab)Whitepaper↗(opens in new tab)

","headings":[{"level":2,"text":"Why we built Rampart","id":"why-we-built-rampart"},{"level":2,"text":"How it works","id":"how-it-works"},{"level":3,"text":"The Eliza","id":"the-eliza"},{"level":3,"text":"Sendero Verde","id":"sendero-verde"},{"level":2,"text":"Benchmarks","id":"benchmarks"},{"level":2,"text":"Limitations","id":"limitations"},{"level":2,"text":"Get started","id":"get-started"}]}}