TL;DR
Get everyday helpers delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
NDS has released Rampart, an open-source alpha system that identifies and redacts personal information in a browser before a message is sent to an AI service. The project reports 98.4% private-term recall on a held-out test set across seven languages, but says the tool is a first line of defense, not a complete privacy guarantee.
NDS has open-sourced Rampart, an alpha system that checks text in a browser and redacts detected personally identifiable information (PII) on-device before a user sends a message to an AI service. The release matters to people who use chatbots with sensitive material because the system is designed to replace detected details with labels such as [SSN] without sending the original text to a separate redaction server.
Rampart combines two detection methods. A rules-based layer uses regular expressions and validation checks for structured details, including Social Security numbers, payment-card numbers, phone numbers, bank routing and account numbers, email addresses, IP addresses and government IDs. A small MiniLM language model handles information such as names and street addresses, where identifying a term can depend on sentence context.
The system runs between typing and sending, with no server in the redaction process, according to NDS. Its reported model package, including the tokenizer, is 14.7 MB, and NDS reports a median browser runtime latency of 3.9 milliseconds with WebGPU. The browser temporarily stores relevant personal information on the device so it can fill in the blanks, the report says.
NDS reports 98.4% private-term recall on a held-out test of 30,000 OpenPII rows covering seven Latin-script languages. The company says the benchmark used its shipped pipeline and training data drawn from AI4Privacy’s OpenPII 1.5M dataset, plus a synthetic generator designed to reinforce 17 entity types in informal chat-style text. The seven supported languages are English, Spanish, French, German, Italian, Portuguese and Dutch.
Redaction Before a Message Leaves
Rampart targets a specific privacy gap in chatbot use: people may paste names, addresses, financial details or other identifying information into a prompt, then transmit that text to a remote service. By attempting to replace recognized details in the browser first, the tool offers a way to reduce what is included in the outgoing message without relying on a server to perform the redaction.
The approach also lowers the stated download barrier compared with some larger PII models. NDS contrasts Rampart’s 14.7 MB package with a roughly 2.8 GB model it identifies as OpenAI Privacy Filter, arguing that a smaller model is more practical to use in a browser, particularly on slower connections. This comparison describes model size; it does not establish that the systems have equivalent features or performance.
For developers, an open-source browser library could make local redaction easier to add to AI chat interfaces. For users, however, the central question is not only whether detection is fast, but whether it catches the sensitive information in their particular message. A missed name or identifier may still be sent to the AI provider, so the release is best understood as an additional safeguard rather than proof that a prompt is private.
As an affiliate, we earn on qualifying purchases.
How Rampart Handles Prompts
NDS frames Rampart around a design principle: personal information is most reliably kept private when it does not leave the device. The report says existing PII-removal approaches can require either trusting a remote service or downloading client-side software. It cites concerns about verifying vendors’ privacy practices and the size of some models as reasons to build a smaller system that runs in the browser.
In NDS’s example, a sentence containing a person’s name and Social Security number is changed to use the labels [GIVEN_NAME], [SURNAME] and [SSN], while the rest of the request remains. The point is to let a chatbot respond to the substance of a prompt while withholding details the detector identifies. NDS says the system can temporarily retain relevant PII locally to restore the information where needed; the source does not describe the full user experience or the controls around that storage.
The benchmark compares Rampart with several alternatives, including GLiNER small v2.1, Community BERT-small PII, Microsoft Presidio and AWS Bedrock Guardrails. NDS reports recall figures of 94.2%, 81.5%, 65% and 63.8%, respectively, alongside Rampart’s 98.4%. The source presents the figures as results on its described test set, but does not provide enough detail here to establish that every competing system was configured or evaluated under identical conditions.
“The only personal information you can be sure is private is the information that never leaves your device.”
— NDS, in its Rampart announcement
As an affiliate, we earn on qualifying purchases.
Limits of the Alpha Release
NDS calls Rampart an alpha product and says it is intended as a first line of defense within a broader effort to manage PII in AI chat experiences. The report does not give a false-negative rate for each type of personal information, describe performance across all real-world writing styles, or establish how the benchmark results will translate to messages outside the test set.
The release also does not fully explain how local temporary storage is managed, how long detected details remain on the device, or what happens if a user edits a message after redaction. It is not clear from the supplied report whether the detector can be bypassed, how it handles unsupported languages or scripts, or whether the benchmark comparison used equivalent settings for each competing system.
On-device processing means the redaction step does not involve a server, according to NDS; it does not by itself establish the privacy practices of the chatbot a user ultimately contacts. The destination service may still receive unredacted information that Rampart fails to recognize, as well as the remaining text in the prompt.
As an affiliate, we earn on qualifying purchases.
Testing and Adoption Ahead
NDS says developers can get started by downloading the model from Hugging Face, installing the NPM library or reading the project whitepaper. Those options give developers routes to inspect and test the system, although the announcement does not set out a product roadmap, a stable-release date or plans for additional language support.
The next useful evidence will come from testing beyond the reported held-out benchmark: how Rampart performs with varied user-written prompts, how often it misses sensitive details, and how its local storage and redaction behavior work in deployed applications. NDS has not announced a timetable for such results in the source material. Until more is available, the project’s own alpha designation and first-line-of-defense description remain the clearest guide to its status.
personal data redaction browser extension
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is Rampart?
Rampart is an open-source alpha tool that detects and redacts personal information in browser text before it is sent to an AI service, according to NDS.
Does Rampart send prompts to a server for redaction?
NDS says the detection runs in the browser with no server in the redaction process. The report does not establish the privacy practices of the separate AI service that receives the message afterward.
Which languages does it support?
The announced release supports English, Spanish, French, German, Italian, Portuguese and Dutch, all listed by NDS as supported languages.
What does the 98.4% result mean?
NDS reports 98.4% private-term recall on a 30,000-row held-out OpenPII test spanning seven languages. It is a benchmark result, not a promise that Rampart will find every personal detail in every message.
Is Rampart a complete privacy guarantee?
No such guarantee is established in the report. NDS describes Rampart as an alpha and a first line of defense; information the system does not detect could remain in the message sent to an AI service.
Source: hn
Columbus Day / Indigenous Peoples' Day Picks
long weekend sales
As an affiliate, we earn on qualifying purchases.
