TL;DR
Get wellness gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
NDS Studio has open-sourced Rampart, an alpha tool that scans chat messages in the browser and replaces detected personal information before a message is sent. The project reports 98.4% private-term recall on a held-out test set, but says the tool is an initial layer of protection, not a complete privacy solution.
NDS Studio has open-sourced Rampart, an alpha system that identifies and redacts personal information in a browser before a chat message is sent. The project combines rule-based detection with a small language model, aiming to limit how much identifying information users share with remote chatbot services.
According to NDS Studio’s announcement, Rampart runs entirely in the browser, in the interval between a user typing a message and sending it; the company says no server is involved in the filtering step. When it detects information such as a name or Social Security number, the system substitutes a category label, such as [GIVEN_NAME] or [SSN]. The browser temporarily keeps the information needed to fill in those blanks, the announcement says.
The detection pipeline has two parts. Regular expressions paired with validation checks look for structured data, including phone numbers, credit cards, email addresses, government identification numbers and account details. A MiniLM model is used to identify context-dependent information, especially names and street addresses, that may not match a fixed pattern.
NDS Studio reports a 14.7-megabyte model package, including its tokenizer, and a median browser runtime latency of 3.9 milliseconds using WebGPU. It also reports 98.4% private-term recall on a held-out sample of 30,000 OpenPII records spanning seven Latin-script languages. The source describes the system as supporting English, Spanish, French, German, Italian, Portuguese and Dutch. Those figures are the project’s reported results, not an independent assessment.
A Local Filter Before Chat Submission
If it works as described, Rampart could reduce the amount of identifying information sent to a chatbot provider when people use AI to edit messages, ask questions about bills or discuss other personal matters. Filtering before transmission differs from sending a complete message to a remote service and asking that service to remove sensitive details afterward.
The browser-based approach may also make PII filtering more accessible than systems that require large downloads or remote processing. NDS Studio says Rampart’s small package is intended to address the size of some existing models, which can make client-side use harder on slower connections or less capable devices. That is a practical design aim; the announcement does not establish how well the system performs across different browsers, hardware or real-world chat applications.
For users, the key point is that on-device redaction is a first layer, not a guarantee that all personal data stays private. A detector can miss information, redact ordinary text incorrectly or fail to recognize a sensitive detail expressed in an unexpected way. Rampart’s own description calls it a first-generation alpha and says it should be part of a more thorough effort to manage personal information.
privacy redaction browser extension
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
How Rampart Handles Sensitive Text
NDS Studio frames the project around a concern that text entered into chatbots may contain details users did not intend to share with a service. Examples in its announcement include names in an email, an address and account number in a question about a medical bill, or other information embedded in a personal account. Its stated design principle is that personal information is most reliably kept private when it does not leave the user’s device.
The group says existing approaches often rely either on a remote service or on software downloaded to a user’s device. It argues that remote processing can be difficult for users to verify and that large models can be burdensome to download. Rampart’s proposed alternative is a compact browser pipeline using deterministic rules for structured information and a language model for details that depend on context.
For its reported evaluation, NDS Studio says it trained Rampart using AI4Privacy’s OpenPII 1.5M dataset and a synthetic generator covering 17 entity types. It says the headline score came from an end-to-end test on a 30,000-row held-out slice. The report compares Rampart’s recall with several other tools and models, but the supplied material does not provide enough detail to independently verify the test setup or assess how comparable each system’s evaluation was.
“The only personal information you can be sure is private is the information that never leaves your device.”
— NDS Studio, in the Rampart announcement
Limits of the Alpha Evaluation
The announcement does not specify an independent audit, a release date beyond saying the system is open source, or how the reported recall score varies by language and type of personal information. It also does not give a false-positive rate, which would help show how often ordinary text might be incorrectly replaced. Real-world performance remains unclear, including on devices without WebGPU support and in varied browser and chatbot setups.
The report says the browser stores relevant personal information temporarily to restore redacted text, but the supplied material does not explain the storage mechanism, how long those values remain available, or what happens if a browser session ends unexpectedly. The announcement also does not establish that Rampart detects every sensitive detail or explain how users can review missed detections before sending a message. Its seven-language support is stated by the project; the provided benchmark description does not give separate results for each language.
Installation and Further Testing
NDS Studio says developers and users can access Rampart through a model download on Hugging Face, an NPM library and a white paper. The source does not announce a specific next release date or a planned timetable for moving beyond alpha. Further documentation and testing will be needed to clarify setup, language-level performance, handling of temporarily stored text and behavior across browsers.
People considering the tool should treat its reported benchmark as an early project result, not proof that messages are free of identifying information. The next practical evidence will come from fuller technical documentation, independent testing and reports on how the alpha performs in actual browser-based chat workflows.
Key Questions
What is Rampart?
Rampart is an open-source, browser-based PII filter announced by NDS Studio. It is designed to detect and replace personal information in a chat message before the message is sent to a remote service.
Does Rampart send messages to its own server for filtering?
NDS Studio says the filtering happens on the device and that there is no server in the loop. The announcement does not provide an independent technical audit of that claim.
What information can Rampart redact?
The project says its rules target structured details such as Social Security numbers, card numbers, phone numbers, emails and identification numbers. Its MiniLM component is intended to detect names and street addresses using sentence context.
How accurate is Rampart?
NDS Studio reports 98.4% private-term recall on a held-out 30,000-row OpenPII test sample across seven languages. The supplied report does not include an independent verification or a false-positive rate, so the score should be understood as the project’s own benchmark result.
Is Rampart a complete privacy guarantee?
No. NDS Studio describes it as an alpha and a first line of defense. It may miss sensitive details or incorrectly redact text, and the announcement does not establish that every message or browser setup will be covered.
Source: hn
Columbus Day / Indigenous Peoples' Day Picks
long weekend sales
As an affiliate, we earn on qualifying purchases.
