TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
NDS has open-sourced Rampart, an alpha system that detects and redacts personal information in a browser before a message is sent to a chatbot. The project says its 14.7 MB pipeline achieved 98.42% private-term recall on a held-out test set; the result is specific to that evaluation and does not establish that every message or data type will be caught.
NDS has open-sourced Rampart, an alpha tool that scans chatbot messages in the browser and redacts detected personal information before the text is sent. The project combines regular-expression rules with a small MiniLM model, aiming to reduce the amount of personally identifiable information (PII) users disclose to remote AI services.
Rampart runs on the user’s device, in the interval between typing a message and sending it, according to NDS’s announcement. The system applies two kinds of detection: validated rules for structured information such as Social Security numbers, payment-card numbers, phone numbers, email addresses and government IDs, and a MiniLM model intended to identify names and street addresses from sentence context.
NDS reports that the model and tokenizer together are 14.7 MB, and gives a median browser runtime latency of 3.9 milliseconds using WebGPU. Those figures describe the project’s reported setup; the announcement does not specify the range of devices or browser configurations tested for the latency measurement.
For its accuracy comparison, NDS says it evaluated the shipped pipeline on a 30,000-row held-out slice of AI4Privacy’s OpenPII dataset, covering seven Latin-script languages. It reports 98.42% private-term recall. The same comparison lists 94.2% for GLiNER small v2.1, 81.5% for Community BERT-small PII, 65% for Microsoft Presidio and 63.8% for AWS Bedrock Guardrails. These are results reported by the project, not an independent assessment; the report says recall is the measure and does not establish equivalent performance across all products or real-world inputs.
Redaction Before Messages Leave
If it works as intended, browser-side filtering gives users a chance to remove some identifying details before submitting text to a remote chatbot. That could matter when people ask for help editing emails, understanding bills or discussing personal circumstances, where names, addresses or account details can appear alongside an otherwise ordinary request.
NDS argues that local processing avoids relying on a remote service to inspect and remove PII, and says its small model is intended to make the approach practical in a browser. But Rampart is described as a first line of defense, not a complete privacy guarantee. A missed identifier could still be sent, and the announcement does not establish that the system prevents chatbot providers from receiving information that remains in a message.
The design also leaves users with a practical trade-off: redaction can preserve the general meaning of a request while replacing identifying details with labels, but removing information may make some tasks harder. NDS says the browser temporarily stores relevant PII on the device to fill in the blanks. The announcement does not explain the complete restoration workflow or how users control that local information.
As an affiliate, we earn on qualifying purchases.
Rules and MiniLM Work Together
NDS presents Rampart as an alternative to approaches that send text to a remote service for PII filtering or require users to download larger models. Its announcement says remote privacy assurances can be difficult for users to verify, while large models may limit access because of download time and device requirements. Those are the project’s stated reasons for building the tool.
The two-part design reflects different detection needs. Regular expressions and validation checks can identify data with predictable formats, while a language model can use surrounding words to spot names and addresses that do not follow one fixed pattern. The example in the report replaces a person’s name and Social Security number with category labels while leaving the stated monthly income and housing question intact.
Rampart currently supports English, Spanish, French, German, Italian, Portuguese and Dutch, according to NDS. The project says it trained on AI4Privacy’s OpenPII 1.5M dataset and a synthetic generator covering 17 entity types. The published evaluation described in the announcement is narrower than a general claim of protection: it uses a held-out dataset slice and seven Latin-script languages.
“The only personal information you can be sure is private is the information that never leaves your device.”
— NDS, in its Rampart announcement
on-device privacy protection software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Limits of the Published Evaluation
The announcement does not provide an independent replication of the 98.42% recall result, nor does it establish how performance changes across different writing styles, devices, browsers or languages beyond the stated evaluation. Recall also does not, on its own, show how often the system incorrectly redacts ordinary text or how well it handles every type of sensitive information.
It is also unclear how Rampart handles information it does not recognize, whether users can inspect or undo each redaction, and precisely how the temporarily stored PII is managed or removed. NDS calls the project alpha and a first line of defense, and does not claim that it catches every identifier. The report does not name a release date, provide adoption figures, or describe a security audit of the implementation.
browser privacy extension for personal info
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Testing Beyond the Alpha
NDS says developers can get started by downloading the model from Hugging Face, installing the NPM library or reading the project white paper. The announcement does not give a roadmap or dates for later releases. The next useful indicators will be further documentation on local data handling, broader testing, and evidence about how the tool performs in ordinary chatbot use.
For now, users and developers considering Rampart should treat it as an experimental filter and avoid assuming that sensitive details are safe to submit simply because the tool is installed. Whether the project expands its language coverage, publishes additional evaluations or moves beyond alpha remains unconfirmed.
PII detection and redaction browser plugin
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is Rampart?
Rampart is an alpha, open-source PII filtering system from NDS. It is designed to identify and redact personal information in a browser before a chatbot message is sent.
Does Rampart send messages to a server for scanning?
NDS says the filtering happens in the browser and that there is no server in the loop during detection. The announcement does not detail every aspect of data handling, including how temporary local PII is managed.
How accurate is the system?
NDS reports 98.42% private-term recall on a 30,000-row held-out OpenPII test slice spanning seven supported languages. This is a project-reported benchmark, not proof that Rampart will catch every sensitive detail in real-world messages.
Which languages does Rampart support?
The announcement lists English, Spanish, French, German, Italian, Portuguese and Dutch. It does not claim support for other languages.
Is Rampart a complete privacy guarantee?
No. NDS describes it as an alpha and first line of defense. Detectors can miss information, and the announcement does not claim that the tool prevents a chatbot from receiving all sensitive details.
Source: hn
Columbus Day / Indigenous Peoples' Day Picks
long weekend sales
As an affiliate, we earn on qualifying purchases.
