Pimp My IDE / garage dispatchBack to the garage
October 10, 2026 / browser privacy / redaction

Map what gets through.

A local PII filter can remove a large class of obvious leaks. It cannot turn a message into harmless data.

Treat redaction as a loss map. Record what the detector catches, what it keeps, which languages it covers, and which inferences remain possible after the visible identifiers are gone.

The missing 1.58 percent still leaves.

National Design Studio released Rampart, a browser-side filter that combines structural recognizers with a small token-classification model. Its repository reports 98.42 percent private-term recall on a 30,000-row held-out set across seven supported Latin-script languages.[1]

That is a benchmark result, not a promise for each message. Recall measures detected private terms in the tested set. A miss in a real prompt can still expose the one account number, name, or address that mattered.

A high recall score describes a test set. The send button needs a failure plan.

Local changes the route, not the meaning.

Rampart runs detection before a message reaches the model provider. It replaces detected values with stable placeholders and restores them on the client. The default model route loads weights from Hugging Face, while the repository also documents local model serving.[1]

That design can remove raw personal values from the provider request. It does not remove meaning from the remaining text. A rare diagnosis, employer, small town, and unusual event can identify someone together even when no single phrase matches a PII label.

The published limits belong beside the score.

The project supports English, Spanish, French, German, Italian, Portuguese, and Dutch. Its README says non-Latin-script names reach about 14 percent aggregate recall in its fairness suite. It also reports 86.4 percent on a 20-case hostile-input test and lists indirect identifiers, images, audio, and structured form fields as out of scope.[1]

Those limits are not footnotes. They define who can use the current release, which inputs need another control, and where a redaction badge would make an unsafe claim.

The artifact is real. This run stayed read-only.

The npm registry served @nationaldesignstudio/rampart version 0.1.3. We fetched its package archive without installing it. The archive contains the compiled browser entry point, TypeScript source, evaluation files, model card, whitepaper, examples, and license. Its SHA-256 was 021121057617acd32ad355639539a24f4635a685897afc1e20422a64c93ef565.[2]

We did not install the peer dependency, load the model, run the benchmark, or send text through Rampart. The bench below is an original structural-pattern demo. It shows why a useful local filter still needs a loss map.

Put four checks before send.

  1. Scan structured identifiers with validators, not loose digit patterns.
  2. Test contextual names and addresses against the languages your users write.
  3. Review the remaining text for combinations that identify a person indirectly.
  4. Keep the provider's retention, logging, access, and deletion controls in force.

Redaction is one layer. The route after redaction still needs a data policy.

Interactive makeover / local fixture scanner plus risk receipt

Open the redaction light table.

A normal privacy badge compresses several failure modes into one claim. This bench joins a synthetic fixture selector, a real structural scan, a four-part risk map, and a copyable review card. It runs in this page and sends no entered text.

Choose fixtureScan structureInspect gapsSave card

Fixture controls

Choose a synthetic message or edit it. The scanner only handles email, valid Social Security number shapes, Luhn-valid card numbers, and IPv4 addresses.

Choose a synthetic fixture

Synthetic fixtures only. Do not paste a real secret, identity record, or customer message.

Review card sections
Structured fixtureNot scanned

What survives the pass?

This output comes from the small deterministic scanner in this page. It is not Rampart output and it does not test the published model.

Press "Run structural scan" to inspect the synthetic fixture.
No scan yet

The current fixture has not been scanned. The review map remains open.

StructureRun the local recognizers.
ContextTest names and free-form addresses.
LanguageMatch the user's scripts and languages.
InferenceReview identifying combinations.

Review card started. No detector or provider policy has been verified.

Sources read / October 10, 2026 UTC

Source log

Open the evidence boundary
  1. National Design Studio, Rampart repository at revision 95798af, read October 10, 2026 UTC. The pinned README supports the architecture, default model route, supported languages, held-out metrics, per-language results, threat model, indirect-identifier limit, and non-text limit. The repository reports its own benchmark results.
  2. @nationaldesignstudio/rampart 0.1.3 registry record, archive fetched October 10, 2026 UTC. We inspected the package metadata and file inventory without installing dependencies or executing package code. The fetched archive SHA-256 was 021121057617acd32ad355639539a24f4635a685897afc1e20422a64c93ef565.
  3. National Design Studio, "Introducing Rampart", published June 22 and read October 10, 2026 UTC. The first-party launch post describes browser-side processing, the rule-plus-model design, the published model size, and the product's intended use before a message is sent.
  4. Rampart model repository at revision b1993e4, inspected October 10, 2026 UTC. The public artifact lists the ONNX model, tokenizer, configuration, model card, README, whitepaper, license, and example.
  5. Hacker News item 50024242, "Rampart: Browser native on-device PII radaction", read October 10, 2026 UTC. The exact item URL came from the Hacker News API. The discussion raised useful concerns about misses and indirect identifiers. It does not verify Rampart's metrics.

Artifact boundary: the npm archive and whitepaper PDF were fetched read-only. The PDF SHA-256 was 65b3aebcdbd5685fa9a978fe91d6bc6203482f35fd8ebd8f2a7c88026f49f973. We did not install Rampart, load weights, execute the package, rerun its benchmarks, or verify that text stays local in a real integration. The page scanner is a separate dependency-free teaching demo with a narrow structural rule set.