Breaking

National Design Studio releases Rampart, an in-browser model that strips PII from prompts

June 29, 2026 at 19:32 EDT

Security
Open Source
Foundation Models

The U.S. federal agency National Design Studio on June 29, 2026 released "Rampart," a small browser-based model that detects and replaces personally identifiable information (PII) such as names and addresses on-device before users send prompts to AI tools. The model is a 14.7MB ONNX token-classification model that swaps detected values for stable placeholders like [GIVEN_NAME_1] and [SSN_1], keeping sensitive data from leaving the device. Code and a model card and an official blog post detail the system.

June 29, 2026 · National Design Studio

Rampart: a 14.7MB model that scrubs your data before it ever reaches the AI

An open-source, browser-side guard that finds names, addresses, SSNs and card numbers in your prompt — and swaps them for stable placeholders like [SSN_1] before anything leaves your device.

14.7MB

ONNX model size, runs entirely in the browser

3.9ms

Browser inference, p50 on WebGPU

Entity types classified per token

Free

Open source under CC BY 4.0

How well it performs — on 30,000 rows, 7 languages

Two outcomes that matter most: blocking private data vs. not over-redacting public terms.

98.42%

Private-term recall
(leak prevention)

91.69%

Public-term retention
(over-redaction prevention)

14%

Recall on
non-Latin scripts

Defense in depth — two layers, one guard

Rule-based layer

Regex + checksums (Luhn) catch well-structured data: SSNs, card numbers, emails, IPs.

ML model layer

~18.5M params (MiniLM-L6-H384, quantized) covers ambiguous named entities.

→

Stable placeholders

[GIVEN_NAME_1] swapped in before the prompt ever leaves the device.

What it delivers

Cuts data exposure via logs and vendors with client-side redaction
Tiny, fast, free and open source
Covers 7 Latin-script languages

What it is not

Reduces exposure — not full anonymization
Misses indirect identifiers (e.g. rare disease + ZIP)
Limited against adversarial input — a first iteration

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.