On-device PII redaction usually comes from privacy startups or open source developers, not the federal government. But that’s exactly where Rampart came from this week, a 14.7 megabyte machine learning model released by National Design Studio, a White House design office, that strips personal information like names, addresses, and social security numbers out of text before it ever reaches a server.

I saw the announcement on X and had two reactions. First, 14.7MB is tiny, smaller than most podcast episodes I download before a flight. Second, a government office building a privacy tool felt worth a closer look, especially given how government and “we protect your data” don’t usually appear in the same sentence.

Why It Matters

Every time you type something into a chatbot or a support form, you’re probably revealing more than you mean to. Asking an assistant to clean up an email might carry your name and a coworker’s. A question about a medical bill might carry your account number and home address. And whatever you type doesn’t stay with you. It travels to a remote server you have no way to inspect.

Rampart’s pitch is that the only personal information you can be sure is private is the information that never leaves your device in the first place. Redaction happens before transmission, not after the fact.

How It Actually Works

Rampart runs on two layers, both inside your browser.

The first is deterministic, using regex paired with validation checks for structured data. Credit card numbers are checksummed with the Luhn algorithm, so every formatting variant collapses to one rule, and a 16-digit number that fails the check isn’t flagged as a card.

The second handles what regex can’t reliably catch, names, street addresses, anything context-dependent. Rules can’t anticipate every name or street address, so a small model called MiniLM reads the sentence with a deeper understanding of context, then redacts what it finds. That MiniLM model is the 14.7MB piece doing the work.

Flagged terms aren’t just deleted. They’re replaced with stable placeholders like [NAME_1], and the cleaned version is what gets sent. The receiving system still understands the structure of your request, just not the personal details. There’s also a policy layer that decides what’s worth keeping. It’s domain-aware, so coarse geography like city, state, and ZIP is retained while the precise street line is redacted, without needing to retrain the model.

Performance-wise it’s meant to be invisible. In browser testing it runs at roughly 3.9 milliseconds on WebGPU and 12.6 milliseconds on WASM as a fallback. You’d never notice it running.

Can You Actually Use This?

Not the way the announcement might suggest. Rampart isn’t a browser extension or consumer app. It’s released as a browser-deployable system under 15MB on the wire, small enough for a low-end phone over a slow connection, which is a hint about who it’s built for. It’s meant for developers to embed into their own products, a chatbot, a support form, an internal tool, so user input gets cleaned before it reaches a backend.

If you’re hoping to add this to your own browser this week, you can’t. The benefit only shows up indirectly, if products you already use decide to build it in.

Is This Actually New?

PII detection and redaction isn’t a new category. Sensitive information detection in unstructured text using deep learning has been outperforming older keyword-based methods for years, and server-side redaction tools have existed for a while.

What’s genuinely different is the size and the default. Most existing tools are gigantic, narrowing who can realistically use them, and most setups require trusting a remote server or downloading large binaries to the client. Shrinking something usable to under 15MB, fast enough to run locally without anyone noticing, is a real engineering win. It removes the step where you have to trust a server with raw data before any protection kicks in.

So nobody reinvented PII redaction here. What changed is that local-first redaction became practical enough to ship as a default, not an expensive afterthought.

About the Org Behind It

Worth knowing before you weigh the privacy framing: National Design Studio isn’t a startup. It’s an agency within the White House Office, established by executive order in August 2025 and led by Airbnb co-founder Joe Gebbia as the country’s first chief design officer, tasked with redesigning federal websites.

It’s also drawn recent scrutiny. A Guardian investigation found that NDS-run federal websites, including ones for passport applications, voter registration, and prescription drugs, had been running undisclosed tracking software, and that ndstudio.gov itself ran custom code recording visitor clicks and form entries that was sent somewhere not visible on the public internet, reportedly removed only after reporters asked about it. None of that changes how Rampart’s code works, since it’s open source and inspectable. But it’s a reasonable thing to factor in when deciding how much trust to put behind the privacy messaging.

FAQ

What is on-device PII redaction?
Personal information like names, addresses, and ID numbers is detected and removed directly on your device before any data is sent to a server.

Can I install Rampart as a browser extension?
No. It’s a model and codebase for developers to build into their own products, not a standalone app.

Is Rampart open source?
Yes, published openly on GitHub and Hugging Face.

Who built Rampart, and should that change how you see it?
National Design Studio, a White House design office. The code is open and inspectable, but the same office has faced scrutiny over tracking practices on other government sites it runs.

Takeaway

Rampart is a useful signal that lightweight, on-device privacy tooling is becoming practical enough to be a default. Whether it shows up in tools you actually use depends on developer adoption, and how much scrutiny the agency behind it continues to get.

If you want more breakdowns like this, no hype, just what’s actually happening, subscribe to the newsletter.