National Design Studio's Rampart PII Filter Recalls 13.7% of Non-Latin Names

National Design Studio's Rampart, a 14.7 MB open-source filter that strips personal information from text before it reaches a chatbot, recalls only about 13.7 percent of non-Latin-script names in its own fairness suite, according to the model card on Hugging Face. The announcement post, which resurfaced on Hacker News on Oct. 9 with 94 points, leads with a 98.42 percent headline figure instead.

The studio, which describes itself as based in the Eisenhower Executive Office Building in Washington, published the announcement on June 22, 2026, under the names Tai Groot and Edward Coristine. It calls Rampart an alpha product and "a first line of defense, not a complete PII solution." PII means personally identifiable information, such as names, addresses and card numbers.

How Rampart works

Rampart runs two layers in the browser. The first is a set of regular expressions with validation, which catch structured data: Social Security numbers, credit cards, phone numbers, routing and account numbers, emails and IP addresses. The second is a MiniLM model that reads text in context to find names and street addresses that rules cannot anticipate.

The model card says it is a fine-tune of nreimers/MiniLM-L6-H384-uncased with a 35-label head covering 17 entity types, about 18.5 million parameters and 4-bit and INT8 quantization. Placeholders such as [GIVEN_NAME] go to the chatbot, and a local reveal step puts the original values back into the reply.

Latency is 3.9 ms at the median in a browser using WebGPU and 6.6 ms on a Node CPU. It supports English, Spanish, French, German, Italian, Portuguese and Dutch.

The 98.42 percent figure and who measured it

The post reports private-term recall, the share of personal terms caught, on a 30,000-row held-out test set drawn from the OpenPII corpus in seven languages. The model card describes the training mix as about 250,000 synthetic chat conversations, in-house OCR documents and the full AI4Privacy pii-masking-openpii-1.5m corpus, with 100,000 rows held out for evaluation. So the test data comes from the same corpus family as the training data.

The comparison table is the studio's own, and The Terminal could not reproduce it. Microsoft's Presidio, an MIT-licensed tool combining named entity recognition, regular expressions and checksum validation, scores 65 percent in it.

1. Rampart (14.7 MB)98.42 %
2. OpenAI Privacy Filter (~2.8 GB)97.4 %
3. GLiNER small v2.1 (~600 MB)94.2 %
4. Community BERT-small PII (~29 MB)81.5 %
5. Microsoft Presidio (~13 MB)65 %
6. AWS Bedrock Guardrails (cloud)63.8 %

Source: National Design Studio, Introducing Rampart, accessed 2026-10-11

Presidio's README carries a warning that cuts the other way: "there is no guarantee that Presidio will find all sensitive information." The same caveat applies to any filter on this list.

What the model card admits

The card lists limits that the announcement does not repeat.

Case	Result on the card
Non-Latin-script names	about 13.7% recall
Government-style IDs	about 67.6% recall, no rule-based backstop
Dutch	97.21% recall, lowest of the seven languages
Adversarial input	weak against zero-width characters and prompt injection

The card also says Rampart does not detect inferential identifiers and "is not a security boundary." System-level calibration error is 0.291, against 0.018 for the model alone.

Two numbers that cannot both be read as headlines

The card's 98.42 percent comes from 2,082 missed terms out of 131,707, an error rate of about 1.6 percent. The same card reports 91.69 percent public-term retention, meaning how much non-private text survives untouched. A filter can raise the first by redacting more, so the two have to be read together, and the post's table shows only the first.

Non-Latin names are where the gap is widest. Rampart supports seven languages, all in Latin script, so 13.7 percent recall on names in other scripts is the model working outside its supported scope. Even so, a user who pastes a Cyrillic, Arabic or Chinese name into a browser tool labelled as a privacy filter has no warning in the announcement that it will probably pass through.

The card ties the model's size to a trimmed vocabulary of 19,730 pieces and 4-bit and INT8 quantization. It does not say how much of the non-Latin gap comes from that trimming, and the 3.9 ms median is the benefit the studio puts against it.

What a redaction layer does not cover

Rampart acts on text before it leaves the page. It does nothing about what an agent does once it has a shell. That is a separate problem, which Microsoft addressed on Oct. 7 when it said its Mxc agent sandbox was generally available, isolating agent-written code with AppContainer on Windows, Seatbelt on macOS and Bubblewrap on Linux. A team that wants both controls needs two tools, and neither replaces the other.

The licence is less clear than "open source" suggests

The model card says CC BY 4.0, a content licence rather than a software one. The announcement names no licence and links no code repository. The Terminal could not fetch the npm page for @nationaldesignstudio/rampart, so the library's licence is unverified.

A named licence on a card is not the same as terms a business can read. The site's Qwen3.8 coverage found one checkpoint under Apache 2.0 and a sibling whose licence text had not been published. Rampart's case is milder, since CC BY 4.0 is well known, but the same check applies: read the card, then read the package.

The card shows 23,427 downloads last month and 186 likes. The studio's whitepaper, linked from the post, is the place to check how each competitor was configured, and The Terminal could not extract its text.