From first principles, the best way to protect your personal information is to never let it leave your device. Until now, that wasn’t practical. Privacy filters lived on a “trusted server” and were too big to run well in a browser, especially on a phone. Rampart Edge is the smallest privacy filter model, at 1.45MB, and it can be run on almost any device.
Design goals
Running Rampart in production gave us two goals for the next version:
- 1.Stop blocking ordinary questions. Rampart was cautious with anything that looked like a name, so questions about public figures, national parks or brands named after people were sometimes blocked by mistake.
- 2.Make it much smaller. Even though Rampart was already the smallest privacy filter of its kind, users on slower connections could still be left waiting to use America.gov while it downloaded.
Reducing false positives
Rampart tagged spans of text with entity labels and redacted them. Any span that looked like a name was treated as one, so “Is Elizabeth, NJ in the flood program?” came back as “[GIVEN_NAME], NJ in the flood program?”, and questions about public figures, landmarks and person-named brands were blocked outright. With every PII-type enabled, Rampart blocks 11.8% of ordinary messages on our test set.
To fix this, Rampart Edge approaches names in three ways. First, we wrote a label policy before generating any training data: a private individual’s full name is blocked, and listed public figures, bare first names, bare surnames and place names are allowed. Second, the corpus includes two hardening rounds built specifically from the categories users told us Rampart got wrong. Third, the block decision is made on the whole message, not on individual tokens, so “Lincoln” in “Does the Lincoln Memorial close at night?” is judged in context.
Share of ordinary messages blocked
False positives drawn from internal testing of the original Rampart including public figures, park names, person-named brands, form numbers and hotline lookups. Lower is better.
On that regression set Rampart blocks 116 of 124 messages; Rampart Edge blocks 4, and still catches all 42 matching messages that do contain personal information.
Small by design
We set the training objective as the smallest browser download that reaches at least 95% catch at no more than 1% false blocks on the development set, with latency under 100 milliseconds as a hard constraint.
We chose Microsoft’s public xtremedistil-l6-h256 encoder as a base model to begin with. It has six layers and a table of 30,522 words and is 50.74 MB. We were able to reduce the size by 35x.
The steps we took to shrink the new base model.
- 50.74 MBXtremeDistil base model
- 34.94 MBFour layers, one stored set of weights
- 8.33 MBA smaller word table
- 1.45 MB4-bit weights
We first truncated it from six layers to four and shared one set of layer weights across all four positions. The embedding table is factorized to rank 48, initialized from an SVD of the pretrained table, and pruned to the 23,910 word pieces that occur in training.
Each panel is one layer’s weights. Edge stores a single layer and runs it four times.
A layer reads the whole message and learns what each word means from its context. Rampart Edge makes four passes instead of six, and uses the same layer every time.
Weights are quantized to 4 bits with no measurable change in benchmark accuracy.
Rounding weights to 4 bits
Block or allow
Rampart Edge returns one decision per message, block or allow, together with the spans that caused it. When the model detects Personally Identifiable Information (PII), the user can be shown a warning with the offending PII marked using the returned span.
Two components make that decision. Deterministic validators check structured identifiers with real checksums: Luhn algorithm for credit card numbers, area and group rules for Social Security numbers, ABA checksums for routing numbers, mod-97 for IBANs, and formats for Medicare, USCIS and seven non-US national identifiers, with allowlists for hotlines, agency mailboxes and landmarks. The model reads the message in 384-token windows with a stride of 96 and takes the maximum probability across windows. A message is blocked if a validator fires or the model’s probability reaches 0.418, the lowest threshold that kept false blocks at or below 1% on the development set.
The same model call labels every token with one of nine span types: name, complete address, personal email, phone, government ID, financial ID, keyed date of birth, personal URL or handle, and other person-bound IDs. Validator hits keep their own type and are merged with the model’s spans, so the interface can point at exactly what to remove. The same spans work on pasted documents and PDFs, so a blocked document can also be redacted.
Evaluation
Rampart Edge is tuned specifically for America.gov use-cases. Its benign questions cover 37 America topics in seven languages, written in 12 voices: plain, lowercase, typos, dictation, fragments, rambling, angry, elderly, teen, accessibility, follow-up replies and pasted notices. Personal information appears the way people share it in chat: a one-line answer to the assistant (“ok its …”), details about a parent or landlord, a quoted scam text, or a pasted letter, email thread or form. Many messages with personal information have a twin with it removed, so the model learns the identifier rather than the topic. Hard negatives cover where the original model failed: public figures, officials, place names, brands named after people, form numbers and checksum-failing digits. We also threw in a few off-topic posts, code and keyboard mashing for good measure.
Share of messages with personal information blocked
Share of messages containing personal information that each filter blocks, on a frozen test set of 30,863 whole messages labeled against a written policy. Higher is better. Benchmark(opens in new tab)
These numbers count whole messages, not individual words like the recall we reported for Rampart in June. That is the measure that matters in chat: a message with any personal information is not sent, so one missed identifier lets the whole message through, and one false flag stops an ordinary question.
We also trained and tested on documents that agencies and courts redacted by hand before publishing them: the Clinton emails, FBI Vault scans, federal court filings, inspector general reports, ICE FOIA releases and CFPB complaints. We filled every black box with a synthetic value of the same kind, so the documents keep their real layout and wording without any real personal information. Three quarters went into training. On the held-out quarter, Rampart Edge catches 98.4% of messages with personal information.
Creating synthetic training data
Case ID: 6177337970 Disputed amount: $375.00 Receiver info: XXXX XXXX Case status: Closed. The case was closed in your favor.
Case ID: 6177337970 Disputed amount: $375.00 Receiver info: Emily WalshnameXXXX XXXX Case status: Closed. The case was closed in your favor.
Example built from a CFPB public complaint. The CFPB replaces personal details with XXXX before publishing.
Usage
Install @nationaldesignstudio/rampart-edge and onnxruntime-web, and host the model and vocabulary files yourself.
import { createGate } from "@nationaldesignstudio/rampart-edge";const gate = await createGate({ modelBaseUrl: "/models/rampart-edge/" });const landlord = await gate.check( "My landlord Marcus Delgado won't return my security deposit.",);console.log(landlord.verdict); // "BLOCK"console.log(landlord.spans); // [{ start: 12, end: 26, type: "NAME", source: "model", ... }]const park = await gate.check( "Is Shenandoah National Park open this weekend?",);console.log(park.verdict); // "ALLOW"const ssn = await gate.check("My SSN is 452-78-1934.");console.log(ssn.basis); // "validator-and-model"Limitations
The weakest areas of Rampart Edge are names and street addresses. We measured this on a 30,000-row slice of OpenPII, a public multilingual benchmark it was not trained on. When a full name is the only personal information in a message, Rampart Edge blocks 49.6% of those messages; when a street address is, it blocks 48.2%. Emails and phone numbers, which the deterministic validators also check, are blocked 100% and 94.3% of the time.
Names and addresses are hard for a model this small because it cannot carry a dictionary of them. A list of first names, surnames, streets and cities broad enough to cover seven languages would be far larger than the model itself. Rampart Edge instead relies on the context around them, such as “my landlord”, “lives at” or “send it to”. A name or address with little context around it is the case it is most likely to miss.
OpenPII is not a fully fair test of Rampart Edge, because it was built on different rules about what counts as personal information. It labels things our policy allows, such as non-US national ID numbers and number strings that only look like IDs, and it tags some full names as first names only.
No chat logs or private conversations were used to train or evaluate it. Every identifier in the training data is synthetic or already public.
Get started
The model and the validators are available under CC0 1.0.
Want to develop technology that is the future of how the government builds its user experiences? Consider joining us at National Design Studio.