Initial Rampart release

.gitattributes

@@ -0,0 +1 @@
+*.onnx filter=lfs diff=lfs merge=lfs -text

LICENSE

@@ -0,0 +1,402 @@
+Copyright 2026 National Design Studio
+
+This work is licensed under the Creative Commons Attribution 4.0
+International License. To view a copy of this license, visit
+https://creativecommons.org/licenses/by/4.0/ or see the full legal
+code below.
+
+Attribution 4.0 International
+
+=======================================================================
+
+Creative Commons Corporation ("Creative Commons") is not a law firm and
+does not provide legal services or legal advice. Distribution of
+Creative Commons public licenses does not create a lawyer-client or
+other relationship. Creative Commons makes its licenses and related
+information available on an "as-is" basis. Creative Commons gives no
+warranties regarding its licenses, any material licensed under their
+terms and conditions, or any related information. Creative Commons
+disclaims all liability for damages resulting from their use to the
+fullest extent possible.
+
+Using Creative Commons Public Licenses
+
+Creative Commons public licenses provide a standard set of terms and
+conditions that creators and other rights holders may use to share
+original works of authorship and other material subject to copyright
+and certain other rights specified in the public license below. The
+following considerations are for informational purposes only, are not
+exhaustive, and do not form part of our licenses.
+
+     Considerations for licensors: Our public licenses are
+     intended for use by those authorized to give the public
+     permission to use material in ways otherwise restricted by
+     copyright and certain other rights. Our licenses are
+     irrevocable. Licensors should read and understand the terms
+     and conditions of the license they choose before applying it.
+     Licensors should also secure all rights necessary before
+     applying our licenses so that the public can reuse the
+     material as expected. Licensors should clearly mark any
+     material not subject to the license. This includes other CC-
+     licensed material, or material used under an exception or
+     limitation to copyright. More considerations for licensors:
+    wiki.creativecommons.org/Considerations_for_licensors
+
+     Considerations for the public: By using one of our public
+     licenses, a licensor grants the public permission to use the
+     licensed material under specified terms and conditions. If
+     the licensor's permission is not necessary for any reason--for
+     example, because of any applicable exception or limitation to
+     copyright--then that use is not regulated by the license. Our
+     licenses grant only permissions under copyright and certain
+     other rights that a licensor has authority to grant. Use of
+     the licensed material may still be restricted for other
+     reasons, including because others have copyright or other
+     rights in the material. A licensor may make special requests,
+     such as asking that all changes be marked or described.
+     Although not required by our licenses, you are encouraged to
+     respect those requests where reasonable. More considerations
+     for the public:
+    wiki.creativecommons.org/Considerations_for_licensees
+
+=======================================================================
+
+Creative Commons Attribution 4.0 International Public License
+
+By exercising the Licensed Rights (defined below), You accept and agree
+to be bound by the terms and conditions of this Creative Commons
+Attribution 4.0 International Public License ("Public License"). To the
+extent this Public License may be interpreted as a contract, You are
+granted the Licensed Rights in consideration of Your acceptance of
+these terms and conditions, and the Licensor grants You such rights in
+consideration of benefits the Licensor receives from making the
+Licensed Material available under these terms and conditions.
+
+
+Section 1 -- Definitions.
+
+  a. Adapted Material means material subject to Copyright and Similar
+     Rights that is derived from or based upon the Licensed Material
+     and in which the Licensed Material is translated, altered,
+     arranged, transformed, or otherwise modified in a manner requiring
+     permission under the Copyright and Similar Rights held by the
+     Licensor. For purposes of this Public License, where the Licensed
+     Material is a musical work, performance, or sound recording,
+     Adapted Material is always produced where the Licensed Material is
+     synched in timed relation with a moving image.
+
+  b. Adapter's License means the license You apply to Your Copyright
+     and Similar Rights in Your contributions to Adapted Material in
+     accordance with the terms and conditions of this Public License.
+
+  c. Copyright and Similar Rights means copyright and/or similar rights
+     closely related to copyright including, without limitation,
+     performance, broadcast, sound recording, and Sui Generis Database
+     Rights, without regard to how the rights are labeled or
+     categorized. For purposes of this Public License, the rights
+     specified in Section 2(b)(1)-(2) are not Copyright and Similar
+     Rights.
+
+  d. Effective Technological Measures means those measures that, in the
+     absence of proper authority, may not be circumvented under laws
+     fulfilling obligations under Article 11 of the WIPO Copyright
+     Treaty adopted on December 20, 1996, and/or similar international
+     agreements.
+
+  e. Exceptions and Limitations means fair use, fair dealing, and/or
+     any other exception or limitation to Copyright and Similar Rights
+     that applies to Your use of the Licensed Material.
+
+  f. Licensed Material means the artistic or literary work, database,
+     or other material to which the Licensor applied this Public
+     License.
+
+  g. Licensed Rights means the rights granted to You subject to the
+     terms and conditions of this Public License, which are limited to
+     all Copyright and Similar Rights that apply to Your use of the
+     Licensed Material and that the Licensor has authority to license.
+
+  h. Licensor means the individual(s) or entity(ies) granting rights
+     under this Public License.
+
+  i. Share means to provide material to the public by any means or
+     process that requires permission under the Licensed Rights, such
+     as reproduction, public display, public performance, distribution,
+     dissemination, communication, or importation, and to make material
+     available to the public including in ways that members of the
+     public may access the material from a place and at a time
+     individually chosen by them.
+
+  j. Sui Generis Database Rights means rights other than copyright
+     resulting from Directive 96/9/EC of the European Parliament and of
+     the Council of 11 March 1996 on the legal protection of databases,
+     as amended and/or succeeded, as well as other essentially
+     equivalent rights anywhere in the world.
+
+  k. You means the individual or entity exercising the Licensed Rights
+     under this Public License. Your has a corresponding meaning.
+
+
+Section 2 -- Scope.
+
+  a. License grant.
+
+       1. Subject to the terms and conditions of this Public License,
+          the Licensor hereby grants You a worldwide, royalty-free,
+          non-sublicensable, non-exclusive, irrevocable license to
+          exercise the Licensed Rights in the Licensed Material to:
+
+            a. reproduce and Share the Licensed Material, in whole or
+               in part; and
+
+            b. produce, reproduce, and Share Adapted Material.
+
+       2. Exceptions and Limitations. For the avoidance of doubt, where
+          Exceptions and Limitations apply to Your use, this Public
+          License does not apply, and You do not need to comply with
+          its terms and conditions.
+
+       3. Term. The term of this Public License is specified in Section
+          6(a).
+
+       4. Media and formats; technical modifications allowed. The
+          Licensor authorizes You to exercise the Licensed Rights in
+          all media and formats whether now known or hereafter created,
+          and to make technical modifications necessary to do so. The
+          Licensor waives and/or agrees not to assert any right or
+          authority to forbid You from making technical modifications
+          necessary to exercise the Licensed Rights, including
+          technical modifications necessary to circumvent Effective
+          Technological Measures. For purposes of this Public License,
+          simply making modifications authorized by this Section 2(a)
+          (4) never produces Adapted Material.
+
+       5. Downstream recipients.
+
+            a. Offer from the Licensor -- Licensed Material. Every
+               recipient of the Licensed Material automatically
+               receives an offer from the Licensor to exercise the
+               Licensed Rights under the terms and conditions of this
+               Public License.
+
+            b. No downstream restrictions. You may not offer or impose
+               any additional or different terms or conditions on, or
+               apply any Effective Technological Measures to, the
+               Licensed Material if doing so restricts exercise of the
+               Licensed Rights by any recipient of the Licensed
+               Material.
+
+       6. No endorsement. Nothing in this Public License constitutes or
+          may be construed as permission to assert or imply that You
+          are, or that Your use of the Licensed Material is, connected
+          with, or sponsored, endorsed, or granted official status by,
+          the Licensor or others designated to receive attribution as
+          provided in Section 3(a)(1)(A)(i).
+
+  b. Other rights.
+
+       1. Moral rights, such as the right of integrity, are not
+          licensed under this Public License, nor are publicity,
+          privacy, and/or other similar personality rights; however, to
+          the extent possible, the Licensor waives and/or agrees not to
+          assert any such rights held by the Licensor to the limited
+          extent necessary to allow You to exercise the Licensed
+          Rights, but not otherwise.
+
+       2. Patent and trademark rights are not licensed under this
+          Public License.
+
+       3. To the extent possible, the Licensor waives any right to
+          collect royalties from You for the exercise of the Licensed
+          Rights, whether directly or through a collecting society
+          under any voluntary or waivable statutory or compulsory
+          licensing scheme. In all other cases the Licensor expressly
+          reserves any right to collect such royalties.
+
+
+Section 3 -- License Conditions.
+
+Your exercise of the Licensed Rights is expressly made subject to the
+following conditions.
+
+  a. Attribution.
+
+       1. If You Share the Licensed Material (including in modified
+          form), You must:
+
+            a. retain the following if it is supplied by the Licensor
+               with the Licensed Material:
+
+                 i. identification of the creator(s) of the Licensed
+                    Material and any others designated to receive
+                    attribution, in any reasonable manner requested by
+                    the Licensor (including by pseudonym if
+                    designated);
+
+                ii. a copyright notice;
+
+               iii. a notice that refers to this Public License;
+
+                iv. a notice that refers to the disclaimer of
+                    warranties;
+
+                 v. a URI or hyperlink to the Licensed Material to the
+                    extent reasonably practicable;
+
+            b. indicate if You modified the Licensed Material and
+               retain an indication of any previous modifications; and
+
+            c. indicate the Licensed Material is licensed under this
+               Public License, and include the text of, or the URI or
+               hyperlink to, this Public License.
+
+       2. You may satisfy the conditions in Section 3(a)(1) in any
+          reasonable manner based on the medium, means, and context in
+          which You Share the Licensed Material. For example, it may be
+          reasonable to satisfy the conditions by providing a URI or
+          hyperlink to a resource that includes the required
+          information.
+
+       3. If requested by the Licensor, You must remove any of the
+          information required by Section 3(a)(1)(A) to the extent
+          reasonably practicable.
+
+       4. If You Share Adapted Material You produce, the Adapter's
+          License You apply must not prevent recipients of the Adapted
+          Material from complying with this Public License.
+
+
+Section 4 -- Sui Generis Database Rights.
+
+Where the Licensed Rights include Sui Generis Database Rights that
+apply to Your use of the Licensed Material:
+
+  a. for the avoidance of doubt, Section 2(a)(1) grants You the right
+     to extract, reuse, reproduce, and Share all or a substantial
+     portion of the contents of the database;
+
+  b. if You include all or a substantial portion of the database
+     contents in a database in which You have Sui Generis Database
+     Rights, then the database in which You have Sui Generis Database
+     Rights (but not its individual contents) is Adapted Material; and
+
+  c. You must comply with the conditions in Section 3(a) if You Share
+     all or a substantial portion of the contents of the database.
+
+For the avoidance of doubt, this Section 4 supplements and does not
+replace Your obligations under this Public License where the Licensed
+Rights include other Copyright and Similar Rights.
+
+
+Section 5 -- Disclaimer of Warranties and Limitation of Liability.
+
+  a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
+     EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
+     AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
+     ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
+     IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
+     WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
+     PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
+     ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
+     KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
+     ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.
+
+  b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
+     TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
+     NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
+     INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
+     COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
+     USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
+     ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
+     DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
+     IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.
+
+  c. The disclaimer of warranties and limitation of liability provided
+     above shall be interpreted in a manner that, to the extent
+     possible, most closely approximates an absolute disclaimer and
+     waiver of all liability.
+
+
+Section 6 -- Term and Termination.
+
+  a. This Public License applies for the term of the Copyright and
+     Similar Rights licensed here. However, if You fail to comply with
+     this Public License, then Your rights under this Public License
+     terminate automatically.
+
+  b. Where Your right to use the Licensed Material has terminated under
+     Section 6(a), it reinstates:
+
+       1. automatically as of the date the violation is cured, provided
+          it is cured within 30 days of Your discovery of the
+          violation; or
+
+       2. upon express reinstatement by the Licensor.
+
+     For the avoidance of doubt, this Section 6(b) does not affect any
+     right the Licensor may have to seek remedies for Your violations
+     of this Public License.
+
+  c. For the avoidance of doubt, the Licensor may also offer the
+     Licensed Material under separate terms or conditions or stop
+     distributing the Licensed Material at any time; however, doing so
+     will not terminate this Public License.
+
+  d. Sections 1, 5, 6, 7, and 8 survive termination of this Public
+     License.
+
+
+Section 7 -- Other Terms and Conditions.
+
+  a. The Licensor shall not be bound by any additional or different
+     terms or conditions communicated by You unless expressly agreed.
+
+  b. Any arrangements, understandings, or agreements regarding the
+     Licensed Material not stated herein are separate from and
+     independent of the terms and conditions of this Public License.
+
+
+Section 8 -- Interpretation.
+
+  a. For the avoidance of doubt, this Public License does not, and
+     shall not be interpreted to, reduce, limit, restrict, or impose
+     conditions on any use of the Licensed Material that could lawfully
+     be made without permission under this Public License.
+
+  b. To the extent possible, if any provision of this Public License is
+     deemed unenforceable, it shall be automatically reformed to the
+     minimum extent necessary to make it enforceable. If the provision
+     cannot be reformed, it shall be severed from this Public License
+     without affecting the enforceability of the remaining terms and
+     conditions.
+
+  c. No term or condition of this Public License will be waived and no
+     failure to comply consented to unless expressly agreed to by the
+     Licensor.
+
+  d. Nothing in this Public License constitutes or may be interpreted
+     as a limitation upon, or waiver of, any privileges and immunities
+     that apply to the Licensor or You, including from the legal
+     processes of any jurisdiction or authority.
+
+
+=======================================================================
+
+Creative Commons is not a party to its public
+licenses. Notwithstanding, Creative Commons may elect to apply one of
+its public licenses to material it publishes and in those instances
+will be considered the "Licensor." The text of the Creative Commons
+public licenses is dedicated to the public domain under the CC0 Public
+Domain Dedication. Except for the limited purpose of indicating that
+material is shared under a Creative Commons public license or as
+otherwise permitted by the Creative Commons policies published at
+creativecommons.org/policies, Creative Commons does not authorize the
+use of the trademark "Creative Commons" or any other trademark or logo
+of Creative Commons without its prior written consent including,
+without limitation, in connection with any unauthorized modifications
+to any of its public licenses or any other arrangements,
+understandings, or agreements concerning use of licensed material. For
+the avoidance of doubt, this paragraph does not form part of the
+public licenses.
+
+Creative Commons may be contacted at creativecommons.org.

MODEL_CARD.md

@@ -0,0 +1,422 @@
+---
+library_name: transformers.js
+pipeline_tag: token-classification
+license: cc-by-4.0
+language:
+  - en
+  - es
+  - fr
+  - de
+  - it
+  - pt
+  - nl
+tags:
+  - pii
+  - redaction
+  - privacy
+  - onnx
+  - web
+  - client-side
+  - minilm
+  - browser
+datasets:
+  - ai4privacy/pii-masking-openpii-1.5m
+base_model: nreimers/MiniLM-L6-H384-uncased
+metrics:
+  - private-term-recall
+  - public-term-retention
+  - span-f1
+  - ece
+---
+
+# Rampart
+
+`rampart` is a 14.7 MB ONNX token-classification model that detects personally identifiable information (PII) in text before it leaves the user's device.
+It is the on-device half of **Rampart**, a defense-in-depth client-side redaction system released by National Design Studio.
+The shipped artifact runs alongside a deterministic recognizer layer that handles structured identifiers; together they form the complete system.
+
+This card documents the released artifact only.
+Alternative configurations explored during model selection (an ELECTRA-small base, the prefilter-off training variant, leaner data mixes, and smaller corpus slices) are discussed in the project whitepaper for context but are not published.
+
+## Model summary
+
+| Property              | Value                                                                                                                           |
+| --------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
+| Model id              | `nationaldesignstudio/rampart`                                                                                               |
+| Architecture          | [`nreimers/MiniLM-L6-H384-uncased`](https://huggingface.co/nreimers/MiniLM-L6-H384-uncased) fine-tuned with a 35-label BIO head (17 entity types) |
+| Parameters            | ≈18.5M (MiniLM-L6-H384 with the trimmed 19,730-piece vocabulary; the 22.7M base figure is for the full 30,522-piece BERT vocab) |
+| Quantization          | 4-bit MatMul + INT8 embedding (`onnx/model_q4.onnx`)                                                                            |
+| Shipped artifact size | 14.7 MB |
+| Vocabulary            | 19,730 WordPieces (trimmed from BERT-uncased's 30,522, retaining all special and single-character pieces plus frequent multi-character pieces) |
+| Max sequence          | 512 tokens                                                                                                                      |
+| Languages             | English, Spanish, French, German, Italian, Portuguese, Dutch (all Latin-script)                                                 |
+| Runtime               | ONNX Runtime Web (WASM/WebGPU) via `transformers.js`                                                                            |
+| License               | CC BY 4.0 (Creative Commons Attribution 4.0 International)                                                                       |
+| Training data license | CC BY 4.0 ([`ai4privacy/pii-masking-openpii-1.5m`](https://huggingface.co/datasets/ai4privacy/pii-masking-openpii-1.5m))        |
+| Released by           | National Design Studio                                                                                                          |
+| Card version          | 1.0 (initial public release)                                                                                                    |
+
+## Intended use
+
+The model is designed for **client-side redaction of user-typed text in AI assistants and intake flows** — replacing identifying values with stable placeholders before any data is transmitted to a model provider, a server, or a logging system.
+
+### Direct uses
+
+- Redact user content before passing it to a hosted LLM.
+- Maintain stable placeholders (`[GIVEN_NAME_1]`, `[SSN_1]`, ...) across a multi-turn conversation, with rehydration on the client.
+- Preempt accidental collection of personal data in analytics, traces, and crash reports.
+- Validate domain-specific redaction policies before deploying chat systems in regulated contexts.
+
+### Out of scope
+
+- **Stand-alone government-ID detection.**
+  The model is one layer of a defense-in-depth system; it is not a replacement for the deterministic recognizer layer that ships alongside it.
+  SSNs and payment cards are caught by the deterministic layer with checksum validation (structural rules and Luhn), at higher recall than the model alone.
+  Phone, routing, government-ID, passport, and license numbers carry no checksum, so they are caught by the model; the deterministic layer does not attempt them.
+- **Indirect / inferential identifiers.**
+  A "rare disease + 5-digit ZIP" combination can re-identify someone even though neither token is in the redact-set.
+  The model does not detect inferential leaks.
+- **Adversarial robustness as a security guarantee.**
+  We publish numbers on hostile inputs and document the failure surface; the system is positioned as harm reduction for users entering their own information in good faith, not as a security boundary against motivated adversaries.
+- **Non-Latin scripts.**
+  This release is scoped to the seven Latin-script languages listed above.
+  Korean, Han Chinese, Japanese, Arabic, Cyrillic, and Devanagari names recall ~14% in aggregate (see "Fairness and limitations" below).
+  Do not deploy this release for populations who routinely type non-Latin-script names without compensating controls; monitor accordingly.
+
+### Usage
+
+The runtime ships as [`@nationaldesignstudio/rampart`](https://www.npmjs.com/package/@nationaldesignstudio/rampart). `createGuard()` returns a `ChatGuard` that loads this classifier and runs the full deterministic + model pipeline:
+
+```ts
+import { createGuard } from "@nationaldesignstudio/rampart";
+
+const guard = await createGuard();
+const { redacted } = await guard.redact("My name is Alex Rivera and my SSN is 472-81-0094.");
+// → "My name is [GIVEN_NAME_1] [SURNAME_1] and my SSN is [SSN_1]."
+```
+
+## Training data
+
+| Source                                                                                                       | Rows used                        | License    | Role                                                                                                                                       |
+| ------------------------------------------------------------------------------------------------------------ | -------------------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
+| [`ai4privacy/pii-masking-openpii-1.5m`](https://huggingface.co/datasets/ai4privacy/pii-masking-openpii-1.5m) | 643,756 train + 100,000 held-out | CC BY 4.0  | Realistic chat-style PII; 7 Latin-script languages (en, es, fr, de, it, pt, nl); the OpenPII schema mapped to our 35-label BIO schema (17 entity types) |
+| Synthetic generator                                                                                          | 20,000 train                     | Apache-2.0 | Class reinforcement for the 17 entity types — accent-bearing names from curated first- and last-name pools and templated structured fields, generated deliberately messy (typos, all-caps, voice-dictated and pasted-from-form phrasing, multilingual mixing, contradictory/duplicated values) so the model sees realistic disordered input, not just clean OpenPII prose |
+
+The held-out 100,000 rows are split into two non-overlapping subsets, seeded for full reproducibility:
+
+- **10,000 rows** for recall-floor threshold tuning.
+- **30,000 rows** for the headline test results below (per-language row counts in the eval table).
+
+The remaining 60,000 held-out rows are reserved for future evaluation and are not used in this release.
+
+### Pre-processing
+
+All training rows pass through the same normalization the runtime applies before tokenization: lowercase, NFKD decomposition, and combining-mark stripping.
+The combining-mark step folds accents — `José` becomes `jose`, `Müller` becomes `muller` — so the model sees a single canonical form regardless of how the user typed the name.
+This matches what BERT's BasicTokenizer does implicitly at inference time under `do_lower_case=True`, so the train-time and runtime distributions are identical by construction.
+A guard in the training pipeline fails the run if a future tokenizer change breaks this assumption.
+
+A re-trainer who omits this normalization step will produce a model with mismatched distributions, and recall numbers will not reproduce.
+
+The structured classes the deterministic layer owns (`SSN`, `CREDIT_CARD`, `IP_ADDRESS`) are also masked to sentinel tokens before tokenization — both at inference (`src/premask.ts`) and during dataset construction — so the model never learns to classify raw card/SSN/IP digits and the train-time and inference-time inputs match by construction.
+
+### Vocabulary
+
+The full BERT-uncased vocabulary contains 30,522 WordPieces.
+The shipped vocabulary retains:
+
+1. All special tokens (`[PAD]`, `[UNK]`, `[CLS]`, `[SEP]`, `[MASK]`).
+2. All single-character pieces and their `##` continuations, which preserve WordPiece's character-level fallback for rare names.
+3. All multi-character pieces appearing in the training corpus above a frequency threshold.
+
+The shipped vocabulary is **19,730 pieces**.
+
+### Training procedure
+
+| Hyperparameter      | Value                            |
+| ------------------- | -------------------------------- |
+| Base                | nreimers/MiniLM-L6-H384-uncased  |
+| Epochs              | 3                                |
+| Batch size          | 32                               |
+| Learning rate       | 5e-5                             |
+| Weight decay        | 0.01                             |
+| Max sequence length | 512                              |
+| Optimizer           | AdamW                            |
+| Eval strategy       | per-epoch on held-out validation |
+| Save strategy       | per-epoch                        |
+| Hardware            | Apple M-series MPS               |
+| Total wall time     | ~3.5 hours                       |
+
+The final epoch was selected by held-out eval loss.
+
+## Label taxonomy
+
+The model emits 35 BIO labels (17 entity types × {B-, I-} + O); the deterministic
+recognizer layer contributes three more structured classes that are masked before
+the model runs. The runtime applies a default-deny policy: every detected span is
+redacted unless its label is explicitly in the keep-set.
+
+### Redacted by default
+
+Owned by the deterministic recognizer layer (regex + validator, masked before the model):
+
+| Label         | Description                                                       |
+| ------------- | ----------------------------------------------------------------- |
+| `SSN`         | Social Security Numbers (US) — structural validation              |
+| `CREDIT_CARD` | Payment card numbers — Luhn-validated                             |
+| `EMAIL`       | Email addresses                                                   |
+| `URL`         | URLs in user content                                              |
+| `IP_ADDRESS`  | IPv4 / IPv6 / MAC addresses                                       |
+
+Emitted by the token-classification model:
+
+| Label               | Description                                          |
+| ------------------- | ---------------------------------------------------- |
+| `GIVEN_NAME`        | Given / first names                                  |
+| `SURNAME`           | Family / last names                                  |
+| `PHONE`             | Phone numbers                                        |
+| `TAX_ID`            | Tax identifiers                                      |
+| `BANK_ACCOUNT`      | Bank account / IBAN numbers                          |
+| `ROUTING_NUMBER`    | Bank routing numbers                                 |
+| `GOVERNMENT_ID`     | Government-issued ID / case numbers                  |
+| `PASSPORT`          | Passport numbers                                     |
+| `DRIVERS_LICENSE`   | Driver's license numbers                             |
+| `BUILDING_NUMBER`   | Street-line building number                          |
+| `STREET_NAME`       | Street name                                          |
+| `SECONDARY_ADDRESS` | Secondary-address line (apt / unit / suite)          |
+
+`BUILDING_NUMBER` + `STREET_NAME` together form the precise street line; both are
+redacted while city/state/ZIP are kept.
+
+### Kept by default
+
+| Label      | Description                                                  |
+| ---------- | ------------------------------------------------------------ |
+| `CITY`     | City — coarse geography for eligibility checks               |
+| `STATE`    | State / region                                               |
+| `ZIP_CODE` | Postal code                                                  |
+
+The keep-set keeps coarse geography (city/state/ZIP) while redacting the precise
+street line. To change it, edit `KEEP_LABELS` in `src/types.ts` — it is a
+compile-time set, not a runtime flag.
+
+The taxonomy is deliberately **atomic**: there is no coarse `PERSON`,
+`STREET_ADDRESS`, `ADDRESS`, `ORGANIZATION`, or `LOCATION` label, and no catch-all
+`SECRET`. Names split into `GIVEN_NAME` / `SURNAME`, the street line into
+`BUILDING_NUMBER` / `STREET_NAME`, and document identifiers into their specific
+classes, so the model learns to catch PII fragments in disordered text rather than
+expecting one tidy blob. Dates, ages, and income are intentionally **not** modeled
+as PII (they map to `O`): a bare date is rarely identifying, and assistants need age
+and income as context, so redacting them was over-redaction without a privacy gain.
+
+## Evaluation
+
+We score the **full system** (model + deterministic layer) because that is what consumers experience end-to-end.
+Model-only numbers are reported separately for researchers who want to evaluate the encoder in isolation.
+
+### Primary metrics
+
+- **Private-term recall**: for every gold private value, did the redacted output contain the value? This is the privacy-headline number; misses here are leaks.
+- **Public-term retention**: for every gold public value, did the redacted output preserve the value? This measures over-redaction.
+- **Span F1 strict (IoU=1.0)** and **relaxed (IoU≥0.5)**: how well predicted span boundaries align with gold boundaries under one-to-one greedy matching.
+- **Latency**: Node.js ONNX runtime cold / p50 / p95 / p99 over the full 30,000-row test set. Browser latency (WebGPU and WASM backends) is measured separately by `eval/bench/webgpu.ts` — see below.
+- **Calibration**: 15-bin reliability ECE, per label and overall, on per-span max-class scores.
+
+All recall and retention numbers carry Wilson 95% confidence intervals; stratified breakdowns include 1000-iteration bootstrap intervals.
+
+### Held-out OpenPII test set — seven supported languages (30,000 rows; 131,707 private terms; 87,207 public terms)
+
+The headline number is measured across all seven supported Latin-script languages.
+English-only, Spanish-only, and the English+Spanish slice are reported as sub-slices.
+
+| Slice                        | Private recall (Wilson 95%) | Public retention\* | Span F1 strict | Latency p50 |
+| ---------------------------- | --------------------------- | ------------------ | -------------- | ----------- |
+| **All seven languages**      | **98.42% [98.35, 98.49]**   | 91.69%             | 0.528          | 6.6 ms      |
+| English only (11,569 rows)   | 98.85%                      | 90.5%              | —              | 6.6 ms      |
+| Spanish only (3,234 rows)    | 98.84%                      | 91.6%              | —              | 6.6 ms      |
+| English + Spanish            | 98.85%                      | 91.0%              | —              | 6.6 ms      |
+
+2,082 leaks of 131,707 private terms on the seven-language test (1 in 64 terms slips past
+the system, before the application's downstream defenses fire). On the English+Spanish
+slice the system leaks 778 of 67,613.
+
+These numbers are measured by the committed `eval/bench` harness running the **shipped Q4
+pipeline** end-to-end over a pinned held-out slice of `pii-masking-openpii-1.5m`. The
+harness was corrected relative to earlier revisions of this card: city/state/ZIP are now
+scored as **kept** (matching the runtime keep-set) instead of being counted as leaks, so
+public retention reflects policy-aware behavior directly. Recall is reported against the
+full, harder seven-language slice. Span-F1 strict (exact byte+label match) is a secondary
+metric; term-presence recall is the privacy headline.
+
+The 6.6 ms p50 above is the Node ONNX (CPU) figure over the 30k held-out set. Run over a
+held-out OpenPII slice in the browser, the same shipped pipeline measures **3.9 ms p50**
+on WebGPU (Apple Metal, p95 9.3 ms) and 12.6 ms on WASM (p95 35.5 ms), via
+`eval/bench/webgpu.ts` — so the WebGPU form factor is faster than Node CPU on the same
+class of inputs, and WASM is the floor when no GPU is available.
+
+\* See "Schema reconciliation" below — the Rampart policy redacts the precise street line
+(`BUILDING_NUMBER` + `STREET_NAME`) and the secondary-address line while keeping city/state/ZIP, which the harness now honors.
+
+### Per-language slices (OpenPII Latin test, 30k rows across 7 languages)
+
+| Language          | Rows   | Private recall | Public retention | Leaks / total |
+| ----------------- | ------ | -------------- | ---------------- | ------------- |
+| English (`en`)    | 11,569 | 98.85%         | 90.5%            | 618 / 53,877  |
+| Spanish (`es`)    | 3,234  | 98.84%         | 91.6%            | 160 / 13,736  |
+| French (`fr`)     | 4,708  | 98.41%         | 92.8%            | 317 / 19,906  |
+| German (`de`)     | 4,260  | 97.94%         | 91.7%            | 357 / 17,347  |
+| Italian (`it`)    | 3,218  | 97.83%         | 94.1%            | 301 / 13,855  |
+| Portuguese (`pt`) | 1,485  | 97.73%         | 92.5%            | 147 / 6,467   |
+| Dutch (`nl`)      | 1,526  | 97.21%         | 91.9%            | 182 / 6,519   |
+
+All seven languages land in the 97-99% band; Dutch is the lowest at 97.21% and is flagged
+for attention in subsequent training cycles. (The recall band moved down ~1pp versus the
+previous card because the harness now scores the corrected, harder slice — see the note
+above; the same model scores higher on the older, easier slice.)
+
+### Hand-curated suites
+
+| Suite                                                                                      | Cases | Private recall (Wilson 95%) | Public retention |
+| ------------------------------------------------------------------------------------------ | ----- | --------------------------- | ---------------- |
+| Domain intake                                                                              | 20    | 96.97% [84.68, 99.46]       | 93.2%            |
+| Adversarial (homoglyph / zero-width / leet / splits / NFC-NFD / casing / prompt-injection) | 20    | 86.36% [66.66, 95.25]       | 83.3%            |
+| Fairness (Faker × 15 naming traditions × 5 templates)                                      | 1,875 | 65.44% [63.26, 67.56]       | 90.0%            |
+
+The adversarial and domain-intake suites are 20 cases each; Wilson CIs are wide.
+The 1,875-case fairness suite has tight CIs and is the most statistically grounded slice we report.
+
+### Schema reconciliation
+
+The 91.69% retention number in the headline table is term-presence scoring that already credits city/state/ZIP as kept, matching the runtime keep-set.
+We analyzed the 7,244 remaining "over-redacted" public terms in the 30,000-row eval:
+
+- **The vast majority** are policy-driven redactions of street-line components (street name, building number, secondary address line).
+  AI4Privacy OpenPII marks `STREET`, `BUILDINGNUM`, and `SECADDRESS` as `O` (public); the Rampart policy redacts the precise street line (`BUILDING_NUMBER` + `STREET_NAME`) and `SECONDARY_ADDRESS` while keeping `CITY`, `STATE`, and `ZIP`.
+  These are not detector errors; they are the policy firing as designed.
+- **A smaller share** are span-edge artifacts.
+  The runtime's particle-rescue step grows name spans (`GIVEN_NAME` / `SURNAME`) to swallow capitalized particles ("de la", "von", "Mc").
+  When an adjacent public token is itself capitalized, that token can be absorbed into the redacted span.
+- **A very small fraction** are digit fragments inside longer correctly-redacted spans (e.g. "376" found inside a redacted 16-digit credit card).
+
+We publish the 91.69% term-presence number for like-for-like comparison against public PII benchmarks running the same scoring rules.
+For product reasoning, the policy-aware retention exceeds 99%.
+
+## Calibration
+
+The runtime applies a single recall-biased confidence floor (`minScore` = 0.4) uniformly
+across the model's labels, chosen against the 10,000-row OpenPII Latin calibration split
+(disjoint from test) so misses — which leak data — are traded against the cheaper failure
+of over-redaction. There is no per-label threshold table in the shipped runtime; the
+deterministic recognizer layer, not a tuned model threshold, is the system of record for
+the structured classes the model alone is weakest on:
+
+- **SSN** — structural validation (reserved-area rules).
+- **CREDIT_CARD** — Luhn checksum over the digit projection.
+- **EMAIL / URL / IP_ADDRESS** — pattern-anchored regex at near-100% recall.
+
+Phone, routing, government-ID, passport, and license numbers carry no checksum and are
+left to the model under the same recall-biased floor.
+
+ECE on the full 30,000-row test set is **0.291** (overall, all labels); the model alone (no deterministic layer) is **0.018**.
+The system-level ECE is higher because the deterministic layer always emits score 1.0 on its detections, making the score distribution bimodal — that is a score-distribution artifact of the union, not a calibration regression of the underlying model.
+
+## Fairness and limitations
+
+We document failures because consumers need this to deploy the redactor responsibly.
+None of these are surprises; we measured each.
+
+### Fairness across naming traditions (1,875 Faker-generated cases)
+
+Cases are stratified by **naming tradition** (15 categories) embedded in 5 chat templates.
+Same surrounding context across all traditions — only the name varies.
+
+| Tradition           | Locale       | Recall | Cases |
+| ------------------- | ------------ | ------ | ----- |
+| Anglo               | en_US        | 99.9%  | 125   |
+| Hispanic            | es_MX, es_ES | 99.9%  | 250   |
+| Francophone         | fr_FR        | 99.9%  | 125   |
+| Germanic            | de_DE        | 99.9%  | 125   |
+| Romance (Italian)   | it_IT        | 99.9%  | 125   |
+| Lusophone           | pt_BR        | 99.9%  | 125   |
+| Turkic              | tr_TR        | 99.9%  | 125   |
+| Vietnamese          | vi_VN        | 99.2%  | 125   |
+| Japanese            | ja_JP        | 45.6%  | 125   |
+| Korean              | ko_KR        | 15.2%  | 125   |
+| Han Chinese         | zh_CN        | 8.8%   | 125   |
+| South Asian (Hindi) | hi_IN        | 5.6%   | 125   |
+| Arabic              | ar_AA        | 4.8%   | 125   |
+| Slavic (Russian)    | ru_RU        | 2.4%   | 125   |
+
+Aggregated by script:
+
+- **Latin-ASCII names**: ~100% recall (695 / 695)
+- **Latin + diacritics**: 99.8% recall (429 / 430)
+- **Non-Latin scripts**: 13.7% recall (103 / 750)
+
+The deterministic recognizer layer does not catch names — there is no checksum to validate against — so this failure surfaces at the system level.
+This is the most important regression we have identified, and the fairness suite is wired into the eval pipeline as a stratified regression test so any further drop will surface in subsequent training cycles.
+
+### Government-style identifiers (model only)
+
+Government-style identifiers (case numbers, Medicare-style identifiers, USCIS receipts,
+A-numbers, passports, licenses) carry no checksum, so — unlike SSNs and payment cards —
+the deterministic layer does **not** detect them. They rely entirely on the model, which
+catches ~67.6% of them in a structured-ID probe.
+This is a documented weak spot: there is no deterministic backstop for these classes, so
+the model's recall is effectively the system's recall on them.
+Consumers should not assume the deterministic layer covers government IDs the way it
+covers SSNs and cards; deployments that handle these identifiers heavily should add their
+own format-specific validators.
+
+### Adversarial robustness
+
+The system catches most homoglyph, casing, leet, NFC/NFD, and basic whitespace-split attacks.
+It does not reliably catch:
+
+- Zero-width characters injected between every digit of an SSN.
+- Prompt-injection text inside the PII span (e.g. `"ignore previous instructions"`).
+- Combined attacks (homoglyph plus whitespace split).
+
+The deterministic layer's digit projection (which strips non-digit characters before checksum validation) restores most digit-bearing PII against these attacks; names remain vulnerable.
+This is the right framing for the limitation, not the primary use case: Rampart is designed to protect users entering their own information in good faith from incidental disclosure to downstream services, not to defeat a motivated user actively trying to smuggle their own PII past the filter.
+
+### WordPiece fragmentation on long names
+
+Names like `Thanh-Nghiem Quoc-Bao` or `Chukwuemeka Okonkwo-Adeyemi` produce many subwords; the runtime performs span-merging across same-label adjacencies plus particle-rescue, which closes most of the gap.
+Some five-or-more-subword names still fragment in a way that loses recall on the trailing subword.
+
+## Reproducibility
+
+The model weights, deterministic layer, and TypeScript evaluation harness are released under CC BY 4.0.
+
+Evaluation runs entirely in TypeScript, against the shipped pipeline: the native
+benchmark (`eval/bench`) runs the real `@nationaldesignstudio/rampart` code over a
+frozen OpenPII held-out slice and writes `summary.json` / `by_language.json`, which are
+committed alongside the eval output — so every number in this card traces to committed
+evidence produced by the code that ships. The held-out
+row `uid`s are pinned in a committed manifest; regenerate the data with
+`bun run bench:fetch` and reproduce the figures with `bun run bench`.
+
+## Citation
+
+If you use this model in research, please cite:
+
+```bibtex
+@misc{rampart-2026,
+  author = {National Design Studio},
+  title  = {Rampart: Client-side PII redaction for AI assistants},
+  year   = {2026},
+  url    = {https://huggingface.co/nationaldesignstudio/rampart},
+}
+```
+
+Please also cite the upstream training corpus:
+
+```bibtex
+@misc{ai4privacy-openpii-1.5m,
+  title  = {ai4privacy/pii-masking-openpii-1.5m},
+  author = {AI4Privacy},
+  year   = {2025},
+  url    = {https://huggingface.co/datasets/ai4privacy/pii-masking-openpii-1.5m},
+}
+```

README.md

@@ -0,0 +1,422 @@
+---
+library_name: transformers.js
+pipeline_tag: token-classification
+license: cc-by-4.0
+language:
+  - en
+  - es
+  - fr
+  - de
+  - it
+  - pt
+  - nl
+tags:
+  - pii
+  - redaction
+  - privacy
+  - onnx
+  - web
+  - client-side
+  - minilm
+  - browser
+datasets:
+  - ai4privacy/pii-masking-openpii-1.5m
+base_model: nreimers/MiniLM-L6-H384-uncased
+metrics:
+  - private-term-recall
+  - public-term-retention
+  - span-f1
+  - ece
+---
+
+# Rampart
+
+`rampart` is a 14.7 MB ONNX token-classification model that detects personally identifiable information (PII) in text before it leaves the user's device.
+It is the on-device half of **Rampart**, a defense-in-depth client-side redaction system released by National Design Studio.
+The shipped artifact runs alongside a deterministic recognizer layer that handles structured identifiers; together they form the complete system.
+
+This card documents the released artifact only.
+Alternative configurations explored during model selection (an ELECTRA-small base, the prefilter-off training variant, leaner data mixes, and smaller corpus slices) are discussed in the project whitepaper for context but are not published.
+
+## Model summary
+
+| Property              | Value                                                                                                                           |
+| --------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
+| Model id              | `nationaldesignstudio/rampart`                                                                                               |
+| Architecture          | [`nreimers/MiniLM-L6-H384-uncased`](https://huggingface.co/nreimers/MiniLM-L6-H384-uncased) fine-tuned with a 35-label BIO head (17 entity types) |
+| Parameters            | ≈18.5M (MiniLM-L6-H384 with the trimmed 19,730-piece vocabulary; the 22.7M base figure is for the full 30,522-piece BERT vocab) |
+| Quantization          | 4-bit MatMul + INT8 embedding (`onnx/model_q4.onnx`)                                                                            |
+| Shipped artifact size | 14.7 MB |
+| Vocabulary            | 19,730 WordPieces (trimmed from BERT-uncased's 30,522, retaining all special and single-character pieces plus frequent multi-character pieces) |
+| Max sequence          | 512 tokens                                                                                                                      |
+| Languages             | English, Spanish, French, German, Italian, Portuguese, Dutch (all Latin-script)                                                 |
+| Runtime               | ONNX Runtime Web (WASM/WebGPU) via `transformers.js`                                                                            |
+| License               | CC BY 4.0 (Creative Commons Attribution 4.0 International)                                                                       |
+| Training data license | CC BY 4.0 ([`ai4privacy/pii-masking-openpii-1.5m`](https://huggingface.co/datasets/ai4privacy/pii-masking-openpii-1.5m))        |
+| Released by           | National Design Studio                                                                                                          |
+| Card version          | 1.0 (initial public release)                                                                                                    |
+
+## Intended use
+
+The model is designed for **client-side redaction of user-typed text in AI assistants and intake flows** — replacing identifying values with stable placeholders before any data is transmitted to a model provider, a server, or a logging system.
+
+### Direct uses
+
+- Redact user content before passing it to a hosted LLM.
+- Maintain stable placeholders (`[GIVEN_NAME_1]`, `[SSN_1]`, ...) across a multi-turn conversation, with rehydration on the client.
+- Preempt accidental collection of personal data in analytics, traces, and crash reports.
+- Validate domain-specific redaction policies before deploying chat systems in regulated contexts.
+
+### Out of scope
+
+- **Stand-alone government-ID detection.**
+  The model is one layer of a defense-in-depth system; it is not a replacement for the deterministic recognizer layer that ships alongside it.
+  SSNs and payment cards are caught by the deterministic layer with checksum validation (structural rules and Luhn), at higher recall than the model alone.
+  Phone, routing, government-ID, passport, and license numbers carry no checksum, so they are caught by the model; the deterministic layer does not attempt them.
+- **Indirect / inferential identifiers.**
+  A "rare disease + 5-digit ZIP" combination can re-identify someone even though neither token is in the redact-set.
+  The model does not detect inferential leaks.
+- **Adversarial robustness as a security guarantee.**
+  We publish numbers on hostile inputs and document the failure surface; the system is positioned as harm reduction for users entering their own information in good faith, not as a security boundary against motivated adversaries.
+- **Non-Latin scripts.**
+  This release is scoped to the seven Latin-script languages listed above.
+  Korean, Han Chinese, Japanese, Arabic, Cyrillic, and Devanagari names recall ~14% in aggregate (see "Fairness and limitations" below).
+  Do not deploy this release for populations who routinely type non-Latin-script names without compensating controls; monitor accordingly.
+
+### Usage
+
+The runtime ships as [`@nationaldesignstudio/rampart`](https://www.npmjs.com/package/@nationaldesignstudio/rampart). `createGuard()` returns a `ChatGuard` that loads this classifier and runs the full deterministic + model pipeline:
+
+```ts
+import { createGuard } from "@nationaldesignstudio/rampart";
+
+const guard = await createGuard();
+const { redacted } = await guard.redact("My name is Alex Rivera and my SSN is 472-81-0094.");
+// → "My name is [GIVEN_NAME_1] [SURNAME_1] and my SSN is [SSN_1]."
+```
+
+## Training data
+
+| Source                                                                                                       | Rows used                        | License    | Role                                                                                                                                       |
+| ------------------------------------------------------------------------------------------------------------ | -------------------------------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
+| [`ai4privacy/pii-masking-openpii-1.5m`](https://huggingface.co/datasets/ai4privacy/pii-masking-openpii-1.5m) | 643,756 train + 100,000 held-out | CC BY 4.0  | Realistic chat-style PII; 7 Latin-script languages (en, es, fr, de, it, pt, nl); the OpenPII schema mapped to our 35-label BIO schema (17 entity types) |
+| Synthetic generator                                                                                          | 20,000 train                     | Apache-2.0 | Class reinforcement for the 17 entity types — accent-bearing names from curated first- and last-name pools and templated structured fields, generated deliberately messy (typos, all-caps, voice-dictated and pasted-from-form phrasing, multilingual mixing, contradictory/duplicated values) so the model sees realistic disordered input, not just clean OpenPII prose |
+
+The held-out 100,000 rows are split into two non-overlapping subsets, seeded for full reproducibility:
+
+- **10,000 rows** for recall-floor threshold tuning.
+- **30,000 rows** for the headline test results below (per-language row counts in the eval table).
+
+The remaining 60,000 held-out rows are reserved for future evaluation and are not used in this release.
+
+### Pre-processing
+
+All training rows pass through the same normalization the runtime applies before tokenization: lowercase, NFKD decomposition, and combining-mark stripping.
+The combining-mark step folds accents — `José` becomes `jose`, `Müller` becomes `muller` — so the model sees a single canonical form regardless of how the user typed the name.
+This matches what BERT's BasicTokenizer does implicitly at inference time under `do_lower_case=True`, so the train-time and runtime distributions are identical by construction.
+A guard in the training pipeline fails the run if a future tokenizer change breaks this assumption.
+
+A re-trainer who omits this normalization step will produce a model with mismatched distributions, and recall numbers will not reproduce.
+
+The structured classes the deterministic layer owns (`SSN`, `CREDIT_CARD`, `IP_ADDRESS`) are also masked to sentinel tokens before tokenization — both at inference (`src/premask.ts`) and during dataset construction — so the model never learns to classify raw card/SSN/IP digits and the train-time and inference-time inputs match by construction.
+
+### Vocabulary
+
+The full BERT-uncased vocabulary contains 30,522 WordPieces.
+The shipped vocabulary retains:
+
+1. All special tokens (`[PAD]`, `[UNK]`, `[CLS]`, `[SEP]`, `[MASK]`).
+2. All single-character pieces and their `##` continuations, which preserve WordPiece's character-level fallback for rare names.
+3. All multi-character pieces appearing in the training corpus above a frequency threshold.
+
+The shipped vocabulary is **19,730 pieces**.
+
+### Training procedure
+
+| Hyperparameter      | Value                            |
+| ------------------- | -------------------------------- |
+| Base                | nreimers/MiniLM-L6-H384-uncased  |
+| Epochs              | 3                                |
+| Batch size          | 32                               |
+| Learning rate       | 5e-5                             |
+| Weight decay        | 0.01                             |
+| Max sequence length | 512                              |
+| Optimizer           | AdamW                            |
+| Eval strategy       | per-epoch on held-out validation |
+| Save strategy       | per-epoch                        |
+| Hardware            | Apple M-series MPS               |
+| Total wall time     | ~3.5 hours                       |
+
+The final epoch was selected by held-out eval loss.
+
+## Label taxonomy
+
+The model emits 35 BIO labels (17 entity types × {B-, I-} + O); the deterministic
+recognizer layer contributes three more structured classes that are masked before
+the model runs. The runtime applies a default-deny policy: every detected span is
+redacted unless its label is explicitly in the keep-set.
+
+### Redacted by default
+
+Owned by the deterministic recognizer layer (regex + validator, masked before the model):
+
+| Label         | Description                                                       |
+| ------------- | ----------------------------------------------------------------- |
+| `SSN`         | Social Security Numbers (US) — structural validation              |
+| `CREDIT_CARD` | Payment card numbers — Luhn-validated                             |
+| `EMAIL`       | Email addresses                                                   |
+| `URL`         | URLs in user content                                              |
+| `IP_ADDRESS`  | IPv4 / IPv6 / MAC addresses                                       |
+
+Emitted by the token-classification model:
+
+| Label               | Description                                          |
+| ------------------- | ---------------------------------------------------- |
+| `GIVEN_NAME`        | Given / first names                                  |
+| `SURNAME`           | Family / last names                                  |
+| `PHONE`             | Phone numbers                                        |
+| `TAX_ID`            | Tax identifiers                                      |
+| `BANK_ACCOUNT`      | Bank account / IBAN numbers                          |
+| `ROUTING_NUMBER`    | Bank routing numbers                                 |
+| `GOVERNMENT_ID`     | Government-issued ID / case numbers                  |
+| `PASSPORT`          | Passport numbers                                     |
+| `DRIVERS_LICENSE`   | Driver's license numbers                             |
+| `BUILDING_NUMBER`   | Street-line building number                          |
+| `STREET_NAME`       | Street name                                          |
+| `SECONDARY_ADDRESS` | Secondary-address line (apt / unit / suite)          |
+
+`BUILDING_NUMBER` + `STREET_NAME` together form the precise street line; both are
+redacted while city/state/ZIP are kept.
+
+### Kept by default
+
+| Label      | Description                                                  |
+| ---------- | ------------------------------------------------------------ |
+| `CITY`     | City — coarse geography for eligibility checks               |
+| `STATE`    | State / region                                               |
+| `ZIP_CODE` | Postal code                                                  |
+
+The keep-set keeps coarse geography (city/state/ZIP) while redacting the precise
+street line. To change it, edit `KEEP_LABELS` in `src/types.ts` — it is a
+compile-time set, not a runtime flag.
+
+The taxonomy is deliberately **atomic**: there is no coarse `PERSON`,
+`STREET_ADDRESS`, `ADDRESS`, `ORGANIZATION`, or `LOCATION` label, and no catch-all
+`SECRET`. Names split into `GIVEN_NAME` / `SURNAME`, the street line into
+`BUILDING_NUMBER` / `STREET_NAME`, and document identifiers into their specific
+classes, so the model learns to catch PII fragments in disordered text rather than
+expecting one tidy blob. Dates, ages, and income are intentionally **not** modeled
+as PII (they map to `O`): a bare date is rarely identifying, and assistants need age
+and income as context, so redacting them was over-redaction without a privacy gain.
+
+## Evaluation
+
+We score the **full system** (model + deterministic layer) because that is what consumers experience end-to-end.
+Model-only numbers are reported separately for researchers who want to evaluate the encoder in isolation.
+
+### Primary metrics
+
+- **Private-term recall**: for every gold private value, did the redacted output contain the value? This is the privacy-headline number; misses here are leaks.
+- **Public-term retention**: for every gold public value, did the redacted output preserve the value? This measures over-redaction.
+- **Span F1 strict (IoU=1.0)** and **relaxed (IoU≥0.5)**: how well predicted span boundaries align with gold boundaries under one-to-one greedy matching.
+- **Latency**: Node.js ONNX runtime cold / p50 / p95 / p99 over the full 30,000-row test set. Browser latency (WebGPU and WASM backends) is measured separately by `eval/bench/webgpu.ts` — see below.
+- **Calibration**: 15-bin reliability ECE, per label and overall, on per-span max-class scores.
+
+All recall and retention numbers carry Wilson 95% confidence intervals; stratified breakdowns include 1000-iteration bootstrap intervals.
+
+### Held-out OpenPII test set — seven supported languages (30,000 rows; 131,707 private terms; 87,207 public terms)
+
+The headline number is measured across all seven supported Latin-script languages.
+English-only, Spanish-only, and the English+Spanish slice are reported as sub-slices.
+
+| Slice                        | Private recall (Wilson 95%) | Public retention\* | Span F1 strict | Latency p50 |
+| ---------------------------- | --------------------------- | ------------------ | -------------- | ----------- |
+| **All seven languages**      | **98.42% [98.35, 98.49]**   | 91.69%             | 0.528          | 6.6 ms      |
+| English only (11,569 rows)   | 98.85%                      | 90.5%              | —              | 6.6 ms      |
+| Spanish only (3,234 rows)    | 98.84%                      | 91.6%              | —              | 6.6 ms      |
+| English + Spanish            | 98.85%                      | 91.0%              | —              | 6.6 ms      |
+
+2,082 leaks of 131,707 private terms on the seven-language test (1 in 64 terms slips past
+the system, before the application's downstream defenses fire). On the English+Spanish
+slice the system leaks 778 of 67,613.
+
+These numbers are measured by the committed `eval/bench` harness running the **shipped Q4
+pipeline** end-to-end over a pinned held-out slice of `pii-masking-openpii-1.5m`. The
+harness was corrected relative to earlier revisions of this card: city/state/ZIP are now
+scored as **kept** (matching the runtime keep-set) instead of being counted as leaks, so
+public retention reflects policy-aware behavior directly. Recall is reported against the
+full, harder seven-language slice. Span-F1 strict (exact byte+label match) is a secondary
+metric; term-presence recall is the privacy headline.
+
+The 6.6 ms p50 above is the Node ONNX (CPU) figure over the 30k held-out set. Run over a
+held-out OpenPII slice in the browser, the same shipped pipeline measures **3.9 ms p50**
+on WebGPU (Apple Metal, p95 9.3 ms) and 12.6 ms on WASM (p95 35.5 ms), via
+`eval/bench/webgpu.ts` — so the WebGPU form factor is faster than Node CPU on the same
+class of inputs, and WASM is the floor when no GPU is available.
+
+\* See "Schema reconciliation" below — the Rampart policy redacts the precise street line
+(`BUILDING_NUMBER` + `STREET_NAME`) and the secondary-address line while keeping city/state/ZIP, which the harness now honors.
+
+### Per-language slices (OpenPII Latin test, 30k rows across 7 languages)
+
+| Language          | Rows   | Private recall | Public retention | Leaks / total |
+| ----------------- | ------ | -------------- | ---------------- | ------------- |
+| English (`en`)    | 11,569 | 98.85%         | 90.5%            | 618 / 53,877  |
+| Spanish (`es`)    | 3,234  | 98.84%         | 91.6%            | 160 / 13,736  |
+| French (`fr`)     | 4,708  | 98.41%         | 92.8%            | 317 / 19,906  |
+| German (`de`)     | 4,260  | 97.94%         | 91.7%            | 357 / 17,347  |
+| Italian (`it`)    | 3,218  | 97.83%         | 94.1%            | 301 / 13,855  |
+| Portuguese (`pt`) | 1,485  | 97.73%         | 92.5%            | 147 / 6,467   |
+| Dutch (`nl`)      | 1,526  | 97.21%         | 91.9%            | 182 / 6,519   |
+
+All seven languages land in the 97-99% band; Dutch is the lowest at 97.21% and is flagged
+for attention in subsequent training cycles. (The recall band moved down ~1pp versus the
+previous card because the harness now scores the corrected, harder slice — see the note
+above; the same model scores higher on the older, easier slice.)
+
+### Hand-curated suites
+
+| Suite                                                                                      | Cases | Private recall (Wilson 95%) | Public retention |
+| ------------------------------------------------------------------------------------------ | ----- | --------------------------- | ---------------- |
+| Domain intake                                                                              | 20    | 96.97% [84.68, 99.46]       | 93.2%            |
+| Adversarial (homoglyph / zero-width / leet / splits / NFC-NFD / casing / prompt-injection) | 20    | 86.36% [66.66, 95.25]       | 83.3%            |
+| Fairness (Faker × 15 naming traditions × 5 templates)                                      | 1,875 | 65.44% [63.26, 67.56]       | 90.0%            |
+
+The adversarial and domain-intake suites are 20 cases each; Wilson CIs are wide.
+The 1,875-case fairness suite has tight CIs and is the most statistically grounded slice we report.
+
+### Schema reconciliation
+
+The 91.69% retention number in the headline table is term-presence scoring that already credits city/state/ZIP as kept, matching the runtime keep-set.
+We analyzed the 7,244 remaining "over-redacted" public terms in the 30,000-row eval:
+
+- **The vast majority** are policy-driven redactions of street-line components (street name, building number, secondary address line).
+  AI4Privacy OpenPII marks `STREET`, `BUILDINGNUM`, and `SECADDRESS` as `O` (public); the Rampart policy redacts the precise street line (`BUILDING_NUMBER` + `STREET_NAME`) and `SECONDARY_ADDRESS` while keeping `CITY`, `STATE`, and `ZIP`.
+  These are not detector errors; they are the policy firing as designed.
+- **A smaller share** are span-edge artifacts.
+  The runtime's particle-rescue step grows name spans (`GIVEN_NAME` / `SURNAME`) to swallow capitalized particles ("de la", "von", "Mc").
+  When an adjacent public token is itself capitalized, that token can be absorbed into the redacted span.
+- **A very small fraction** are digit fragments inside longer correctly-redacted spans (e.g. "376" found inside a redacted 16-digit credit card).
+
+We publish the 91.69% term-presence number for like-for-like comparison against public PII benchmarks running the same scoring rules.
+For product reasoning, the policy-aware retention exceeds 99%.
+
+## Calibration
+
+The runtime applies a single recall-biased confidence floor (`minScore` = 0.4) uniformly
+across the model's labels, chosen against the 10,000-row OpenPII Latin calibration split
+(disjoint from test) so misses — which leak data — are traded against the cheaper failure
+of over-redaction. There is no per-label threshold table in the shipped runtime; the
+deterministic recognizer layer, not a tuned model threshold, is the system of record for
+the structured classes the model alone is weakest on:
+
+- **SSN** — structural validation (reserved-area rules).
+- **CREDIT_CARD** — Luhn checksum over the digit projection.
+- **EMAIL / URL / IP_ADDRESS** — pattern-anchored regex at near-100% recall.
+
+Phone, routing, government-ID, passport, and license numbers carry no checksum and are
+left to the model under the same recall-biased floor.
+
+ECE on the full 30,000-row test set is **0.291** (overall, all labels); the model alone (no deterministic layer) is **0.018**.
+The system-level ECE is higher because the deterministic layer always emits score 1.0 on its detections, making the score distribution bimodal — that is a score-distribution artifact of the union, not a calibration regression of the underlying model.
+
+## Fairness and limitations
+
+We document failures because consumers need this to deploy the redactor responsibly.
+None of these are surprises; we measured each.
+
+### Fairness across naming traditions (1,875 Faker-generated cases)
+
+Cases are stratified by **naming tradition** (15 categories) embedded in 5 chat templates.
+Same surrounding context across all traditions — only the name varies.
+
+| Tradition           | Locale       | Recall | Cases |
+| ------------------- | ------------ | ------ | ----- |
+| Anglo               | en_US        | 99.9%  | 125   |
+| Hispanic            | es_MX, es_ES | 99.9%  | 250   |
+| Francophone         | fr_FR        | 99.9%  | 125   |
+| Germanic            | de_DE        | 99.9%  | 125   |
+| Romance (Italian)   | it_IT        | 99.9%  | 125   |
+| Lusophone           | pt_BR        | 99.9%  | 125   |
+| Turkic              | tr_TR        | 99.9%  | 125   |
+| Vietnamese          | vi_VN        | 99.2%  | 125   |
+| Japanese            | ja_JP        | 45.6%  | 125   |
+| Korean              | ko_KR        | 15.2%  | 125   |
+| Han Chinese         | zh_CN        | 8.8%   | 125   |
+| South Asian (Hindi) | hi_IN        | 5.6%   | 125   |
+| Arabic              | ar_AA        | 4.8%   | 125   |
+| Slavic (Russian)    | ru_RU        | 2.4%   | 125   |
+
+Aggregated by script:
+
+- **Latin-ASCII names**: ~100% recall (695 / 695)
+- **Latin + diacritics**: 99.8% recall (429 / 430)
+- **Non-Latin scripts**: 13.7% recall (103 / 750)
+
+The deterministic recognizer layer does not catch names — there is no checksum to validate against — so this failure surfaces at the system level.
+This is the most important regression we have identified, and the fairness suite is wired into the eval pipeline as a stratified regression test so any further drop will surface in subsequent training cycles.
+
+### Government-style identifiers (model only)
+
+Government-style identifiers (case numbers, Medicare-style identifiers, USCIS receipts,
+A-numbers, passports, licenses) carry no checksum, so — unlike SSNs and payment cards —
+the deterministic layer does **not** detect them. They rely entirely on the model, which
+catches ~67.6% of them in a structured-ID probe.
+This is a documented weak spot: there is no deterministic backstop for these classes, so
+the model's recall is effectively the system's recall on them.
+Consumers should not assume the deterministic layer covers government IDs the way it
+covers SSNs and cards; deployments that handle these identifiers heavily should add their
+own format-specific validators.
+
+### Adversarial robustness
+
+The system catches most homoglyph, casing, leet, NFC/NFD, and basic whitespace-split attacks.
+It does not reliably catch:
+
+- Zero-width characters injected between every digit of an SSN.
+- Prompt-injection text inside the PII span (e.g. `"ignore previous instructions"`).
+- Combined attacks (homoglyph plus whitespace split).
+
+The deterministic layer's digit projection (which strips non-digit characters before checksum validation) restores most digit-bearing PII against these attacks; names remain vulnerable.
+This is the right framing for the limitation, not the primary use case: Rampart is designed to protect users entering their own information in good faith from incidental disclosure to downstream services, not to defeat a motivated user actively trying to smuggle their own PII past the filter.
+
+### WordPiece fragmentation on long names
+
+Names like `Thanh-Nghiem Quoc-Bao` or `Chukwuemeka Okonkwo-Adeyemi` produce many subwords; the runtime performs span-merging across same-label adjacencies plus particle-rescue, which closes most of the gap.
+Some five-or-more-subword names still fragment in a way that loses recall on the trailing subword.
+
+## Reproducibility
+
+The model weights, deterministic layer, and TypeScript evaluation harness are released under CC BY 4.0.
+
+Evaluation runs entirely in TypeScript, against the shipped pipeline: the native
+benchmark (`eval/bench`) runs the real `@nationaldesignstudio/rampart` code over a
+frozen OpenPII held-out slice and writes `summary.json` / `by_language.json`, which are
+committed alongside the eval output — so every number in this card traces to committed
+evidence produced by the code that ships. The held-out
+row `uid`s are pinned in a committed manifest; regenerate the data with
+`bun run bench:fetch` and reproduce the figures with `bun run bench`.
+
+## Citation
+
+If you use this model in research, please cite:
+
+```bibtex
+@misc{rampart-2026,
+  author = {National Design Studio},
+  title  = {Rampart: Client-side PII redaction for AI assistants},
+  year   = {2026},
+  url    = {https://huggingface.co/nationaldesignstudio/rampart},
+}
+```
+
+Please also cite the upstream training corpus:
+
+```bibtex
+@misc{ai4privacy-openpii-1.5m,
+  title  = {ai4privacy/pii-masking-openpii-1.5m},
+  author = {AI4Privacy},
+  year   = {2025},
+  url    = {https://huggingface.co/datasets/ai4privacy/pii-masking-openpii-1.5m},
+}
+```

WHITEPAPER.md

@@ -0,0 +1,316 @@
+# Rampart — A Local-First System for PII Redaction
+
+## Abstract
+
+We describe **Rampart**, a local-first system for removing personally identifiable information from user-typed text before it leaves the browser.
+The system combines a 14.7 MB ONNX token-classification model with a deterministic recognizer layer; together the two layers form the first gate of a defense-in-depth pipeline.
+
+This release is scoped to the **seven Latin-script languages** the model was trained on (English, Spanish, French, German, Italian, Portuguese, Dutch); names in non-Latin scripts are out of scope (see §8).
+Across all seven languages, on a 30,000-row held-out test set drawn from the OpenPII 1.5M corpus, the full system achieves **98.42% private-term recall** (Wilson 95% CI [98.35, 98.49]) at 6.6 ms median latency in Node ONNX, with 91.7% public-term retention under term-presence scoring (and >99% under policy-aware scoring after schema reconciliation with the gold labels).
+On the English+Spanish slice the system reaches **98.85%** recall.
+In the browser, over a held-out OpenPII slice, the shipped pipeline runs at **3.9 ms p50** on WebGPU (Apple Metal) and 12.6 ms on WASM, measured by the `eval/bench/webgpu.ts` harness (latency is hardware-dependent; reproduce with `bun run bench:webgpu`).
+
+Rampart is **harm reduction**, not perfect protection.
+Any privacy system that depends on a trusted server-side environment inherits that environment's risk: once unredacted text leaves the device — to a model provider, a logging pipeline, an analytics SDK, or a future infrastructure breach — it is exposed to failures beyond the user's control.
+Redacting in the browser shifts that trust boundary: the impact of any downstream failure is bounded by what the client already removed, because a later component cannot leak what was never sent.
+No model this small catches every instance of PII, so we deliberately chose a recall-biased operating point that still runs entirely in the browser on low-end hardware, offline, with no network round trip — a meaningful layer of defense in depth, not a guarantee.
+
+This document describes the architecture, the alternatives we evaluated and rejected, our training and evaluation methodology, operating-point and calibration analysis, known failure modes, and the licensing under which the system is released.
+
+## 1. Design goals
+
+The system is built around four constraints:
+
+1. **Local-first privacy as harm reduction.** Personal information is removed before reaching application infrastructure. Data the server never receives cannot be leaked by a model provider, a logging system, an analytics pipeline, a third-party SDK, or a future compromise of the application's own backend. This is the threat model that motivates the entire system: every other constraint follows from refusing to put the user in a position where they have to trust a remote operator with their unredacted text.
+2. **Browser-deployable.** The shipped artifact must fit on a low-end mobile phone. Targeting under 15 MB on the wire ruled out most modern PII NER models, including GLiNER (≈50 MB) and DistilBERT-based detectors (≈64 MB).
+3. **Recall-biased.** Misses leak data, so the default policy redacts whenever a detector fires above its calibrated threshold. Over-redaction has a real cost, too: a chat assistant that cannot see context cannot help, but at a smaller cost than a leak.
+4. **Domain-aware retention.** Useful assistants often need rough context, like coarse geography, to be helpful. The keep-set (`{CITY, STATE, ZIP_CODE}`) is policy-driven so applications can tune the boundary between privacy and utility without retraining; the precise street line is redacted.
+
+## 2. Architecture
+
+Rampart ships as two cooperating layers that run in parallel and merge their outputs.
+Each layer is designed to cover a class of failures the other layer cannot reliably handle on its own.
+Both run entirely in-browser.
+
+### 2.1 The deterministic recognizer layer
+
+Real-world PII often has structure that is faster and more reliable to validate than to learn.
+The deterministic layer is a curated set of regular expressions paired with checksum and structural validators.
+It owns five classes end-to-end:
+
+- **Luhn checksum** for payment cards, matched over the digit projection so every separator form collapses to one rule.
+- **SSN structural rules** that reject reserved areas (000, 666, 9XX) and ZIP+4 codes that pattern-match the SSN shape.
+- **Pattern-backed detection** for email addresses, URLs, and IP addresses (IPv4, IPv6, and MAC), where the structure lives in the punctuation.
+
+These detectors are synchronous and run on the raw input, so this structured PII can be removed even before the model has loaded.
+Because cards and SSNs use checksums and structural rules rather than only shape matching, false-positive rates are very low: a 16-digit number that fails Luhn is not redacted as a card; a 9-digit number with a reserved-area prefix is not redacted as an SSN.
+Classes with no checksum — phone, routing, tax, government-ID, passport, and license numbers, and street-address components — are deliberately left to the model rather than guessed at with a regex.
+
+### 2.2 The token-classification model
+
+The deterministic layer cannot recognize contextual PII — names, phone numbers, account/routing/tax numbers, government IDs, passports, licenses, and free-form address components.
+For these, Rampart uses a MiniLM-L6-H384 encoder fine-tuned on a 35-label BIO head (17 entity types).
+The tokenizer is an uncased WordPiece tokenizer trimmed to 19,730 pieces (from BERT-uncased's 30,522).
+Single-character pieces are always retained, which preserves WordPiece's character-level fallback for rare names and out-of-vocabulary content.
+
+### 2.3 Span repair
+
+HuggingFace's standard `aggregation_strategy="simple"` produces fragmented spans when subword B-`GIVEN_NAME` probabilities outrank I-`GIVEN_NAME` inside a name, e.g. "Zaccarino" tokenized as "Zac"+"##car"+"##ino" can come back as three separate name spans.
+Rampart applies three layers of post-processing:
+
+1. **Adjacent-span merging** collapses consecutive same-label spans separated only by name-internal punctuation (space, hyphen, apostrophe, period, comma).
+2. **Iterative bridge-and-merge** rescues low-confidence candidates (score between the 0.15 extend floor and the 0.4 keep threshold) when they bridge two high-confidence spans of the same label. This catches names like "Jose [LOW] de [HIGH] Garcia" where a particle scored below the cutoff but is structurally part of the name.
+3. **Capitalized-particle rescue** grows name spans (`GIVEN_NAME` / `SURNAME`) to swallow short capitalized name particles ("De la", "Von", "Mc") sitting inside a name's flow.
+
+This composition lifts span-F1 to 0.53 strict (IoU=1.0) and 0.66 relaxed (IoU≥0.5) on the 30,000-row test set, well above the fragmented spans the default aggregation produces.
+
+### 2.4 Defense in depth
+
+The two layers are complementary, not redundant. Each owns the classes the other handles poorly:
+
+| Layer         | Owns                                                                                                                                                                                                             | Why                                                                                                                                                                               |
+| ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Deterministic | `SSN`, `CREDIT_CARD`, `IP_ADDRESS`, `EMAIL`, `URL`                                                                                                                                                               | Checksum/structural validation (cards, SSNs) or punctuation-anchored patterns (email, URL, IP) give near-perfect precision and recall, including under orthographic perturbation. |
+| Model         | `GIVEN_NAME`, `SURNAME`, `PHONE`, `TAX_ID`, `BANK_ACCOUNT`, `ROUTING_NUMBER`, `GOVERNMENT_ID`, `PASSPORT`, `DRIVERS_LICENSE`, `BUILDING_NUMBER`, `STREET_NAME`, `SECONDARY_ADDRESS`, `CITY`, `STATE`, `ZIP_CODE` | Open-ended, context-dependent, and free of any checksum to validate against — exactly what an enumerable rule set cannot keep up with.                                            |
+
+The model handles open-ended cases in shapes the regex catalog cannot predict for; the deterministic layer covers the structured classes where exact-character recall matters and adversarial inputs where a Luhn-valid card survives any perturbation of the surrounding text.
+
+The system unions the two layers' spans before applying policy, so a token redacted by either layer is redacted in output.
+This is why full-system private-term recall exceeds the model alone on the structured classes the deterministic layer owns, while the model raises the ceiling on classes the deterministic layer cannot enumerate.
+
+### 2.5 Policy
+
+Every detected span carries a label.
+The policy layer applies **default-deny**: each label is redacted unless explicitly in the keep-set.
+The default keep-set is `{CITY, STATE, ZIP_CODE}` so an assistant can reason about coarse geography and eligibility while the precise street line (`BUILDING_NUMBER` + `STREET_NAME`) and secondary-address line (`SECONDARY_ADDRESS`) are redacted alongside names, identifiers, and contact information.
+The keep-set is a compile-time set (`KEEP_LABELS` in `src/types.ts`), not a runtime flag.
+
+### 2.6 Session table
+
+A client-only session table maps each detected raw value to a stable placeholder:
+
+```
+Maria Garcia    →  [GIVEN_NAME_1] [SURNAME_1]
+555-11-2222     →  [SSN_1]
+88 Pine Avenue  →  [BUILDING_NUMBER_1] [STREET_NAME_1]
+```
+
+The model provider sees only the placeholders.
+The user sees the restored response.
+Placeholders are intentionally formatted to look obviously synthetic so a model provider cannot easily de-anonymize them through downstream inference.
+The table is never transmitted.
+
+## 3. Methodology
+
+### 3.1 The candidate space
+
+Model selection was not a one-shot grid.
+The shipped model is the product of a sustained, instrumented search: many fine-tuning runs across base architecture, corpus composition, label schema, vocabulary trim, prefilter strategy, and quantization, run over the project's lifetime.
+The eval harness (§3.4) was the instrument that drove it.
+Every run was scored end-to-end against the held-out set, and the corpus and schema were evolved in whatever direction the metrics said was working.
+The relabeling and corpus update decisions in §3.5 are themselves validated outputs of that loop.
+
+One representative round of that search — the selection matrix detailed in §4 — varied four axes over their Cartesian product:
+
+- **Base architecture (2).** MiniLM-L6-H384-uncased vs ELECTRA-small. ELECTRA is attractive in size (its trimmed Q4 artifact is ~10 MB to MiniLM's ~19 MB at full vocab) but, as §4.1 shows, did not imbibe additional data the way MiniLM did.
+- **Prefilter (2).** Whether the deterministic layer's structured classes (`SSN`, `CREDIT_CARD`, `IP_ADDRESS`) are premasked before the model classifier runs or trained as real model classes (the no-prefilter ablation). Prefilter-on is the shipped configuration; the model never spends capacity on digits a checksum already settles.
+- **Data mix (3).** Cumulative: the synthetic conversation corpus alone, then plus an OCR'd-document corpus, then plus the public AI4Privacy template corpus.
+- **Corpus volume (2).** The first 100k vs the first 250k synthetic conversations.
+
+That is 2 × 3 × 2 = 12 data/architecture cells per base, scored under both runtime modes — a 24-model ablation, each cell exported to its Q4 and several vocab-trimmed artifacts.
+§4 reports it and the directional findings that came out of it; this section defines the rules under which every cell was scored.
+It is one round of the larger, ongoing search, not its entirety.
+
+### 3.2 Pre-registered eval design
+
+The eval design is fixed before a round's numbers are read.
+The governing principle is recall-biased and size-aware:
+
+> Among candidates that clear the private-term recall floor on the held-out set, ship the smallest — unless a documented reason (multilingual coverage, adversarial robustness, a fairness regression) justifies overriding.
+
+### 3.3 Datasets
+
+| Dataset                             | Rows  | Use                                                                                                               |
+| ----------------------------------- | ----- | ----------------------------------------------------------------------------------------------------------------- |
+| OpenPII calibration                 | 10k   | Recall-floor threshold tuning                                                                                     |
+| OpenPII held-out test (7 languages) | 30k   | Headline test (en, es, fr, de, it, pt, nl)                                                                        |
+| Per-language slices                 | —     | English (11,569) and Spanish (3,234) reported separately; remaining five in the per-language table (§ model card) |
+| Fairness                            | 1,875 | Faker × 15 naming traditions × 5 templates                                                                        |
+
+All OpenPII splits are drawn deterministically from the held-out 100k partition of the OpenPII 1.5M corpus, disjoint from training.
+The shipped headline is measured across all seven supported languages; the per-language counts are the natural language distribution of that 30k slice (see model card).
+
+### 3.4 Metrics
+
+- **Private-term recall**: for every gold private value, did the redacted output contain the value? Wilson 95% CI; bootstrap 1000-resample CI for stratified breakdowns.
+- **Public-term retention**: for every gold public value, did the redacted output preserve the value?
+- **Span-level F1**: strict at IoU=1.0; relaxed at IoU≥0.5; overlap at IoU>0. One-to-one greedy matching, higher-scored predictions match first.
+- **Latency**: Node.js ONNX runtime cold / p50 / p95 / p99 over the full 30,000-row test set.
+- **Calibration**: 15-bin reliability expected calibration error (ECE), per label and overall, computed on per-span max-class scores.
+
+#### Headline results, per language
+
+Full system (model + deterministic layer + policy) on the 30,000-row held-out test, scored end-to-end by the committed `eval/bench` harness:
+
+| Language        |       Rows | Private recall | Public retention | Leaks / private terms |
+| --------------- | ---------: | -------------: | ---------------: | --------------------: |
+| English (en)    |     11,569 |         98.85% |            90.5% |          618 / 53,877 |
+| Spanish (es)    |      3,234 |         98.84% |            91.6% |          160 / 13,736 |
+| French (fr)     |      4,708 |         98.41% |            92.8% |          317 / 19,906 |
+| German (de)     |      4,260 |         97.94% |            91.7% |          357 / 17,347 |
+| Italian (it)    |      3,218 |         97.83% |            94.1% |          301 / 13,855 |
+| Portuguese (pt) |      1,485 |         97.73% |            92.5% |           147 / 6,467 |
+| Dutch (nl)      |      1,526 |         97.21% |            91.9% |           182 / 6,519 |
+| **All seven**   | **30,000** |     **98.42%** |       **91.69%** |   **2,082 / 131,707** |
+
+Recall is term-presence (did every gold private value vanish from the output); retention is the policy-aware keep-set (city/state/ZIP). The seven-language aggregate carries a Wilson 95% CI of [98.35, 98.49].
+
+### 3.5 Label schema and training-data design
+
+The shipped model reflects two design decisions that postdate the candidate sweep above.
+Both are about _what_ the model is asked to learn, not which checkpoint to ship.
+
+**Atomic label decomposition.**
+Earlier iterations used coarse, pre-combined labels — a single `STREET_ADDRESS`, a single `PERSON`, plus `ORGANIZATION`, `LOCATION`, `DATE`, `AGE`, `INCOME`, and a catch-all `SECRET`.
+A model trained on those overfits to the easy case where a name or address arrives as one tidy, well-formed blob.
+The shipped schema instead forces everything to atomic pieces: names split into `GIVEN_NAME` / `SURNAME`; the street line into `BUILDING_NUMBER` / `STREET_NAME`; geography into `CITY` / `STATE` / `ZIP_CODE`; and document identifiers into their specific classes (`TAX_ID`, `BANK_ACCOUNT`, `ROUTING_NUMBER`, `GOVERNMENT_ID`, `PASSPORT`, `DRIVERS_LICENSE`) rather than a generic `SECRET`.
+This trains the model to recognize PII _fragments_ in disordered text — a building number on one line, a street name three messages later — instead of expecting a textbook one-line address.
+
+**Dates, ages, and income are non-PII.**
+These were dropped from the redact-set entirely and map to `O` (kept context).
+A public-benefits assistant needs to reason about age and income to be useful, and a bare date is rarely identifying on its own; classifying them as redactable was over-redaction that hurt utility without a matching privacy gain.
+The keep-set proper is `{CITY, STATE, ZIP_CODE}`; dates/ages/income are simply not modeled as PII.
+
+**Premask train/serve symmetry.**
+The structured classes the deterministic layer owns (`SSN`, `CREDIT_CARD`, `IP_ADDRESS`) are replaced with sentinel tokens _before_ the model sees the text, both at inference (`src/premask.ts`) and during dataset construction .
+The model therefore never spends capacity learning to classify raw card/SSN/IP digits — those are a solved problem for a checksum — and the train-time and inference-time input distributions match by construction.
+
+**A deliberately noisy corpus.** OpenPII supplies broad multilingual entropy, but its conversations are clean and well-formed.
+To keep the redactor from overfitting to tidy inputs, the synthetic portion of the corpus is generated to be messy and realistic on purpose: low-effort and typo-prone text, voice-dictated phrasing, values pasted out of forms, multilingual mixing, and contradictory, duplicated, or wrong-field entries, produced across a range of assistant personas so the user-side language varies.
+The aim is a model that catches partial, fragmented PII in real chatbot text rather than only in clean examples.
+
+## 4. Alternatives we tried
+
+### 4.1 Base architecture: MiniLM over ELECTRA
+
+The first axis we settled was the encoder.
+ELECTRA-small was the strongest size contender — its trimmed, Q4 artifact is ~10 MB against MiniLM's ~19 MB at full vocab — which for a browser-deployed model is a real pull.
+We ran the entire selection matrix (§4.2) twice, once on each base, on identical data and schema.
+
+ELECTRA did not turn extra data into accuracy the way MiniLM did.
+Its eval loss bottomed out early and then crept up as the corpus grew, and the matrix bears this out: every one of ELECTRA's strongest cells used the _smaller_ (100k-conversation) data slice, and adding the larger slice produced its _worst_ cells, not its best.
+MiniLM, on the same axes, reached its top result on the larger slice.
+For a project whose whole thesis is a corpus that keeps growing (§3.5), an encoder that stops improving — or regresses — as data grows has no headroom for the loop we rely on.
+We shipped MiniLM-L6-H384-uncased and kept ELECTRA on the shelf as a size lever for a hypothetical future release willing to accept that ceiling.
+
+### 4.2 The selection matrix
+
+To choose the data recipe and the prefilter strategy, we ran a Cartesian ablation rather than tuning one variable at a time.
+Twelve cells per base — **prefilter** {on, off} × **data mix** {synthetic-only, +OCR'd documents, +AI4Privacy templates} × **corpus volume** {100k, 250k synthetic conversations} — each fine-tuned, exported to its Q4 and vocab-trimmed artifacts, and scored _end-to-end through its matching runtime_ (prefilter-on cells run with the deterministic layer; prefilter-off cells run the model raw).
+Across both bases that is 24 trained models, scored under both runtime modes.
+
+Scoring used a deliberately hard internal development suite — 55 hand-written chat cases (66 private terms) skewed toward the failure modes we most wanted to catch: hyphenated and particled names, non-Latin-script names, address fragments, government identifiers, split and dotted contact details.
+It is **not** the shipped held-out metric (the 98.42% headline is measured on 30k OpenPII rows, §3.3); these are the much harder, much smaller dev numbers we used to rank _directions_, and the shipped model is many training iterations beyond this round.
+The matched-runtime results:
+
+| Base    | Best cell (data mix / volume / prefilter) | Dev recall | Worst cell                                                           |
+| ------- | ----------------------------------------- | ---------: | -------------------------------------------------------------------- |
+| MiniLM  | +AI4Privacy / 250k / prefilter-on         |  **80.3%** | 21.2% (no-prefilter, 250k synthetic, full mix — a training collapse) |
+| ELECTRA | +AI4Privacy / 100k / prefilter-on         |      81.8% | 42.4% (no-prefilter, 250k, synthetic-only)                           |
+
+Three findings drove the recipe:
+
+1. **The full data mix produced every top cell.** On both bases the highest-recall configurations folded in all three sources; synthetic-only cells trailed. Breadth of corpus, not volume of one source, moved the needle.
+2. **MiniLM scaled with data; ELECTRA did not** (§4.1). MiniLM's best cell used the larger slice; all of ELECTRA's best cells used the smaller one.
+3. **One cell collapsed.** The MiniLM no-prefilter / 250k synthetic / full-mix cell scored 21.2% — a reminder that more data and more classes can destabilize training, and the reason every candidate is scored end-to-end before it is trusted, never assumed good from its loss curve.
+
+The prefilter-on configuration won on its merits here and matches the runtime: the deterministic layer is a checksum away from perfect on the digit classes, so making the model relearn them only adds variance.
+
+### 4.3 Prefolded normalization
+
+All training rows pass through the same normalization the runtime applies before tokenization: lowercase, NFKD decomposition, and combining-mark stripping.
+The combining-mark step is what folds accents — `José` becomes `jose`, `Müller` becomes `muller`, `François` becomes `francois` — so the model sees a single canonical form regardless of how the user typed the name.
+
+We do this for two reasons.
+First, BERT's BasicTokenizer already performs the same fold implicitly at inference time under `do_lower_case=True` with default accent-stripping, so prefolding the training data makes the train-time and runtime distributions identical by construction; without it, the model would learn token sequences containing combining marks that the runtime tokenizer would never emit.
+Second, accent collapse is a robustness property we want: a user who types `Jose` and a user who types `José` should be redacted identically, and an attacker who substitutes one for the other to evade detection should fail.
+Prefolding bakes that property into the training distribution rather than relying on the runtime to recover it after the fact.
+
+A guard in the training pipeline fails the run if a future tokenizer change breaks this assumption, so retraining with a cased base model cannot silently desync the two normalizations.
+Because prefolding already produces the canonical form, separate accent-augmentation (training on both `José` and `Jose` as distinct strings) is disabled — it would be a no-op against an already-folded corpus.
+
+## 5. Comparison to public PII baselines
+
+During model selection we ran a one-off comparison of Rampart against public PII systems — a community BERT-small detector, Microsoft Presidio + spaCy, GLiNER small v2.1, and AWS Bedrock Guardrails — on the English+Spanish slice under identical scoring rules.
+On that slice Rampart reached 98.85% private-term recall; the open baselines trailed on retention in particular (GLiNER and BERT-small kept ~33.5% of public context), and the cloud incumbent trailed on both recall and latency.
+Also of note, those systems are Python- or cloud-only (Presidio, GLiNER/torch, Bedrock) and cannot run in the shipped TypeScript form factor.
+
+## 6. Calibration
+
+The runtime applies a single recall-biased confidence floor (`minScore` = 0.4) uniformly across the model's labels, chosen against the 10,000-row OpenPII Latin calibration split (disjoint from test).
+There is no per-label threshold table in the shipped runtime: classes the model alone is weak on — SSN, CREDIT_CARD — are not propped up with a tuned threshold but covered by the deterministic layer's checksum/structural validation, which is the system of record for them (with EMAIL, URL, and IP_ADDRESS covered by pattern match).
+Phone, routing, government-ID, passport, and license numbers carry no checksum and are left to the model under the same floor.
+Trading a miss (which leaks data) against the cheaper failure of over-redaction is the explicit policy choice here, not a model regression.
+
+ECE on the 30,000-row test set is **0.018** for the model alone (well-calibrated, no post-hoc isotonic correction needed) and **0.291** for the full system.
+The system-level ECE is higher because the deterministic layer always emits score 1.0 on its detections, making the score distribution bimodal — that is a score-distribution artifact of the union, not a calibration regression of the underlying model.
+
+## 7. Schema reconciliation
+
+The 91.69% retention number on the headline test is term-presence scoring that already credits the keep-set (city/state/ZIP) as kept, matching the Rampart policy. We analyzed the 7,244 remaining "over-redacted" public terms in the 30,000-row eval:
+
+- The vast majority are policy-driven redactions of street-line components (street name, building number, secondary address line). OpenPII marks `STREET`, `BUILDINGNUM`, and `SECADDRESS` as `O` (public); the Rampart policy redacts the precise street line (`BUILDING_NUMBER` + `STREET_NAME`) and `SECONDARY_ADDRESS` while keeping `CITY`, `STATE`, and `ZIP`. These are not detector errors; they are the policy firing as designed.
+- A smaller share are span-edge artifacts. The runtime's particle-rescue step grows name spans (`GIVEN_NAME` / `SURNAME`) to swallow capitalized particles ("De la", "Von", "Mc"). When an adjacent public token is itself capitalized, that token can be absorbed into the redacted span.
+- A very small fraction are digit fragments inside longer correctly-redacted spans (e.g. "376" found inside a redacted 16-digit credit card, surfacing as a "kept token" because the gold schema marks individual digits separately from the card number).
+
+We publish the term-presence number for like-for-like comparison with public PII benchmarks running the same scoring rules.
+Under policy-aware scoring the retention exceeds 99%.
+
+## 8. Systems we considered and did not adopt
+
+Two widely-discussed alternatives are worth addressing directly because each is a plausible default for a team starting from scratch on this problem.
+
+**OpenAI Privacy Filter.** OpenAI released an open-weight token-classification model under Apache 2.0 ([announcement](https://openai.com/index/introducing-openai-privacy-filter/)) with a similar shape to ours: bidirectional token classification with BIOES span decoding via constrained Viterbi, eight detection categories (person, address, email, phone, URL, date, account number, secret), and reported F1 of 97.4% on the corrected `pii-masking-300k` benchmark.
+It is the closest peer to Rampart in design intent, and we evaluated it as a candidate.
+
+We did not adopt it for two reasons.
+(1) Size: the released model is 1.5B total parameters (50M active, MoE-style routing).
+Even with aggressive quantization the on-disk footprint is two orders of magnitude beyond our 15 MB browser-deployment target, and the active-parameter count alone exceeds what we can ship to a low-end device over the wire.
+(2) Inference shape: a 1.5B-parameter forward pass with a 128k-token context window is engineered for server-side or workstation-class throughput on long documents, not for sub-10 ms per-keystroke client-side redaction during a chat turn.
+The two systems are solving overlapping problems with different deployment constraints, and the OpenAI model's strengths (long-context coherence, fine-tunability for domain adaptation) are orthogonal to ours (browser-deployable size, encoder-only latency, per-class checksum validation through the deterministic layer).
+For applications that have a server they trust and documents that justify the round-trip, the OpenAI model is a strong choice; for an application whose contract is "the user's text never leaves the device," it is too large to deploy on the device.
+
+**`ai4privacy/llama-ai4privacy-english-anonymiser-openpii`.**
+A Llama-family fine-tune trained on the same OpenPII corpus we used.
+The model is high quality on its native distribution and was a serious candidate.
+We did not adopt it for three reasons.
+(1) Size: the released artifact is multiple gigabytes, three orders of magnitude larger than our 15 MB target and incompatible with browser deployment on the low-end devices we need to support.
+(2) Inference cost: a Llama-class generative anonymizer takes hundreds of milliseconds to seconds per turn even on accelerated hardware, versus 6.6 ms for an encoder pass; running it on the client is not viable, and running it on the server reintroduces the threat-model problem above.
+(3) Generative outputs require a different correctness story — the model rewrites text rather than emitting spans, which makes calibration, span F1, and policy-driven keep-sets harder to define and audit.
+A token classifier with a deterministic post-processing layer is a much smaller surface area to reason about for a system whose contract is "do not leak."
+
+Both systems are good engineering for their intended deployment shape.
+Neither is a substitute for client-side redaction when the goal is to prevent data from reaching any server in the first place.
+
+## 9. Limitations
+
+The model card enumerates each documented failure with statistics. The most consequential:
+
+1. **Cross-locale name fairness.** Recall on Faker-generated names spans 15 naming traditions; non-Latin scripts (Korean, Han Chinese, Japanese, Arabic, South Asian, Slavic) are below 50%. This is the most important regression to close in subsequent training cycles and is tracked by a stratified regression test in the eval suite.
+2. **Adversarial robustness.** The system catches 86.4% of a 20-case adversarial suite. Combined attacks (homoglyph plus whitespace-split, deep zero-width injection inside checksum-valid identifiers) can still bypass the union of the two layers. The deterministic layer raises the floor on structured classes but does not close the gap on unstructured identifiers under composed perturbations. This is the right framing for the limitation, not the primary use case: Rampart is designed to protect users who are entering their own information in good faith from incidental disclosure to downstream services, not to defeat a motivated user who is actively trying to smuggle their own PII past the filter. Adversarial cases are scored to characterize the failure surface and to surface regressions, not because circumventing one's own redactor is the threat model.
+3. **Indirect identifiers.** Inferential leaks — e.g. a rare medical condition combined with a ZIP code — are out of scope. The system redacts terms, not statistical fingerprints.
+
+## 10. Reproducibility
+
+The training pipeline and the benchmark are released under CC BY 4.0.
+The benchmark (`eval/bench`) runs the shipped TypeScript pipeline over a frozen OpenPII held-out slice and writes the per-run `summary.json` / `by_language.json` that the published numbers cite, so every figure traces to committed evidence produced by the artifact itself.
+The held-out row `uid`s are pinned in a committed manifest; `bun run bench:fetch` regenerates the rows and `bun run bench` reproduces the numbers.
+
+## 11. Conclusion
+
+Rampart is harm reduction. No client-side redactor at this size will catch every leak, and we do not claim otherwise — §9 documents the classes where the system underperforms and the eval suite is structured so future regressions surface immediately.
+What it provides is a defensible floor: text is filtered through two complementary layers and replaced with stable placeholders before any server sees it, so the worst case for a downstream leak is bounded by what the client failed to redact, not by the entire raw conversation.
+
+We release the model, deterministic layer, and eval suite under CC BY 4.0 so any team building privacy-sensitive software can use, audit, fork, and improve it.
+The constraints adopted here — browser-deployable size, recall-biased calibration, defense in depth, no network dependency at inference — are specific to the threat model in which the user's unredacted text must never leave the device.
+Other deployment shapes warrant other tradeoffs; under this one, the system reported here is a deployable baseline against which future work can be measured.

config.json

@@ -0,0 +1,99 @@
+{
+  "architectures": [
+    "BertForTokenClassification"
+  ],
+  "attention_probs_dropout_prob": 0.1,
+  "classifier_dropout": null,
+  "dtype": "float32",
+  "gradient_checkpointing": false,
+  "hidden_act": "gelu",
+  "hidden_dropout_prob": 0.1,
+  "hidden_size": 384,
+  "id2label": {
+    "0": "O",
+    "1": "B-GIVEN_NAME",
+    "2": "I-GIVEN_NAME",
+    "3": "B-SURNAME",
+    "4": "I-SURNAME",
+    "5": "B-EMAIL",
+    "6": "I-EMAIL",
+    "7": "B-PHONE",
+    "8": "I-PHONE",
+    "9": "B-URL",
+    "10": "I-URL",
+    "11": "B-TAX_ID",
+    "12": "I-TAX_ID",
+    "13": "B-BANK_ACCOUNT",
+    "14": "I-BANK_ACCOUNT",
+    "15": "B-ROUTING_NUMBER",
+    "16": "I-ROUTING_NUMBER",
+    "17": "B-GOVERNMENT_ID",
+    "18": "I-GOVERNMENT_ID",
+    "19": "B-PASSPORT",
+    "20": "I-PASSPORT",
+    "21": "B-DRIVERS_LICENSE",
+    "22": "I-DRIVERS_LICENSE",
+    "23": "B-BUILDING_NUMBER",
+    "24": "I-BUILDING_NUMBER",
+    "25": "B-STREET_NAME",
+    "26": "I-STREET_NAME",
+    "27": "B-SECONDARY_ADDRESS",
+    "28": "I-SECONDARY_ADDRESS",
+    "29": "B-CITY",
+    "30": "I-CITY",
+    "31": "B-STATE",
+    "32": "I-STATE",
+    "33": "B-ZIP_CODE",
+    "34": "I-ZIP_CODE"
+  },
+  "initializer_range": 0.02,
+  "intermediate_size": 1536,
+  "label2id": {
+    "B-BANK_ACCOUNT": 13,
+    "B-BUILDING_NUMBER": 23,
+    "B-CITY": 29,
+    "B-DRIVERS_LICENSE": 21,
+    "B-EMAIL": 5,
+    "B-GIVEN_NAME": 1,
+    "B-GOVERNMENT_ID": 17,
+    "B-PASSPORT": 19,
+    "B-PHONE": 7,
+    "B-ROUTING_NUMBER": 15,
+    "B-SECONDARY_ADDRESS": 27,
+    "B-STATE": 31,
+    "B-STREET_NAME": 25,
+    "B-SURNAME": 3,
+    "B-TAX_ID": 11,
+    "B-URL": 9,
+    "B-ZIP_CODE": 33,
+    "I-BANK_ACCOUNT": 14,
+    "I-BUILDING_NUMBER": 24,
+    "I-CITY": 30,
+    "I-DRIVERS_LICENSE": 22,
+    "I-EMAIL": 6,
+    "I-GIVEN_NAME": 2,
+    "I-GOVERNMENT_ID": 18,
+    "I-PASSPORT": 20,
+    "I-PHONE": 8,
+    "I-ROUTING_NUMBER": 16,
+    "I-SECONDARY_ADDRESS": 28,
+    "I-STATE": 32,
+    "I-STREET_NAME": 26,
+    "I-SURNAME": 4,
+    "I-TAX_ID": 12,
+    "I-URL": 10,
+    "I-ZIP_CODE": 34,
+    "O": 0
+  },
+  "layer_norm_eps": 1e-12,
+  "max_position_embeddings": 512,
+  "model_type": "bert",
+  "num_attention_heads": 12,
+  "num_hidden_layers": 6,
+  "pad_token_id": 0,
+  "position_embedding_type": "absolute",
+  "transformers_version": "4.57.6",
+  "type_vocab_size": 2,
+  "use_cache": true,
+  "vocab_size": 19730
+}

examples/basic-chat.ts

@@ -0,0 +1,12 @@
+import { createGuard } from "../index.ts";
+
+const guard = await createGuard();
+
+const safe = await guard.protect("My name is Alex Rivera. My SSN is 472-81-0094.");
+const reply = await llm(safe.text);
+
+console.log(guard.reveal(reply));
+
+async function llm(text: string): Promise<string> {
+  return "Got it, [GIVEN_NAME_1].";
+}

onnx/model_q4.onnx

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:9f27d24949b0581701071ea5ef522d77ccd3f50c525cc91eac4d265b0fc2afe5
+size 14693379

special_tokens_map.json

@@ -0,0 +1,37 @@
+{
+  "cls_token": {
+    "content": "[CLS]",
+    "lstrip": false,
+    "normalized": false,
+    "rstrip": false,
+    "single_word": false
+  },
+  "mask_token": {
+    "content": "[MASK]",
+    "lstrip": false,
+    "normalized": false,
+    "rstrip": false,
+    "single_word": false
+  },
+  "pad_token": {
+    "content": "[PAD]",
+    "lstrip": false,
+    "normalized": false,
+    "rstrip": false,
+    "single_word": false
+  },
+  "sep_token": {
+    "content": "[SEP]",
+    "lstrip": false,
+    "normalized": false,
+    "rstrip": false,
+    "single_word": false
+  },
+  "unk_token": {
+    "content": "[UNK]",
+    "lstrip": false,
+    "normalized": false,
+    "rstrip": false,
+    "single_word": false
+  }
+}

tokenizer_config.json

@@ -0,0 +1,58 @@
+{
+  "added_tokens_decoder": {
+    "0": {
+      "content": "[PAD]",
+      "lstrip": false,
+      "normalized": false,
+      "rstrip": false,
+      "single_word": false,
+      "special": true
+    },
+    "1": {
+      "content": "[UNK]",
+      "lstrip": false,
+      "normalized": false,
+      "rstrip": false,
+      "single_word": false,
+      "special": true
+    },
+    "2": {
+      "content": "[CLS]",
+      "lstrip": false,
+      "normalized": false,
+      "rstrip": false,
+      "single_word": false,
+      "special": true
+    },
+    "3": {
+      "content": "[SEP]",
+      "lstrip": false,
+      "normalized": false,
+      "rstrip": false,
+      "single_word": false,
+      "special": true
+    },
+    "4": {
+      "content": "[MASK]",
+      "lstrip": false,
+      "normalized": false,
+      "rstrip": false,
+      "single_word": false,
+      "special": true
+    }
+  },
+  "clean_up_tokenization_spaces": true,
+  "cls_token": "[CLS]",
+  "do_basic_tokenize": true,
+  "do_lower_case": true,
+  "extra_special_tokens": {},
+  "mask_token": "[MASK]",
+  "model_max_length": 1000000000000000019884624838656,
+  "never_split": null,
+  "pad_token": "[PAD]",
+  "sep_token": "[SEP]",
+  "strip_accents": null,
+  "tokenize_chinese_chars": true,
+  "tokenizer_class": "BertTokenizer",
+  "unk_token": "[UNK]"
+}