Limitations
What Detection does not catch and where adapter guarantees stop.
Detection is not perfect anonymization. Treat local-pii as defense in depth, not a guarantee. A successful round trip restores exactly what was protected; it cannot restore content that Detection missed.
Indirect identifiers pass through
Removing a name, email, and phone does not de-identify:
"I'm the only Brazilian engineer at company X in Kempten, diagnosed yesterday with a rare disease."
No detector catches that. Add known terms to the
dictionary, remove indirect details explicitly, or skip a
provider entirely for especially sensitive notes. strict only makes Rampart
load or inference failures throw; it does not improve recall.
Detection-model recall has a ceiling
Rampart Q4 is a small Detection model tuned for Latin-script languages. Its reported private-term recall is ~97–99% for EN/ES/FR/DE/IT/PT/NL and ~13.7% for non-Latin scripts (Cyrillic, CJK, Arabic). Government-style IDs rely on model coverage (~68%). Deterministic detectors remain structural/checksum based and run first.
Choose the right placeholder
Readable [TYPE_N] placeholders can collide with placeholder-shaped input, and
models can mangle brackets in JSON/Markdown/tool contexts. Use token()
for tools and machine-parsed output.
local-pii is an independent community project, not affiliated with Expo,
Vercel, OpenAI, or National Design Studio.