Zero-trust on-device redaction for any sensitive document. A privacy layer for Medical, Financial, Legal, Tactical, Journalism, Field Service, and General content — running entirely on a Samsung Galaxy S25 Ultra. No cloud calls. No INTERNET permission. No BAA required. All AI inference on-device via the LiteRT-LM compiled-model API on Snapdragon 8 Elite.

Built for the Qualcomm × Google LiteRT Developer Hackathon 2026 by team Edge Artists.

Healthcare is the canary. 6.4M home health workers break HIPAA daily — not out of negligence, but because the compliant tools are too slow for the field. The same shadow-IT pattern repeats across finance, law, public safety, journalism, and field service. One leaked text. Eight identifiers. Up to $1.9M in fines. Every existing solution encrypts the pipe. Redacto sanitizes the content — across seven domains, on-device, before a byte touches the network. No cloud. No BAA. No behavior change. Just tap Share, tap Redacto, tap Send.

Frontline professionals — clinicians, financial advisors, attorneys, first responders, journalists, field technicians — live in a world where compliant tools require VPN, a separate login, and a network connection. In the gaps between tasks, they do what every human does. They text. They paste. They send.

"TigerConnect may not be appropriate for use in emergency situations." — TigerConnect's own documentation

The gap isn't between secure and insecure channels. The gap is between the moment sensitive content is created and the moment it leaves the device. Nobody has put intelligence in that gap — until now.

8 sensitive identifiers in a single typical field message — same profile in finance, legal, public safety, journalism, field service.

Maria, home health nurse. 11 years · sees 8 patients/day · 3 counties. She's in her car. 45 seconds until the next patient. The hospital app needs VPN. She opens iMessage instead and types what she always types:

"Mrs. Chen (DOB 3/15/48, MRN 4471829) — left heel wound not improving, glucose 289, increased Lantus to 22u. Mentioned depression — need psych referral. Daughter Lisa (408-555-1234) wants updates."

8 PHI identifiers · potential fine up to $1.9M per violation category.

Layer 1 (Classify) auto-detects the document's category and switches Layer 2's prompt to the matching specialist. Seven categories supported end-to-end in the pipeline:

Every competitor solves the wrong problem. They encrypt the channel. We sanitize the content. That is not a feature difference — it is a category difference.

The architectural truth: Redacto is the only solution where it is physically impossible for raw sensitive content to leave the device. Not policy. Not encryption. Not hoping the recipient is on the same platform. Data is sanitized in-memory before any network call can occur.

The app opens to your document vault. Tap + to scan, photograph, or paste. Redacto runs its pipeline entirely on-device and returns a redacted result you can save or send.

Screen	Image
01 · Home — document vault with category grid
02 · Add — gallery, camera, or paste text
03 · Pick — OS gallery picker
04 · Pipeline — Step 2/4 · Detecting Medical identifiers
05 · Result · GPU — 2.0s total · 1.9s TTFT · 24 tok/s

Backend	Total	TTFT	tok/s	Screenshot
GPU	2.0s	1.9s	24
NPU	1.6s	97ms	42

The same general check-up report. The same 4-layer pipeline. The same on-device model. Backend swap delivers the speedup the benchmarks promised.

Feature	Image
Toggle — flip between Redacted and Original views; tap individual blocks to selectively reveal
Text · Journalism — plain text input, color-coded category placeholders, save as snippet

A single LLM call asked to simultaneously classify, detect, replace, and verify produces inconsistent results. Redacto separates concerns — each layer runs a fresh conversation with a purpose-built prompt.

Document type + category detection. The LLM reads the input and determines what kind of document it is and which regulatory category applies. This single decision shapes every subsequent prompt — wrong classification means wrong redaction rules. Output drives which of the 7 specialist detectors runs in Layer 2.

DOCUMENT_TYPE: Medical Note
CATEGORY: Medical

Find every identifier — including relational ones. Each category has a hand-crafted prompt that explicitly names what to find (NAME, DOB, MRN, PHONE…) and what to preserve (diagnoses, medications, lab values, ages under 90). The LLM finds relational identifiers that regex never could: "the patient's daughter Lisa" — "Lisa" in isolation isn't PHI; in context, it is.

NAME: Mrs. Chen
DATE: 3/15/48
MRN:  4471829
PHONE: 408-555-1234

For images, the LLM labels indices, not strings: 1:NAME 2:NAME 5:DATE.

OCR is imperfect. The LLM detects inquire@ucal.com but the raw OCR text says inquire@blucurrent.mail. A deterministic string.replace() silently fails — the identifier slips through untouched. Layer 3 uses the LLM to perform the substitution, so OCR errors in detection never produce missed redactions.

For images, detected index ranges map directly to bounding boxes — black rectangles are drawn on the bitmap. No string matching involved.

A completely fresh LLM conversation reads the redacted output and asks one question: did any plain-text identifier survive? The auditor has no memory of what Layers 1–3 decided — it can't be anchored to their assumptions.

If it finds a miss, it extracts the leaked items and triggers a re-run of Layers 3 + 4. Maximum 3 rounds (initial + 2 retries). After three clean passes, the result is returned. This is why Redacto catches what single-pass systems miss.

OCR (indexed)        →  LLM labels (Layer 2)  →  Layer 3 draws boxes
[0] Patient              1:NAME                   Patient ████ ████
[1] Jane                 2:NAME                   DOB: ████
[2] Smith                4:DATE                   compound fracture
[3] DOB:                 0,3,5,6:preserve
[4] 03/15/78
[5] compound
[6] fracture

Why we index instead of string-match: the index → bounding-box mapping is lossless. No text matching means no OCR-error sensitivity. HUD field count and visual box count are always consistent.

10-second pitch: "Every other solution protects the pipe. We protect what goes through it — before it goes anywhere. Every channel is safe, it works offline, and requires no agreement from the recipient. No competitor can claim all three."

Every section above describes what shipped. This section describes what we tried, what broke, and what we're explicit about not having reached alone.

Captured live from the v1 ShieldText benchmark screen. Overall score collapsed 80.5% → 70.3%; HIPAA recall fell 95.7% → 39.9%; preservation dropped 83.7% → 65.9%. Field service and tactical improved, but the average regressed. We have the artifact — what we don't have is the QNN AOT toolchain to ship it to NPU and re-evaluate after Qualcomm's quantization.

We have a fine-tuned Gemma 4 E2B specialized on the redaction task. It runs on GPU. We cannot ship it to the Hexagon V79 NPU. Compiling a fine-tuned .litertlm into a Qualcomm-prepared _qualcomm_sm8750.litertlm bundle requires the QNN graph-compilation pipeline — AIMET quantization plus Qualcomm's internal AOT conversion toolchain. That is not part of the public LiteRT-LM SDK.

NPU runs the stock gemma-4-E2B-it_qualcomm_sm8750.litertlm bundle published by litert-community. With Qualcomm hardware-team support to QNN-compile our fine-tuned bundle, we expect domain-specific accuracy gains and a smaller compiled binary. This is a hardware-team integration boundary — not an engineering shortcut.

Every number below is from a verified run on a Galaxy S25 Ultra — 30 entries across 5 redaction modes.

NPU costs ~560 MB more — model file is 2.8 GB vs 2.4 GB, plus QNN runtime buffers. Both fit comfortably in S25's 12 GB RAM.

The NPU is faster per token, but QNN doesn't yet support constrained decoding — so we can't cap output length the way GPU does (topK=64, topP=0.95). The NPU's unconstrained sampling produces ~2× more tokens, which equalizes the 30-entry total at ~5s. For TTFT-critical UX and short inputs, NPU still wins decisively. We surface this — not hide it.

A real clinical message. Three steps. Wall-clock from tap to result.

Step 2 TTFT: 159ms on NPU vs 424ms on GPU. 2.0× faster end-to-end.

• Latency: System.currentTimeMillis() wall-clock around full engine.infer() call — includes all overhead.
• TTFT: timestamp of first onMessage callback minus start time.
• Decode tok/s: (tokens − 1) × 1000 / (lastToken − firstToken), excludes prefill.
• Peak RSS: /proc/self/status VmRSS line.

Reproduction commands and full per-entry data live in the docs alongside this README.

A short list — every item here is unblocked by a known dependency, not by uncertainty about the path.

• Android Studio Meerkat or later
• Android SDK 36, JDK 21 (bundled with Android Studio)
• Device: Samsung Galaxy S25 Ultra (or any arm64 Android 12+ with 8 GB RAM)

# NPU variant (S25 Ultra)
adb push gemma4_npu.litertlm /sdcard/Android/data/com.example.redacto/files/gemma4_npu.litertlm

# CPU/GPU variant
adb push gemma4.litertlm /sdcard/Android/data/com.example.redacto/files/gemma4.litertlm

export JAVA_HOME="/Applications/Android Studio.app/Contents/jbr/Contents/Home"
export ANDROID_HOME="$HOME/Library/Android/sdk"
./gradlew installDebug

adb shell am start -n com.example.redacto/com.example.starterhack.MainActivity

The engine cold-starts on first run, AOT-cached after.

applicationId:  com.example.redacto
namespace:      com.example.starterhack
compileSdk:     36
minSdk:         31
targetSdk:      36
abiFilters:     arm64-v8a
largeHeap:      true (required for 2.4 GB model)
permissions:    No INTERNET

Gemma 4 E2B Instruct — litert-community/gemma-4-E2B-it-litert-lm on HuggingFace. License: Apache 2.0.

Walk up with any document — a clinical note, an account statement, a contract, a witness account, a source memo, a service ticket, or anything in between. Photograph it or paste the text, and watch the sensitive parts disappear on-device in under 500ms.

Repository: github.com/rikenshah/redacto Hackathon: Qualcomm × Google LiteRT Developer Hackathon · 2026 Team: Edge Artists