Description

Adds a new Privacy Filter native model for on-device PII detection, with a TypeScript hook (usePrivacyFilter), module (PrivacyFilterModule), types, and a demo screen in the apps/llm example. Two models are wired up out-of-the-box:

• PRIVACY_FILTER_OPENAI — openai/privacy-filter, 8 categories (person, email, phone, address, DOB, URL, account number, secret).
• PRIVACY_FILTER_NEMOTRON — OpenMed/privacy-filter-nemotron-base, 55+ categories adding medical, financial, demographic, technical, and government-document spans.

Both models share the same single-method forward(input_ids, attention_mask) → logits graph, the same o200k tokenizer (pad/eos id 199999), and 256-token banded attention. They differ only in the BIOES label space, which is supplied as labelNames at load time.

Highlights:

• Constrained Viterbi decoding with six tunable BIOES transition biases, matching OpenAI's viterbi_calibration.json schema. Defaults to neutral validity-only Viterbi.
• Sliding-window inference: 256-token windows, 50% overlap, no truncation — arbitrary-length input is supported.
• seq_len is read from the model's forward input shape at load time, so a 512-token export would Just Work without code changes.
• Typed JSI return: generate() returns PiiEntity[] directly via a getJsiValue overload — no JSON bridge.
• Viterbi decoder is split into its own Viterbi.{h,cpp} module under rnexecutorch::models::privacy_filter::viterbi, mirroring the Utils.{h,cpp} convention used by VAD.

Introduces a breaking change?

• Yes
• No

Type of change

• Bug fix (change which fixes an issue)
• New feature (change which adds functionality)
• Documentation update (improves or adds clarity to existing documentation)
• Other (chores, tests, code style improvements etc.)

Tested on

• iOS
• Android

Testing instructions

1. cd apps/llm && yarn install
2. iOS: yarn pods && yarn ios · Android: yarn android
3. From the home screen, open "Privacy Filter".
4. Pick a model in the picker (OpenAI base or Nemotron fine-tune) — the model downloads on first run.
5. Tap "Run" to scan the bundled sample text.
6. Verify detected entity spans are highlighted inline with their label and color, and inference time is shown on the button.
7. Switch models and re-run — entity coverage should differ between the two (Nemotron picks up medical/financial/demographic categories the base model doesn't have).

Screenshots

Related issues

Checklist

• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have updated the documentation accordingly
• My changes generate no new warnings

Additional notes

• The tokenizer.json is bit-identical between the OpenAI base and the Nemotron fine-tune; both use the GPT-4o o200k BPE.
• All PTE files are exported as a single forward method rather than the 18-method multimethod export — this brings RAM down from ~3.5 GB to ~1.2 GB on iPhone 16 Pro and inference from ~8s to ~1.5s, since planner buffers are reused across the full graph.
• Docs are added to docs/docs/ (next-version only). The 06-api-reference/ typedoc output regenerates automatically from the @category Models - Privacy Filter tags on the exported constants and the public hook/module/types — no manual entries were added there.
• Benchmarks (02-benchmarks/) are intentionally not updated in this PR; we'll add measured numbers in a follow-up once we have proper multi-device timings.