A lot of privacy advice ends with "do not send the data to the cloud" and then quietly assumes you have a spare ML team to build the replacement. Desert Ant Labs takes a less heroic approach. Its desertant CLI is a set of small, focused models that run on your machine, expose predictable commands, and can pass JSON to the next step.

That makes it interesting as a preprocessing layer. Redact a support transcript before an API call. Turn a private recording into searchable text. Pick clips without uploading the source video. The point is not to replace a general chatbot. The point is to keep the boring, sensitive step local.

Desert Ant Labs Voz on-device speech model

The install path

The CLI is called desertant, with da as its shorter alias. The official installer downloads a release for the host, checks its release checksums, places it under ~/.local/share/desertant, and links the executables into ~/.local/bin:

curl -fsSL https://raw.githubusercontent.com/Desert-Ant-Labs/desert-ant-cli/main/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
da models

The same project documents Homebrew and mise installs. I would use the script for a disposable machine and Homebrew or mise for a workstation that you update regularly. Either way, check da models before writing an automation around a model. Availability is not uniform across platforms.

The first useful test is PII redaction. It needs no API key and demonstrates the privacy boundary clearly:

da redact "Email Anna at anna@example.hu or call 555-0100"

The documented output is:

Email [GIVEN_NAME_1] at [EMAIL_1] or call [PHONE_1]

That is more useful than a vague promise that the model is "private." You can inspect the text after the local step, decide whether the remaining content is safe enough for a hosted model, and keep the placeholder map if you need to restore names in the answer later.

For application developers, Desert Ant's Redact SDK uses a 23 million parameter classifier plus deterministic checks for structured values such as cards and IBANs. The published model card reports 88.8% recall and 99.6% precision on its evaluation, with an 11.6 MB Apple build and a 24.5 MB LiteRT build for Android and the web. Those numbers are not a guarantee that every name in your production data will be caught. They are a reason to use it as a first filter, followed by logging and review, rather than pretending redaction is solved.

The useful pipeline

The CLI gets much more interesting when it stops being a collection of one-off commands. Every command supports --json, reads stdin where the command contract allows it, and returns exit codes that a shell or coding agent can inspect. The project gives this example for turning a transcript into clip candidates:

da voz talk.mp4 --json | da clips talk.mp4 --transcript -

The first command produces structured transcription data. The second consumes that transcript while still reading the source media. This is the shape you want in an automation: each model does one narrow job, the handoff is explicit, and a failure can stop the pipeline instead of producing a plausible empty file.

For a private meeting-recording workflow, I would start with a dry run rather than connecting it to an upload or publishing step:

set -euo pipefail

input="meeting.mp4"
da models
mkdir -p out

da voz "$input" --srt out/meeting.srt --txt out/meeting.txt
da redact "$(cat out/meeting.txt)" --json > out/meeting.redacted.json

The exact output flags and model availability should be checked with da docs voz and da schema --json on the installed release. That small bit of caution matters because the CLI is moving quickly, and the README says that Voz currently needs Apple silicon while other commands run on macOS and Linux. If the transcript is going to a remote LLM for summarization, send the redacted result, not the original file or raw transcript.

The media case has a measurable payoff. Desert Ant's Voz page reports 10 minutes of audio in 2 seconds on an iPhone 17 Pro, and the CLI README shows a 48-minute recording transcribed in 9.7 seconds, or 296 times realtime, in its example. Voz is an Apple-only model today, built around an Apple Neural Engine optimized version of NVIDIA's Parakeet TDT 0.6B v3. The reported average word error rate is 7.40% across six public English sets, compared with 7.00% for Whisper large-v3-turbo. That is close enough to make local batch transcription useful, but not close enough to skip checking names, numbers, or noisy meeting sections.

You can also keep an agent inside the same boundary. Run desertant setup in a project and the CLI adds instructions for Claude Code, Pi, or Codex. The generated integration tells the agent what commands exist and how to use JSON. This is a better use of an agent than giving it an unrestricted cloud tool and hoping a prompt says "be careful with personal data." The model still needs permission to act, but its first pass can happen before the data is sent anywhere.

Where it breaks

The core SDK ships across 3 SDK languages, Swift, Kotlin, and JavaScript, using Core ML on Apple, LiteRT on Android, Linux, Windows, and the web, plus a native Node runtime, but individual models have narrower support. Check the model page, not the top-level marketing list.

The second trap is the download. Voz is listed at 467 MB compiled, downloaded on demand. That is fine for a Mac utility with a setup screen. It is awkward for a phone feature that must work immediately on a train. Redact is much smaller, but even an 11.6 MB model deserves an explicit cache and offline test. Bundle it when predictable first-run behavior matters. Download it when application size matters more.

The third trap is accuracy. Redact's own notes say roughly one item in ten can be missed, and its English name score trails AWS Comprehend even though it covers more languages and stays local. Voz's published language results vary sharply, from 3.31% word error for Italian read speech to 39.46% for Greek. A privacy filter can reduce exposure. It cannot certify that a document is clean. A transcription model can make a backlog searchable. It cannot be your only copy editor.

The licensing line also needs attention. Desert Ant says its models are free up to 100k monthly active devices per SDK, with unlimited inference per user, while the core SDK uses a source-available license and says a commercial license is required at scale. That is a very different proposition from an open-source package that you can fork indefinitely. Read the license before shipping a product, especially if your definition of "free" includes a large consumer audience.

There is a sensible division of labor here. Keep PII masking, language detection, transcription, and other predictable preprocessing local. Use a cloud model only for the part that needs broad reasoning, and send it the smallest sanitized representation you can. That is the same reason remote LLM calls on tiny text jobs deserve scrutiny, except this time the concern is privacy as much as cost.

Try one task. Install the CLI, run da redact against a copied transcript, and inspect every output. If the result is good enough for your data, add --json and one downstream command. Do not start with a six-model autonomous pipeline. The local step earns its place when it removes a real boundary, not when it adds another demo to your toolbox.

Sources