README.md

metadata

title: SynthShield | Privacy Intelligence Lab
emoji: 🛡️
colorFrom: green
colorTo: blue
sdk: static
app_file: index.html
license: mit
pinned: false
short_description: Synthetic data and privacy audits
tags:
  - synthetic-data
  - privacy
  - data-quality
  - responsible-ai
  - javascript

SynthShield: Synthetic Data Privacy & Utility Laboratory

A free, browser-native research application for creating test datasets and studying the trade-offs between statistical fidelity and privacy risk.

SynthShield provides six interactive workspaces:

Module	What it does
Command center	High-level k-risk, class sizes and distributional fidelity
Privacy audit	Configurable quasi-identifiers; k-anonymity, distinct-value ℓ-diversity and categorical TVD
Synthetic studio	Deterministic conditional-category generation plus noisy numeric sampling
Utility benchmark	Marginal distribution comparisons, cohort means and literal row overlap
Noise simulator	Educational seeded Laplace histogram experiment
Data & methods	Validated CSV import and downloadable audit JSON, Markdown memo and synthetic CSV

Quick start

1. Open the App tab of this Space.
2. Explore the three fictional examples from the dataset selector.
3. In Privacy audit, change the quasi-identifiers to see how smaller groups increase potential singling-out risks.
4. In Synthetic studio, adjust record count, seed and conditional blending, then select Regenerate dataset.
5. Compare source and generated distributions in Utility benchmark.
6. For your own test data, open Data & methods and import a CSV, then inspect the exportable audit.

Everything runs locally in your browser. No training server, external libraries, account sign-in, cookies, analytics trackers or external API keys are required. The application does not upload your CSV to the hosting server.

Input schema

A CSV must contain these six header names (in any order):

age_band,region,segment,channel,spend,outcome
25-34,North,Core,Web,120.50,Retained
35-44,South,Growth,Mobile,95.00,Churned

The categorical columns are text; spend is a nonnegative number. The local importer enforces a 2 MB / 5,000-row limit and rejects malformed rows before modifying application state. Use fake or already-cleared data for public demonstrations.

Methods

• k-anonymity screening: size of equivalence classes formed using selected quasi-identifiers; count rows in classes below 5.
• Distinct-value ℓ-diversity: count of distinct sensitive-outcome values within an equivalence class; flag classes below 2.
• Categorical t-closeness proxy: total variation distance between each class's outcome distribution and the global distribution; flag TVD above 0.20. This is one specific choice of distance and threshold, not a complete privacy certification.
• Synthetic generator: draws the categorical attributes from observed empirical / conditional distributions, draws spend using segment-and-channel moments with Gaussian perturbation and shrinkage, and supports deterministic seeds for reproducibility.
• Utility: marginal total variation distances, conditional numeric means, mean-spend relative error and literal exact-row overlap. A weighted illustrative utility score combines averages of categorical and numeric similarity. It is not an established industry standard.
• Laplace histogram: adds seeded Laplace noise of scale 1 / ε to bounded categorical counts and clamps negative noisy values to zero. The pseudorandom seed is public and is not cryptographically secure, so the educational implementation does not establish differential privacy.

See METHODOLOGY.md in the complete source package for formulas, design decisions and explicit limitations.

Privacy and safety limitations

Research demonstration, not an anonymity certification. A dataset may be re-identifiable even when its reported k, ℓ, or TVD statistics appear favorable. Synthetic-data generation can inadvertently leak information about its inputs. Publishing sensitive data, even synthetic derivatives, requires appropriate legal, technical, and institutional review.

• The source dataset is not transmitted by this static application, but it remains in the browser tab's memory and is available to browser extensions and the local device environment.
• The generative model has no formal membership-inference, reconstruction, or linkage-risk guarantees.
• Reproducible seeded noise is not a secure differential-privacy deployment. Do not publish an underlying dataset on the basis of the ε control.
• Descriptive privacy screens depend on which attributes and adversary knowledge are considered.
• Demo data and outcome categories are entirely fictional. No individuals are represented.

Engineering and reproducibility

• Stack: vanilla HTML, CSS and ES modules; no build step or dependency installation.
• Hosting: Hugging Face Static Space, index.html entry point.
• Core: core.mjs contains the math, generators, CSV handling and export safeguards. data.mjs contains seeded fictional examples. app.mjs handles UI state and interactions.
• Tests: use node --test tests/core.test.mjs in the complete source archive. Optional Playwright browser test uses an isolated local render due to browser sandbox restrictions.
• Exports: audits include seeds, quasi-identifiers, parameters, risk summaries, utility statistics and limitations, not the raw source records.

Attribution

Project 034, Hugdrigo public research portfolio. MIT licensed. If this research demonstration is used for a report, distinguish results obtained on fictional examples from results derived from an actual dataset.