| --- |
| title: SynthShield | Privacy Intelligence Lab |
| emoji: 🛡️ |
| colorFrom: green |
| colorTo: blue |
| sdk: static |
| app_file: index.html |
| license: mit |
| pinned: false |
| short_description: Synthetic data and privacy audits |
| tags: |
| - synthetic-data |
| - privacy |
| - data-quality |
| - responsible-ai |
| - javascript |
| --- |
| |
| # SynthShield: Synthetic Data Privacy & Utility Laboratory |
|
|
| [](LICENSE)   |
|
|
| **A free, browser-native research application for creating test datasets and studying the trade-offs between statistical fidelity and privacy risk.** |
|
|
| SynthShield provides six interactive workspaces: |
|
|
| | Module | What it does | |
| | --- | --- | |
| | Command center | High-level k-risk, class sizes and distributional fidelity | |
| | Privacy audit | Configurable quasi-identifiers; k-anonymity, distinct-value ℓ-diversity and categorical TVD | |
| | Synthetic studio | Deterministic conditional-category generation plus noisy numeric sampling | |
| | Utility benchmark | Marginal distribution comparisons, cohort means and literal row overlap | |
| | Noise simulator | Educational seeded Laplace histogram experiment | |
| | Data & methods | Validated CSV import and downloadable audit JSON, Markdown memo and synthetic CSV | |
|
|
| ## Quick start |
|
|
| 1. Open the **App** tab of this Space. |
| 2. Explore the three **fictional** examples from the dataset selector. |
| 3. In **Privacy audit**, change the quasi-identifiers to see how smaller groups increase potential singling-out risks. |
| 4. In **Synthetic studio**, adjust record count, seed and conditional blending, then select **Regenerate dataset**. |
| 5. Compare source and generated distributions in **Utility benchmark**. |
| 6. For your own test data, open **Data & methods** and import a CSV, then inspect the exportable audit. |
|
|
| Everything runs locally in your browser. No training server, external libraries, account sign-in, cookies, analytics trackers or external API keys are required. The application does not upload your CSV to the hosting server. |
|
|
| ## Input schema |
|
|
| A CSV must contain these six header names (in any order): |
|
|
| ```csv |
| age_band,region,segment,channel,spend,outcome |
| 25-34,North,Core,Web,120.50,Retained |
| 35-44,South,Growth,Mobile,95.00,Churned |
| ``` |
|
|
| The categorical columns are text; `spend` is a nonnegative number. The local importer enforces a **2 MB / 5,000-row** limit and rejects malformed rows before modifying application state. Use fake or already-cleared data for public demonstrations. |
|
|
| ## Methods |
|
|
| - **k-anonymity screening:** size of equivalence classes formed using selected quasi-identifiers; count rows in classes below 5. |
| - **Distinct-value ℓ-diversity:** count of distinct sensitive-outcome values within an equivalence class; flag classes below 2. |
| - **Categorical t-closeness proxy:** total variation distance between each class's outcome distribution and the global distribution; flag TVD above 0.20. This is one specific choice of distance and threshold, not a complete privacy certification. |
| - **Synthetic generator:** draws the categorical attributes from observed empirical / conditional distributions, draws `spend` using segment-and-channel moments with Gaussian perturbation and shrinkage, and supports deterministic seeds for reproducibility. |
| - **Utility:** marginal total variation distances, conditional numeric means, mean-spend relative error and literal exact-row overlap. A weighted **illustrative utility score** combines averages of categorical and numeric similarity. It is not an established industry standard. |
| - **Laplace histogram:** adds seeded Laplace noise of scale `1 / ε` to bounded categorical counts and clamps negative noisy values to zero. The pseudorandom seed is public and **is not cryptographically secure**, so the educational implementation **does not establish differential privacy**. |
|
|
| See [METHODOLOGY.md](METHODOLOGY.md) in the complete source package for formulas, design decisions and explicit limitations. |
|
|
| ## Privacy and safety limitations |
|
|
| > **Research demonstration, not an anonymity certification.** A dataset may be re-identifiable even when its reported k, ℓ, or TVD statistics appear favorable. Synthetic-data generation can inadvertently leak information about its inputs. Publishing sensitive data, even synthetic derivatives, requires appropriate legal, technical, and institutional review. |
|
|
| - The source dataset is **not** transmitted by this static application, but it remains in the browser tab's memory and is available to browser extensions and the local device environment. |
| - The generative model has **no formal membership-inference, reconstruction, or linkage-risk guarantees**. |
| - Reproducible seeded noise is **not a secure differential-privacy deployment**. Do not publish an underlying dataset on the basis of the ε control. |
| - Descriptive privacy screens depend on which attributes and adversary knowledge are considered. |
| - Demo data and outcome categories are entirely **fictional**. No individuals are represented. |
|
|
| ## Engineering and reproducibility |
|
|
| - **Stack:** vanilla HTML, CSS and ES modules; no build step or dependency installation. |
| - **Hosting:** Hugging Face **Static** Space, `index.html` entry point. |
| - **Core:** `core.mjs` contains the math, generators, CSV handling and export safeguards. `data.mjs` contains seeded fictional examples. `app.mjs` handles UI state and interactions. |
| - **Tests:** use `node --test tests/core.test.mjs` in the complete source archive. Optional Playwright browser test uses an isolated local render due to browser sandbox restrictions. |
| - **Exports:** audits include seeds, quasi-identifiers, parameters, risk summaries, utility statistics and limitations, not the raw source records. |
|
|
| ## Attribution |
|
|
| **Project 034**, Hugdrigo public research portfolio. MIT licensed. If this research demonstration is used for a report, distinguish results obtained on fictional examples from results derived from an actual dataset. |
|
|
