---
title: SynthShield | Privacy Intelligence Lab
emoji: 🛡️
colorFrom: green
colorTo: blue
sdk: static
app_file: index.html
license: mit
pinned: false
short_description: Synthetic data and privacy audits
tags:
  - synthetic-data
  - privacy
  - data-quality
  - responsible-ai
  - javascript
---

# SynthShield: Synthetic Data Privacy & Utility Laboratory

[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE) ![No backend](https://img.shields.io/badge/Architecture-100%25%20Browser--based-1e9283) ![Project](https://img.shields.io/badge/Portfolio-034-1f2937)

**A free, browser-native research application for creating test datasets and studying the trade-offs between statistical fidelity and privacy risk.**

SynthShield provides six interactive workspaces:

| Module | What it does |
| --- | --- |
| Command center | High-level k-risk, class sizes and distributional fidelity |
| Privacy audit | Configurable quasi-identifiers; k-anonymity, distinct-value ℓ-diversity and categorical TVD |
| Synthetic studio | Deterministic conditional-category generation plus noisy numeric sampling |
| Utility benchmark | Marginal distribution comparisons, cohort means and literal row overlap |
| Noise simulator | Educational seeded Laplace histogram experiment |
| Data & methods | Validated CSV import and downloadable audit JSON, Markdown memo and synthetic CSV |

## Quick start

1. Open the **App** tab of this Space.
2. Explore the three **fictional** examples from the dataset selector.
3. In **Privacy audit**, change the quasi-identifiers to see how smaller groups increase potential singling-out risks.
4. In **Synthetic studio**, adjust record count, seed and conditional blending, then select **Regenerate dataset**.
5. Compare source and generated distributions in **Utility benchmark**.
6. For your own test data, open **Data & methods** and import a CSV, then inspect the exportable audit.

Everything runs locally in your browser. No training server, external libraries, account sign-in, cookies, analytics trackers or external API keys are required. The application does not upload your CSV to the hosting server.

## Input schema

A CSV must contain these six header names (in any order):

```csv
age_band,region,segment,channel,spend,outcome
25-34,North,Core,Web,120.50,Retained
35-44,South,Growth,Mobile,95.00,Churned
```

The categorical columns are text; `spend` is a nonnegative number. The local importer enforces a **2 MB / 5,000-row** limit and rejects malformed rows before modifying application state. Use fake or already-cleared data for public demonstrations.

## Methods

- **k-anonymity screening:** size of equivalence classes formed using selected quasi-identifiers; count rows in classes below 5.
- **Distinct-value ℓ-diversity:** count of distinct sensitive-outcome values within an equivalence class; flag classes below 2.
- **Categorical t-closeness proxy:** total variation distance between each class's outcome distribution and the global distribution; flag TVD above 0.20. This is one specific choice of distance and threshold, not a complete privacy certification.
- **Synthetic generator:** draws the categorical attributes from observed empirical / conditional distributions, draws `spend` using segment-and-channel moments with Gaussian perturbation and shrinkage, and supports deterministic seeds for reproducibility.
- **Utility:** marginal total variation distances, conditional numeric means, mean-spend relative error and literal exact-row overlap. A weighted **illustrative utility score** combines averages of categorical and numeric similarity. It is not an established industry standard.
- **Laplace histogram:** adds seeded Laplace noise of scale `1 / ε` to bounded categorical counts and clamps negative noisy values to zero. The pseudorandom seed is public and **is not cryptographically secure**, so the educational implementation **does not establish differential privacy**.

See [METHODOLOGY.md](METHODOLOGY.md) in the complete source package for formulas, design decisions and explicit limitations.

## Privacy and safety limitations

> **Research demonstration, not an anonymity certification.** A dataset may be re-identifiable even when its reported k, ℓ, or TVD statistics appear favorable. Synthetic-data generation can inadvertently leak information about its inputs. Publishing sensitive data, even synthetic derivatives, requires appropriate legal, technical, and institutional review.

- The source dataset is **not** transmitted by this static application, but it remains in the browser tab's memory and is available to browser extensions and the local device environment.
- The generative model has **no formal membership-inference, reconstruction, or linkage-risk guarantees**.
- Reproducible seeded noise is **not a secure differential-privacy deployment**. Do not publish an underlying dataset on the basis of the ε control.
- Descriptive privacy screens depend on which attributes and adversary knowledge are considered.
- Demo data and outcome categories are entirely **fictional**. No individuals are represented.

## Engineering and reproducibility

- **Stack:** vanilla HTML, CSS and ES modules; no build step or dependency installation.
- **Hosting:** Hugging Face **Static** Space, `index.html` entry point.
- **Core:** `core.mjs` contains the math, generators, CSV handling and export safeguards. `data.mjs` contains seeded fictional examples. `app.mjs` handles UI state and interactions.
- **Tests:** use `node --test tests/core.test.mjs` in the complete source archive. Optional Playwright browser test uses an isolated local render due to browser sandbox restrictions.
- **Exports:** audits include seeds, quasi-identifiers, parameters, risk summaries, utility statistics and limitations, not the raw source records.

## Attribution

**Project 034**, Hugdrigo public research portfolio. MIT licensed. If this research demonstration is used for a report, distinguish results obtained on fictional examples from results derived from an actual dataset.