README.md

metadata

title: PrivacyForge | Data Privacy Intelligence Studio
emoji: 🔐
colorFrom: green
colorTo: blue
sdk: static
app_file: index.html
pinned: false
license: mit
short_description: Offline k-anonymity and l-diversity exploration
tags:
  - privacy
  - data-anonymization
  - data-analysis
  - research
  - data-governance
  - javascript

PrivacyForge | Data Privacy Intelligence Studio

PrivacyForge (Project #75) is a self-contained, interactive research lab for exploring disclosure risk and information loss during tabular data anonymization. It runs entirely in the browser as a Hugging Face Static Space, with no runtime packages, CDNs, analytics services, model calls, or API keys.

What it does

• Command center: computes source records, retained records, suppression share and minimum retained k/l.
• Transform studio: controls quasi-identifier generalization for age, region and role, with instant data previews.
• Equivalence class explorer: inspects class sizes and distinct sensitive outcomes and flags groups below selected thresholds.
• Privacy planner: searches all 36 combinations of global age/region/role generalization levels, filters by privacy targets and maximum suppression, then ranks feasible results by an explicitly defined weighted information-loss objective.
• Utility diagnostics: shows information granularity, record retention and outcome-distribution changes after suppression.
• Data & audit: imports CSV locally and exports an anonymized CSV, equivalence-class audit CSV, JSON report, Markdown methodology, settings JSON and a CSV template.

Quick start

1. Create a public Space at https://huggingface.co/new-space using Manual setup → Static → Blank.
2. Set owner to Hugdrigo and Space name to privacyforge-anonymization-lab.
3. Upload README.md, index.html and LICENSE directly at the repository root.
4. Choose Commit directly to main; open App.
5. For a reproducible demonstration, select Training cohort, k=3, l=2 and the default generalization levels 1/1/1.

Import requirements

CSV must contain the header columns id,age,region,role,outcome, in any order. Additional columns are ignored. Data are validated before replacing the current dataset. IDs must be unique; ages must be integers between 16 and 110; region, role and outcome must not be empty. Import limit: 1 MB / 5,000 records.

Example:

id,age,region,role,outcome
DEMO-001,34,North,Analyst,Completed
DEMO-002,35,North,Operator,Pending

Only use authorized, non-sensitive demo data. Although processing runs locally, a public demo application is not an authorized personal-data processing environment. No rows or settings are saved after refresh; always export required outputs before leaving.

Anonymization algorithm

1. Group records according to three generalized quasi-identifiers: age, region and role.
2. Count group members (k) and distinct outcome categories (distinct l).
3. Suppress every whole equivalence group with k < chosen k or l < chosen l.
4. Check that at least one group remains. The remaining groups must meet the selected thresholds.
5. Compute the percentage suppressed and attribute-level generalization loss.
6. In the planner, enumerate 4 × 3 × 3 = 36 transformations. Choose feasible transformations (privacy thresholds and maximum suppression). Rank by (generalization distortion × retained fraction) + (suppression fraction × penalty).

The age generalization levels are exact, five-year bands, ten-year bands, twenty-year bands. Region levels are exact, predefined zones, wildcard. Role levels are exact, broad occupation class, wildcard. If imported regions do not match the six demonstration labels, unknown labels generalize to Other zone. Imported roles not included in the knowledge-work classification generalize to Service operations. Evaluate this grouping choice before interpretation.

The initial demonstration comprises 128 synthetic training records. At the starting levels 1/1/1 with k=3 and distinct l=2, the dataset retains 103 records and suppresses 25. These results are only for the synthetic sample, not claims of security in a real setting.

Limits and research ethics

• Not a certification: Meeting k-anonymity and distinct l-diversity does not guarantee anonymity, non-identifiability or safety against re-identification.
• Neither differential privacy, t-closeness, nor entropy/recursive l-diversity is implemented.
• Outcomes remain in each released record, so residual information about individuals may be inferred.
• No model of external linkage, side information or membership disclosure is provided.
• Suppression can distort the distribution of ages, roles, regions and outcomes.
• The utility score is a transparent illustrative proxy, not a formally calibrated measure of scientific utility.
• Use independent privacy, legal and information-governance review before any real data release.
• Never interpret the three synthetic example scenarios as genuine public-service or personnel records.

Reproducibility and tests

The technical bundle includes tests/validate.py (desktop/mobile, navigation, imports, exports, UI controls, no JavaScript errors and spreadsheet-formula protection) and tests/independent.py (Python grouping results compared against the JavaScript engine on hundreds of randomly constructed samples). Both use Python Playwright and installed Chromium in the test environment, but no dependencies are required to run the published application.

License

MIT. Copyright © 2026 Hugdrigo.