Pablo Zavala · AI Safety Evaluation · Research Engineering
A dependency-free prototype releases structure from a free-text SQLite dataset without exposing raw rows or private base tables. Pattern redaction cleans text before storage, a distinct-text floor of k=5 gates every public topic and aggregate cell, and SQLite's authorizer denies writes, private tables, and sensitive columns on each query.
Six boundary self-checks gate CI: determinism, a k=5 distinct-text floor, a read-only SQL authorizer, redaction at rest, a hash-chained audit, and a private-table-free extract
The controls stay structural rather than semantic; pattern redaction misses novel self-identifying text, and the floor counts distinct text rather than people.
Role: Sole author: boundary design, SQLite authorizer, redaction and deterministic topic layers, hash-chained audit, and the self-check suite.
| Axis | Sample | Evaluator | Result | Limitation |
|---|---|---|---|---|
| Distinct-text floor | Five-record cohort against a five-copy duplicate flood | public_topics and aggregate_cells release check at k = 5 | The genuine cohort surfaces one public topic while the duplicate flood surfaces zero public topics, because the floor counts distinct normalized text. | The floor counts distinct text rather than identities, so it blocks exact-duplicate flooding without proving anonymity. |
| Read-only SQL guard | Seven adversarial statements: writes, private-table reads, sensitive columns, sqlite_master, and randomblob | SQLite parsed-statement authorizer under a query_only pragma | The authorizer admits the public views and denies all seven boundary-crossing statements: writes, private reads, sensitive columns, internal schema, and unapproved functions. | The guard governs SQLite query paths only, so application logic layered above them stays outside its reach. |
| Redaction at rest | Free-text notes carrying emails, phone numbers, and unicode look-alikes | NFKC-normalized pattern redaction applied before truncation | Redaction runs before truncation and strips emails, phones, links, handles, addresses, and ZIP-like runs, including full-width look-alike characters. | Pattern redaction catches common identifiers and stops short of parsing every self-identifying sentence. |
| Tamper-evident audit | A SHA-256 hash-chained log under a row edit and a tail deletion | verify_chain with an externally pinned head and row count | Chain verification catches a mutated row on its own and catches a clipped tail once the caller pins the expected head and count. | Pinning depends on a trusted prior observation of the head and count. |
| Portable public extract | A published extract database built after ingesting PII-bearing records | Extract-schema inspection for private tables and residual identifiers | The extract carries only public_topics, aggregate_cells, and meta, omitting private base tables, audit rows, and row-level text. | Structural omission falls short of semantic anonymity for an arbitrary dataset. |
The public path exposes only two views, public_topics and aggregate_cells, while SQLite's parsed-statement authorizer denies writes, private base tables, sensitive columns, internal schema tables, and functions outside an explicit allowlist.
The repository ships the boundary module, the redaction patterns, deterministic topic clustering, a hash-chained audit log, a formal boundary note, and a self-check that CI runs across three Python versions.
Start with the formal boundary note, then rerun the self-check and unit suite from a clone to confirm the k=5 floor, the read-only guard, and the private-table-free extract.
Free-text datasets carry incidental identifiers, and a naive SQLite release exposes raw rows and private base tables straight through the query path.
The prototype stores records in private SQLite tables, redacts free text before storage, groups records into deterministic topics, and exposes only k=5 distinct-text public views.
Every user query runs through SQLite's parsed-statement authorizer under a read-only pragma, a distinct-text floor of k=5 gates topic and aggregate-cell release, and publication writes a separate extract that physically omits private tables and row-level text.
The committed self-check verifies six boundary properties: determinism, the k=5 floor with duplicate-flood resistance, redaction at rest, a read-only SQL guard, hash-chained audit verification, and a private-table-free extract. CI runs the unit suite and the self-check on Python 3.11, 3.12, and 3.13, so a regression on any property breaks the build.
The artifact enforces structural controls rather than semantic anonymity or regulatory compliance; pattern redaction misses novel self-identifying text, and the floor counts distinct text rather than distinct people.
The dependency-free repository ships the boundary module, the authorizer, the redaction patterns, the audit chain, a formal boundary note, and the self-check that gates CI.