Raadhesh/GDPR-Data-Privacy-Sanitizer

🛡️ GDPR Data Privacy Sanitizer

An RL environment where an AI agent must mask Personally Identifiable Information (PII) in a relational SQLite database — without breaking foreign-key integrity or distorting statistical distributions.

🌍 Real-World Value

GDPR, CCPA, and HIPAA regulations require organisations to protect personal data. Manual compliance is slow, error-prone, and does not scale.

This environment teaches RL agents to automate privacy-preserving data transformations — a problem worth billions of dollars in compliance costs every year.

The agent must learn:

📐 Architecture

┌────────────────┐       JSON Action        ┌──────────────────┐
│   LLM Agent    │ ───────────────────────▶  │  DataPrivacyEnv  │
│  (Llama 3 /    │                           │   (SQLite DB)    │
│   Groq API)    │ ◀───────────────────────  │                  │
└────────────────┘     Observation + Reward   └──────────────────┘

Observation Space

Action Space

Reward Structure

🎯 Tasks

Easy — Column Redaction

Redact email and phone in the Users table. Grading: 1.0 if both columns contain only [REDACTED]. Partial credit (0.5) for one column.

Medium — Referential Hashing

Hash Users.id and Purchases.user_id with SHA-256. A JOIN between the tables must still return all 5 original rows. Grading: 1.0 if hashes are consistent and the JOIN succeeds. 0.0 otherwise.

Hard — Statistical Jittering

Jitter Employees.salary so that every value changes, but AVG(salary) remains within 5% of the original. Grading: 1.0 if all salaries changed and the average is within tolerance. 0.0 otherwise.

🚀 Quick Start

1. Install Dependencies

pip install -r requirements.txt

2. Set Your API Key

We use Groq for free Meta Llama 3 inference (you can also use any OpenAI-compatible endpoint):

export GROQ_API_KEY="gsk_your_key_here"

3. Run the Inference Script

# Easy task (default)
python inference.py

# Medium task
TASK=medium python inference.py

# Hard task
TASK=hard python inference.py

4. Run the Server (for judge validation)

uvicorn server:app --host 0.0.0.0 --port 7860

Then test:

curl -X POST http://localhost:7860/reset

5. Docker

docker build -t gdpr-sanitizer .
docker run -p 7860:7860 gdpr-sanitizer

✅ Validation

The judges' validate-submission.sh checks:

1. 1.Dockerfile exists ✓
2. 2.Container builds ✓
3. 3.`POST /reset` returns 200 OK ✓

This submission passes all three checks.

📁 Project Structure

.
├── models.py          # Pydantic Observation & Action schemas
├── db_utils.py        # SQLite database setup with mock data
├── environment.py     # Core OpenEnv environment (step/reset/state)
├── graders.py         # Programmatic graders (easy/medium/hard)
├── server.py          # FastAPI HTTP wrapper (/reset, /step, /state)
├── inference.py       # Async LLM agent with strict logging
├── openenv.yaml       # OpenEnv configuration
├── Dockerfile         # Container (python:3.10-slim, port 7860)
├── requirements.txt   # Python dependencies
└── README.md          # This file

🧪 Technical Notes

• —LLM Backend: Uses the openai Python client pointed at Groq's free API (https://api.groq.com/openai/v1) with llama3-8b-8192. Swap by setting API_BASE_URL and MODEL_NAME environment variables.
• —Structured Output: The LLM is prompted to return raw JSON matching the Pydantic Action schema. response_format={"type": "json_object"} enforces valid JSON.
• —Dense Rewards: Every step provides immediate feedback, enabling faster RL convergence.
• —Safety: Destructive SQL keywords (DROP, DELETE, etc.) are detected and immediately terminate the episode with a −1.0 penalty.

📜 License

MIT — Built for the Meta PyTorch × Hugging Face OpenEnv Hackathon.