PETs Testbed

Why PETs?

Privacy-enhancing technologies (PETs) are technical controls that attempt to reduce privacy risks by limiting how data is collected, analyzed, and shared. This page contains a very brief introduction to PETs and NIST’s work in that area.

When an online service wants to verify that you are at least 18 years old, zero-knowledge proofs, a cryptographic technique, can prove you are an adult without revealing your exact age to the service.

A business wanting to use a cloud service to process sensitive data may worry about cloud provider exposure or data leaks. The business can use a trusted execution environment, a hardware-based solution providing mathematically provable assurance that no outside entity, including the provider, can observe data executing on the processor.

A network provider seeking to conduct machine learning on data from a million user devices may find centralized aggregation risky in the event of a breach. Federated learning allows each user device to build a local model, enabling the organization to assemble an overall model through federated aggregation without original data ever leaving the devices.

These are just a few examples of PETs applied to address privacy risks. While a growing number of organizations use PETs to mitigate risks, many still lack the confidence to adopt these emerging technologies.

Which PET best addresses a specific problem? How can we verify a PET is implemented correctly? How will this technology disrupt existing workflows? How significantly do these technologies reduce risk in practice? Where should an organization begin?

NIST seeks to empower organizations to evaluate and adopt PETs by producing guidelines, testbeds, and practice guides.

Model Problem: Prediction of phenotype by genotype across data silos

Offered through the National Cybersecurity Center of Excellence, NIST is developing a privacy-preserving federated learning environment as a model system to conduct cyber- and privacy-risk analysis.

Motivation:

Human genomic data is being collected and stored in data silos such as the Gene Expression Omnibus (GEO) and the NCI Genomic Data Commons (GDC). Analyzing genomic data across disparate silos can lead to improved research outcomes. For example, working across silos may be necessary to study rare cancers. Yet, aggregating information from multiple silos requires overcoming regulatory, data, security, and privacy issues. Privacy-preserving federated learning (PPFL) enables machine learning algorithms to train across silos while limiting personally identifiable information flows by adding private noise to the model weights (e.g., differential privacy) and encrypting computations (e.g., multi-party computation). PPFL is a promising architecture to balance machine learning data needs with privacy concerns. This project seeks to build PPFL model systems, frameworks, and assessment tools to help organizations evaluate the risks and benefits of PPFL systems. 

Testbed component: Privacy-Preserving Federated Learning (PPFL) Model Environment for Genomics Data

Hosted by the National Cybersecurity Center of Excellence, this component investigates the trade-offs of a distributed learning system deployed across silos of phenotype and genotype data.

The Testbed simulates several nodes (data silos), each containing unique individuals' phenotype and genotype data. The goal is to build an output model using single nucleotide polymorphism (SNP) data to predict physical traits. Initial resources rely on plant and non-human genetic data to eliminate privacy risks to individuals. Privacy-preserving mechanisms, such as differential privacy and multi-party computation, are integrated into the distributed learning pipeline to protect against reconstruction, membership inference, and other privacy attacks.

PPFL output models will be evaluated using a set of fidelity and utility metrics. Privacy risks will be evaluated using a set of empirical privacy evaluation metrics and further tested through a series of red-teaming exercises.

Testbed outputs:

The Testbed has developed a set of model PPFL architectures, model datasets (coming soon!), and evaluation methods. We’ve deployed some of these in our PPFL Red Teaming Exercise, which concluded in 2025.

Collaborations:

We are currently working with official collaborators to test models, data, and evaluation methods. We anticipate publishing the codebase and datasets in July 2026. Prospective collaborators should email PETs [at] nist.gov (PETs[at]nist[dot]gov).

Model Problem: De-identification and synthesis of tabular demographic data

NIST is conducting a major data de-identification benchmarking exercise called the Collaborative Research Cycle (CRC). At its core, the CRC investigates trade-offs among competing de-identification and data synthesis techniques.

Motivation: 

Tabular demographic data is ubiquitous and valuable, yet its privacy risks are extensive. De-identification algorithms process individual records to produce datasets that preserve analytical utility without revealing identity. Effective de-identification enables organizations to share valuable data safely—supporting machine learning training, fraud detection, health research, and other applications. Synthetic data algorithms leverage generative models to reproduce sensitive data distributions with synthetic records.

While de-identification release mechanisms can improve privacy, they may also introduce artifacts or bias that distort data distributions. Identifying and resolving these distortions is essential yet challenging. The CRC provides target datasets, metrology, and a collaborative forum to evaluate and compare the impact of various de-identification and synthetic data methods.

Testbed component: The Collaborative Research Cycle, a massive deidentification benchmarking exercise

The Collaborative Research Cycle (CRC) is a comprehensive benchmarking exercise for de-identification and synthetic data algorithms. Participants are invited to de-identify target datasets sourced from the U.S. Census Bureau. The project features over 500 de-identified excerpts created using techniques such as redaction, k-anonymity, differentially private synthetic data, and other algorithms. Each excerpt is evaluated using SDNist, a Python library designed to measure de-identified data fidelity, utility, and privacy.

Testbed outputs:

The CRC target data, the database of deidentified excerpts, the SDNist evaluation software, and quick-start notebooks are all in the public domain. We invite the public to use these tools to improve deidentification technologies. 

Collaborations:

We continue to invite the community to contribute deidentified data excerpts. We welcome collaborations on analysis of our growing database of techniques, on new fidelity, utility, and privacy metrics, and related research goals. Please reach out to PETs [at] nist.gov (PETs[at]nist[dot]gov) for more information.