Deident Wasm

Abstract

1. Introduction

risk-assessed anonymization for CSV, JSONL, Parquet and DICOM, driven by a declarative YAML policy.

extension. Input and output formats are independent, so a job converts while it transforms. See Formats.

quasi_identifier, sensitive, utility) and pick a strategy: tokenize, remove, redact, bucket, truncate dates, keep a prefix. See Policy reference.

2. Objective

Privacy transformation engine for structured datasets — pseudonymization and risk-assessed anonymization for CSV files, driven by a declarative YAML policy.

This project demonstrates how Rust can be applied to a real-world Cybersecurity & Ethical Hacking problem.

3. Key Features / Modules

• Formats — CSV, JSONL/NDJSON and Parquet, inferred from the file
• Column rules — classify every column (direct_identifier,
• Content patterns — find identifiers inside values (an IBAN in a
• Chained datasets — process several files as one export with shared token
• Sandboxed execution — each job can run in its own WebAssembly sandbox
• Encrypted mapping vault — optionally record original→token mappings
• Risk report — row counts, per-identifier actions, pattern findings and
• DICOM — metadata de-identification of medical imaging instances, with
• Policy lints — warn about risky-but-valid policies before a job runs.
• Audit log — append-only JSONL, metadata only. See

4. Technology Stack

5. System Requirements

General requirements for this technology stack — check the README for exact versions.

• Rust toolchain (rustup / cargo)
• Git (to clone the repository)

6. Installation & Setup

git clone https://github.com/ikuV/deident-wasm.git
cd deident-wasm

git clone <this-repo> && cd deident-wasm

# install the `deident` binary onto your PATH
cargo install --path crates/cli

# to also sandbox jobs, build the guest module (see Sandboxed execution)
rustup target add wasm32-wasip1
cargo build -p deident-worker --target wasm32-wasip1 --release

# — or just build and use it from target/release/
cargo build --release
./target/release/deident --help

# reversible: tokenize direct identifiers, keep everything else
deident pseudonymize examples/data/patients.csv \
  --policy examples/policies/patients.yaml \
  --out pseudo.csv

# irreversible: remove/generalize identifiers, write a risk report
deident anonymize examples/data/patients.csv \
  --policy examples/policies/patients.yaml \
  --out anon.csv \
  --report report.json

Full setup instructions are in the project README.

7. Future Enhancements

Suggested extensions you can add to make this your own project.

• Add logging and alert notifications (email / Telegram)
• Write a threat model document for the tool
• Package it with Docker for safe lab testing

8. Viva / Review Questions

Common questions examiners ask for projects in this domain.

1. Which threat or attack does this project defend against?
2. What detection or protection technique is used and what are its limits?
3. How are false positives and false negatives handled?
4. Which cryptographic algorithms or security standards are involved?
5. What legal and ethical rules apply when testing a tool like this?

9. Source Code & License

This project is developed by ikuV and published on GitHub under the Apache License 2.0. Please follow the license terms and credit the original author when you use or modify this code.