NIST releases open-source testbed to measure how privacy protections affect AI models

The National Institute of Standards and Technology (NIST) has released open-source software for testing how well privacy protections work when machine learning models are trained on sensitive data. NIST's National Cybersecurity Center of Excellence (NCCoE) published the Privacy-Preserving Federated Learning (PPFL) Testbed on October 29, 2026, together with a curated genomic dataset to run it on. Both belong to NIST's testbeds for privacy-enhancing technologies, or PETs.

The problem it tackles is common in medicine and research. Models trained on sensitive or proprietary records can reveal new insights, NIST says, as when patient data helps point to new treatments, but privacy, regulatory or security concerns often stop organizations from sharing such data. Federated learning lets several organizations train one shared model while each keeps its data on its own systems. Differential privacy adds a second safeguard: random noise, tuned to a chosen level, is mixed into training so the finished model gives away less about any one record. The price is some loss of accuracy.

What the testbed does

The software trains a model either centrally or across several simulated sites, with or without differential privacy, and shows how each setup and privacy setting changes the model's performance. Its documentation says the aim is to measure what privacy protections cost using a common benchmark, so that different teams' results can be compared. It is built on two open-source libraries, Opacus for differential privacy and Flower for federated learning, and the code is published on GitHub. Genomics is the first use case, but NIST says the software can be pointed at many other tables of data with little setup.

Soybeans before people

The benchmark dataset holds genetic and trait data for 18,348 soybean samples, called accessions, from the US Department of Agriculture's Soybean Germplasm Collection. The plants were genotyped with a chip that reads more than 50,000 single-nucleotide polymorphisms (SNPs), the genetic markers the testbed's models use to predict physical traits. Each sample comes with traits recorded by the USDA's Germplasm Resources Information Network, such as yield, plant height and seed coat color, though only seed coat color is recorded for every sample. NIST says it chose plant data so that the early work carries no privacy risk for individuals.

The setup mirrors a human problem. Human genomic data sit in separate repositories, such as the Gene Expression Omnibus and the National Cancer Institute's Genomic Data Commons, and analyzing them together could improve research, for example on rare cancers. Pooling them, however, raises regulatory, security and privacy issues, according to NIST. The testbed therefore simulates several such silos, each holding different individuals' genetic and trait data.

Tested by attackers first

Earlier versions of the testbed were used in a public red-teaming exercise that NIST's Privacy Engineering Program and the NCCoE ran in 2025. Teams were invited to attack models trained at different privacy levels, so that NIST could learn how much protection differential privacy gives genomic data when the central server coordinating the training cannot be trusted. NIST says the privacy risks of the testbed's models will be judged with empirical measures and tested further in more red-teaming exercises.

What comes next

NIST says it plans to use its PETs testbeds to support guidelines on deploying and evaluating privacy-enhancing technologies. It has already published SP 800-226, a March 2025 guide to evaluating differential privacy guarantees, which describes differential privacy as a mathematical framework for quantifying the privacy loss people face when their data appear in a dataset. Researchers and organizations can join the NCCoE's Genomic Data Community of Interest to help shape future tools.