Data Obfuscator

Real data should not be shared with LLM not hosted in your organization. And yet an LLM is the fastest route to a clean NONMEM control stream, a first exploratory plot or a thorough check of your data. Data Obfuscator gives you both. With one offline command it replaces every subject, study and site identifier, moves the calendar, hides labels and free text and, when you ask for more, disguises the covariates, while the doses, times, concentrations and event flags that your model depends on stay exactly as they were. The LLM works on a dataset that behaves like yours; the real values never leave your computer, and one more command puts them back when the answer comes home.

It is a single, offline command-line program written in Rust: no installer, no cloud, no upload. The data are read from a file on your computer and the masked copy is written next to it. The same input, options and seed always give a byte-identical result, so a masking can be repeated and audited.

The problem it solves

Pharmacometric datasets carry real subject, study and site identifiers, real calendar dates, covariates that can single out a person, and free text. An LLM is very useful for exploratory analysis, NONMEM control streams and data quality control, but the raw file cannot simply be pasted into it. Scrubbing the file by hand is slow and easy to get wrong, and a careless scrub often damages exactly what the analysis needs: the order of times within a subject, the dosing records, the observations, the event flags.

What it does, in one picture

 real dataset  ──►  data-obfuscator  ──►  masked dataset      share it
 (pk_study.csv)                      ──►  llm.txt             share it (prompts built for this dataset)
                                     ──►  tokens.txt          for you (how big is it for GPT, Claude, Gemini ...)
                                     ──►  keymap.txt          KEEP PRIVATE (the key that undoes the masking)

The masked dataset keeps doses, observations (DV), times (TIME, TAD), event flags (EVID, MDV, CMT, RATE, ADDL, II, SS, DVID, ...) exactly as they were. What changes is what identifies: identifiers are recoded, dates are moved by a constant, covariates can be rescaled, free text is removed.

The four commands

Typical workflow

1. Mask: data-obfuscator run --input pk_study.csv --output ./masked --level 2
2. Check the warnings the program prints and read masked/summary.txt.
3. Share only obfuscated.csv and llm.txt with the LLM or collaborator. Keep keymap.txt, summary.txt, config.used.txt and obfuscator.log to yourself.
4. Work with the LLM on the masked data: exploration, a NONMEM control stream, QC.
5. Restore when you need the real values: data-obfuscator reverse --input table_from_llm.csv --keymap masked/keymap.txt.

Who it is for

Clinical pharmacologists, pharmacometricians and data scientists who want an LLM's help on clinical PK/PD data without handing over the real identifiers.

What it is not

Masking lowers the risk of re-identification; it is not formal anonymisation. Unusual covariate combinations, rare dates or rare events can still identify someone. The program prints warnings for the problems it can detect, but the decision to share a dataset stays with you and your organisation's rules.

Where to go next