IBM
IBM · Security · Filed May 8, 2025 · USPTO published Nov 12, 2026 · This week's release
IBM Files Patent for Testing Apps With Real Data After Scrubbing Private Details
Software has to be tested on realistic data before it reaches you, but the most realistic data is often the data privacy laws forbid developers from using. IBM's patent application describes a way to keep the useful parts of real customer records and scrub out the parts that point to a person.
- Publication number
- US 2026/0359649 A1(US20260359649A1)
- Applicant
- International Business Machines Corporation
- Filed · Published
- May 8, 2025 · Nov 12, 2026
- Inventors
- SARIKA SINHA, SIDDHARTH K. SARAYA
- Status when we published
- Waiting for an examiner
- Document
- 20 claims
- US classification
- 706/20
What IBM's privacy-safe test data setup does
Before a bank can release a new app, developers need realistic data to test it with. The most realistic data is the real thing: your name, your age, your account activity. Privacy laws in many countries put much of that off limits.
IBM's patent application describes a tool that sorts the data before anyone touches it. Each column of a customer table gets a sensitivity score. Anything that points to a person, like a name or customer ID, gets scrubbed. Harmless details, like a transaction date or amount, pass through as they are.
The result is a test set that still looks and behaves like live data, but no longer carries the pieces that could identify you. Developers get something realistic to test against, and the company stays on the right side of the law.
… transmitting a first plurality of data from the dataset that has been designated as highly sensitive, based on exceeding a sensitivity threshold, to a data pruner; transmitting a second plurality of data from the dataset that has been classified as low sensitivity, based on a sensitivity threshold, to a data provisioner; masking the first plurality of data, by the data pruner; …
Translation: The system splits data into sensitive and safe piles, sending the secret stuff to be hidden.
How IBM sorts sensitive data from safe data
The filing describes a data testing manager built from a few cooperating parts. First, developers mark which inputs matter for each API (application program interface, the doorway one program uses to ask another for something). In the example given, a loan-eligibility check depends on age and salary, while the customer ID barely affects the result.
- Data privacy analyzer: scores each column of data from 1 to 10 for sensitivity. In one example, anything above 7 counts as highly sensitive. It uses rules written by people such as business analysts, plus supervised learning (a model trained on labeled examples), and maps each column to the local privacy policy.
- Data pruner: removes or masks the highly sensitive columns, such as names and customer IDs, so they are anonymized.
- Data provisioner: collects the cleaned data and the low-sensitivity data and sends both to the target server used for testing.
Combinations matter too. A customer ID paired with age is treated as regulated, but age alone or salary alone can be used. Free-text cells, like comments, get scanned for patterns such as employee IDs or street addresses and masked if they turn up.
The filing also describes the analyzer re-checking its ratings when laws change or when new columns are added to a database.
An approach for defining data sets for each API (application program interface) and providing these data based on live data, after applying the data privacy laws, to be used in testing software applications may be provided.
Translation: This method turns real live data into safe test material while obeying privacy rules.
Why testers and banks may care about this
If this works, the apps that handle your money get tested against data that behaves like the real thing, while your personal details stay out of the test environment. The filing says live data is sometimes unavailable from a client because of the privacy laws in that country, which leaves testers guessing.
It could matter most for companies that build software across several countries. The description points out that places disagree about what counts as personal information, so a system that applies each region's rules automatically gives teams a way to prove their test data stayed compliant. This is a patent application, and the filing names no product.
IBM's 12th filing we've tracked since July in our on-device AI privacy watchlist builds on earlier applications like searching encrypted documents and sorting files without reading them.
Source: US 2026/0359649 A1 at the USPTO (PDF). Full patent text and figures are in the official publication.
Get our take in your Top Stories
Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time IBM patent news breaks.
Add Patentlyze on Google
One click.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings · 4 sheets
4 drawing sheets from US 2026/0359649 A1 · click any drawing to enlarge
More from IBM
All 470 IBM patents →
More in Security
All 341 Security patents →
Google
Google Patents a Faster Way to Crunch Private Data Without Exposing It
Google
Google Patents a Camera Sensor That Counts People Without Keeping a Single Photo
Google
Google Patents a Method to Test Product Changes Without Exposing Individual User Data
Microsoft
No comments yet