MicroCluster

How much can you say about an outbreak without exposing the people in it? A detector reads anonymous reports from a simulated dorm, names the finest safe group, and measures what the restraint costs.

Comment

Inspiration

Living in dormitories, I am well familiar with this cycle: One person falls sick on Monday, and come Friday half the residents are afflicted. Both options result in negative consequences. People do not communicate about the problem because to speak out means reporting; people continue utilizing facilities with no idea anything must be avoided. The other option would be announcing that room 214 has been infected since Tuesday; this person must endure questioning from strangers for a whole week whereas those ill next remain silent. There is terminology within public health regarding the latter problem and a general approach used, yet no one informs me about where the limit exists or the price associated with maintaining it. It was needed in numeric form.

What it does

MicroCluster simulates an illness spreading through a 150-person dorm: two floors, three suites of 25. The detection engine sees only anonymous reports (symptom category, approximate time, group) and must locate an outbreak nobody told it about.

Disclosure requires two independent gates, pulling in opposite directions. Evidence scales up with the size of the claim, so naming a larger population demands more support:

$$\text{reports needed} \;=\; \max\left(5,\; \left\lceil \sqrt{n} \right\rceil\right)$$

Privacy scales down, refusing any group small enough to identify its members or so heavily reported that naming it amounts to reading out a list:

$$n \;\geq\; 20 \quad \text{and} \quad \frac{\text{reports}}{n} \;\leq\; 0.5$$

The most optimal window clearing out the maximum amount possible will have its name announced. Nothing can ever be revealed without clearing enough. Otherwise, the reasoning will be presented rather than a name. In the provided scenario, a detector triggers an alarm on day three, reveals a name on day four, then takes back that revelation on day eight due to reporting becoming too extensive.

Who it is for. Anyone setting up guidelines for reporting within any little community – be it health services in the university, residence life, occupational health at work, etcetera – comes across this dilemma. What is the minimum number before identifying such a gathering becomes mandatory? And at what price do we wait? Any actual implementation will never resolve that dilemma without putting lives in danger. Building it as a simulation allows us to get those answers ahead of time without endangering anybody.

Prior art. It seems epidemic modeling agents are fully mature and cell suppression policies commonly appear within health statistic publications. However, neither has been my experience. Rather, I wanted to analyze the effect of applying a suppression policy to epidemic model agent outputs considering delay costs and leaks associated with that specific combination.

How its built

Built solo using Python and FastAPI for backend, wrote HTML/CSS/JS by hand without any frameworks. No database used, nor build steps required. Free-tiered hosting was used. Disclosures' logic and testing occurred before creation of user interface; simulator came next, followed by experiment running and interface building. Three results are computed, not claimed:

  • Cost of the policy. Over 500 simulated outbreaks, detection lands around day 8 and disclosure around day 14. Those six days are roughly 35 additional infections.
  • Rules against a learned model. Authored rules reach 0.95 precision, the trained model 0.93 with slightly better recall and about a day less delay. Because the model learned my own assumptions, I retested it at a transmission rate absent from its training data; the edge survived, narrowly. The rules ship and the model stays a benchmark.
  • An attack on my own output. A separate module differences published counts day over day. Against exact counts it pinned one-person changes 358 times. Against the ranges the interface publishes, 0 — though direction still leaks on 204 of 1,171 comparisons. Both numbers are on the page.

243 tests pass, and any run is reproducible from the settings shown on screen.

Challenges we ran into

Deployment. At times, a quarter of my requests would fail even prior to making it to my code as they failed at the host's edge level, and sleep of the free tier would nullify any running computations stored in memory. Creating a unique identifier with the parameter specifications of a run ensured deterministic recreation of the computation; therefore, it could reconstruct anything, despite never having seen it prior to restarting the process.

Comprehension. At first, my project consisted of diagrams that made no sense unless you had prior context. In its final state, the product opens up with clear language describing the process and mechanisms involved, executes the entire experiment from start to finish using only one button, and describes ideal outcomes beneath each graph produced.

Accessibility. Verified under Machado colourblind simulation and a full WCAG contrast audit, which found three real failures. Every state now carries a shape as well as a colour, every text pair passes, the interface is keyboard-navigable, and the floor plan carries a live text description for screen readers.

Accomplishments that I'm proud of

  • The visible refusal When a group is withheld, the screen says so and gives the reason, rather than logging it where only I would see.
  • The simple method. Authored rules beat the trained model on precision, so the model was benched rather than featured.
  • Nothing is a mock-up. The detector, both gates, the 500-run sweep, the benchmark, the robustness test and the attacker are all implemented, tested and live.

What I learned

There exists a cost associated with privacy, and within the context, there is a six-day period where 35 individuals contract the illness. The defensive strategy that mitigates any headlines related to the attack will create some residue that only the attacker sees. Increasing costs for the attackers does not stop the attacks; hence, the reason why the submission limit is noted as insufficient rather than being viewed as sufficient.

What's next

Finished and live: detection, both disclosure gates, the simulator, all three measured results, the interface, and the policy pages.

Not Completed: parameters are chosen rather than measured; nothing is validated beyond 150 people and three grouping levels; the reporting model is synthetic, where real reporting is clustered, correlated and suppressed by stigma; and resisting fabricated reports without collecting identities remains unsolved. Grounding both thresholds in formal privacy accounting is the next piece of work.

Extra Information

LINKS: One Pager PDF Code PDF

Built With

Share this project:

Updates

Submission history