Synthetic Data in Secure Document AI Systems: Privacy-Preserving Model Development

Passport and ID images contain the name, document number, date of birth, photo, signature, and sometimes biometric data. Therefore, transferring real production images into an AI development environment poses a serious privacy and security risk. Synthetic data is a powerful tool for developing document analysis and defect detection models using fictional identities that do not belong to real individuals.

However, the purpose of synthetic data is not to make a real government document counterfeitable. A secure approach involves modeling verification tasks using fictional templates that do not replicate the design of real documents, their hidden security features, or their production parameters.

What problems can be addressed using synthetic data?

• Determining document boundaries, orientation, and perspective
• Localization of portraits, signatures, MRZ, and data fields
• OCR and field normalization
• Detection of blurriness, glare, low contrast, and geometric distortion
• Simulations of presentation attacks such as on-screen display, printing, and re-capture
• Detection of missing fields, positional deviations, and surface defects on the personalization line

Data generation layers

1. Identity layer: Entirely fictional name, date, document number, and synthetic portrait.
2. Design layer: A template representing functional areas that does not belong to the actual product.
3. Personalization layer: Placement of portrait, text, signature, and machine-readable data.
4. Defect layer: Scratches, stains, missing print, positional deviation, or tonal differences.
5. Capture layer: Perspective, lens distortion, screen moiré, shadows, and reflections.
6. Label layer: Defect type, bounding box, mask, and production parameters.

A simple synthetic sample generator

from PIL import Image, ImageDraw, ImageFilter
from dataclasses import dataclass
import random, uuid

@dataclass
class SampleLabel:
    sample_id: str
    defect: str | None
    defect_box: tuple[int, int, int, int] | None

def generate_sample(seed: int) -> tuple[Image.Image, SampleLabel]:
    rng = random.Random(seed)
    img = Image.new("RGB", (1012, 638), "#dfe8e8")
    draw = ImageDraw.Draw(img)

    # Kurgusal düzen: gerçek bir belge tasarımını kopyalamaz.
    draw.rounded_rectangle((32, 32, 980, 606), 28,
                           fill="#edf3f2", outline="#55747b", width=3)
    draw.rectangle((76, 146, 326, 466), fill="#9fb4b8")
    draw.text((374, 150), "SPECIMEN / SYNTHETIC", fill="#24434b")
    draw.text((374, 220), f"ID: SYN-{seed:08d}", fill="#24434b")
    draw.text((76, 525), "SYNTHETIC<<TRAINING<<DATA<<<<", fill="#24434b")

    defect, box = None, None
    if rng.random() < 0.5:
        x, y = rng.randint(360, 820), rng.randint(180, 430)
        box = (x, y, x + rng.randint(40, 120), y + rng.randint(8, 24))
        draw.rectangle(box, fill="#eef3f2")
        defect = "missing_personalization"

    if rng.random() < 0.35:
        img = img.filter(ImageFilter.GaussianBlur(rng.uniform(0.4, 1.4)))

    return img, SampleLabel(str(uuid.uuid4()), defect, box)

This example does not generate a security document; it only demonstrates the logic behind field placement and defect labeling. In a real project, portraits should also come from synthetic identities, and the training data and license of the generator model used must be evaluated.

The line between realism and security

Realism that does not serve the model’s purpose should not be added. An OCR model requires readable text and capture diversity; it does not require a realistic hologram design. Defect localization requires surface texture and defect geometry; it does not require a realistic document serial number algorithm. This principle of “minimum necessary realism” reduces both security risk and unnecessary domain dependency.

How is the domain gap measured?

High accuracy on synthetic data does not guarantee success in real-world production. The model should be evaluated not only with a synthetic validation set but also with a small, representative real-world validation set maintained in a controlled environment. Real-world data can be scored through a secure evaluation service without being exposed to the development team.

def release_gate(synthetic_f1, secure_real_f1, max_gap=0.08):
    gap = synthetic_f1 - secure_real_f1
    return {
        "synthetic_f1": synthetic_f1,
        "secure_real_f1": secure_real_f1,
        "domain_gap": gap,
        "approved": secure_real_f1 >= 0.90 and gap <= max_gap
    }

Data leakage controls

The generative model must be tested to ensure it does not memorize and reproduce real examples. Excessive similarity between synthetic examples and real records can be investigated using nearest neighbor analysis, perceptual hashing, face similarity, and text field scanning. Each example must be traceable via its generator version and seed value.

Balanced dataset design

The dataset should not consist solely of examples with minor flaws. Flawless examples, production variations that are marginally acceptable, and critical flaws should be classified separately. Camera, angle, lighting, resolution, and device distribution should represent the target environment. Demographic diversity in synthetic identities should be measured; the model’s unnecessary reliance on specific portrait features should be tested.

Conclusion

Synthetic data reduces privacy risks in secure document AI work and enables the controlled generation of rare defects. However, it does not completely replace real data. The most robust approach combines fictional and secure synthetic generation, isolated evaluation against limited real data, domain gap tracking, and versioned data governance.

References

• IDNet — Synthetic Dataset for Identity Document Analysis
• Synthetic ID Card Image Generation for Presentation Attack Detection
• FakeIDet2 — Privacy-Aware Fake Identity Document Detection