TrustLens: Explainable AI for Zero Trust Continuous Authentication

A complete research system that makes AI-driven access control decisions transparent, trustworthy, and auditable.

CI CodeQL Python 3.9+ License: MIT Tests Security: Bandit

Explainable AI Zero Trust Adversarial XAI Streamlit

Topics: trustworthy-ai · ai-assurance · explainable-ai · xai · interpretable-machine-learning · zero-trust · shap · lime · anchor · adversarial-machine-learning · adversarial-xai · ai-safety · cybersecurity · nist-800-207 · concept-drift · continuous-authentication · mlsecops · threat-modeling · anomaly-detection · streamlit

When an AI system grants or denies network access in a Zero Trust Architecture, can it explain why — in a way a human security analyst understands and trusts?

TrustLens answers this by combining:

• 3 ML classifiers (Random Forest, XGBoost, Neural Network) for access decisions
• 3 XAI methods (SHAP, LIME, Anchor) to explain every single decision
• A real-time 5-page dashboard for security analysts
• NIST SP 800-207 compliance with HIPAA and GDPR audit trails
• Novel evaluation metrics for explanation quality (faithfulness, stability, sparsity)
• 🆕 Explanation-assurance layer (v2.0) — cross-method consensus scoring, adversarial-robustness auditing, and concept-drift monitoring that guard the human-in-the-loop against explanation-manipulation attacks and silent model decay

Most XAI systems assume the explanation is correct and the model stays valid forever. TrustLens v2.0 challenges both assumptions with three novel, tested, dependency-light modules that turn "trust the explanation" into "verify the explanation."

Together these form a closed explanation-assurance loop — see docs/ARCHITECTURE.md §4 and the attack tree in docs/THREAT_MODEL.md.

Real-time stream of authentication requests with color-coded ALLOW/DENY decisions, trust scores, and interactive filtering.

Live Authentication Monitor

Side-by-side SHAP, LIME, and Anchor explanations for any decision. Includes counterfactual analysis ("what would flip the decision?").

Explanation Deep Dive

Head-to-head performance metrics, ROC curves, and inference speed benchmarks for all three classifiers.

Model Comparison

Attack pattern detection, risk heatmaps, anomaly analysis, and top risky users ranked by denial frequency.

Threat Intelligence

NIST SP 800-207, HIPAA, and GDPR compliance reporting with one-click CSV/JSON audit log export.

Compliance & Audit

# 1. Clone the repository
git clone https://github.com/Krishita17/TrustLens.git
cd TrustLens/trustlens
# 2. Create virtual environment
python3 -m venv venv
source venv/bin/activate # macOS/Linux
# venv\Scripts\activate # Windows
# 3. Install dependencies
pip install -r requirements.txt
# 4. Run the full pipeline (one command)
python run_pipeline.py
# 5. Launch the dashboard
streamlit run src/dashboard/app.py

Open http://localhost:8501 in your browser.

flowchart TD
 REQ([Incoming Auth Request<br/>user · device · location · auth_method]) --> CTX[ZTA Context Builder]
 CTX --> TS[Trust Scorer<br/>0.30·device + 0.25·behavior + 0.20·network<br/>+ 0.15·auth + 0.10·location]
 TS -->|trust ≥ 0.65| ALLOW([✅ ALLOW — fast path])
 TS -->|trust &lt; 0.65| ML[ML Classifier<br/>Random Forest · XGBoost · Neural Net]
 ML --> XAI[XAI Explainer<br/>SHAP · LIME · Anchor]
 XAI --> ASSURE[🆕 Assurance Layer<br/>Consensus · Robustness]
 PRE[Preprocessed stream] --> DRIFT[🆕 Concept-Drift Monitor<br/>PSI → retrain?]
 ASSURE --> LOG[Decision Logger<br/>+ NIST / HIPAA / GDPR tags]
 DRIFT --> LOG
 LOG --> DASH[Streamlit Dashboard<br/>5 analyst pages]
 classDef novel fill:#7b2ff7,stroke:#4b1e9e,color:#fff;
 class ASSURE,DRIFT novel;

📐 Full diagrams — system context, component view, decision sequence, and the explanation-assurance loop — are in docs/ARCHITECTURE.md .

trustlens/
├── src/
│ ├── data/ # Data loading, preprocessing, feature engineering
│ │ ├── synthetic_generator.py # Generates 50K realistic auth events
│ │ ├── preprocessor.py # Cleaning, encoding, normalization
│ │ └── feature_engineering.py # ZTA-specific derived features
│ ├── models/ # ML classifiers
│ │ ├── random_forest.py # Primary model (best SHAP support)
│ │ ├── xgboost_model.py # Gradient boosting classifier
│ │ ├── neural_net.py # PyTorch feedforward network
│ │ ├── train.py # Training orchestrator
│ │ └── evaluate.py # Metrics: accuracy, F1, AUC-ROC
│ ├── xai/ # Explainability methods
│ │ ├── shap_explainer.py # SHAP TreeExplainer + KernelExplainer
│ │ ├── lime_explainer.py # LIME tabular explainer
│ │ ├── anchor_explainer.py # Anchor rule-based explanations
│ │ └── xai_evaluator.py # Faithfulness, stability, sparsity metrics
│ ├── zta/ # Zero Trust Architecture engine
│ │ ├── policy_engine.py # NIST SP 800-207 policy rules
│ │ ├── trust_scorer.py # Weighted trust score computation
│ │ ├── context_builder.py # Request context assembly
│ │ └── decision_logger.py # Audit logging + compliance tags
│ └── dashboard/ # Streamlit UI (5 pages)
│ ├── app.py # Main entry point
│ └── components/ # Reusable UI components
├── data/
│ ├── synthetic/ # 50K pre-generated auth events
│ └── processed/ # Feature-engineered dataset (21 columns)
├── notebooks/ # 7 Jupyter notebooks (EDA → User Study)
├── experiments/ # Configs, results, logs
├── tests/ # 39 unit tests (all passing)
├── paper/ # IEEE paper outline + references
└── user_study/ # IRB protocol + questionnaire

Aligned with NIST SP 800-207:

• Never trust, always verify — every request re-evaluated independently
• Least privilege — role-based access with minimum necessary permissions
• Continuous validation — re-authentication every 15 minutes
• Micro-segmentation — network segment boundary enforcement

• NIST SP 800-207: Full ZTA pillar mapping (Identity, Device, Network, Application, Data)
• HIPAA: PHI-adjacent access flagging for sensitivity level 4-5 resources
• GDPR: Right to explanation, data minimization, pseudonymized user IDs

python -m src.data.synthetic_generator

Creates data/synthetic/generated_auth_logs.csv (50,000 rows, 12 features).

python -m src.data.feature_engineering

Produces data/processed/processed_auth_events.csv (50,000 rows, 21 features).

python -m src.models.train

Trains RF, XGBoost, and Neural Net with 5-fold cross-validation. Saves models and metrics.

python -m src.xai.xai_evaluator

Computes faithfulness, stability, sparsity, and latency for all XAI methods.

streamlit run src/dashboard/app.py

Opens at http://localhost:8501 with all 5 pages.

pytest tests/ -v

39 tests, all passing.

jupyter notebook notebooks/

Run in order: 01 → 02 → 03 → 04 → 05 → 06 → 07

50,000 pre-generated authentication events with realistic distributions. Ready to use immediately.

Download from UNSW Research and place CSVs in data/raw/. Not required — all functionality works with synthetic data.

brew install python@3.11
git clone https://github.com/Krishita17/TrustLens.git
cd TrustLens/trustlens
python3 -m venv venv && source venv/bin/activate
pip install -r requirements.txt
python run_pipeline.py
streamlit run src/dashboard/app.py

sudo apt install -y python3 python3-pip python3-venv git
git clone https://github.com/Krishita17/TrustLens.git
cd TrustLens/trustlens
python3 -m venv venv && source venv/bin/activate
pip install -r requirements.txt
python run_pipeline.py
streamlit run src/dashboard/app.py

pytest tests/ -v

TrustLens is a defensive security research project and ships a full security posture:

Report vulnerabilities privately via GitHub's Security advisories.

@inproceedings{choksi2026xaizta,
 title = {{TrustLens}: Explainable and Assured {AI} for Zero Trust
 Continuous Authentication},
 author = {Choksi, Krishita Sanjay},
 booktitle = {Proceedings of the IEEE Conference on Security and Privacy},
 year = {2026},
 note = {https://github.com/Krishita17/TrustLens}
}

Krishita Sanjay Choksi — sole author and maintainer. GitHub: @Krishita17

MIT License — For academic and research use. See LICENSE.

Built and maintained by Krishita Sanjay Choksi (@Krishita17)