diff --git a/PROJECTS/advanced/ai-threat-detection/backend/ml/synthetic.py b/PROJECTS/advanced/ai-threat-detection/backend/ml/synthetic.py
new file mode 100644
index 00000000..cf222bd4
--- /dev/null
+++ b/PROJECTS/advanced/ai-threat-detection/backend/ml/synthetic.py
@@ -0,0 +1,509 @@
+"""
+©AngelaMos | 2026
+synthetic.py
+"""
+
+import logging
+import random
+from datetime import UTC, datetime, timedelta
+
+import numpy as np
+
+from app.core.features.encoder import encode_for_inference
+from app.core.features.extractor import extract_request_features
+from app.core.ingestion.parsers import ParsedLogEntry
+
+logger = logging.getLogger(__name__)
+
+SQLI_PAYLOADS: list[str] = [
+ "' OR 1=1--",
+ "' OR '1'='1",
+ "' UNION SELECT NULL,NULL--",
+ "' UNION SELECT username,password FROM users--",
+ "1; DROP TABLE users--",
+ "admin'--",
+ "' AND 1=1--",
+ "' AND SLEEP(5)--",
+ "' OR BENCHMARK(1000000,SHA1('test'))--",
+ "1' ORDER BY 1--",
+ "1' ORDER BY 10--",
+ "' UNION ALL SELECT @@version--",
+ "-1' UNION SELECT 1,CONCAT(user(),database())--",
+ "' OR 'x'='x",
+ "1; WAITFOR DELAY '0:0:5'--",
+ "' AND EXTRACTVALUE(1,CONCAT(0x7e,version()))--",
+ "' AND UPDATEXML(1,CONCAT(0x7e,version()),1)--",
+ "admin' AND '1'='1",
+ "' UNION SELECT LOAD_FILE('/etc/passwd')--",
+ "' INTO OUTFILE '/tmp/shell.php'--",
+ "1' AND 1=1 UNION SELECT 1,2,3--",
+ "' OR EXISTS(SELECT * FROM users)--",
+]
+
+XSS_PAYLOADS: list[str] = [
+ "",
+ "",
+ "
",
+ "