The Release Gate
Who bears the privacy risk in synthetic data?
Suppose a privacy test uncovers a sensitive detail about ten hospital patients. Before deciding whether to release the synthetic data, I would want to know one thing. Did those ten patients have anything in common?
What the average leaves out
A hospital might use synthetic records to share patterns of illness and treatment. A patient with a rare diagnosis has a more specific concern. Could someone who knows part of their medical history learn the rest?
The Release Gate starts with that patient’s question. My thesis is that a decision to release synthetic data should account for exposure within the groups represented in the original records.
A group can be small enough to disappear in an average and still contain every person a test exposed.
How 1% can hide 20%
Imagine a test that tries to infer a private detail about each of 1,000 people. It succeeds ten times, all within a group of 50 people who share a rare diagnosis.
Across the full dataset, that is one person in a hundred. Within the smaller group, it is one in five. The same ten cases support both readings.
Who was easier to identify?
The example above asks whether someone could guess a private detail. A membership inference attack asks whether a particular person’s record was used to train the generator. Two studies show how much the answer can depend on whom the attacker tests.
Heart failure dataset
A medication group stands out
In van Breugel and colleagues’ experiment, the DOMIAS attack guessed training membership correctly about 77% of the time for patients taking angiotensin II receptor blockers, compared with about 70% for the remaining patients. The medication group made up 6.3% of the test data.
Approximate accuracies read from Figure 5, averaged over eight runs. The test included equal numbers of training members and non‑members overall.
van Breugel et al. · AISTATS 2023 · Fig. 5Texas hospital dataset
Five unusual records tell different stories
Stadler and colleagues tested five deliberately selected unusual records. For three, replacing the raw data with CTGAN‑generated records yielded a privacy gain below 0.3 against a linkage attack using simple summary statistics.
On the authors’ scale, zero gain means the attacker keeps the same advantage as with the raw data. One of the five records consistently received a gain below 0.005 with CTGAN. These counts describe the selected targets.
Stadler et al. · USENIX Security 2022 · Fig. 2What if they only guess when they’re confident?
In a separate heart failure experiment, van Breugel and colleagues ranked records by the DOMIAS attack score. Among the highest‑scoring fifth, 86.2% were actual training members on average. The paper reports a standard deviation of 5.5 percentage points across runs.
The denominator matters here too. Precision counts how often a membership prediction was right among the people the attacker chose to flag. It answers a different question from accuracy across everyone tested.
Why the count matters
In the example, one additional successful inference inside the group would move its observed rate from 20% to 22%. Across all 1,000 people, the same case would move the rate from 1% to 1.1%.
| Population | Ten cases | Eleven cases | Change |
|---|---|---|---|
| The 50 with the rare diagnosis | 20% | 22% | +2 points |
| All 1,000 patients | 1% | 1.1% | +0.1 points |
If I were reading that hospital’s release assessment, I would look for the patient counts beside each percentage. I would also want the assessment to name any group it had too little evidence to evaluate. Otherwise the people about whom we know the least can look like the people we have protected best.
Sources
- 1
Boris van Breugel, Hao Sun, Zhaozhi Qian and Mihaela van der Schaar. Membership Inference Attacks against Synthetic Data through Overfitting Detection. AISTATS 2023.
arXiv 2302.12580 - 2
Theresa Stadler, Bristena Oprisanu and Carmela Troncoso. Synthetic Data: Anonymisation Groundhog Day. USENIX Security 2022.
arXiv 2011.07018