Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

SMOTE-DP: Improving Privacy-Utility Tradeoff with Synthetic Data

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read SMOTE-DP: contracting SMOTE preprocessing before a differentially private generator shrinks sensitivity, so an 'unreasonably large' privacy budget like 50 can be genuinely privacy-protective without sacrificing utility.

desk verdict A well-motivated empirical study whose central formal claim does not establish differential privacy; the practical results are suggestive but the theory overreaches. read the letter →

arxiv 2506.01907 v1 pith:T2EGSAE3 submitted 2025-06-02 cs.LG cs.CRstat.ML

Yan Zhou , Bradley Malin , Murat Kantarcioglu This is my paper
classification cs.LGcs.CRstat.ML MSC 68P27
keywords differentialprivacysyntheticdataSMOTEprivacy-utilitytradeoffsensitivityreductionmembershipinferenceBayesiannetworkpublication
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the privacy-utility tradeoff in synthetic data publishing can be fundamentally improved by prepending a contracting oversampling step, SMOTE, to a differentially private generator. The intended result is that SMOTE shrinks the generator's sensitivity, so the same amount of noise that normally costs privacy budget epsilon now costs only alpha times epsilon, with 0

What carries the argument

The central object is Definition 2, the sensitivity of a synthetic generator: $\Delta$ f_s = max_{X_S, X'_S} (||mu_{X_S} - mu_{X'_S}|| + tr(Sigma_{X_S} + Sigma_{X'_S})). The mechanism that carries the argument is SMOTE's contracting geometry, established by the covariance analysis in [8]: linear interpolation between a point and its nearest neighbor yields new samples with essentially the same mean but smaller covariance, so the trace term in Definition 2 decreases. That decrease produces the identity $\Delta$ f_s = $\alpha$ $\Delta$ f with 0<$\alpha$<1, which lets one fixed amount of additive Laplace noise be described as achieving $\alpha$ epsilon privacy instead of epsilon privacy. The empirical evaluation uses the privacy-gain attack framework from [36], which measures how much a released synthetic dataset reduces a membership-inference adversary's advantage relative to releasing the real data.

What would settle it

Take a pair of neighboring datasets with identical means and covariances but different higher-order statistics, publish SMOTE-DP output with epsilon=50, and compute the exact privacy loss under the standard differential privacy definition. If the loss exceeds alpha*50, the claimed privacy enhancement is refuted.

Watch

Extended reading notes

Core claim

On the paper's own terms, the core discovery is Theorem 2: for a SMOTE-transformed dataset X_S, the output of an epsilon-differentially private mechanism is differentially private with respect to $\alpha$ epsilon in the Sigma_{X_S}-transformed metric space, where 0<$\alpha$<1. The theorem follows from Definition 2, which defines the sensitivity of a generative model as the maximum over neighboring datasets of the expected distance between generated datasets, measured as the difference in means plus the trace of the summed covariances. Because SMOTE-generated data has nearly the same mean but a smaller covariance trace, the sensitivity obeys $\Delta$ f_s = $\alpha$ $\Delta$ f, so Laplace noise calibrated to $\Delta$ f_s yields a privacy budget of $\alpha$ epsilon. The paper reads this as justification that a deliberately large epsilon, such as 50, is not merely a utility compromise but an actually protective choice on SMOTE-preprocessed data.

Load-bearing premise

The proof relies on a non-standard sensitivity definition, Definition 2, which bounds the expected difference in means plus the trace of the covariances of the generated data; if this definition is not a valid upper bound on the true sensitivity that standard differential privacy requires—the distance between full output distributions—then the claimed alpha epsilon guarantee does not imply actual differential privacy.

Editorial extensions

If this is right

  • A privacy budget that would normally be dismissed as meaningless, such as epsilon=50, becomes a defensible choice once SMOTE has contracted the data.
  • Because the proof does not depend on any particular generator pair, SMOTE-DP can combine any contracting data transformation with any differentially private generator.
  • Downstream utility, such as Random Forest classification accuracy on the Texas, German Credit, and Employee datasets, stays close to the raw-data level while privacy gain remains near its maximum.
  • Privacy protection becomes more consistent across individuals, covering both outlier records and randomly selected records, compared with running the DP generator alone.
  • Any data generator that produces contracting patterns, meaning smaller covariance, should provide the same privacy enhancement as SMOTE when placed before a DP mechanism.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the contraction analysis in [8] is derived under Gaussian assumptions, the alpha < 1 sensitivity reduction may fail for strongly non-Gaussian source distributions; this is an extension of the paper's claim, not a claim the paper makes.
  • If the moment-based sensitivity definition does not imply standard differential privacy, the strong privacy protection claimed here should be understood as protection against the membership-inference attacks studied, not necessarily against adversaries exploiting higher-order output statistics.
  • The paper's logic points to a broader design rule: effective privacy depends on the geometry of the data representation, so epsilon values are not directly comparable across preprocessing pipelines—an insight that could reshape how practitioners set privacy budgets.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes SMOTE-DP, a pipeline that applies SMOTE to a source dataset before feeding it to a differentially private generative model, with the aim of improving the privacy-utility tradeoff. The central theoretical claim is that SMOTE's contracting effect on covariance reduces the sensitivity of the data, so a DP mechanism can use a much larger privacy budget epsilon (e.g., 50) while still providing an effective guarantee of alpha-epsilon differential privacy, where 0<alpha<1. The paper supports this with two theorems (Theorem 1 on sensitivity reduction and Theorem 2 on SMOTE-enhanced privacy) and with experiments on artificial data and three real datasets, measuring privacy via the membership-inference privacy gain metric of Stadler et al. and utility via classification accuracy.

Significance. If the central claim were valid, the proposed method would be significant: it would offer a practical way to publish synthetic data with both a formal differential privacy guarantee and low utility loss under large privacy budgets. The paper also has useful strengths: it engages seriously with the empirical benchmark of Stadler et al., explicitly tests a deliberately large epsilon, and is transparent that SMOTE is intended as one instance of a broader class of contraction-producing generators. However, the formal contribution is not sound. The sensitivity definition introduced in Definition 2 is not the global sensitivity required by differential privacy, and the proof of Theorem 2 does not establish a standard DP guarantee. Consequently the paper's central claim, that SMOTE-DP is differentially private with alpha-epsilon, is unsupported. The empirical attack-based results are interesting but cannot substitute for the missing formal guarantee.

major comments (4)
  1. [Section 3.2, Definition 2 and Theorem 2] Definition 2 defines the sensitivity of a generative model as max_{X_S,X'_S} E(||X_S-X'_S||) = max (||mu_XS - mu_X'S|| + tr(Sigma_XS + Sigma_X'S)). This is not the global sensitivity used in Definition 1, and it is not the quantity that controls differential privacy. DP requires that for every pair of neighboring datasets X,X' and every output event O, the likelihood ratio P(M(X) in O)/P(M(X') in O) is bounded by e^epsilon (and symmetrically); bounding a first-moment functional does not imply such a likelihood-ratio bound. Two distributions can share means and covariances while having nearly disjoint support. For SMOTE, whose outputs are linear interpolations among K nearest neighbors, removing one outlier can delete a cluster of synthetic points that lies far from every point in the neighboring dataset's output, so the pre-noise output distributions can have essentially disjoint supports. Therefore Theorem 2's conclusion that X_S^epsilon is alpha-epsilon-DP is not established.
  2. [Section 3.2, Eqs. (4)-(5)] The proof of Theorem 2 relabels the same noise scale and presents it as a privacy improvement. Eq. (4) adds Laplace noise Lap(Delta f/epsilon); after SMOTE, Eq. (5) is written with noise Lap(Delta f_s/(alpha epsilon)), and since Delta f_s = alpha Delta f these two Laplace distributions are identical. A fixed noise distribution cannot yield a smaller privacy parameter unless the true DP sensitivity of the released query has actually decreased, and that is precisely what has not been shown. Moreover, applying SMOTE before the DP generator is not DP post-processing: post-processing preserves the same epsilon guarantee only when applied after the mechanism's output. Without a Lipschitz or sensitivity analysis for the transformation f_S, the full SMOTE-to-DP pipeline has no standard DP guarantee of any epsilon. The phrase 'in the Sigma_XS-transformed metric space' also does not correspond to any standard notion of differential privacy.
  3. [Section 3.2, Theorem 1] Theorem 1's proof is not valid as written. It assumes X ~ N(mu, Sigma), invokes the approximate covariance formula Eq. (2) from reference [8], and compares traces, but Definition 2 involves maxima over all neighboring datasets of a sum of mean differences and covariance traces. The proof replaces the mean-difference term with 'approximately 0' based on Eq. (1), which is a statement about the mean of SMOTE samples drawn from a single fixed distribution, not a bound on the supremum over neighboring X and X'. Similarly, inequality (3) is stated for a fixed distribution and does not imply that the supremum of tr(Sigma_XS + Sigma_X'S) over neighboring datasets is smaller than the supremum of tr(Sigma_X + Sigma_X'). Thus the conclusion Delta f_s < Delta f is not derived from the stated definitions and assumptions.
  4. [Section 4.2, Figures 4-7] The empirical evaluation uses the 'privacy gain' metric of reference [36], which is an attack-based membership-inference advantage, not differential privacy. Experiments showing high privacy gain on five hand-picked outliers with epsilon=50 (Figure 4) and better privacy gain for larger epsilon on the Employee dataset (Figure 7) are difficult to interpret as support for a formal privacy claim, and the plots do not report confidence intervals or repeated-seed variation. The paper's conclusion that SMOTE-DP 'ensures robust privacy protection' is therefore not backed by a DP guarantee; the attack metric alone cannot carry the theoretical weight of the paper's central claim.
minor comments (4)
  1. [Section 3.1, Eq. (2)] The parameter C in Eq. (2) is not defined in the manuscript beyond 'a random variable parameterized in terms of dimension d and K'; readers cannot verify the trace inequality without consulting reference [8].
  2. [Section 3.2, Eq. (5)] The notation in Eq. (5) is unclear: the terms f_S(X), Y, and w*Delta are combined without a precise definition of how the SMOTE transformation, the Laplace noise, and the interpolation variable interact, making the proposed mechanism hard to reproduce.
  3. [Section 4.2, Experiment Setup] The experimental section does not state how many SMOTE records are generated, how they are combined with the original data before training the DP generator, or why K=1 was chosen; these details are needed to replicate Figures 4-7.
  4. [Section 3.2, proof of Theorem 1] The use of 'approximately equal to 0' for the mean-difference term is informal; since the theorem asserts a strict inequality, the proof should replace this approximation with a quantified bound or state it as an additional assumption.

Circularity Check

2 steps flagged · score 8.0 of 10

The central privacy theorem reduces to Definition 2's moment-based sensitivity and a relabeling of the Laplace noise scale as a smaller privacy budget.

  1. self definitional [Section 3.2, Definition 2 and Theorem 1]
    "Definition 2. ... the sensitivity of the synthetic output is: ∆fs = max XS,X′S E(||XS − X′S||) = max XS,X′S (||µXS − µX′S|| + tr(ΣXS + ΣX′S)) ... Therefore, ∆fs < ∆f, that is, the sensitivity is reduced after applying SMOTE."

    The proof of Theorem 1 does not use the standard DP sensitivity sup|f(X)-f(X')|; it uses the newly defined moment functional in Definition 2. Since that definition includes tr(ΣXS + ΣX′S), the externally known SMOTE contraction tr(Σz) < tr(Σx0) (Eq. 3) directly makes ∆fs < ∆f. The sensitivity reduction is therefore true by construction of the definition, not a derived property of the SMOTE transformation in the standard DP sense.

  2. renaming known result [Section 3.2, Theorem 2 proof and Eq. (5)]
    "Since ∆fs < ∆f, or equivalently, ∆fs = α·∆f where 0 < α < 1, it follows: ∆f/ϵ = ∆fs/(α·ϵ) ... XϵS = fS(X) + Y + w∆, where Y ∼ Lap(∆fs/(α·ϵ)) ... which essentially decreases the privacy budget from ϵ to α·ϵ for 0 < α < 1."

    The theorem defines α by the relation ∆fs = α∆f, then rewrites the identical Laplace scale Lap(∆f/ϵ) as Lap(∆fs/(αϵ)). Because α<1 is forced by the definitional relation, αϵ<ϵ is a tautology. The proof never bounds the likelihood ratio P(XS^epsilon ∈ O)/P(XS'^epsilon ∈ O) required by differential privacy; it only renames the fixed noise level as a smaller privacy budget. The claimed 'enhanced privacy' is thus the input relation ∆fs = α∆f relabeled as a conclusion.

full rationale

The paper's empirical comparison against the Stadler et al. benchmark is external and not circular: the privacy-gain and utility measurements on Texas, German Credit, and Employee do not depend on the paper's own definitions. The theoretical claim, however, is circular at its core. Definition 2 replaces the standard worst-case query sensitivity with a moment-based functional on generated distributions, and Theorem 1 then obtains SMOTE sensitivity reduction by plugging the known covariance contraction (Eq. 3) into that definition. Theorem 2 introduces α as the ratio ∆fs/∆f, rewrites the same noise scale Lap(∆f/ϵ) as Lap(∆fs/(αϵ)), and declares the privacy budget decreased. Because α < 1 is guaranteed by the definitional relation, the conclusion follows by construction; no standard differential-privacy likelihood-ratio bound is supplied. The failure to prove a standard DP guarantee is also a correctness issue, but the specific circularity is that the 'privacy enhancement' is not derived from DP's definition—it is manufactured by defining a sensitivity that SMOTE is already known to shrink and then renaming the fixed noise as αϵ-DP. There is no load-bearing self-citation: the SMOTE contraction result in [8] is independent external work. The score reflects that the central theory reduces by definition, while the empirical portion remains independent.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on a hand-chosen sensitivity definition, a Gaussian distribution assumption inherited from prior SMOTE analysis, and a large hand-selected privacy budget. No new physical or conceptual entities are introduced, but the non-standard sensitivity metric is effectively an ad hoc modeling choice that drives the theoretical conclusion.

free parameters (4)
  • privacy budget epsilon = 50 (also 0.1 and 1.0 in baselines)
    The method's claimed benefit depends on choosing a very large epsilon (50) that would normally be considered too weak for DP; this value is hand-selected in the experiments.
  • SMOTE neighbor count K = 1
    SMOTENC is run with K=1; the contraction effect and results may depend on this choice.
  • Number of SMOTE-generated synthetic records = not reported
    The size of the intermediate SMOTE dataset XS is not specified, and it affects both the DP generator's training and the final utility.
  • alpha (sensitivity scaling factor) = data-dependent, not estimated
    Theorem 2 uses alpha = delta_fs / delta_f with 0 < alpha < 1, but the paper does not estimate or bound alpha empirically.
assumptions (5)
  • domain assumption Source data X follows a multivariate Gaussian distribution (X ~ N(mu, Sigma)).
    The SMOTE covariance contraction result (Eq. 2 and inequality 3) is derived under a Gaussian assumption in [8]; real datasets are not Gaussian.
  • ad hoc to paper Sensitivity of a generative model can be defined as the expected difference in means plus the trace of covariances of the generated data (Definition 2).
    This definition is introduced by the authors and is not the standard global sensitivity used in differential privacy; the main theorem depends on it.
  • standard math The Laplace mechanism with sensitivity delta_f and budget epsilon provides epsilon-differential privacy.
    Standard DP result used in Eq. (4).
  • standard math A differentially private mechanism applied to a transformed dataset inherits privacy properties through post-processing.
    Invoked implicitly when applying a DP generator to SMOTE-transformed data, but the paper never proves that the SMOTE transformation is a safe post-processing step.
  • domain assumption Privacy gain as defined in [36], based on adversary advantage in a linkage attack, is an adequate measure of privacy.
    The empirical evaluation relies on this attack-based metric rather than a formal worst-case guarantee.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SMOTE-DP: Improving Privacy-Utility Tradeoff with Synthetic Data." pith.science (2026). https://pith.science/paper/T2EGSAE3

@misc{pith2026250601907,
  author       = {Pith},
  title        = {Pith review of: SMOTE-DP: Improving Privacy-Utility Tradeoff with Synthetic Data},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/T2EGSAE3}},
  note         = {Machine review of arXiv:2506.01907}
}
read the original abstract

Privacy-preserving data publication, including synthetic data sharing, often experiences trade-offs between privacy and utility. Synthetic data is generally more effective than data anonymization in balancing this trade-off, however, not without its own challenges. Synthetic data produced by generative models trained on source data may inadvertently reveal information about outliers. Techniques specifically designed for preserving privacy, such as introducing noise to satisfy differential privacy, often incur unpredictable and significant losses in utility. In this work we show that, with the right mechanism of synthetic data generation, we can achieve strong privacy protection without significant utility loss. Synthetic data generators producing contracting data patterns, such as Synthetic Minority Over-sampling Technique (SMOTE), can enhance a differentially private data generator, leveraging the strengths of both. We prove in theory and through empirical demonstration that this SMOTE-DP technique can produce synthetic data that not only ensures robust privacy protection but maintains utility in downstream learning tasks.

Figures

Figures reproduced from arXiv: 2506.01907 by the authors.

Figure 1
Figure 1. SMOTE-DP: a synthetic data generator pipeline. a.) For the non-DP generator G1, we employ a well-known synthetic data genera￾tor SMOTE [3]. SMOTE is frequently relied upon to rebalance an imbalanced dataset to improve model accuracy on minority classes. When compared to other generative models, SMOTE has been shown to achieve a more reason￾able balance between privacy and utility [27]. To our knowledge, its power to… view at source ↗
Figure 2
Figure 2. Original data distribution vs. SMOTE-generated sample distribution [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Data distributions before and after synthetic generation with DP, SMOTE, and SMOTE-DP. 4.2 Experiments on Real Data We now focus on test cases reported in [36] that were claimed to be most challenging where DP has experienced significant utility loss while protecting privacy, and other generative models with no explicit privacy protection fail to protect outlier data points in the face of linkage attacks. We adapted… view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Adversary’s privacy gain & utility on five outliers in the Texas dataset. We also recommend to be cautious when considering DP for privacy protection [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 5
Figure 5. Figure 5: shows the results of repeating the previous experiment using 10 randomly selected instances to replace the five outliers. The non-DP generator BayesianNet (1 st from the left) provided much better privacy protection than all DP generators (2 nd–4 th) without incurring …
Figure 6
Figure 6. Figure 6: When DP generators are applied to the SMOTE-preprocessed data, [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: Adversary’s privacy gain & utility on random samples in the Employee dataset with different publishing methods. 5 Conclusions The release of synthetic data has been touted as offering enhanced privacy protection compared to traditional data sanitization techniques. How…

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Synthesizing real-world distributions from high-dimensional Gaussian Noise with Fully Connected Neural Network

    cs.LG 2026-04 unverdicted novelty 5.0 of 10

    Fully connected neural network with randomized loss synthesizes real-world tabular data distributions from Gaussian noise faster than state-of-the-art deep generative models.

Reference graph

Works this paper leans on

47 extracted references · 31 canonical work pages · cited by 1 Pith paper

  1. [18]

    Phd thesis, Columbia University (October 2022), available at https://doi.org/10.7916/k9cc-v818 Improving Privacy-Utility Tradeoff 15

    Lut, Y.: Privacy-Aware Data Analysis: Recent Developments for Statistics and Machine Learning. Phd thesis, Columbia University (October 2022), available at https://doi.org/10.7916/k9cc-v818 Improving Privacy-Utility Tradeoff 15

    work page doi:10.7916/k9cc-v818 2022

  2. [8]

    Information Sciences505, 32–64 (2019)

    Elreedy, D., Atiya, A.F.: A comprehensive analysis of synthetic minority oversam- pling technique (smote) for handling class imbalance. Information Sciences505, 32–64 (2019). https://doi.org/https://doi.org/10.1016/j.ins.2019.07.070, https://www.sciencedirect.com/science/article/pii/S0020025519306838

    work page doi:10.1016/j.ins.2019.07.070 2019

  3. [36]

    In: 31st USENIX Security Symposium (USENIX Security 22)

    Stadler, T., Oprisanu, B., Troncoso, C.: Synthetic data – anonymisation groundhog day. In: 31st USENIX Security Symposium (USENIX Security 22). pp. 1451–

    work page

  4. [1]

    (eds.) Privacy in Statistical Databases

    Abowd, J.M., Vilhuber, L.: How protective are synthetic data? In: Domingo-Ferrer, J., Saygın, Y. (eds.) Privacy in Statistical Databases. pp. 239–246. Springer Berlin Heidelberg, Berlin, Heidelberg (2008)

    work page 2008

  5. [2]

    Chakraborty, J., Majumder, S., Menzies, T.: Bias in machine learning software: Why? how? what to do? In: Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. pp. 429–440. ESEC/FSE 2021 (2021).https://doi.org/10. 1145/3468264.3468537,https://doi.org/10.1145/3468264.3...

    arXiv 2021

  6. [3]

    Chawla, N.V., Bowyer, K.W., Hall, L.O., Kegelmeyer, W.P.: Smote: Synthetic minority over-sampling technique. J. Artif. Int. Res.16(1), 321–357 (jun 2002)

    work page 2002

  7. [4]

    In: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security

    Chen, D., Yu, N., Zhang, Y., Fritz, M.: Gan-leaks: A taxonomy of membership infer- ence attacks against generative models. In: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. pp. 343–362. CCS ’20, Association for Computing Machinery, New York, NY, USA (2020).https://doi. org/10.1145/3372297.3417238,https://doi.org/10...

    arXiv 2020

  8. [5]

    https: //desfontain.es/privacy/real-world-differential-privacy.html (10 2021), ted is writing things (personal blog)

    Desfontaines, D.: A list of real-world uses of differential privacy. https: //desfontain.es/privacy/real-world-differential-privacy.html (10 2021), ted is writing things (personal blog)

    work page 2021

Show all 47 references
  1. [6]

    Developers, T.I.L.: Smotenc (2024), https://imbalanced-learn.org/stable/ references/generated/imblearn.over_sampling.SMOTENC.html

    2024

  2. [7]

    In: Proceedings of the 33rd International Conference on Automata, Languages and Programming - Volume Part II

    Dwork, C.: Differential privacy. In: Proceedings of the 33rd International Conference on Automata, Languages and Programming - Volume Part II. pp. 1–12. ICALP’06, Springer-Verlag, Berlin, Heidelberg (2006).https://doi.org/10.1007/11787006_ 1,https://doi.org/10.1007/11787006_1

    2006 doi

  3. [9]

    Ma- chine Learning (2023)

    Elreedy, D., Atiya, A.F., Kamalov, F.: A theoretical distribution analysis of syn- thetic minority oversampling technique (smote) for imbalanced learning. Ma- chine Learning (2023). https://doi.org/10.1007/s10994-022-06296-4, https: //doi.org/10.1007/s10994-022-06296-4

    2023 doi

  4. [10]

    England, N.: A and e synthetic data,https://data.england.nhs.uk/dataset/ a-e-synthetic-data

  5. [11]

    In: International Conference on Data Engineering

    Gehrke, J., Kifer, D., Machanavajjhala, A., Abowd, J., Vilhuber, L.: Privacy: Theory meets practice on the map. In: International Conference on Data Engineering. p. 10. Cornell University Comuputer Science Department, Cornell, USA (April 2008), http://www.truststc.org/pubs/463.html

  6. [12]

    In: Su, C., Sakurai, K

    Ghatak, D., Sakurai, K.: A survey on privacy preserving synthetic data generation and discussion on privacy-utility trade-off problem. In: Su, C., Sakurai, K. (eds.) Science of Cyber Security - SciSec 2022 Workshops. pp. 167–180. Springer Nature Singapore, Singapore (2022)

    2022

  7. [13]

    ACM (2019)

    Gonzlez Zelaya, C.V., Missier, P., Prangle, D.: Parametrised Data Sampling for FairnessOptimisation.In:ProceedingsofExplainableAIforFairness,Accountability & Transparency Workshop (KDD XAI). ACM (2019)

    2019

  8. [14]

    Journal of Privacy and Confidentiality4(2) (Mar 2013)

    Hall, R., Wasserman, L., Rinaldo, A.: Random differential privacy. Journal of Privacy and Confidentiality4(2) (Mar 2013). https://doi.org/10.29012/ jpc.v4i2.621, https://journalprivacyconfidentiality.org/index.php/jpc/ article/view/621

    2013

  9. [15]

    UCI Machine Learning Repository (1994), DOI: https://doi.org/10.24432/C5NC77

    Hofmann, H.: Statlog (German Credit Data). UCI Machine Learning Repository (1994), DOI: https://doi.org/10.24432/C5NC77

    1994 doi

  10. [16]

    Kaggle: Datasets,https://www.kaggle.com/datasets

  11. [17]

    Lavalle, A., Maté, A., Trujillo, J., García Carrasco, J., et al.: A methodology based on rebalancing techniques to measure and improve fairness in artificial intelligence algorithms (2022)

    2022

  12. [19]

    ACM Trans

    Machanavajjhala, A., Kifer, D., Gehrke, J., Venkitasubramaniam, M.: L-diversity: Privacy beyond k-anonymity. ACM Trans. Knowl. Discov. Data1(1), 3–es (mar 2007). https://doi.org/10.1145/1217299.1217302, https://doi.org/10.1145/ 1217299.1217302

    2007

  13. [20]

    IEEE Internet of Things Journal7(7), 5827–5842 (2020).https://doi.org/10.1109/JIOT.2019.2952146

    Mahawaga Arachchige, P.C., Bertok, P., Khalil, I., Liu, D., Camtepe, S., Atiquz- zaman, M.: Local differential privacy for deep learning. IEEE Internet of Things Journal7(7), 5827–5842 (2020).https://doi.org/10.1109/JIOT.2019.2952146

    2020

  14. [21]

    In: IEEE 30th Computer Security Founda- tions Symposium (CSF)

    Mironov, I.: Rényi differential privacy. In: IEEE 30th Computer Security Founda- tions Symposium (CSF). pp. 263–275. IEEE (2017)

    2017

  15. [22]

    In: Pri- vacy in Statistical Databases: UNESCO Chair in Data Privacy, International Conference, PSD 2020, Tarragona, Spain, September 23-25, 2020, Proceedings

    Muralidhar, K., Domingo-Ferrer, J., Martínez, S.: epsilon-differential privacy for microdata releases does not guarantee confidentiality (let alone utility). In: Pri- vacy in Statistical Databases: UNESCO Chair in Data Privacy, International Conference, PSD 2020, Tarragona, Sp...

    2020 doi

  16. [23]

    Narayanan, A., Shi, E., Rubinstein, B.: Link prediction by de-anonymization: How we won the kaggle social network challenge. pp. 1825–1834. Proceedings of the International Joint Conference on Neural Networks (Oct 2011). https: //doi.org/10.1109/IJCNN.2011.6033446, 2011 Intern...

    2011

  17. [24]

    In: 2008 IEEE Symposium on Security and Privacy (sp 2008)

    Narayanan, A., Shmatikov, V.: Robust de-anonymization of large sparse datasets. In: 2008 IEEE Symposium on Security and Privacy (sp 2008). pp. 111–125 (2008). https://doi.org/10.1109/SP.2008.33

    2008 doi

  18. [25]

    In: 2009 30th IEEE Symposium on Security and Privacy

    Narayanan, A., Shmatikov, V.: De-anonymizing social networks. In: 2009 30th IEEE Symposium on Security and Privacy. pp. 173–187 (2009).https://doi.org/ 10.1109/SP.2009.22

    2009 doi

  19. [26]

    https://www.nist.gov/blogs/cybersecurity-insights/ differential-privacy-future-work-open-challenges (1 2022), cybersecu- rity Insights: a NIST blog

    Near, J., Darais, D.: Differential privacy: Future work & open challenges. https://www.nist.gov/blogs/cybersecurity-insights/ differential-privacy-future-work-open-challenges (1 2022), cybersecu- rity Insights: a NIST blog

    2022

  20. [27]

    NIST: Hlg-mos synthetic data challenge submissions (2022), https: //media.githubusercontent.com/media/usnistgov/HLG-MOS_Synthetic_Data_ Test_Drive/nist-pages/submissions/cra/cra_report.pdf

    2022

  21. [28]

    In: Proceedings of the 29th International Conference on Scientific and Statistical Database Management

    Ping, H., Stoyanovich, J., Howe, B.: Datasynthesizer: Privacy-preserving synthetic datasets. In: Proceedings of the 29th International Conference on Scientific and Statistical Database Management. SSDBM ’17, Association for Computing Machin- ery, New York, NY, USA (2017).https...

    2017

  22. [29]

    In: Bazzan, A.L.C., Labidi, S

    Prati, R.C., Batista, G.E.A.P.A., Monard, M.C.: Learning with class skews and small disjuncts. In: Bazzan, A.L.C., Labidi, S. (eds.) Advances in Artificial Intelligence – SBIA 2004. pp. 296–306. Springer Berlin Heidelberg, Berlin, Heidelberg (2004)

    2004

  23. [30]

    In: 25th Annual Network and Distributed System Security Symposium, NDSS 2018

    Pyrgelis, A., Troncoso, C., Cristofaro, E.D.: Knock knock, who’s there? membership inference on aggregate location data. In: 25th Annual Network and Distributed System Security Symposium, NDSS 2018. The Internet So- ciety (2018), https://www.ndss-symposium.org/wp-content/uploa...

    2018

  24. [31]

    Journal of official Statistics9(2), 461–468 (1993)

    Rubin, D.B.: Statistical disclosure limitation. Journal of official Statistics9(2), 461–468 (1993)

    1993

  25. [32]

    In: Proceedings of the 26th Annual Network and Distributed System Security Symposium (NDSS) (2019)

    Salem, A., Zhang, Y., Humbert, M., Berrang, P., Fritz, M., Backes, M.: Ml-leaks: Model and data independent membership inference attacks and defenses on machine 16 Yan Zhou, Bradley Malin, and Murat Kantarcioglu learning models. In: Proceedings of the 26th Annual Network and D...

    2019

  26. [33]

    Seeman, J., Susser, D.: Between privacy and utility: On differential privacy in theory and practice. ACM J. Responsib. Comput. (oct 2023).https://doi.org/ 10.1145/3626494,https://doi.org/10.1145/3626494, just Accepted

    2023 doi

  27. [34]

    In: 2017 IEEE Symposium on Security and Privacy (SP)

    Shokri, R., Stronati, M., Song, C., Shmatikov, V.: Membership inference attacks against machine learning models. In: 2017 IEEE Symposium on Security and Privacy (SP). pp. 3–18 (2017).https://doi.org/10.1109/SP.2017.41

    2017 doi

  28. [35]

    CoRR abs/2011.07018(2020),https://arxiv.org/abs/2011.07018

    Stadler, T., Oprisanu, B., Troncoso, C.: Synthetic data - A privacy mirage. CoRR abs/2011.07018(2020),https://arxiv.org/abs/2011.07018

    2020 arXiv

  29. [37]

    Texas Department of State Health Services, Austin, T.: Texas hospital inpatient discharge public use data file 2013 q1-q4,https://www.dshs.texas.gov/THCIC/ Hospitals/Download.shtm

    2013

  30. [38]

    Sweeney, L.: K-anonymity: A model for protecting privacy. Int. J. Uncertain. Fuzziness Knowl.-Based Syst.10(5), 557–570 (oct 2002). https://doi.org/10. 1142/S0218488502001648,https://doi.org/10.1142/S0218488502001648

    2002 doi

  31. [39]

    Winograd-Cort, D., Haeberlen, A., Roth, A., Pierce, B.C.: A framework for adaptive differential privacy. Proc. ACM Program. Lang.1(ICFP) (aug 2017).https://doi. org/10.1145/3110254,https://doi.org/10.1145/3110254

    2017 doi

  32. [40]

    Curran Associates Inc., Red Hook, NY, USA (2019)

    Xu, L., Skoularidou, M., Cuesta-Infante, A., Veeramachaneni, K.: Modeling Tabular Data Using Conditional GAN. Curran Associates Inc., Red Hook, NY, USA (2019)

    2019

  33. [41]

    In: Proceedings of the 29th ACM International Conference on Information and Knowledge Management

    Yan, S., Kao, H.t., Ferrara, E.: Fair class balancing: Enhancing model fairness with- out observing sensitive attributes. In: Proceedings of the 29th ACM International Conference on Information and Knowledge Management. pp. 1715–1724. CIKM ’20 (2020). https://doi.org/10.1145/3...

    2020

  34. [42]

    In: 2018 IEEE 31st Computer Security Foundations Symposium (CSF)

    Yeom, S., Giacomelli, I., Fredrikson, M., Jha, S.: Privacy risk in machine learning: Analyzing the connection to overfitting. In: 2018 IEEE 31st Computer Security Foundations Symposium (CSF). pp. 268–282 (2018).https://doi.org/10.1109/ CSF.2018.00027

    2018

  35. [43]

    Yeom, S., Giacomelli, I., Menaged, A., Fredrikson, M., Jha, S.: Overfitting, robustness, and malicious algorithms: A study of potential causes of privacy risk in machine learning. J. Comput. Secur.28(1), 35–70 (jan 2020). https: //doi.org/10.3233/JCS-191362,https://doi.org/10....

    2020 doi

  36. [44]

    In: International Conference on Learning Representations (2019),https://openreview.net/forum?id=S1zk9iRqF7

    Yoon, J., Jordon, J., van der Schaar, M.: PATE-GAN: Generating synthetic data with differential privacy guarantees. In: International Conference on Learning Representations (2019),https://openreview.net/forum?id=S1zk9iRqF7

    2019

  37. [45]

    ACM Trans

    Zhang, J., Cormode, G., Procopiuc, C.M., Srivastava, D., Xiao, X.: Privbayes: Private data release via bayesian networks. ACM Trans. Database Syst.42(4) (oct 2017).https://doi.org/10.1145/3134428,https://doi.org/10.1145/3134428

    2017 doi

  38. [46]

    874–882 (2023).https: //doi.org/10.1137/1.9781611977653.ch98, https://epubs.siam.org/doi/abs/ 10.1137/1.9781611977653.ch98

    Zhou, Y., Kantarcioglu, M., Clifton, C.: On Improving Fairness of AI Models with Synthetic Minority Oversampling Techniques, pp. 874–882 (2023).https: //doi.org/10.1137/1.9781611977653.ch98, https://epubs.siam.org/doi/abs/ 10.1137/1.9781611977653.ch98

    2023 doi

  39. [1468]

    USENIX Association, Boston, MA (Aug 2022),https://www.usenix.org/ conference/usenixsecurity22/presentation/stadler

    2022

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.