REVIEW 4 major objections 5 minor 41 references
Enabling PSO-Secure Synthetic Data Sharing Using Diversity-Aware Diffusion Models
T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash
Pith's one-line read Diversity-aware diffusion plus a re-identification filter makes synthetic chest X-rays both GDPR-safe and within one point of real-data performance.
desk verdict Useful empirical recipe undercut by an unsupported privacy guarantee: the paper equates a re-ID filter with PSO-security, a load-bearing conflation. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing object is the re-identification filter $P$ combined with diversity-aware conditioning. SwAV features serve as pseudo-conditional labels $c_s$ that decouple image quality from sample diversity; the diffusion model is asked to generate images sharing $c_s$ while the filter $P$, trained on subject labels, deletes candidates for which $P(x,x')$ is not zero. A final BCE-based selection step chooses the surviving candidate whose classifier prediction best matches the real image, preserving task-relevant predicates. The paper's equation (1) packages this as $x' = \arg\min_{x'\in D^-_x} \mathrm{BCE}(C_r(x), C_r(x'))$ over the filtered set, and the authors read $P(x,x')=0$ as the operational translation of legal non-singling-out.
What would settle it
Release the generated datasets and run an adversarial predicate search: if any synthetic image that the filter accepts ($P=0$) can be matched to exactly one real patient using a predicate combination absent from the filter's training labels, the PSO-security claim is false.
Extended reading notes
Core claim
The authors claim that a PSO-secure synthetic dataset, one where no combination of observable predicates lets an attacker single out a real patient, can be generated by conditioning a DiADM-style diffusion model on pseudo-labels extracted by a SwAV feature encoder and then filtering candidates through a re-identification model. They formalize the filter as $P(x,x')=0$, meaning knowing the predicate features of a real image $x$ does not imply knowledge of the identity behind a synthetic image $x'$. The selected synthetic image is the one minimizing the binary cross-entropy between a real-data classifier's prediction on $x$ and on the candidate. Empirically, models trained only on these synthetic sets reach 84.04 AUCROC against 84.99 for real data, and datasets combined across NIH, CXR, and CXP generalize better than models trained on a single real dataset.
Load-bearing premise
The whole privacy claim rests on the re-identification filter catching every image that could single out a real person; the paper itself concedes the results depend heavily on this filter.
Editorial extensions
If this is right
- If the central claim holds, hospitals can share synthetic versions of chest X-ray datasets across institutions without entering GDPR personal-data territory, since the data are treated as non-personal.
- Models trained on synthetic data from this pipeline stay within about one AUCROC point of real-data models, making synthetic-only training a realistic option for in-domain classification.
- The IRS value above one indicates the conditioning scheme produces more diversity than an ideal unconditional sampler, so diversity and fidelity are not in conflict here.
- Because the method outperforms the EDM-2, EDM-2-AG, and DiADM baselines on FID, IRS, and downstream AUCROC, the same framework is offered as a generalisable template for other personal-data domains beyond chest X-rays.
Reading between the lines
- The paper's privacy guarantee is only as strong as the re-identification filter's coverage; I would not infer GDPR anonymity beyond the specific predicates and subject labels that filter was trained on.
- A natural stress test the authors did not run is an adversarial predicate search: enumerate rare attribute combinations in the real dataset and check whether any synthetic candidate realizes a unique combination despite passing $P=0$.
- The same diversity-as-privacy mechanism could be ported to non-image personal data such as tabular or time-series records by replacing pixel predicates with feature vectors, but the legal equivalence would need to be re-validated for each modality.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The manuscript proposes a framework for generating synthetic chest X-ray datasets using a diffusion model conditioned on SwAV pseudo-conditional features, followed by a re-identification filter that removes samples deemed too similar to real training images. The authors claim that the resulting datasets are PSO-secure under the GDPR and that downstream models trained on them reach within one percentage point of real-data AUCROC (Table 1, gap -0.95). Experiments are reported on MIMIC-CXR, CheXpert, and ChestXray8 with FID, IRS, and AUCROC metrics, and the authors include a data-sharing experiment in Table 2.
Significance. If the privacy claim were substantiated, the paper would be significant: it offers a concrete pipeline for sharing medical synthetic data while claiming a formal legal privacy guarantee, and it releases code and uses public benchmarks. The diversity-oriented generation results are also interesting, as the SwAV conditioning achieves FID 5.0 and IRS 1.58, outperforming the compared baselines. However, the central PSO-security claim is not established: the formal argument equates a learned re-identification classifier with the Cohen-Nissim predicate singling-out property, and the paper's own Limitations section concedes that the results depend on the privacy filter. The headline performance claim is based on a single generated dataset without error bars or repeated sampling. The significance is therefore conditional on a substantially revised privacy analysis.
major comments (4)
- [Section 3, Eq. (1)] The only formal link between the method and PSO-security is invalid. Equation (1) defines the accepted synthetic sample as the one minimizing BCE(Cr(x), Cr(x')) among candidates with P(x,x')=0, and the text states that P(x,x')=0 'ensures that knowing predicates cs does not imply knowledge of the identity.' However, P is a pairwise re-identification model trained on subject labels (Section 2, refs. [10,33]); it does not implement or approximate the Cohen-Nissim notion of predicate singling out, which is a dataset-level property about whether a set of predicates uniquely identifies a record. A synthetic image can be pairwise dissimilar from its source image (so P=0) and still be unique with respect to a combination of attributes such as sex, age, disease labels, or support devices. The paper never evaluates the released dataset against a singling-out attack, and the Limitations section explicitly states that the results 'highly depend on the privacy filters' and only claims 'generalization according to a privacy filter.' The central claim that the datasets are PSO-secure and 'unpersonal' under the GDPR is therefore unsupported.
- [Section 4, Tab. 1 and Fig. 3] The headline performance claim of 'within one percentage point of real-data models' rests on a single generated dataset per method: the text states that 'each generative model samples one synthetic dataset, D′, which is then split according to the ten-fold cross-validation.' Table 1 reports one FID, one IRS, and one AUCROC gap value with no error bars, confidence intervals, or repeated sampling trials, so the -0.95 gap is not statistically characterized. The ten-fold cross-validation in Fig. 3 splits this one sample, and the paper explicitly notes that subject overlap is ignored, a choice that affects the real-data baseline. Thus the abstract's quantitative claim is not supported as reported.
- [Section 4, privacy evaluation] The paper's only privacy-related quantitative result is the re-identification filter's own 'combined test performance of 96% AUCROC on re-identification.' This measures how well P detects whether two images come from the same subject; it is not a measure of predicate singling-out. Because the claimed privacy guarantee is defined as the output of this same filter, the evaluation is circular: a dataset is declared PSO-secure if P does not flag it, and P's accuracy is then presented as evidence of PSO-security. No membership-inference or singling-out attack is applied to the released synthetic dataset, and no adversarial predicate set is considered.
- [Section 1 and Table 2] The contribution statement says that 'models trained exclusively on our synthetic data generalize better than those trained on real data alone,' but Table 2 shows the opposite in all nine training/test settings: for training on NIH, Real vs. Ours is 85.41 vs. 83.65 on NIH, 81.78 vs. 79.60 on CXR, and 79.62 vs. 76.16 on CXP, with the same pattern for training on CXR and CXP. The text later concedes that 'the model is still not on par with real data.' This internal contradiction should be resolved.
minor comments (5)
- [Throughout] There are several typos: 'largley' in the Abstract, 'illustraction' in the Fig. 2 caption, 'instituations' in Section 3, 'mimicing' in Section 4, and 'Suprisingly' in Section 4; these should be corrected.
- [Table 2] The baseline 'Rec. (SDv2)' is not defined in the text, and the header 'PSO-s.' is unexplained; the reader cannot tell what is being compared.
- [Section 3, Eq. (1)] The set D^-_x is not formally defined, and it is unclear whether BCE is computed on predicted class probabilities, logits, or binary disease labels; please clarify the notation.
- [Section 2 and 4] The re-identification model P is central to the privacy argument, but its architecture, training data, and operating point are not described; at minimum, the false-negative rate on a held-out re-identification task should be reported.
- [Section 1] The paper cites Cohen et al. [6] for PSO-security but does not reproduce or state their formal definition; adding the definition would help readers judge what is being claimed.
Circularity Check
The central PSO-security claim is definitional: the paper equates its re-identification filter's output with the absence of predicate singling out, and the Limitations concede that the guarantee depends entirely on that filter.
-
self definitional
[Section 3, Eq. (1); Limitations]
"x′ = arg min x′∈D− x BCE(Cr(x), Cr(x′)) for D− x := {x′|P(x, x′) = 0} (1) where P(x, x′) = 0 ensures that knowing predicates cs does not imply knowledge of the identity. ... Additionally, the results highly depend on the privacy filters. Nevertheless, we have successfully shown that our filtering approach can generate images that are sufficiently different to achieve generalization according to a privacy filter."
The only formal link between the concrete computation and PSO-security is the assertion that P(x,x')=0 guarantees that knowing predicates does not imply knowledge of identity. P is a pairwise re-identification classifier trained on subject labels, not an implementation of the Cohen–Nissim predicate-singling-out property, which is a dataset-level condition over arbitrary predicate combinations. The paper's own Limitations concede that 'the results highly depend on the privacy filters.' Thus the GDPR/PSO claim is defined by the filter's own output: a synthetic image is declared PSO-secure because the filter accepts it, rather than because the external PSO property has been formalized or verified.
full rationale
The downstream performance claim is benchmarked against held-out real-data AUCROC, so the reported -0.95 gap is an empirical result rather than a purely definitional one, though the selection criterion in Eq. (1) uses the real-data classifier Cr and may inflate the apparent improvement. The central novel claim, however, is PSO-security under the GDPR. The paper never formalizes the Cohen–Nissim dataset-level property, never evaluates a singling-out attack, and the only formal bridge is the statement that P(x,x')=0 'ensures that knowing predicates cs does not imply knowledge of the identity.' Because P is a learned re-identification model from the authors' prior work rather than a verified instantiation of predicate singling-out security, the privacy guarantee reduces by construction to the filter's own acceptance criterion. The Limitations reinforce this by saying that the results 'highly depend on the privacy filters' and that the approach 'can generate images that are sufficiently different to achieve generalization according to a privacy filter.' This makes the privacy claim definitional: accepted samples are deemed PSO-secure because the filter accepted them. Score 8 reflects that the central result is forced by definition, while the downstream accuracy component retains some independent empirical content.
Assumptions & free parameters
free parameters (4)
- Guidance strength for classifier guidance =
1.2
- Sampling batch size b =
32
- Privacy filter decision threshold =
not specified
- Guidance reduction on resampling =
0.1
assumptions (4)
- domain assumption Cohen and Nissim's PSO-security definition is the correct formalization of the GDPR notion of singling out.
- ad hoc to paper The re-identification model P trained on subject labels is a valid and complete detector of predicate singling-out.
- domain assumption SwAV features are better aligned with the diffusion reconstruction loss than Inception features.
- domain assumption Selecting synthetic images by BCE with Cr's predictions preserves the information needed for downstream classification of the same disease classes.
Cite this review
Pith. "Pith review of Enabling PSO-Secure Synthetic Data Sharing Using Diversity-Aware Diffusion Models." pith.science (2026). https://pith.science/paper/YMBUBK4I
@misc{pith2026250617975,
author = {Pith},
title = {Pith review of: Enabling PSO-Secure Synthetic Data Sharing Using Diversity-Aware Diffusion Models},
year = {2026},
howpublished = {\url{https://pith.science/paper/YMBUBK4I}},
note = {Machine review of arXiv:2506.17975}
}
read the original abstract
Synthetic data has recently reached a level of visual fidelity that makes it nearly indistinguishable from real data, offering great promise for privacy-preserving data sharing in medical imaging. However, fully synthetic datasets still suffer from significant limitations: First and foremost, the legal aspect of sharing synthetic data is often neglected and data regulations, such as the GDPR, are largley ignored. Secondly, synthetic models fall short of matching the performance of real data, even for in-domain downstream applications. Recent methods for image generation have focused on maximising image diversity instead of fidelity solely to improve the mode coverage and therefore the downstream performance of synthetic data. In this work, we shift perspective and highlight how maximizing diversity can also be interpreted as protecting natural persons from being singled out, which leads to predicate singling-out (PSO) secure synthetic datasets. Specifically, we propose a generalisable framework for training diffusion models on personal data which leads to unpersonal synthetic datasets achieving performance within one percentage point of real-data models while significantly outperforming state-of-the-art methods that do not ensure privacy. Our code is available at https://github.com/MischaD/Trichotomy.
Figures
Figures from the paper (1 more)
Reference graph
Works this paper leans on
-
[1]
org/news_item/when-are-synthetic-health-data-personal-data/
GDPR Brief: when are synthetic health data personal data?, https://www.ga4gh. org/news_item/when-are-synthetic-health-data-personal-data/
-
[2]
Opinion 4/2007 on the concept of personal data https://www.pdp.ie/docs/1030. pdf
work page 2007
-
[3]
Recital 26 - Not Applicable to Anonymous Data, https://gdpr-info.eu/recitals/ no-26/
-
[4]
Caron, M., Misra, I., Mairal, J., Goyal, P., Bojanowski, P., Joulin, A.: Unsuper- visedLearningofVisual FeaturesbyContrastingClusterAssignments.In: NeurIPS (2020)
work page 2020
-
[5]
Chebykin, A., Bosman, P.A.N., Alderliesten, T.: Hyperparameter-Free Medical Im- age Synthesis for Sharing Data and Improving Site-Specific Segmentation (2024)
work page 2024
-
[6]
Towards Formalizing the GDPR's Notion of Singling Out
Cohen, A., Nissim, K.: Towards Formalizing the GDPR’s Notion of Singling Out. Proceedings of the National Academy of Sciences 117(15), 8344–8352 (Apr 2020). https://doi.org/10.1073/pnas.1914598117, http://arxiv.org/abs/1904. 06009, arXiv:1904.06009 [cs]
work page Pith review arXiv 2020
-
[7]
Deshpande, T., Prakash, E., Ross, E.G., Langlotz, C., Ng, A., Valanarasu, J.M.J.: Auto-Generating Weak Labels for Real & Synthetic Data to Improve Label-Scarce Medical Image Segmentation (2024)
work page 2024
-
[8]
In: Medical Imaging with Deep Learning (2025)
Dombrowski, M., Kainz, B.: Can diffusion models generalize? privacy and fairness trade-offs for medical data sharing. In: Medical Imaging with Deep Learning (2025)
work page 2025
Show all 41 references
-
[9]
In: ICCV 2023
Dombrowski,M.,Reynaud,H.,Baugh,M.,Kainz,B.:Foreground-BackgroundSep- aration through Concept Distillation from Generative Image Foundation Models. In: ICCV 2023
2023
-
[10]
Dombrowski, M., Reynaud, H., Kainz, B.: Uncovering Hidden Subspaces in Video Diffusion Models Using Re-Identification (Nov 2024), arXiv:2411.04956
2024 arXiv
-
[11]
In: CVPR
Dombrowski, M., Zhang, W., Cechnicka, S., Reynaud, H., Kainz, B.: Image gener- ation diversity issues and how to tame them. In: CVPR. pp. 3029–3039 (2025)
2025
-
[12]
Elbatel, M., Kamnitsas, K., Li, X.: An Organism Starts with a Single Pix-Cell: A Neural Cellular Diffusion for High-Resolution Image Synthesis (Jul 2024), arXiv:2407.03018 [cs]
2024 arXiv
-
[13]
Frisch, Y.e.a.: Synthesising Rare Cataract Surgery Samples with Guided Diffusion Models (Aug 2023), arXiv:2308.02587 [eess]
2023 arXiv
-
[14]
Han, K., Xiong, Y., You, C., Khosravi, P., Sun, S., Yan, X., Duncan, J., Xie, X.: MedGen3D: A Deep Generative Framework for Paired 3D Image and Mask Generation (Jul 2023), arXiv:2304.04106 [eess]
2023 arXiv
-
[15]
NeurIPS33, 6840–6851 (2020)
Ho, J., Jain, A., Abbeel, P.: Denoising diffusion probabilistic models. NeurIPS33, 6840–6851 (2020)
2020
-
[16]
Ho, J., Salimans, T.: Classifier-Free Diffusion Guidance (2022), arXiv:2207.12598
2022 arXiv
-
[17]
In: MICCAI 2023, vol
Hou, Z., Yan, R., Wang, Q., Lang, N., Zhou, X.: Diversity-Preserving Chest Ra- diographs Generation from Reports in One Stage. In: MICCAI 2023, vol. 14224, pp. 482–492. Springer Nature Switzerland, Cham (2023)
2023
-
[18]
Huang, G., Liu, Z., Maaten, L.v.d., Weinberger, K.Q.: Densely Connected Convo- lutional Networks (Jan 2018)
2018
-
[19]
Huang, K., Ma, X., Zhang, Y., Su, N., Yuan, S., Liu, Y., Chen, Q., Fu, H.: Memory- efficient High-resolution OCT Volume Synthesis with Cascaded Amortized Latent Diffusion Models (May 2024), arXiv:2405.16516 [eess]
2024 arXiv
-
[20]
Irvin, J.e.a.: CheXpert: A Large Chest Radiograph Dataset with Uncertainty La- bels and Expert Comparison (2019) 10 Dombrowski and Kainz
2019
-
[21]
Data Mining and Knowledge Discovery 33(4), 917–963 (2019)
Ismail Fawaz, H., Forestier, G., Weber, J., Idoumghar, L., Muller, P.A.: Deep learn- ing for time series classification: a review. Data Mining and Knowledge Discovery 33(4), 917–963 (2019)
2019
-
[22]
Scientific Data (2019)
Johnson, A.E.W., Pollard, T.J., Berkowitz, S.J., Greenbaum, N.R., Lungren, M.P., Deng, C.y., Mark, R.G., Horng, S.: MIMIC-CXR, a de-identified publicly available database of chest radiographs with free-text reports. Scientific Data (2019)
2019
-
[23]
Karras, T., Aittala, M., Aila, T., Laine, S.: Elucidating the Design Space of Diffusion-Based Generative Models (Oct 2022), arXiv:2206.00364 [cs]
2022 arXiv
-
[24]
Karras,T.,Aittala,M.,Kynkäänniemi,T.,Lehtinen,J.,Aila,T.,Laine,S.:Guiding a Diffusion Model with a Bad Version of Itself (Jun 2024)
2024
-
[25]
Karras, T., Aittala, M., Lehtinen, J., Hellsten, J., Aila, T., Laine, S.: Analyzing and Improving the Training Dynamics of Diffusion Models (Mar 2024)
2024
-
[26]
Kumar, A., Bhunia, A.k., Narayan, S., Cholakkal, H., Anwer, R.M., Laaksonen, J., Khan, F.S.: Cross-modulated Few-shot Image Generation for Colorectal Tissue Classification (Jul 2023)
2023
-
[27]
In:MICCAI2024,vol.15011.Cham(2024)
Liu, Z., Zhang, T., He, Y., Zhang, G.: Generating Progressive Images from Patho- logicalTransitions ViaDiffusionModel. In:MICCAI2024,vol.15011.Cham(2024)
2024
-
[28]
Na, I., Kim, J., Ko, E.S., Park, H.: RadiomicsFill-Mammo: Synthetic Mammogram Mass Manipulation with Radiomics Features (2024)
2024
-
[29]
Oh, H.J., Jeong, W.K.: Controllable and Efficient Multi-Class Pathology Nuclei Data Augmentation using Text-Conditioned Diffusion Models (2024)
2024
-
[30]
Scientific Reports12(1) (2022)
Packhäuser, K., Gündel, S., Münster, N., Syben, C., Christlein, V., Maier, A.: Deep learning-based patient re-identification is able to exploit the biometric nature of medical chest X-ray data. Scientific Reports12(1) (2022)
2022
-
[31]
In: MICCAI 2024, vol
Peng, Q., Lin, W., Hu, Y., Bao, A., Lian, C., Wei, W., Yue, M., Liu, J., Yu, L., Wang, L.: Advancing H&E-to-IHC Virtual Staining with Task-Specific Domain Knowledge for HER2 Scoring. In: MICCAI 2024, vol. 15004. Cham (2024)
2024
-
[32]
Rajpurkar, P., Irvin, J., Zhu, K., Yang, B., Mehta, H., Duan, T., Ding, D., Bagul, A., Langlotz, C., Shpanskaya, K., Lungren, M.P., Ng, A.Y.: CheXNet: Radiologist- Level Pneumonia Detection on Chest X-Rays with Deep Learning (2017)
2017
-
[33]
Reynaud, H., Meng, Q., Dombrowski, M., Ghosh, A., Day, T., Gomez, A., Leeson, P., Kainz, B.: EchoNet-Synthetic: Privacy-preserving Video Generation for Safe Medical Data Sharing (2024)
2024
-
[34]
Reynaud, H., Qiao, M., Dombrowski, M., Day, T., Razavi, R., Gomez, A., Leeson, P., Kainz, B.: Feature-Conditioned Cascaded Video Diffusion Models for Precise Echocardiogram Synthesis. vol. 14229 (2023)
2023
-
[35]
Rombach, R., Blattmann, A., Lorenz, D., Esser, P., Ommer, B.: High-Resolution Image Synthesis with Latent Diffusion Models (Apr 2022), arXiv:2112.10752 [cs]
2022 arXiv
-
[36]
Shen, Z., Cao, M., Wang, S., Zhang, L., Wang, Q.: CellGAN: Conditional Cervical Cell Synthesis for Augmenting Cytopathological Image Classification (Jul 2023)
2023
-
[37]
In: MICCAI 2024
Wang, F., Ren, Z., Lian, C., Ma, J.: Controllable Counterfactual Generation for Interpretable Medical Image Classification. In: MICCAI 2024. Cham (2024)
2024
-
[38]
Wang, X., Peng, Y., Lu, L., Lu, Z., Bagheri, M., Summers, R.M.: ChestX-ray8: Hospital-Scale Chest X-Ray Database and Benchmarks on Weakly-Supervised Classification and Localization of Common Thorax Diseases (2017)
2017
-
[39]
Ye, J., Ni, H., Jin, P., Huang, S.X., Xue, Y.: Synthetic Augmentation with Large- scale Unconditional Pre-training (Aug 2023), arXiv:2308.04020 [cs]
2023 arXiv
-
[40]
In: MICCAI 2024, vol
Yuan, Z.e.a.: Adapting Pre-trained Generative Model to Medical Image for Data Augmentation. In: MICCAI 2024, vol. 15005. Cham (2024)
2024
-
[41]
In: MICCAI 2023, vol
Zhao, Z.e.a.: Label-Preserving Data Augmentation in Latent Space for Diabetic Retinopathy Recognition. In: MICCAI 2023, vol. 14222
2023
Reviewed August 6, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.