Pith. sign in

REVIEW 4 major objections 6 minor 25 references

SecretFan: Synthesizing Realistic Data without Breaking Privacy

T0 review · 4 major / 6 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Synthetic tabular data can be produced by an evolutionary fuzzer guided by a discriminator trained on private data, yielding useful data without copying any original row.

desk verdict Interesting GAN-inspired fuzzing loop, but the 'no data flow' privacy claim is contradicted by the method's own design; as a privacy paper it needs a real privacy analysis. read the letter →

arxiv 2602.05833 v2 pith:VZKCA3VL submitted 2026-02-05 cs.LG

Laura Plein , Alexi Turcotte , Arina Hallemans , Andreas Zeller This is my paper
classification cs.LG
keywords syntheticdatatabularprivacyfuzzinggenerativeadversarialnetworksmachinelearningutilitymembershipinferenceevolutionaryalgorithms
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper attempts to establish that synthetic tabular data with good utility can be generated without a generative model that ever sees the original private data. It replaces the neural generator of a GAN with an evolutionary, grammar-guided fuzzer, and uses a classifier trained to separate original rows from generated rows as the discriminator. Rows that fool the classifier are fed back as the starting population for the next round, so the fuzzer evolves toward the original distribution without direct access to it. The authors claim this design gives privacy by construction, and their preliminary experiments on four datasets show models trained on synthetic rows perform close to models trained on original rows, with no generated row equal to an original row. If the claim holds, the approach offers a transparent, low-resource route to privacy-preserving synthetic data.

What carries the argument

The load-bearing mechanism is the discriminator-as-constraint loop. An evolutionary fuzzer for grammar-described inputs generates and mutates rows; a decision-tree classifier trained on original-plus-generated data serves as the constraint that 'good' rows must satisfy by being labelled original. Good rows are injected as the initial population for the next fuzzer round, and periodic retraining of the discriminator on the growing set of good rows raises the bar each iteration. This replaces backpropagation with evolutionary search and makes the generative step transparent and inspectable.

What would settle it

Measure the distance from every generated row to its nearest original row and run a membership-inference attack against the synthetic set: if an attacker can reliably tell which original rows are near a generated row, the no-data-flow claim fails even though no row is a duplicate.

Watch

Extended reading notes

Core claim

The paper's central claim is that replacing the learned generator with a search-based fuzzer removes the privacy bottleneck of GAN-style synthesis. A decision-tree classifier trained on original and generated data acts as a fitness function: its 'original' label marks a row as good, and good rows seed the next generation. When the classifier becomes unable to distinguish the two classes, it is retrained on the accumulated good rows, forcing the search to keep moving closer to the target distribution. The authors assert that this loop has no data flow from the original data into the synthesized data because the fuzzer only ever receives the grammar and labels, not the private rows. Their evid

Load-bearing premise

The privacy guarantee depends on the premise that a classifier trained on the original data can guide a fuzzer without passing person-specific details into the generated rows—and the paper only verifies that no generated row is an exact copy, which by itself does not rule out subtler leakage.

Editorial extensions

If this is right

  • Synthetic rows can be generated with a few thousand fuzzer iterations (849 for the largest dataset, 60 for the smallest), taking 3–4.5% of the dataset size in iterations.
  • Models trained on generated rows and tested on original rows reach accuracy within a few points of original-only training on adult, credit, and bank; on insurance, the synthetic-trained regressor can even outperform the original-trained one.
  • The discriminator's accuracy drops from 96–98% initially to near random guessing after retraining, which is the signal to retrain—so the loop has a natural stopping criterion.
  • Privacy in the paper's sense—no generated row equals an original row—is achieved on all four datasets.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable extension is to make the discriminator differentially private; if it is, the feedback loop may inherit a provable privacy guarantee, turning the asserted 'by construction' statement into a measurable one.
  • The same loop could be pointed at underrepresented slices of the distribution—minority classes or rare feature combinations—by biasing the grammar or the discriminator threshold, which is a known weakness of GAN-based synthesis.
  • The paper's privacy check only rules out exact copies; a nearest-neighbor distance audit (every generated row's distance to its closest original row) would be a stronger, still simple test of whether the loop is leaking person-specific detail.
  • Because the discriminator is a shallow decision tree, the evolution of rows can be traced feature-by-feature, offering a transparency property that neural generators do not have.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper presents SecretFan (also titled 'Synthesizing Realistic Test Data without Breaking Privacy'), a GAN-inspired approach to synthetic tabular data generation in which a grammar-based fuzzer (Fandango) replaces the generator and a decision-tree classifier plays the role of the discriminator. The discriminator is trained on the original private data plus currently generated data; samples it classifies as 'original' are treated as 'good samples' and seeded into Fandango's evolutionary population for the next iteration. The authors claim that because the generator itself is not trained on the original data, 'by construction, this ensures there is no data flow from the original data to the synthesized data' (§6), and they evaluate utility and resemblance on four datasets (adult, bank, credit, insurance), measuring utility by training models on synthetic data and testing on original data, and privacy only by checking that no generated row exactly matches an original row. The results show mixed utility (e.g., credit accuracy drops from 0.930 to 0.743; bank from 0.906 to 0.730) and moderate Wasserstein distances. The paper is explicitly positioned as preliminary, with future work including adding baselines and assessing privacy.

Significance. The core idea of combining a grammar-based fuzzer with a learned discriminator is a fresh and potentially low-cost alternative to GANs for synthetic tabular data. If the privacy claim were valid, this would be a meaningful contribution to both the software testing and synthetic data communities, and the use of an open-source fuzzer and public datasets makes the approach reproducible. However, the paper's central assertion — that the method provides privacy by construction — is unsupported and, in fact, contradicted by the method's own architecture: the discriminator is trained on the private data and its decisions directly steer the generated samples. The utility evidence is also preliminary, with no baselines, error bars, or statistical tests, and the paper itself defers privacy assessment to future work. As a result, the current manuscript does not substantiate its main claims.

major comments (4)
  1. [§6 vs §3.1–§3.2] The assertion 'By construction, this ensures there is no data flow from the original data to the synthesized data' is inconsistent with the method. In §3.1 a decision-tree discriminator is trained on the original private data and the synthetic data; in §3.2 its classifications select the 'good samples' that are returned as the initial population for Fandango. Every retained sample is therefore one that the discriminator — a function of the private data — judged to be original-like, which is a direct information channel from the private data into the generated dataset. The only privacy check in §4.1 is the absence of exact duplicate rows, which does not rule out membership inference, attribute inference, or near-duplicate reconstruction. The paper itself lists 'Assessing privacy' as future work in §6, undermining the headline privacy guarantee.
  2. [§4, Tables 2–4] The RQ2 takeaway that 'it is feasible to generate synthetic datasets as useful as the original dataset' is not supported by the reported numbers. For credit, Random Forest accuracy drops from 0.930 (original) to 0.743 (generated) and to 0.672 for 'Train Generated - Test Original'; for bank, the corresponding numbers are 0.906, 0.730, and 0.789. These are substantial degradations, not small gaps. There are no baselines (no CTGAN, no grammar-only Fandango without the discriminator, no simple random/statistical sampler), no error bars or repeated runs, and no significance tests. Without these, the utility claim cannot be evaluated.
  3. [§4.1, Privacy metric] The privacy evaluation is limited to verifying that no generated sample exactly equals an original row. This is a necessary but not sufficient condition for privacy in tabular data. Standard threats such as membership inference, attribute inference, and identity disclosure are not addressed. Since the title and abstract promise to generate data 'without breaking privacy,' this omission is load-bearing: the evidence provided is compatible with substantial leakage through the discriminator feedback loop.
  4. [§3.2, Definition of 'good samples'] The quality criterion is circular: a sample is 'good' if the discriminator — trained on the original data — classifies it as original. Consequently, 'resemblance to the original' is partly defined by the discriminator's decision boundary rather than by an external standard. The downstream utility evaluation on held-out original data provides some independent grounding, but the reported results are mixed and lack variance estimates, so the circularity is not broken. This should be acknowledged and addressed, for example by reporting performance across multiple discriminator initializations or by using an independent similarity measure.
minor comments (6)
  1. [Abstract vs §4.1] The abstract states that the approach was evaluated on 'eight datasets,' but §4.1 says 'we currently use four datasets' and 'We are aiming for 10 datasets in the final version.' This inconsistency should be corrected in any revision.
  2. [§5.2] The threats-to-validity section says 'one dataset is used for a classification task and three for regression tasks,' but the evaluation actually includes three classification datasets (adult, credit, bank) and one regression dataset (insurance). The description is reversed.
  3. [Figure 3] Panels (c) and (d) are both captioned 'Insurance Dataset.' One of them is presumably another dataset (likely Bank); please fix the caption.
  4. [§1 and title] The arXiv metadata title is 'SecretFan: Synthesizing Realistic Data without Breaking Privacy,' but the paper header is 'Synthesizing Realistic Test Data without Breaking Privacy.' Please unify the title. Also, the keyword 'Syntactic Data Generation' likely should be 'Synthetic Data Generation.'
  5. [§3.1] The statement 'Fandango never sees the private data' is true only for the initial generation; in later phases Fandango receives samples selected by a discriminator trained on the private data. The phrasing is misleading and should be clarified.
  6. [§4.2] The experimental setup says the maximum number of Fandango iterations was set to dataset size but was never reached. Reporting the actual number of iterations and the final discriminator accuracy for each dataset would help reproducibility.

Circularity Check

2 steps flagged · score 6.0 of 10

The 'no data flow' guarantee is contradicted by the discriminator-in-the-loop, and 'good samples' are definitionally whatever the private-data-trained discriminator accepts.

  1. self definitional [§3.2 'Synthesizing Good Samples (Phase 2)' and Fig. 2; §3.1 'Train Classifier on Private Data']
    "Fandango will generate samples and query the discriminator to see if the generated samples are classified as original. Every sample that fools the discriminator in this way is considered a 'good sample'"

    The discriminator is trained on the original private data (§3.1: 'We also train a discriminator on the initial synthetic data and original private data'). Thus 'good sample' is defined as 'sample that the private-data-trained discriminator labels original'. Any statement that the retained synthetic data is close to the original is then true by construction: closeness is the discriminator's acceptance criterion, not an independent finding. The paper's similarity/privacy evidence (no exact duplicates) does not break this loop; it only checks a weaker condition than the 'no data flow' claim.

  2. other [§6 Conclusion and Future Work, first paragraph]
    "By construction, this ensures there is no data flow from the original data to the synthesized data. The amount of information flow from the original data can be controlled through the strictness of the discriminator"

    The construction described in §3.1–3.2 includes a discriminator trained on the original data whose predictions select which Fandango samples survive as 'good samples' and are fed back as the initial population. So the conclusion 'no data flow' is not derived from the construction; it is contradicted by it. The very next sentence concedes 'amount of information flow', revealing that the guarantee is an unsupported assertion rather than a consequence of the method. This is the paper's load-bearing privacy claim, and it reduces to a definitional dodge: ignoring the discriminator channel while calling the loop 'indirect'.

full rationale

The paper's central privacy claim ('By construction, this ensures there is no data flow', §6) is not supported by its own design. In §3.1 a decision-tree discriminator is trained on the original private data; in §3.2 its classifications define 'good samples', which are fed back into Fandango's initial population. Every retained row is therefore the output of a selection function that depends on the private data. Calling this 'no data flow' is a definitional assertion, not a derived result. The utility evaluation (RQ2) is partly independent: models trained on generated data are tested on held-out original data, so utility is not purely circular. However, the resemblance/'good sample' notion is circular by construction, and the privacy check (absence of exact duplicate rows) is too weak to substantiate the no-flow guarantee. The paper itself defers 'assessing privacy' to future work (§6), confirming that the privacy claim is not established. Self-citations to Fandango [23] and language-based testing [19] are tooling and not load-bearing for the privacy claim. Overall, the derivation chain contains a definitional loop at the core of the method's 'good samples', plus a central privacy conclusion that is contradicted rather than implied by the construction; hence score 6.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim depends on several unvalidated assumptions: that a discriminator trained on private data can be used as a fitness signal without leaking information, that exact-duplicate non-membership is an adequate privacy definition, and that grammar-based evolutionary search can cover the original distribution. No new physical or formal entity is introduced; the free parameters are largely unreported implementation choices that could affect results.

free parameters (3)
  • Discriminator decision-tree parameters
    The central loop depends on a decision tree trained on original + synthetic data, but no depth/split criteria are reported; these choices shape which fuzzed rows are called 'good'.
  • Discriminator retraining schedule
    Section 3.3 leaves retraining frequency 'variable' and says it will be stated per experiment, but the experimental section does not report the values used.
  • Fandango evolutionary parameters
    Population size, mutation/crossover rates are not given; only max iterations and number of desired samples set to dataset size (§4.2).
assumptions (4)
  • domain assumption Fooling a decision tree trained on original vs synthetic data is a sufficient proxy for statistical resemblance to the original distribution.
    Used implicitly in §3.2; no proof or calibration against a distribution-distance metric in the loop.
  • ad hoc to paper A classifier trained on the private data can be used as a fitness function without leaking private information through its decision boundary.
    The privacy claim rests on this; contradicted by the authors' own 'no data flow' assertion being unsupported (§3.1, §6).
  • domain assumption Absence of exact duplicate rows implies privacy.
    §4.1 defines privacy this way; no MIA or reconstruction tests.
  • domain assumption Fandango's evolutionary search can reach regions of the input space that encode the dependencies of the original dataset from a grammar plus discriminator feedback.
    Feasibility RQ1 assumed; no coverage/completeness analysis.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SecretFan: Synthesizing Realistic Data without Breaking Privacy." pith.science (2026). https://pith.science/paper/VZKCA3VL

@misc{pith2026260205833,
  author       = {Pith},
  title        = {Pith review of: SecretFan: Synthesizing Realistic Data without Breaking Privacy},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VZKCA3VL}},
  note         = {Machine review of arXiv:2602.05833}
}
read the original abstract

There is a need for synthetic training and test datasets that replicate statistical distributions of original datasets without compromising their confidentiality. A lot of research has been done in leveraging Generative Adversarial Networks (GANs) for synthetic data generation, however the resulting models are either not accurate enough or are still vulnerable to membership inference attacks (MIA) or dataset reconstruction attacks since the original data has been leveraged in the training process. In this paper, we frame synthetic data generation as a guided test generation, or search-based testing problem rather than a purely generative modeling task. Ours is a search-based, adequacy-guided input generation technique inspired by GANs, with a generation step and a discrimination step; as in GAN, discrimination uses a discriminator model trained on the date, but instead of using models also for generation, we use a fuzzer. This way, the original (private) data is only indirectly leveraged in the generation process, and by evolving samples and determining "good samples" with the discriminator, we can generate privacy-preserving data that follows the same statistical distributions as the original dataset, leading to a similar utility as the original data. We evaluated our approach on eight datasets that have been used to evaluate the state-of-the-art techniques, finding that synthetic generated with our technique achieves good utility on average while also having good similarity scores, highlighting the potential of a mixed approach leveraging classical generation and model-driven discrimination for generating privacy-preserving, useful synthetic datasets.

Figures

Figures reproduced from arXiv: 2602.05833 by the authors.

Figure 1
Figure 1. Example CSV grammar and constraints. Grammars. A context-free grammar (CFG) is defined as a 4-tuple 𝐺 = (𝑉 , Σ, 𝑅, 𝑆): – 𝑉 is a finite set of non-terminal symbols, essentially variables in the grammar; – Σ is a finite set of terminal characters, where 𝑉 ∩ Σ = ∅; [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Overview of the approach. 3.1 Setup (Phase 1) Data Format Specification and Initial Generation. As a first step, our approach re￾quires a Fandango specification for the data format. Such a specification is a mix of grammar and constraints; see [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Comparison of the good samples collection rate across different datasets [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Good samples for insurance dataset, with discriminator retraining. Each orange vertical dotted line represents a new iteration, with a newly trained discriminator. RQ2: Utility of Synthetic Data In this research question, we investigate the utility of the following com…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

25 extracted references · 2 canonical work pages

  1. [1]

    https://www.kaggle.com/datasets/mirichoi0218/insurance, dataset

    Medical cost personal dataset. https://www.kaggle.com/datasets/mirichoi0218/insurance, dataset

  2. [2]

    In: Proceedings of the First ACM International Conference on AI in Finance

    Assefa, S.A., Dervovic, D., Mahfouz, M., Tillman, R.E., Reddy, P., Veloso, M.: Generating synthetic data in finance: opportunities, challenges and pitfalls. In: Proceedings of the First ACM International Conference on AI in Finance. pp. 1–8 (2020)

    2020

  3. [3]

    UCI Machine Learning Repository (1996), DOI: https://doi.org/10.24432/C5XW20

    Becker, B., Kohavi, R.: Adult. UCI Machine Learning Repository (1996), DOI: https://doi.org/10.24432/C5XW20

    doi:10.24432/c5xw20 1996

  4. [4]

    Bettscheider,L.,Zeller,A.:Inferringinputgrammarsfromcodewithsymbolicparsing.ACM Trans. Softw. Eng. Methodol. (Nov 2025). https://doi.org/10.1145/3776743

    work page doi:10.1145/3776743 2025

  5. [5]

    arXiv preprint arXiv:2507.11590 (2025)

    Challagundla, R., Dorodchi, M., Wang, P., Lee, M.: Synthetic tabular data generation: A comparative survey for modern techniques. arXiv preprint arXiv:2507.11590 (2025)

    arXiv 2025

  6. [6]

    In: International conference on theory and applications of models of computation

    Dwork, C.: Differential privacy: A survey of results. In: International conference on theory and applications of models of computation. pp. 1–19. Springer (2008)

    2008

  7. [7]

    Journal of Official Statistics9(2), 383–406 (1993)

    Fuller, W.: Masking procedures for microdata disclosure. Journal of Official Statistics9(2), 383–406 (1993)

    1993

  8. [8]

    Advances in neural information processing sys- tems27(2014)

    Goodfellow,I.J.,Pouget-Abadie,J.,Mirza,M.,Xu,B.,Warde-Farley,D.,Ozair,S.,Courville, A., Bengio, Y.: Generative adversarial nets. Advances in neural information processing sys- tems27(2014)

    2014

Show all 25 references
  1. [9]

    Neurocomputing493, 28–45 (2022)

    Hernandez, M., Epelde, G., Alberdi, A., Cilla, R., Rankin, D.: Synthetic data generation for tabular health records: A systematic review. Neurocomputing493, 28–45 (2022)

    2022

  2. [10]

    IEEE Transactions on Informa- tion theory37(1), 145–151 (2002)

    Lin, J.: Divergence measures based on the shannon entropy. IEEE Transactions on Informa- tion theory37(1), 145–151 (2002)

    2002

  3. [11]

    arXiv preprint arXiv:2511.17977 (2025)

    Liu, K., Chakraborty, D., Liggesmeyer, A., Zeller, A.: Synthesizing precise protocol specs from natural language for effective test generation. arXiv preprint arXiv:2511.17977 (2025)

    2025

  4. [12]

    Liu, Q., Khalil, M., Jovanovic, J., Shakya, R.: Scaling while privacy preserving: A compre- hensivesynthetictabulardatagenerationandevaluationinlearninganalytics.In:Proceedings of the 14th Learning Analytics and Knowledge Conference. pp. 620–631 (2024)

    2024

  5. [13]

    Computer Methods and Programs in Biomedicine p

    Liu, Y., Acharya, U.R., Tan, J.H.: Preserving privacy in healthcare: A systematic review of deep learning approaches for synthetic data generation. Computer Methods and Programs in Biomedicine p. 108571 (2024)

    2024

  6. [14]

    UCI Machine Learning Repository (2014), DOI: https://doi.org/10.24432/C5K306

    Moro, S., Rita, P., Cortez, P.: Bank Marketing. UCI Machine Learning Repository (2014), DOI: https://doi.org/10.24432/C5K306

    2014 doi

  7. [15]

    Probability Theory and Related Fields70(1), 117–129 (1985)

    Rüschendorf, L.: The wasserstein distance and approximation theorems. Probability Theory and Related Fields70(1), 117–129 (1985)

    1985

  8. [16]

    In: PODS

    Samarati,P.,Sweeney,L.:Generalizingdatatoprovideanonymitywhendisclosinginforma- tion. In: PODS. vol. 98, pp. 10–1145 (1998)

    1998

  9. [17]

    Samarati,P.,Sweeney,L.:Protectingprivacywhendisclosinginformation:k-anonymityand its enforcement through generalization and suppression (1998) Synthesizing Realistic Test Data without Breaking Privacy 15

    1998

  10. [18]

    Cus- tomer needs and solutions12(1), 1–8 (2025)

    Schneider, M.J., Bailie, J., Iacobucci, D.: Why data anonymization has not taken off. Cus- tomer needs and solutions12(1), 1–8 (2025)

    2025

  11. [19]

    Steinhöfel, D., Zeller, A.: Language-based software testing. Commun. ACM67(4), 80–84 (Mar 2024). https://doi.org/10.1145/3631520, https://doi.org/10.1145/3631520

    2024 doi

  12. [20]

    International journal of uncer- tainty, fuzziness and knowledge-based systems10(05), 557–570 (2002)

    Sweeney, L.: k-anonymity: A model for protecting privacy. International journal of uncer- tainty, fuzziness and knowledge-based systems10(05), 557–570 (2002)

    2002

  13. [21]

    https://www.kaggle.com/datasets/laotse/credit-risk-dataset (2019), dataset

    Tse, L.: Credit risk dataset. https://www.kaggle.com/datasets/laotse/credit-risk-dataset (2019), dataset

    2019

  14. [22]

    Advances in neural information processing systems32(2019)

    Xu, L., Skoularidou, M., Cuesta-Infante, A., Veeramachaneni, K.: Modeling tabular data us- ing conditional GAN. Advances in neural information processing systems32(2019)

    2019

  15. [23]

    ZamudioAmaya,J.A.,Smytzek,M.,Zeller,A.:FANDANGO:Evolvinglanguage-basedtest- ing. Proc. ACM Softw. Eng.2(ISSTA) (Jun 2025). https://doi.org/10.1145/3728915

    2025 doi

  16. [24]

    Zhang, J., Cormode, G., Procopiuc, C.M., Srivastava, D., Xiao, X.: Privbayes: Private data releaseviabayesiannetworks.ACMTransactionsonDatabaseSystems(TODS)42(4),1–41 (2017)

    2017

  17. [25]

    In: Asian conference on machine learning

    Zhao, Z., Kunar, A., Birke, R., Chen, L.Y.: CTAB-GAN: Effective table data synthesizing. In: Asian conference on machine learning. pp. 97–112. PMLR (2021)

    2021

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.