Pith. sign in

REVIEW 2 major objections 5 minor 79 references

Synthetic Tabular Data: Methods, Attacks and Defenses

T0 review · 2 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This survey argues that synthetic tabular data is not inherently private: a table too close to its training source can leak sensitive information, so releases need both formal differential-privacy guarantees and empirical attack-based…

desk verdict Useful survey of synthetic tabular data, but Eq. (3) overstates what attack-based epsilon estimates mean and the SOTA narrative leans on author-affiliated results. read the letter →

arxiv 2506.06108 v1 pith:2GW6H5SG submitted 2025-06-06 cs.LG cs.CR

Graham Cormode , Samuel Maddock , Enayat Ullah , Shripad Gade This is my paper
classification cs.LGcs.CR
keywords synthetictabulardatadifferentialprivacymarginaldistributionsmembershipinferenceattributeselect-measure-generatedeepgenerativemodelsGANs
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This survey argues that synthetic tabular data is not inherently private: if a generated table is too similar to the sensitive reference data it was built from, it can reveal information about the people in that data. To make the tradeoff concrete, it organizes the field into two paradigms—marginal-based methods that follow a 'select-measure-generate' loop under differential privacy, and deep generative models such as GANs, diffusion models, and LLM-based generators. Against this backdrop it presents privacy attacks, chiefly membership and attribute inference, as an empirical complement to formal privacy guarantees: Eq. (3) converts an attack's true- and false-positive rates into an estimated differential-privacy parameter. The practical upshot is that releasing synthetic data should be treated as a privacy-sensitive act, audited with both worst-case guarantees and attack-based testing.

What carries the argument

The load-bearing conceptual machinery is the marginal distribution—the empirical frequency of value combinations over subsets of columns—together with the select-measure-generate loop that many differentially private tabular generators follow: select the next marginal to query, measure it with calibrated DP noise, and generate synthetic rows from the accumulated noisy marginals via a probabilistic graphical model. On the attack side, the key object is the membership-inference game, in which an adversary guesses whether a target record was in the training set; Eq. (3) turns the attack's true-positive and false-positive rates into an empirical differential-privacy parameter. A second organizing distinction is between density-based attacks, which score the target by its likelihood under the fitted generator, and shadow-modeling attacks, which train a meta-classifier on many simulated training-and-test splits. These objects carry the survey's claim that privacy risk is measurable both formally and empirically.

What would settle it

Run a controlled study where a generator's true DP epsilon is set to known values such as 0.1, 1, and 10, and the same membership-inference attack is executed on each release; if the empirical epsilon from Eq. (3) does not increase monotonically with the formal epsilon, or if attribute-inference attacks succeed at empirical epsilons near zero, the survey's assumption that attacks are a meaningful empirical proxy for privacy breaks down.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central claim is that 'synthetic' and 'private' are not synonyms. The survey states that if synthetic data closely resembles its source, it may leak sensitive information about that source, and that the entire research program is a balancing act among fidelity, privacy, expressivity, and efficiency. Methodologically, it reduces current tabular generators to two families: marginal-based algorithms, culminating in the select-measure-generate paradigm implemented by MST and AIM, and deep-learning generators such as CTGAN, PATE-GAN, DP-MERF, TabDDPM, TabSyn, GReaT, and SynLM, with differentially private versions of the latter obtained mainly through DP-SGD or post-processing of private measurements. It then argues that membership-inference and attribute-inference attacks provide an empirical measure of leakage that complements the worst-case differential-privacy guarantee, and presents Eq. (3) as the conversion from attack true- and false-positive rates to an empirical epsilon. The survey's conclusion is that no single method dominates, and that marginal-based methods remain more reliable under differential privacy, while diffusion- and LLM-based methods have not yet been systematically benchmarked against them.

Load-bearing premise

The load-bearing premise is that differential privacy is the right yardstick for synthetic-data privacy, and that the epsilon estimated from a membership-inference attack's true- and false-positive rates actually tracks real disclosure risk.

Editorial extensions

If this is right

  • High-fidelity synthetic data cannot be assumed private, because closeness to the training data is itself a leakage channel.
  • Differentially private marginal-based methods such as MST and AIM currently reproduce basic statistics more reliably than DP-trained GANs, which often fail at one-way marginals regardless of the privacy budget.
  • Membership and attribute inference attacks give a practical, attack-specific measure of privacy that can expose leaks even in implementations that claim formal guarantees.
  • Equation (3) lets a practitioner estimate a lower bound on the DP parameter from an attack's true- and false-positive rates, turning an adversary into an auditing tool.
  • No single synthetic-data generator dominates across datasets and tasks, so method choice should be guided by the target workload and privacy regime.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The survey implies a release checklist that it does not spell out: any synthetic data product without a stated DP guarantee should be treated as sensitive until density- and shadow-modeling attacks have been run on it.
  • If empirical epsilons from membership inference and formal worst-case DP epsilons diverge strongly, Eq. (3) may be measuring attack difficulty rather than disclosure risk; the honest reading is to report both numbers and investigate the gap.
  • The methods comparison also suggests a testable hypothesis: matched-budget attribute-inference attacks may separate marginal-based from deep generative methods more sharply than membership inference does, because attribute leakage depends on how the model encodes specific sensitive columns.
  • Recent diffusion- and LLM-based generators are the open frontier: if they close the utility gap with marginal methods at low epsilon, the survey's tentative preference for marginal methods would need revision.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The manuscript is a survey of synthetic tabular data generation. It motivates the topic through privacy desiderata, identifies differential privacy as the formal standard, and categorizes generation methods into marginal-based approaches (Naive Bayes, MWEM, PrivBayes, PGM, MST, PrivMRF, PrivSyn, AIM, RAP/RAP++) and deep-learning-based approaches (CTGAN, TVAE, DP-CTGAN, PATE-GAN, DP-MERF, GEM, TabDDPM, TabSyn, GReaT, SynLM). Section 5 describes membership and attribute inference attacks, including density-based and shadow-model-based methods, and argues that attacks provide an empirical complement to formal DP guarantees. Section 6 covers extensions to graphs, images, text, distributed generation, public-data-assisted methods, and software frameworks. The paper's central message is that synthetic data is not automatically private and must be audited both formally and empirically.

Significance. If its guidance is followed, the survey would lead practitioners to treat synthetic tabular data as a privacy-sensitive artifact requiring both DP guarantees and attack-based auditing. The paper provides a useful, clearly written synthesis of a rapidly moving area, and it generally attributes benchmark conclusions to the original studies rather than to new experiments. Its taxonomy of marginal-based versus deep-learning methods and its structured account of attacks are valuable organizational contributions. The main reservation is that the paper's central recommendation on empirical privacy auditing rests on a mischaracterization of Eq. (3), which is a lower-bound audit rather than an estimate of the DP parameter; this needs correction before the guidance is reliable.

major comments (2)
  1. [Section 5.1.2, Eq. (3)] Equation (3) is presented as yielding "an empirical value of the differential privacy parameter ε," but the displayed inequality is only a necessary condition and gives a lower bound on the true ε, not an estimate. If the generator is (ε,δ)-DP, then for any membership-inference attack TPR ≤ e^ε·FPR + δ, hence ε ≥ log((TPR−δ)/FPR), and symmetrically for the TNR/FNR term. A weak attack with TPR ≈ FPR produces a small right-hand side regardless of whether the generator is private, so a small computed value does not certify privacy; conversely, finite-sample estimates of TPR/FPR can violate the DP inequality even for a truly DP generator. Because Sections 1 and 5 recommend using attack success "as an estimate of empirical privacy risk" and as a complement to DP, the missing caveat is load-bearing. The authors should rewrite Eq. (3) as a lower-bound audit, state explicitly that attacks can falsify a privacy claim or detect implementation bugs but cannot certify privacy, and adjust the surrounding language accordingly.
  2. [Section 3.6 and Section 6] The survey repeatedly labels certain methods as "state of the art" without supporting that label with a systematic comparison. Section 3.6 asserts that "The state of the art (SOTA) approaches are also based on marginal queries," and Section 6 calls JAM-PGM and Conditional AIM "Current SOTA methods." These claims are stronger than what the survey itself establishes in Section 4.4, where the authors note that diffusion- and LLM-based methods "have not been systematically compared to marginal-based methods" and that recent advances may close the gap. The paper should either replace "SOTA" with more modest descriptors such as "prominent" or "recently proposed," or cite the specific comprehensive benchmark on which the SOTA claim rests.
minor comments (5)
  1. [Section 3.4 and Section 3.5] Equations (1) and (2) use Pr(x,y) and related probabilities without stating explicitly that these are empirical marginals over finite categorical domains; a brief clarifying sentence would help readers unfamiliar with the notation.
  2. [Section 4.2] The phrase "TVAEs helps" should be "TVAE helps".
  3. [Section 3.7] The phrase "The PrivLava algorithms aims" should be "The PrivLava algorithm aims".
  4. [Section 6] The closing sentence announcing that the authors plan to open-source an internal synthetic data generation library is out of place in a survey; it should be removed or replaced with a neutral pointer to existing open-source frameworks.
  5. [Section 5.2] The sentence "The work of [23], proposes MAMA-MIA" contains a punctuation error and should read "The work of [23] proposes MAMA-MIA."

Circularity Check

2 steps flagged · score 3.0 of 10

No central circularity: the survey's main claims are supported by external benchmarks, but Eq. (3) mislabels a one-sided DP necessary condition as an 'empirical value of ε' and one SOTA attribution rests on the authors' own preprint.

  1. other [Section 5.1.2 'Privacy Risk', Eq. (3), with framing in Section 1 and Section 5.]
    "We obtain an empirical value of the differential privacy parameter ε for a corresponding δ as follows [36]. ε ≥ log(max(TPR−δ/FPR, TNR−δ/FNR)) (3). ... discuss how the relative success of attacks can be used as an estimate of empirical privacy risk of synthetic data release."

    Eq. (3) is the algebraic rearrangement of the (ε,δ)-DP necessary condition (TPR ≤ e^ε·FPR + δ): by construction it outputs a lower bound on the true ε, not an empirical estimate. A random-guessing attack (TPR≈FPR) yields near-zero 'ε' for a non-private generator, while finite-sample TPR/FPR can violate the inequality for a truly DP generator, so the quantity labeled 'an empirical value of ε' is defined by the very inequality it claims to estimate. The survey's framing that attack success can be 'an estimate of empirical privacy risk' is therefore one-sided: attacks can falsify a privacy claim, but a low computed value provides no positive assurance.

  2. self citation load bearing [Section 6 ('Pragmatic data generation'); related self-citations at Sections 3.7 and 6 ('Distributed data generation').]
    "Current SOTA methods include JAM-PGM [21], which uses public information during the private training of AIM, extending the selection strategy to choose between a publicly available marginal or a private one and Conditional AIM [47], which leverages conditional generation in the vertical setting."

    Reference [47] (Maddock, Gade, Cormode, Bullock, arXiv 2025) shares three authors with this survey and is an unvalidated preprint, so the 'Current SOTA' designation for Conditional AIM rests on the authors' own claim. The step is minor: the survey's central conclusions (synthetic data can leak; marginal-based methods remain competitive under DP; attacks find real vulnerabilities) are supported by independent citations ([3], [50], [65]) and do not reduce to the self-cited preprints.

full rationale

The paper is a survey, not a derivation paper: there is no fitted parameter that is later renamed a prediction, no imported uniqueness theorem, and no known result repackaged as a new unified framework. The central claims—that synthetic data can leak sensitive information, that marginal-based 'select-measure-generate' methods and deep generative models are the two main paradigms, and that empirical attacks complement formal DP guarantees—are supported by external work (e.g., [3] finds vulnerabilities in PrivBayes and MST implementations; [65] benchmarks 12 DP-SDG methods; [50] introduces AIM). Two issues keep the score above zero without making the paper substantially circular. First, Eq. (3) in Section 5.1.2 is a one-sided DP necessary condition, and the paper calls the resulting lower bound 'an empirical value of the differential privacy parameter ε'; because the formula is just the DP inequality rearranged, the 'measurement' cannot certify privacy and the attack-as-validation framing in Sections 1 and 5 needs the lower-bound caveat. Second, the SOTA list at the end of Section 6 includes Conditional AIM [47], a self-cited preprint by three of the present authors, so that particular attribution depends on an unverified self-citation; PrivLava [11], FLAIM [46], and PrivBayes [77] are similarly author-coauthored but are presented descriptively rather than as load-bearing evidence. Neither issue collapses the paper's message, which retains independent support.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

This survey contributes no new equations or fitted constants, so the ledger records assumptions the paper inherits from the literature it surveys. No free parameters are introduced by the survey itself, and no new entities are postulated. The main inherited assumptions are the choice of differential privacy as the formal privacy lens and the use of attack-based epsilon estimation as an empirical check.

assumptions (4)
  • domain assumption Differential privacy is the appropriate formal notion of privacy for synthetic data.
    Section 2.3 states DP has become the de facto standard and frames all subsequent methods and defenses through it, giving much less weight to alternative definitions.
  • domain assumption The reference data can be adequately treated as a single categorical table.
    Section 3.2 assumes each feature is categorical with a known domain and each row is an independent record; this underpins the marginal-based method descriptions and the attack discussion.
  • domain assumption Empirical membership-inference epsilon estimates approximate true privacy risk.
    Section 5.1.2 presents Eq. (3) to turn attack true and false positive rates into an epsilon value, which assumes the attack game and auxiliary data model the worst-case adversary closely enough.
  • domain assumption Benchmark conclusions about DP synthetic data methods generalize beyond the datasets and budgets tested.
    Section 4.4 rests on external benchmarks, including Tao et al., Liu et al., and Ganev et al., rather than new experiments, so its comparative claims inherit the scope and limitations of those studies.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Synthetic Tabular Data: Methods, Attacks and Defenses." pith.science (2026). https://pith.science/paper/2GW6H5SG

@misc{pith2026250606108,
  author       = {Pith},
  title        = {Pith review of: Synthetic Tabular Data: Methods, Attacks and Defenses},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2GW6H5SG}},
  note         = {Machine review of arXiv:2506.06108}
}
read the original abstract

Synthetic data is often positioned as a solution to replace sensitive fixed-size datasets with a source of unlimited matching data, freed from privacy concerns. There has been much progress in synthetic data generation over the last decade, leveraging corresponding advances in machine learning and data analytics. In this survey, we cover the key developments and the main concepts in tabular synthetic data generation, including paradigms based on probabilistic graphical models and on deep learning. We provide background and motivation, before giving a technical deep-dive into the methodologies. We also address the limitations of synthetic data, by studying attacks that seek to retrieve information about the original sensitive data. Finally, we present extensions and open problems in this area.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

79 extracted references · 65 canonical work pages

  1. [47]

    Leveraging Vertical Public-Private Split for Improved Synthetic Data Generation

    S. Maddock, S. Gade, G. Cormode, and W. Bullock. Leveraging vertical public-private split for improved synthetic data generation. arXiv preprint arXiv:2504.10987, 2025

    work page Pith review arXiv 2025

  2. [1]

    Abadi, A

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang. Deep learning with differential privacy. In ACM CCS, pages 308–318, 2016

    work page 2016

  3. [2]

    Albert and A

    R. Albert and A. Barabási. Statistical mechanics of complex networks. CoRR, cond-mat/0106096, 2001

    arXiv 2001

  4. [3]

    what do you want from theory alone?

    M. S. M. S. Annamalai, G. Ganev, and E. De Cristofaro. "what do you want from theory alone?" experimenting with tight auditing of differentially private synthetic data generation. In USENIX Security, pages 4855–4871, 2024

    work page 2024

  5. [4]

    Aydöre, W

    S. Aydöre, W. Brown, M. Kearns, K. Kenthapadi, L. Melis, A. Roth, and A. A. Siva. Differentially private query release through adaptive projection. InProceedings of the 38th International Conference on Machine Learning, ICML 2021, 18-24 July 2021, Virtual Event, volume 139 of Proceedings of Machine Learning Research , pages 457–467. PMLR, 2021

    work page 2021

  6. [5]

    A. Bie, G. Kamath, and V. Singhal. Private estimation with public data. Advances in neural information processing systems , 35:18653–18666, 2022

    work page 2022

  7. [6]

    F. Bie, Y. Yang, Z. Zhou, A. Ghanem, M. Zhang, Z. Yao, X. Wu, C. Holmes, P. Golnari, D. A. Clifton, Y. He, D. Tao, and S. L. Song. Renaissance: A survey into ai text-to-image generation in the era of large model. IEEE Transactions on Pattern Analysis and Machine Intelligence , 47(3):2212–2231, 2025

    work page 2025

  8. [7]

    Borisov, K

    V. Borisov, K. Seßler, T. Leemann, M. Pawelczyk, and G. Kasneci. Language models are realistic tabular data generators. arXiv preprint arXiv:2210.06280 , 2022

    arXiv 2022

Show all 79 references
  1. [8]

    K. W. Bowyer, N. V. Chawla, L. O. Hall, and W. P. Kegelmeyer. SMOTE: synthetic minority over-sampling technique. CoRR, abs/1106.1813, 2011

    2011 arXiv

  2. [9]

    Bun and T

    M. Bun and T. Steinke. Concentrated differential privacy: Simplifications, ex- tensions, and lower bounds. In Theory of Cryptography - 14th International Conference, TCC 2016-B, Beijing, China, October 31 - November 3, 2016, Proceedings, Part I, volume 9985 of Lecture Notes in...

    2016

  3. [10]

    K. Cai, X. Lei, J. Wei, and X. Xiao. Data synthesis via differentially private markov random field. Proc. VLDB Endow., 14(11):2190–2202, 2021

    2021

  4. [11]

    K. Cai, X. Xiao, and G. Cormode. Privlava: Synthesizing relational data with foreign keys under differential privacy.Proc. ACM Manag. Data, 1(2):142:1–142:25, 2023

    2023

  5. [12]

    Carlini, S

    N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramer. Membership inference attacks from first principles. In 2022 IEEE symposium on security and privacy (SP), pages 1897–1914. IEEE, 2022

    2022

  6. [13]

    K. Chen, X. Li, C. Gong, R. McKenna, and T. Wang. Benchmarking differentially private tabular data synthesis. arXiv preprint arXiv:2504.14061, 2025

    2025

  7. [14]

    Chow and C

    C. Chow and C. Liu. Approximating discrete probability distributions with dependence trees. IEEE Transactions on Information Theory , 14(3):462–467, 1968

    1968

  8. [15]

    Clifton and T

    C. Clifton and T. Tassa. On syntactic anonymity and differential privacy. In 2013 IEEE 29th International Conference on Data Engineering Workshops (ICDEW) , pages 88–93, 2013

    2013

  9. [16]

    Dalenius and S

    T. Dalenius and S. P. Reiss. Data-swapping: A technique for disclosure control. Journal of Statistical Planning and Inference , 6:73–85, 1982

    1982

  10. [17]

    Dhariwal and A

    P. Dhariwal and A. Nichol. Diffusion models beat gans on image synthesis. Advances in neural information processing systems , 34:8780–8794, 2021

    2021

  11. [18]

    Dwork and A

    C. Dwork and A. Roth. The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science , 9(3-4):211–407, 2014

    2014

  12. [19]

    M. L. Fang, D. S. Dhami, and K. Kersting. DP-CTGAN: Differentially private medical data generation using ctgans. In Intl. Conf. on artificial intelligence in medicine, 2022

    2022

  13. [20]

    S. E. Fienberg and J. McIntyre. Data swapping: Variations on a theme by dalenius and reiss. In Privacy in Statistical Databases: CASC Project International Workshop, PSD 2004, Barcelona, Spain, June 9-11, 2004. Proceedings , volume 3050 of Lecture Notes in Computer Science , p...

    2004

  14. [21]

    Fuentes, B

    M. Fuentes, B. C. Mullins, R. McKenna, G. Miklau, and D. Sheldon. Joint selec- tion: Adaptively incorporating public information for private synthetic data. In AISTATS, 2024

    2024

  15. [22]

    Ganev, K

    G. Ganev, K. Xu, and E. De Cristofaro. Graphical vs. deep generative models: Measuring the impact of differentially private mechanisms and budgets on util- ity. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 1596–1610, 2024

    2024

  16. [23]

    S. Golob. Privacy Vulnerabilities in Marginals-based Synthetic Data . University of Washington, 2024

    2024

  17. [24]

    I. J. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. C. Courville, and Y. Bengio. Generative adversarial nets. In NeurIPS, 2014

    2014

  18. [25]

    Gretal.AI SDK, 2020

    Gretel.AI. Gretal.AI SDK, 2020

    2020

  19. [26]

    Harder, K

    F. Harder, K. Adamczewski, and M. Park. DP-MERF: differentially private mean embeddings with randomfeatures for practical privacy-preserving data genera- tion. In The 24th International Conference on Artificial Intelligence and Statistics, AISTATS 2021, April 13-15, 2021, Virt...

    2021

  20. [27]

    Hardt, K

    M. Hardt, K. Ligett, and F. McSherry. A simple and practical algorithm for differentially private data release. In Advances in Neural Information Processing Systems, pages 2348–2356, 2012

    2012

  21. [28]

    Hardt and G

    M. Hardt and G. N. Rothblum. A multiplicative weights mechanism for privacy- preserving data analysis. In IEEE FOCS, pages 61–70, 2010

    2010

  22. [29]

    Hayes, L

    J. Hayes, L. Melis, G. Danezis, and E. De Cristofaro. Logan: Membership inference attacks against generative models. arXiv preprint arXiv:1705.07663, 2017

    2017 arXiv

  23. [30]

    Hilprecht, M

    B. Hilprecht, M. Härterich, and D. Bernau. Monte carlo and reconstruction membership inference attacks against generative models. Proceedings on Privacy Enhancing Technologies, 2019

    2019

  24. [31]

    J. Ho, A. Jain, and P. Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems , 33:6840–6851, 2020

    2020

  25. [32]

    Hod and R

    S. Hod and R. Canetti. Differentially private release of israel’s national registry of live births. CoRR, abs/2405.00267, 2024

    2024 arXiv

  26. [33]

    Houssiau, J

    F. Houssiau, J. Jordon, S. N. Cohen, O. Daniel, A. Elliott, J. Geddes, C. Mole, C. Rangel-Smith, and L. Szpruch. Tapas: a toolbox for adversarial privacy auditing of synthetic data. arXiv preprint arXiv:2211.06550, 2022

    2022 arXiv

  27. [34]

    Jordon, J

    J. Jordon, J. Yoon, and M. Van Der Schaar. Pate-gan: Generating synthetic data with differential privacy guarantees. In International conference on learning representations, 2018

    2018

  28. [35]

    Kairouz, H

    P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. A. Bonawitz, Z. Charles, G. Cormode, R. Cummings, R. G. L. D’Oliveira, H. Eichner, S. E. Rouayheb, D. Evans, J. Gardner, Z. Garrett, A. Gascón, B. Ghazi, P. B. Gibbons, M. Gruteser, Z. Harchaoui, C. H...

    2021

  29. [36]

    Kairouz, S

    P. Kairouz, S. Oh, and P. Viswanath. The composition theorem for differential privacy. In International conference on machine learning , pages 1376–1385. PMLR, 2015

    2015

  30. [37]

    S. P. Kasiviswanathan, H. K. Lee, K. Nissim, S. Raskhodnikova, and A. Smith. What can we learn privately? SIAM Journal on Computing , 40(3):793–826, 2011

    2011

  31. [38]

    Koller and N

    D. Koller and N. Friedman. Probabilistic Graphical Models - Principles and Tech- niques. MIT Press, 2009

    2009

  32. [39]

    A. Kopp. Microsoft smartnoise differential privacy machine learning case studies. Microsoft Azure White Papers, 14, 2021

    2021

  33. [40]

    Kotelnikov, D

    A. Kotelnikov, D. Baranchuk, I. Rubachev, and A. Babenko. Tabddpm: Modelling tabular data with diffusion models. In ICML, 2023

    2023

  34. [41]

    A. D. Lautrup, T. Hyrup, A. Zimek, and P. Schneider-Kamp. Syntheval: a frame- work for detailed utility and privacy evaluation of tabular synthetic data. Data Mining and Knowledge Discovery , 39(1):1–25, 2025

    2025

  35. [42]

    T. Liu, J. Tang, G. Vietri, and S. Wu. Generating private synthetic data with genetic algorithms. In ICML, 2023

    2023

  36. [43]

    T. Liu, G. Vietri, T. Steinke, J. Ullman, and S. Wu. Leveraging public data for practical private query release. In ICML. PMLR, 2021

    2021

  37. [44]

    T. Liu, G. Vietri, and S. Wu. Iterative methods for private synthetic data: Unifying framework and new methods. In NeurIPS, 2021

    2021

  38. [45]

    Liu, C.-H

    Y. Liu, C.-H. Wang, and G. Cheng. On the utility recovery incapability of neural net-based differential private tabular training data synthesizer under privacy deregulation, 2022

    2022

  39. [46]

    Maddock, G

    S. Maddock, G. Cormode, and C. Maple. FLAIM: Aim-based synthetic data generation in the federated setting. In ACM SIGKDD, 2024

    2024

  40. [48]

    McKenna, G

    R. McKenna, G. Miklau, and D. Sheldon. Winning the NIST contest: A scalable and general approach to differentially private synthetic data. J. Priv. Confidentiality, 11(3), 2021

    2021

  41. [49]

    McKenna, G

    R. McKenna, G. Miklau, and D. Sheldon. Winning the nist contest: A scalable and general approach to differentially private synthetic data. arXiv preprint arXiv:2108.04978, 2021

    2021 arXiv

  42. [50]

    McKenna, B

    R. McKenna, B. Mullins, D. Sheldon, and G. Miklau. AIM: an adaptive and iterative mechanism for differentially private synthetic data. Proc. VLDB Endow., 15(11):2599–2612, 2022

    2022

  43. [51]

    McKenna, D

    R. McKenna, D. Sheldon, and G. Miklau. Graphical-model based estimation and inference for differential privacy. In Proceedings of the 36th International Conference on Machine Learning, ICML 2019, 9-15 June 2019, Long Beach, California, USA, volume 97 of Proceedings of Machine ...

    2019

  44. [52]

    I. Mironov. Rényi differential privacy. In30th IEEE Computer Security Foundations Symposium, CSF 2017, Santa Barbara, CA, USA, August 21-25, 2017 , pages 263–275. IEEE Computer Society, 2017

    2017

  45. [53]

    MOSTLY AI SDK, 2025

    MOSTLY AI. MOSTLY AI SDK, 2025

    2025

  46. [54]

    Naveed, A

    H. Naveed, A. U. Khan, S. Qiu, M. Saqib, S. Anwar, M. Usman, N. Barnes, and A. Mian. A comprehensive overview of large language models. CoRR, abs/2307.06435, 2023

    2023 arXiv

  47. [55]

    Patki, R

    N. Patki, R. Wedge, and K. Veeramachaneni. The synthetic data vault. In IEEE International Conference on Data Science and Advanced Analytics (DSAA) , pages 399–410, Oct 2016. KDD ’25, August 3–7, 2025, Toronto, ON, Canada. Graham Cormode, Samuel Maddock, Enayat Ullah, and Shripad Gade

    2016

  48. [56]

    Pentyala, M

    S. Pentyala, M. Pereira, and M. De Cock. Caps: Collaborative and private synthetic data generation from distributed sources. arXiv preprint arXiv:2402.08614, 2024

    2024 arXiv

  49. [57]

    Pereira, S

    M. Pereira, S. Pentyala, A. Nascimento, R. T. d. Sousa Jr, and M. De Cock. Secure multiparty computation for synthetic data generation from distributed data.arXiv preprint arXiv:2210.07332, 2022

    2022 arXiv

  50. [58]

    H. Ping, J. Stoyanovich, and B. Howe. Datasynthesizer: Privacy-preserving synthetic datasets. In Proceedings of the 29th International Conference on Scientific and Statistical Database Management , pages 1–5, 2017

    2017

  51. [59]

    Qian, B.-C

    Z. Qian, B.-C. Cebere, and M. van der Schaar. Synthcity: facilitating innovative use cases of synthetic data in different data modalities, 2023

    2023

  52. [60]

    Sablayrolles, Y

    A. Sablayrolles, Y. Wang, and B. Karrer. Privately generating tabular data using language models. arXiv preprint arXiv:2306.04803, 2023

    2023 arXiv

  53. [61]

    Shokri, M

    R. Shokri, M. Stronati, C. Song, and V. Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3–18. IEEE, 2017

    2017

  54. [62]

    Sohl-Dickstein, E

    J. Sohl-Dickstein, E. Weiss, N. Maheswaranathan, and S. Ganguli. Deep unsuper- vised learning using nonequilibrium thermodynamics. In International conference on machine learning, pages 2256–2265. pmlr, 2015

    2015

  55. [63]

    Stadler, B

    T. Stadler, B. Oprisanu, and C. Troncoso. Synthetic data–anonymisation ground- hog day. In 31st USENIX Security Symposium (USENIX Security 22) , pages 1451– 1468, 2022

    2022

  56. [64]

    L. Sweeney. k-anonymity: A model for protecting privacy. International journal of uncertainty, fuzziness and knowledge-based systems , 10(05):557–570, 2002

    2002

  57. [65]

    Y. Tao, R. McKenna, M. Hay, A. Machanavajjhala, and G. Miklau. Benchmarking differentially private synthetic data generation algorithms. In Workshop on Privacy-Preserving Artificial Intelligence, AAAI 2022 , Vancouver, 2022. AAAI

    2022

  58. [66]

    Thanh-Tung and T

    H. Thanh-Tung and T. Tran. Catastrophic forgetting and mode collapse in gans. In 2020 international joint conference on neural networks (ijcnn) , pages 1–10. IEEE, 2020

    2020

  59. [67]

    Tsitsulin, B

    A. Tsitsulin, B. Rozemberczki, J. Palowitch, and B. Perozzi. Synthetic graph generation to benchmark graph learning. CoRR, abs/2204.01376, 2022

    2022 arXiv

  60. [68]

    Ullah, M

    E. Ullah, M. Menart, R. Bassily, C. Guzmán, and R. Arora. Public-data as- sisted private stochastic optimization: Power and limitations. arXiv preprint arXiv:2403.03856, 2024

    2024 arXiv

  61. [69]

    Van Breugel, H

    B. Van Breugel, H. Sun, Z. Qian, and M. van der Schaar. Membership inference attacks against synthetic data through overfitting detection. arXiv preprint arXiv:2302.12580, 2023

    2023 arXiv

  62. [70]

    Vietri, C

    G. Vietri, C. Archambeau, S. Aydöre, W. Brown, M. Kearns, A. Roth, A. A. Siva, S. Tang, and Z. S. Wu. Private synthetic data for multitask learning and marginal queries. In NeurIPS, 2022

    2022

  63. [71]

    Watson, C

    L. Watson, C. Guo, G. Cormode, and A. Sablayrolles. On the importance of diffi- culty calibration in membership inference attacks.arXiv preprint arXiv:2111.08440, 2021

    2021 arXiv

  64. [72]

    G. I. Webb. Naïve bayes. In C. Sammut and G. I. Webb, editors, Encyclopedia of Machine Learning and Data Mining . Springer, 2017

    2017

  65. [73]

    L. Xu, M. Skoularidou, A. Cuesta-Infante, and K. Veeramachaneni. Modeling tabular data using conditional GAN. In NeurIPS, pages 7333–7343, 2019

    2019

  66. [74]

    J. Ye, A. Maddi, S. K. Murakonda, V. Bindschaedler, and R. Shokri. Enhanced membership inference attacks against machine learning models. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , pages 3093–3106, 2022

    2022

  67. [75]

    Zarifzadeh, P

    S. Zarifzadeh, P. Liu, and R. Shokri. Low-cost high-power membership inference attacks. arXiv preprint arXiv:2312.03262, 2023

    2023 arXiv

  68. [76]

    Zhang, J

    H. Zhang, J. Zhang, B. Srinivasan, Z. Shen, X. Qin, C. Faloutsos, H. Rangwala, and G. Karypis. Mixed-type tabular data synthesis with score-based diffusion in latent space. arXiv preprint arXiv:2310.09656, 2023

    2023 arXiv

  69. [77]

    Zhang, G

    J. Zhang, G. Cormode, C. M. Procopiuc, D. Srivastava, and X. Xiao. Privbayes: Private data release via bayesian networks.ACM Trans. Database Syst., 42(4):25:1– 25:41, 2017

    2017

  70. [78]

    Zhang, G

    J. Zhang, G. Cormode, C. M. Procopiuc, D. Srivastava, and X. Xiao. Privbayes: Private data release via bayesian networks. ACM Transactions on Database Systems (TODS), 42(4):1–41, 2017

    2017

  71. [79]

    Zhang, T

    Z. Zhang, T. Wang, N. Li, J. Honorio, M. Backes, S. He, J. Chen, and Y. Zhang. Privsyn: Differentially private data synthesis. In USENIX Security, 2021

    2021

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.