🤖 AI

A Consensus Privacy Metrics Framework for Synthetic Data

Through an expert consensus process, this paper establishes a framework for evaluating synthetic data privacy that discourages the use of similarity metrics for identity disclosure, emphasizes the importance of measuring membership and attribute disclosures, and offers specific recommendations and research opportunities to support legislative compliance and widespread adoption.

Original authors: Lisa Pilgram, Fida K. Dankar, Jorg Drechsler, Mark Elliot, Josep Domingo-Ferrer, Paul Francis, Murat Kantarcioglu, Linglong Kong, Bradley Malin, Krishnamurty Muralidhar, Puja Myles, Fabian Prasser, Je

Published 2026-08-18

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Lisa Pilgram, Fida K. Dankar, Jorg Drechsler, Mark Elliot, Josep Domingo-Ferrer, Paul Francis, Murat Kantarcioglu, Linglong Kong, Bradley Malin, Krishnamurty Muralidhar, Puja Myles, Fabian Prasser, Jean Louis Raisaro, Chao Yan, Khaled El Emam

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the modern world of health research, scientists often need to share detailed information about patients to find cures or understand diseases. However, sharing real records of people's lives, medical histories, and genetic codes carries a serious risk: someone could piece together the data to figure out exactly who a person is, exposing their private secrets. To solve this, researchers have developed a method called synthetic data generation. Instead of releasing the real records, they use computer programs to create entirely new, fake datasets. These fake records look and behave statistically just like the real ones, allowing researchers to run their studies without ever seeing a real patient's name. But this creates a new puzzle: how do you know the fake data is actually safe? If the computer program that makes the data is too perfect, it might accidentally copy a real person's record word-for-word, defeating the whole purpose.

A team of privacy experts from around the world recently gathered to solve this puzzle. They wanted to create a single, agreed-upon set of rules for measuring whether synthetic data is safe to share. They did not invent new computer programs or fix existing ones; instead, they acted as judges, reviewing the many different ways scientists currently try to test for privacy risks. Through a careful, multi-step process of discussion and voting, they examined the tools used to measure risk and decided which ones actually work and which ones are misleading. Their goal was to stop the confusion that currently surrounds this field, where dozens of different tests exist, many of which give conflicting answers.

The researchers found that one of the most popular ways to test for safety is actually a dead end. Many scientists currently measure privacy by checking how close a fake record is to a real one, assuming that if the numbers are far apart, the data is safe. The experts concluded that this approach is flawed. Just because a fake record looks different from a real one does not mean a hacker cannot figure out who the person is or what their secret medical condition might be. In fact, relying on these simple distance measurements can give a false sense of security. The team explicitly advised against using these "similarity" scores as the main proof of safety.

Instead, the panel agreed that the only reliable way to test synthetic data is to simulate an attack. They recommended two specific types of tests. The first is a membership test, which asks: "Can an attacker figure out if a specific person was part of the group used to train the computer program?" The second is an attribute test, which asks: "Can an attacker guess a sensitive detail, like a specific disease, about a person just by looking at the fake data?" The experts stressed that these tests must be done carefully. For instance, when testing if someone was in the training group, the attacker must be assumed to know only what is publicly available, not every single detail of the person's life. They also found that the way these tests are currently scored often ignores how common or rare a condition is in the population, which can make the results look better or worse than they really are.

The group also tackled the issue of a popular privacy technique called differential privacy. This method adds a specific amount of mathematical "noise" to the data to hide individual details. For years, researchers have tried to use the amount of noise added as a simple score for safety. The panel found that this score is useless unless the noise is extremely high, to the point where the data becomes almost useless for research. For any realistic amount of noise that keeps the data useful, the experts said you cannot just trust the score; you must still run the same attack simulations mentioned above to see if the data is actually safe.

The final result of this work is a clear framework for the future. The experts agreed that there is no single magic number that guarantees safety. Instead, data controllers must run specific attack simulations to measure the risk of revealing who is in the data and what their secrets are. They also noted that while they could suggest a starting point for what counts as an acceptable risk level, the final decision depends on the sensitivity of the data and the potential harm to the people involved. By moving away from vague distance measurements and toward concrete attack simulations, this framework gives researchers and regulators a practical, reliable way to share synthetic data without compromising the privacy of the individuals it represents.

Technical Summary: A Consensus Privacy Metrics Framework for Synthetic Data

Problem Statement

The generation of synthetic data (SDG) has emerged as a viable approach to facilitate data sharing for secondary analysis, particularly in sensitive domains like healthcare. However, a significant barrier to the widespread adoption of synthetic data is the lack of a consolidated, standardized framework for measuring privacy protection. While numerous privacy metrics exist, their diversity and the historical reliance on "identity disclosure" concepts (developed for anonymized, perturbed data) make them difficult to apply and interpret for fully synthetic data.

Current practices often suffer from several critical issues:

Misapplication of Similarity Metrics: Many studies rely on record-level similarity metrics (e.g., distance to the closest record) as a proxy for privacy, often assuming that high similarity equates to high identity disclosure risk.
Inappropriate Assumptions: Metrics often assume adversaries know all attributes or that vulnerability is best estimated by pre-selecting "vulnerable" records, which may not reflect worst-case scenarios.
Differential Privacy (DP) Interpretability: The privacy budget ( $\epsilon$ ) is frequently used as the sole metric for DP-based synthetic data, yet its empirical interpretation varies widely, and values far from zero often lack clear privacy guarantees.
Lack of Consensus: There is no agreed-upon standard for evaluating membership disclosure (inferring if an individual was in the training set) or attribute disclosure (inferring sensitive attributes), leading to inconsistent privacy assessments.

Methodology

To address these gaps, the authors conducted a formal consensus study using a Delphi process involving a global panel of 13 privacy experts. The study spanned from February to November 2024 and followed a structured three-phase approach:

Round 0 (Critical Analysis): The team performed a literature-informed critical analysis based on four existing systematic reviews of synthetic data evaluation. They inductively classified privacy metrics into four categories: (1) Record-level similarity, (2) Membership disclosure, (3) Attribute disclosure, and (4) Differential Privacy. This phase included iterative revisions and feedback from regulators.
Round 1 (Initial Scoring): Panelists scored statements derived from the critical analysis on a five-point Likert scale (1 = Strongly Disagree to 5 = Strongly Agree) regarding the validity and utility of current metrics and practices.
Rounds 2-n (Re-scoring with Feedback): Panelists re-scored statements after receiving controlled feedback, including statistical summaries of the group's previous responses and anonymized comments.

Stopping Criterion: The process continued until group stability was achieved (defined as a p-value > 0.05 in the Wilcoxon matched-paired signed-rank test between successive rounds), rather than forcing a consensus.
Consensus Measurement: Once stability was reached, consensus was defined as an Interquartile Range (IQR) of $\le$ 1.0. Agreement levels were then determined based on the median score.

The study also included simulation experiments to test specific hypotheses, such as the impact of using all attributes versus quasi-identifiers (QIs) on membership disclosure vulnerability and the behavior of similarity metrics under different adversarial assumptions.

Key Contributions and Results

The panel reached stable consensus on agreement for 10 out of 11 recommendations and stable consensus on uncertainty for 1. The key findings and recommendations are categorized below:

1. Overarching Considerations

Quasi-Identifiers (QIs): Disclosure vulnerability metrics must be based on QIs (attributes known to the adversary), not all attributes. The study demonstrated via simulation that using all attributes often underestimates vulnerability because matching on more attributes increases the likelihood of mismatches in synthetic data. The data controller must ascertain QIs based on the specific context and adversary knowledge.
Stochasticity: Vulnerability metrics should be reported for both individual synthetic datasets and aggregated across multiple datasets generated by the same SDG model to account for stochastic variability.
Scope of Calculation: Metrics must be calculated for all records, not just pre-selected "vulnerable" subsets. Pre-selection assumes which records are most at risk, which may not be true and can overlook high-risk records.

2. Record-Level Similarity

Discouraged as Stand-Alone Metric: The panel reached consensus that stand-alone similarity metrics (e.g., distance to the closest record) should not be used to report privacy.
Reasoning: Similarity measures reconstruction, not necessarily identity disclosure. High similarity does not guarantee that sensitive information is correctly inferred (attribute disclosure) or that the individual's identity is revealed (membership). In synthetic data, identity disclosure is more accurately captured through membership or attribute disclosure concepts.

3. Membership Disclosure

Contextual Validity: Metrics are only valid if the adversarial assumptions match the sampling assumptions. Specifically, current metrics (often using partitioning methods) assume the adversary draws targets from the same population as the training data to learn sample-defining information (e.g., "was this person in the study?"). They fail if the adversary learns population-defining information (e.g., "does this person have HIV?") from a broader population.
Relative Metrics: Because the F1 score is prevalence-dependent, it must be reported relative to a naïve baseline (an adversary guessing membership without synthetic data). The panel suggested a relative F1 score ( $F_{rel}$ ) of 0.2 as a potential anchor, though this reached consensus on uncertainty due to the need for context-specific adjustments.

4. Attribute Disclosure

Members vs. Non-Members: Meaningful attribute disclosure vulnerability applies only to individuals in the dataset (members). Accurately predicting attributes for non-members is considered "knowledge generation" (research utility), not a privacy violation.
Relative Vulnerability: Vulnerability should be measured as the incremental gain in prediction accuracy for members compared to a non-member baseline.
Dual Thresholds: A relative vulnerability above a threshold is only considered unacceptable if the absolute vulnerability (prediction accuracy) is also above a threshold. High relative improvement on a low-accuracy baseline is less concerning than high absolute accuracy.

5. Differential Privacy (DP)

Epsilon Limitations: The privacy budget ( $\epsilon$ ) is not an adequate metric for reporting disclosure vulnerability unless it is set to a value close to 0. For larger $\epsilon$ values, theoretical guarantees do not translate to empirical privacy.
Empirical Evaluation: Even for DP-based synthetic data, disclosure vulnerability must be evaluated empirically using the same membership and attribute disclosure metrics applied to non-DP synthetic data.

Significance and Claims

The paper claims to provide the first consensus framework for evaluating privacy vulnerabilities in synthetic data. Its primary significance lies in:

Standardization: Moving the field away from ad-hoc metric selection toward a unified set of recommendations based on expert consensus.
Correction of Misconceptions: Explicitly discouraging the use of record-level similarity as a privacy proxy and clarifying the limitations of the DP privacy budget.
Practical Guidance: Offering specific, actionable steps for calculating membership and attribute disclosure (e.g., using relative metrics, defining QIs, and distinguishing between knowledge generation and disclosure).
Future Research Directions: Identifying gaps where current metrics fail, such as the lack of precise identity disclosure metrics for synthetic data and the need for better anchor values for thresholds.

The authors emphasize that their goal was not to invent new metrics but to consolidate existing knowledge and provide a framework to support regulatory certainty and the responsible sharing of synthetic data. They acknowledge limitations, including the potential for group bias in the Delphi process and the inherent subjectivity in defining quasi-identifiers.