Repurposing Image Diffusion Models for Adversarial Synthetic Structured Data: A Case Study of Ground Truth Drift

1. Problem Statement

The paper addresses a shifting threat landscape in data security: the ability of low-resource adversaries to generate synthetic structured data (tabular data) that can deceive machine learning pipelines.

• The Shift: Historically, creating convincing synthetic tabular data required specialized generators (e.g., CTGAN, TabDDPM) or manual statistical manipulation. The authors argue that public, high-capacity image diffusion models (like Stable Diffusion) can now be repurposed for this task without architectural modification.
• The Threat: This leads to "Ground Truth Drift." This is defined as the silent reclassification of AI-generated outputs as authentic when they enter downstream training pipelines that do not interrogate their provenance. Unlike "model collapse" (degradation from training on AI outputs), ground truth drift occurs when synthetic data is introduced into a pipeline as if it were real, corrupting the statistical substrate of future models.
• The Gap: Current forensic audits for tabular data focus on statistical realism (column distributions, pairwise correlations) rather than semantic/logical consistency (row-level logic). The paper posits that an attacker can exploit this gap by generating data that passes statistical audits but fails semantic checks.

2. Methodology

The study employs a "low-resource" attack model using an unmodified Stable Diffusion v1.5 U-Net to generate data from the UCI Adult Income dataset.

A. Core Technique: Input Reshaping

Since diffusion models expect image tensors (Height $\times$ Width $\times$ Channels) and tabular data is a flat vector, the authors use a reshape strategy:

1. Preprocessing: Categorical columns are one-hot encoded; numerical columns are scaled.
2. Mapping: Each row is flattened into a feature vector and mapped onto a fixed $10 \times 11$ single-channel grid (110 pixels).
3. Inference: The model treats these grids as "pseudo-images." During generation, noise is sampled, and the resulting pixel values are read back in a fixed order to reconstruct a synthetic tabular row.

B. Experimental Design: Layout Strategies

The authors hypothesize that the spatial locality bias of convolutional layers (U-Net) is critical. Features that must correlate (e.g., Sex and Relationship) must be placed near each other on the grid for the model to learn their relationship. Three layouts were tested:

1. Baseline (Arbitrary): Features placed in processing order with no structural logic.
2. Clustered: Features grouped based on pairwise correlation coefficients calculated from the training data.
3. Manual (Semantic): Features grouped by human-defined semantic relatedness (e.g., placing Education next to Occupation).

C. Evaluation Metrics

The generated data (5,000 rows per layout) was evaluated on:

• Statistical Fidelity: Measured via SDMetrics (column shape scores and pairwise correlations).
• Semantic Consistency: A rule-based checker flagging logical violations (e.g., negative capital gains, hours worked > 100, contradictory Sex/Relationship pairs).
• Downstream Utility: A "Train-on-Synthetic, Test-on-Real" (TSTR) evaluation using an income classifier ($>50k$ vs. $\le 50k$).
• Privacy Risk: Disclosure scores to check for data memorization.

3. Key Results

The results demonstrate a stark divergence between statistical fidelity and semantic consistency.

• Statistical Success: All layouts achieved high statistical fidelity (80%+), with the Clustered layout performing best. The model successfully learned column distributions and pairwise correlations without fine-tuning.
• Semantic Failure:
  • The Baseline layout failed catastrophically on logic (70% error rate), primarily due to negative capital gains.
  • Manual and Clustered layouts reduced logic errors to ~12% by normalizing constraints and grouping related features.
  • Limitation: Even the best layouts could not eliminate all errors. The U-Net simply swapped one type of semantic error for another (e.g., reducing "Female + Husband" errors but increasing "Male + Wife" errors), indicating a ceiling imposed by the lack of explicit logical constraints in the architecture.
• Downstream Utility: The Clustered layout significantly outperformed others in the TSTR test (F1=0.25 vs 0.056) because it better preserved the joint distribution of high-income indicators (e.g., correctly correlating Married, Husband, and Bachelors degrees).

4. Key Contributions

1. Conceptual Distinction (Synthetic Evidence vs. Synthetic Media):
   • Synthetic Media: Targets humans; judged by perceptual realism (does it look real?).
   • Synthetic Evidence: Targets machines; judged by statistical realism (does it fit the correlation audit?).
   • The paper introduces "Synthetic Evidence" as a distinct category of AI-generated material intended for closed evidentiary pipelines.
2. Architectural Convertibility:
   • Demonstrates that a model trained for perceptual tasks (images) can be converted to statistical tasks (tables) simply by reshaping the input tensor, without retraining or fine-tuning.
3. Ground Truth Drift by Design:
   • While previous examples of drift were accidental (e.g., mislabeled medical images), this study proves drift can be deliberately induced by an adversary using off-the-shelf tools.
4. The "Audit Gap":
   • The study highlights that standard tabular audits (checking columns and correlations) are insufficient to detect adversarial synthetic data generated by image models, as these models pass statistical checks while failing row-level logic.

5. Significance and Implications

• Lowered Barrier to Entry: The cost of manufacturing adversarial synthetic data has shifted from requiring model training expertise to requiring only data pipeline access and a public image model. This democratizes the ability to poison datasets.
• Forensic Vulnerability: Traditional forensic methods (looking for manual editing artifacts like out-of-sequence IDs or duplicate entries) will fail against diffusion-generated data. The generated rows are statistically "clean" and lack the fingerprints of human manipulation.
• The Semantic Ceiling: The primary defense against this attack is currently row-level semantic validation. While the model passes statistical audits, it still produces logically impossible rows (e.g., negative income). However, as models improve or attackers add post-processing, this gap may close.
• Real-World Anchor: The paper references the Francesca Gino case (a Harvard professor accused of research misconduct) to illustrate the stakes. If an adversary could use a diffusion model to generate synthetic data supporting a hypothesis, it would be nearly impossible to distinguish from real data using current statistical forensics, potentially undermining scientific integrity and fraud detection systems.

Conclusion: The paper concludes that the boundary between "media" and "evidence" has collapsed at the point of generation. An unmodified vision model can produce structured data that satisfies the statistical audits of modern machine learning pipelines, creating a new, low-cost vector for Ground Truth Drift.