🤖 machine learning

LLM-as-a-Discriminator: When Synthetic Tables Still Look Real

This paper proposes and evaluates an LLM-based discrimination method for auditing the privacy of synthetic tabular data, demonstrating that large language models can effectively distinguish between real and synthetic tables across various synthesis models and datasets, offering a practical alternative to traditional statistical tests and human evaluation.

Original authors: Manel Slokom, Malek Slokom, Thierno Kante

Published 2026-06-10

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Manel Slokom, Malek Slokom, Thierno Kante

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a food critic trying to tell the difference between a real, home-cooked meal and a perfect-looking fake meal made by a robot chef. In the world of data, organizations often use "synthetic data" (fake data made by computers) to share information without revealing private details about real people. But how do you know if the fake data is good enough to fool a detective?

This paper introduces a new way to test that: using a super-smart AI (a Large Language Model or LLM) as the detective.

Here is the breakdown of their experiment in simple terms:

The Setup: The "Taste Test"

The researchers set up a game where the AI detective has to look at a small sample of a table (like a spreadsheet with 20 rows) and decide: "Is this Real (from real people) or Synthetic (fake)?"

They tested the AI under two different "threat" scenarios:

Scenario C1 (The Blind Taste Test): The AI only sees the table itself. It's like looking at a plate of food without knowing the recipe or the chef's reputation.
Scenario C2 (The Full Menu): The AI sees the table plus a detailed summary of the data's statistics (like the average age, how spread out the numbers are, etc.). This is like giving the detective the recipe and the nutritional facts alongside the food.

The Players

They used two different "detectives" (AI models):

Gemini: A very powerful, commercial AI from Google.
LLaMA: A popular open-source AI from Meta (run here via a service called Groq).

They also tested three different "robot chefs" (synthesis methods) that created the fake data: CTGAN, TVAE, and Gaussian Copula.

The Results: The Detectives Had Very Different Personalities

1. The "Overconfident" Detective (LLaMA/Groq)
This detective was terrible at the game, but for different reasons depending on the dataset:

On the "Adult" dataset: It was so lazy it just guessed "REAL" for everything. It didn't even try to look for fakes.
On the "Census" dataset: It got the opposite bias and guessed "SYNTHETIC" for everything.
The Lesson: Just because an AI says "I can tell the difference" doesn't mean it actually can. Sometimes it just has a strong habit of guessing one way.

2. The "Sharp-Eyed" Detective (Gemini)
This detective was much better, but its performance depended on the data:

On the "Adult" dataset: It was a master detective. It spotted the fakes 100% of the time, even when it only saw the table (Scenario C1). It found tiny cracks in the logic, like a fake education level that didn't match the years of schooling.
On the "Census" dataset: It was great at spotting fakes when it only saw the table (C1). But when given the extra statistics (C2), it got confused. The extra numbers actually helped the fake data blend in, making it harder for the AI to tell them apart.

3. The Human vs. The Machine
The researchers also asked two real humans to play the game.

LLaMA performed worse than the humans.
Gemini performed just as well as, or sometimes even better than, the humans.
What did they spot? Both the smart AI and the humans noticed the same weird things: impossible combinations (like a person being a "husband" but also "never married") or broken rules (like an education level saying "High School" but having a number code for "College").

The Big Takeaway

The paper concludes that the choice of AI detective matters more than the choice of the robot chef.

If you use a weak or biased AI (like the LLaMA version they tested), you might think your fake data is safe because the AI can't tell the difference. But that's just because the AI is bad at the job, not because the data is perfect.
If you use a strong AI (like Gemini), it can often spot the fakes, especially if the fake data has logical errors (like a 10-year-old being a CEO).

The "Privacy Score" (DRS)
The authors created a score called the Disclosure Risk Score (DRS).

0%: The AI can't tell real from fake (Good for privacy, but only if the AI is actually smart enough to try!).
100%: The AI spots every single fake (Bad for privacy; the fake data is too obvious).

Why This Matters

The paper argues that using an AI to check if synthetic data is "real-looking" is a practical tool for privacy auditors. However, you have to be careful:

Don't just trust the result; check which AI gave the result.
Don't assume that because one AI can't tell the difference, the data is safe. It might just be a bad detective.
The best AI (Gemini) found that the fake data often had "glitches" in logic that humans also noticed, proving that these AI models are becoming good enough to act as privacy auditors.

In short: If you want to know if your fake data looks real, ask a very smart AI to look at it. But make sure you pick a smart AI, not a lazy one, or you'll get a false sense of security.

Technical Summary: LLM-as-a-Discriminator

Problem Statement

Organizations increasingly utilize synthetic tabular data to share information while mitigating privacy risks. However, auditing the privacy of such data remains challenging. Classical Statistical Disclosure Control (SDC) tools (e.g., $k$ -anonymity) and modern attack-based measures (e.g., Membership Inference Attacks or MIA) often fail to capture whether a synthetic table is perceptually distinguishable from a real one by a human or AI observer. While MIA frames privacy risk as a binary classification of whether a record belonged to the training set, it does not directly assess if an informed adversary can distinguish a synthetic release from a real one based on the data's appearance and distributional properties.

Methodology

The authors propose an LLM-as-Discriminator protocol, framing privacy auditing as a binary classification task where a Large Language Model (LLM) acts as a discriminator ( $D$ ).

Experimental Conditions

The study evaluates two threat models:

C1 (Table Only): The discriminator receives a 20-row Markdown sample of the table with column names and dataset dimensions. This simulates an adversary with access only to the data release.
C2 (Table + Metadata): The same sample is augmented with a structured metadata block containing per-column descriptive statistics (mean, std, quartiles, skewness, kurtosis), Shapiro–Wilk test results, top- $k$ category frequencies, Shannon entropy, and a Pearson correlation matrix. This simulates a scenario where summary statistics are published alongside the synthetic data.

Protocol and Metrics

Models: The study utilizes Gemini-2.5-Flash (Google) and LLaMA-3.1-8b-instant (via Groq) as discriminators.
Synthesis Methods: Three generators were tested: CTGAN (Conditional GAN), TVAE (Variational Autoencoder), and Gaussian Copula.
Datasets: Two census datasets were used: UCI Adult (human-readable string encodings) and ACS Census 2018 (numeric integer encodings for categorical columns).
Disclosure Risk Score (DRS): To translate raw accuracy into a privacy-oriented scalar, the authors define DRS as the minimum of the true positive rates for both classes:
$DRS = \min(\hat{p}_{REAL}, \hat{p}_{SYNTHETIC})$
A DRS near 0 indicates the discriminator cannot distinguish the data (either due to good privacy or a collapsed model), while a DRS near 0.5 indicates chance-level discrimination. A DRS > 0.5 suggests the synthetic data contains discriminative artifacts.
Baselines: The LLM results were compared against:
1. Classifier Two-Sample Test (C2ST): A logistic regression classifier trained to separate real and synthetic distributions.
2. Record Linkage: Measuring the Euclidean distance between synthetic records and their nearest real neighbors.
3. Human Annotation: A pilot study with two human annotators performing the same C1/C2 tasks.

Key Contributions

Protocol Definition: A formal LLM-as-Discriminator protocol for black-box privacy auditing under two distinct threat conditions (C1 and C2).
Empirical Evaluation: A comprehensive evaluation across 451 valid trials involving two datasets, three synthesis methods, and two LLM families, revealing strong dependencies on model choice and data encoding.
Metric Proposal: The introduction of the Disclosure Risk Score (DRS) to normalize discrimination accuracy and account for label-bias artifacts.
Human-LLM Comparison: A controlled pilot demonstrating that while frontier LLMs can match or exceed human performance, smaller open models may collapse to biased baselines, failing to provide a useful privacy signal.

Experimental Results

Model Performance Disparity

The choice of discriminator model proved as critical as the choice of synthesizer:

LLaMA (Groq): Exhibited severe bias. On UCI Adult, it labeled nearly all tables as REAL (DRS = 0%). On ACS Census, it labeled all tables as SYNTHETIC (DRS = 0%). In both cases, the model collapsed, providing no discriminative signal.
Gemini: Demonstrated high discriminative capability.
- On UCI Adult, Gemini achieved DRS = 100% for CTGAN and TVAE under both C1 and C2 conditions.
- On ACS Census, Gemini achieved DRS = 100% under C1 for all methods. Under C2, performance dropped for CTGAN (0%) and TVAE (25%), while Gaussian Copula remained at 100%.

Metadata Effects (C1 vs. C2)

The impact of adding distributional metadata was dataset- and method-dependent:

On UCI Adult, metadata had no effect on Gemini's perfect discrimination of CTGAN and TVAE.
On ACS Census, metadata significantly reduced discrimination for CTGAN and TVAE, suggesting that when real and synthetic marginals are closely aligned, summary statistics can obscure the detection signal.

Alignment with Formal Baselines

UCI Adult: Gemini's DRS reached a ceiling (100%) for CTGAN and TVAE, preventing method ranking. However, C2ST scores varied (TVAE: 0.725, CTGAN: 0.538), indicating that while Gemini detected artifacts in both, C2ST could differentiate the degree of distributional separation.
ACS Census: Under C2, the DRS ordering (Gaussian Copula > TVAE > CTGAN) was inverted relative to C2ST scores. Gaussian Copula had a low C2ST score (0.542) but maintained high DRS, suggesting its artifacts remained perceptually salient despite statistical similarity.

Human vs. LLM

Human Performance: Human annotators achieved a pooled DRS of 66.4%, significantly outperforming LLaMA (which collapsed to 0%) but generally lower than Gemini.
Gemini vs. Humans: Gemini matched or exceeded human performance in most cells, particularly on UCI Adult where it achieved 100% DRS compared to human rates of 33–60%.
Reasoning: Both humans and Gemini identified the same structural artifacts as primary discriminators, such as broken mappings between education levels and numeric codes (e.g., "Bachelors" vs. 13) and contradictions in marital status/relationship fields.

Significance and Claims

The paper claims that LLM discrimination is a practical privacy audit signal, but only when interpreted with care regarding the specific model and data encoding used.

Model Dependency: The discriminator's capability is the bottleneck. A collapsed model (like LLaMA in this study) yields a DRS of 0%, which mimics perfect privacy but actually indicates a failure of the evaluator. Conversely, a strong model (Gemini) can detect subtle structural violations that statistical tests might miss.
Practical Utility: The authors position DRS as a "fast distributional screen" rather than a standalone privacy guarantee. They recommend using DRS alongside C2ST for initial screening, followed by more rigorous MIA if record-level memorization is a specific concern.
Interpretability: Unlike black-box statistical tests, LLMs provide natural language rationales (e.g., identifying specific broken constraints), making the audit process transparent and actionable for practitioners.

The study concludes that while the paradigm is promising, future work requires locally hosted models to avoid API failures, broader validation across more synthesis methods (including diffusion and LLM-based generators), and encoding-aware auditing to handle numeric vs. string representations.