"What can theory alone give you?" Tight audit experiments for differentially private synthetic data generation
"What do you want from theory alone?" Experimenting with Tight Auditing of Differentially Private Synthetic Data Generation
Translation in progress — untranslated text is omitted.
Researchers conducted a large-scale membership inference audit of six differentially private synthetic data generation (DP-SDG) implementations and found DP violations in four of them, including a new violation in a DPWGAN implementation submitted to the NIST DP Synthetic Data Challenge. The audit estimates actual leakage by distinguishing between gaming and membership inference attacks (MIA), and finds that commonly used black-box attacks (such as DCR) severely underestimate leakage, giving estimates close to 0 for some implementations. The authors propose white-box MIAs for PrivBayes and MST (which the authors describe as the first), and adapt the gradient canary attack to DPWGAN, achieving empirical estimates of 3.23, 3.10 and 3.02 for PrivBayes (Hazy), MST (Smartnoise) and DPWGAN (NIST) respectively at a theoretical ε=4.0. Most violations stem from implementations extracting unnoised metadata directly from the input dataset, and the audit pipeline can also automatically identify early stopping and noise scale configuration vulnerabilities. The code is publicly available.
- Algorithmic or code bugs in DP synthetic data generation (DP-SDG) implementations may cause actual information leakage to exceed theoretical guarantees, requiring auditing to verify whether the theoretical ε holds in practice.
- The authors use membership inference attacks (MIA) to play the distinguishing game and estimate the empirical leakage εemp, comparing black-box, passive/active white-box threat models with worst-case target records and neighboring datasets, auditing two implementations each of PrivBayes, MST, and DPWGAN.
- The authors state that black-box MIA (especially DCR) estimates are too loose; white-box attacks plus implementation-specific worst-case datasets tighten estimates for PrivBayes and MST, while DPWGAN requires active white-box; automated auditing found known violations in 4 implementations and one new violation in DPWGAN (NIST).
- The authors point out that auditing requires training thousands of models and is computationally expensive, and that the maximum auditable ε is limited by confidence intervals; one-shot auditing techniques are not applicable to generative models and are left for future work.
An audit of six differentially private synthetic data implementations found DP violations in four, and common black-box membership inference attacks severely underestimate actual leakage.