Understanding the Impact of Data Domain Extraction on Synthetic Data Privacy
Extracted source text · arXiv 2504.08254
\documentclass{article} %
\usepackage{iclr2025_conference,times}
%
\input{math_commands.tex}
\usepackage[hyphens]{url}
\makeatletter
\def\url@leostyle{%
\@ifundefined{selectfont}{\def\UrlFont{}}%
{\def\UrlFont{}}%
}
\makeatother
\urlstyle{leo}
\definecolor{darkred}{RGB}{90, 0, 0}
\definecolor{darkblue}{RGB}{0,0,130}
\usepackage[bookmarks=false, colorlinks=true, plainpages=false, linkcolor=darkred, citecolor=darkred, urlcolor=darkblue, filecolor=blue]{hyperref}
\renewcommand{\footnotesize}{\fontsize{8pt}{9pt}\selectfont}
%
%
\usepackage{paralist}
\usepackage{enumitem}
\usepackage{graphicx} %
\setkeys{Gin}{width=\textwidth, height=\textheight, keepaspectratio}
\usepackage[skip=0pt,font=footnotesize,justification=centering]{subcaption}
\newif\ifcomment
\commenttrue
%
\usepackage[hang,flushmargin,stable]{footmisc}
\renewcommand{\footnoterule}{%
\kern -3pt
\hrule width 1in
\kern 2pt
}
\usepackage[compact]{titlesec}
\titlespacing*{\section}{0pt}{*1}{1pt}
\titlespacing*{\subsection}{0pt}{*1}{1pt}
%
\setitemize{noitemsep,topsep=0pt,parsep=0pt,partopsep=0pt,leftmargin=2em}
\ifcomment
\newcommand{\edc}[1]{\textbf{\em\color{red}EDC: #1}}
\newcommand{\gvg}[1]{\textbf{\em\color{blue}GG: #1}}
\newcommand{\sundar}[1]{\textbf{\em\color{purple}MS: #1}}
\newcommand{\sof}[1]{\textbf{\em\color{brown}SOF: #1}}
\else
\newcommand\edc[1]{}
\newcommand\gvg[1]{}
\newcommand\sundar[1]{}
\newcommand\sof[1]{}
\fi
\setlength{\abovecaptionskip}{3pt plus 2pt minus 1pt}
\setlength{\belowcaptionskip}{-2pt}
\newcommand{\descr}[1]{\noindent\textbf{#1}}
%
%
%
\title{Understanding the Impact of Data Domain \\ Extraction on Synthetic Data Privacy}
%
%
%
\author{%
Georgi Ganev$^{1,2}$ \quad Meenatchi Sundaram Muthu Selva Annamalai$^{1}$ \\
\textbf{Sofiane Mahiou}$^{2}$ \quad \textbf{Emiliano De Cristofaro}$^{3}$ \\
$^1$UCL \quad $^2$SAS \quad $^3$UC Riverside \\
\texttt{\href{mailto:georgi.ganev.16@ucl.ac.uk}{georgi.ganev.16@ucl.ac.uk}}
}
%
%
%
%
%
%
%
\newcommand{\fix}{\marginpar{FIX}}
\newcommand{\new}{\marginpar{NEW}}
\iclrfinalcopy %
\begin{document}
\maketitle
\vspace*{-0.4cm}
\begin{abstract}
%
%
%
%
%
Privacy attacks, particularly membership inference attacks (MIAs), are widely used to assess the privacy of generative models for tabular synthetic data, including those with Differential Privacy (DP) guarantees.
These attacks often exploit outliers, which are especially vulnerable due to their position at the boundaries of the data domain (e.g., at the minimum and maximum values).
However, the role of data domain extraction in generative models and its impact on privacy attacks have been overlooked.
%
In this paper, we examine three strategies for defining the data domain: assuming it is externally provided (ideally from public data), extracting it directly from the input data, and extracting it with DP mechanisms.
While common in popular implementations and libraries, we show that the second approach breaks end-to-end DP guarantees and leaves models vulnerable.
While using a provided domain (if representative) is preferable, extracting it with DP can also defend against popular MIAs, even at high privacy budgets.
\end{abstract}
\section{Introduction}
Differentially Private (DP) synthetic tabular data promises to support the safe release of sensitive data by training generative machine learning models while limiting individual-level information leakage.
This approach is gaining significant traction~\citep{jordon2022synthetic, hu2024sok,cristofaro2024synthetic}
and is increasingly being deployed in real-world applications, from public releases of census data~\citep{nasem2020census, ons2023synthesising, hod2024differentially} to data sharing in financial and healthcare contexts~\citep{ico2023synthetic, microsoft2022iom}.
Synthetic data has also attracted interest from regulators~\citep{ico2023privacy,ico2023synthetic, fca2024using}, who are shifting focus from assessing the anonymity of released datasets~\citep{eu2014opinion} to evaluating generative models%
~\citep{eu2024opinion}.
In this context, membership inference attacks (MIAs)~\citep{shokri2017membership, hayes2019logan}, %
are used as a measuring stick for privacy leakage.
MIAs are typically evaluated using a privacy game that entails identifying (or crafting) a vulnerable record, training a generative model with it and without it, generating synthetic data, and having the adversary distinguish whether or not that record was used to train the model.
In this game, outliers located at the boundaries of the data domain (e.g., at each column's min or max values) are particularly vulnerable~\citep{stadler2022synthetic, annamalai2024what}. %
However, adding/removing outliers can significantly impact the training of DP generative models, especially the initial pre-processing steps (e.g., scaling, normalization, discretization, encoding, etc.) common in DP synthetic tabular data algorithms.
%
This presents a unique challenge for tabular data, unlike, e.g., for images or text, where input pixels and tokens have clearly defined domains (e.g., $[0, 255]$ or ASCII characters).
Nonetheless, many implementations and libraries for DP synthetic tabular data have overlooked this issue, as they directly extract data domain from the input data~\citep{zhang2017privbayes, ping2017datasynthesizer, vietri2020new, mckenna2021winning, qian2023synthcity, mahiou2022dpart, du2024towards}.
%
%
%
In this paper, we examine how different strategies for extracting the data domain affect the privacy of DP generative models for tabular synthetic data.
%
Specifically, we compare a publicly available data domain to extracting the domain directly from the input data---denoted, respectively, as {\em provided} and {\em extracted} domain.
We do so both with and without DP and for two generative models, PrivBayes~\citep{zhang2017privbayes} and MST~\citep{mckenna2021winning}.
Since both models require discretized data, we adapt and assess four DP discretization strategies: uniform, quantile, k-means, and PrivTree~\citep{zhang2016privtree}.
For the MIA, we use the GroundHog attack~\citep{stadler2022synthetic}.
%
In short, our experiments show that:
\begin{itemize}
\item Extracting the data domain directly from the input data, %
which is the common practice, breaks the end-to-end DP guarantees of generative models and exposes outliers to MIAs. %
\item Assuming that a representative data domain is provided and extracting it with DP (up to $\epsilon=100$) successfully protects outliers from specific MIAs.
In particular, adopting a DP domain extraction strategy could address many previously identified DP vulnerabilities in open-source implementations and libraries.
\item The GroundHog attack~\citep{stadler2022synthetic} may be more effective at detecting issues with data domain extraction than with vulnerabilities of the generative models themselves.
\end{itemize}
%
%
\descr{From Domain Extraction to Discretization.}
In separate work~\citep{ganev2025importance}, we examine the broader question of discretization in end-to-end DP generative models, primarily focusing on utility.
In contrast, this paper focuses specifically on data domain extraction strategies and their privacy implications, which is closely related to Research Question~4 in~\citep{ganev2025importance}.
\section{Experimental Framework}
\label{sec:fram}
As mentioned, we aim to evaluate the impact of the domain extraction strategy on privacy leakage in (end-to-end) DP generative models using an MIA.
We experiment with three strategies:
1) assuming a provided data domain set to the full dataset's range, regardless of the target record's inclusion/exclusion,
2) extracting it directly from the input data (without DP), as done in numerous publicly available implementations and libraries~\citep{zhang2017privbayes, ping2017datasynthesizer, vietri2020new, mckenna2021winning, qian2023synthcity, mahiou2022dpart, du2024towards}, or
3) extracting the data domain with DP~\citep{desfontaines2020lowering}.
\descr{MIA Instantiation.}
To evaluate the privacy of the resulting synthetic data, we use GroundHog~\citep{stadler2022synthetic}, one of the most widely used MIAs for synthetic tabular data, %
on the Wine dataset~\citep{dua2017data}.
First, we select a vulnerable record as the target, picking the data point furthest from all others in the training set~\citep{meeus2023achilles} and ensuring it lies outside their domain.
Then, we train two sets of 200 shadow models: %
one trained on the full dataset, including the target record, and the other excluding it.
To do so, for each model, we extract the domain, discretize the data, and train the generative model.
We generate synthetic datasets and extract statistical features (minimum, maximum, mean, median, and standard deviation, corresponding to the naive feature set $F_{naive}$ in~\citep{stadler2022synthetic}) from each column of the synthetic datasets.
Half of these datasets are used to train a classifier, and the adversary's success in distinguishing between the two scenarios is measured using Area Under the Curve (AUC), reported on the remaining data.
%
\descr{Settings.}
We choose PrivBayes~\citep{zhang2017privbayes} and MST~\citep{mckenna2021winning} as our DP generative models, using $\epsilon=1$ for pre-processing (split evenly between domain extraction, when applicable, and discretization) and $\epsilon=1$ for the model (with $\delta=1\mathrm{e}{-5}$ for MST).
We use 20 bins for all discretization strategies and the default hyperparameters for both models.
The selected target record represents a worst-case scenario, consistent with prior work~\citep{stadler2022synthetic, annamalai2024what}, %
given two columns with values significantly larger than for the remaining records (289 and 440 vs.~146.5 and 366.5).
%
Due to space limitations, we defer additional details, including the DP data extraction method, discretization strategies, DP generative models, and dataset, to Appendix~\ref{app:elems}.
\section{Experimental Evaluation}
\label{sec:exp}
\begin{figure*}[t!]
\centering
\begin{subfigure}{0.75\linewidth}
\includegraphics[width=0.99\linewidth]{plots/legend.pdf}
\end{subfigure}
\centering
\begin{subfigure}{0.75\linewidth}
\includegraphics[width=0.99\linewidth]{plots/graph_1_1.pdf}
\end{subfigure}
\caption{\small Privacy leakage with \emph{provided} and \emph{extracted} domain (w/ and w/o DP) for the four DP discretizers ($\epsilon=1$) and two DP generative models ($\epsilon=1$) on a target record \emph{outside} the domain of the remaining data.}
\label{fig:attack_1}
\vspace{-0.3cm}
\end{figure*}
Figure~\ref{fig:attack_1} provides an overview of our experiments, quantifying the impact of the three domain extraction strategies on privacy leakage as measured by GroundHog~\citep{stadler2022synthetic}'s success with four discretizers and two generative models.
\descr{Direct Domain Extraction.}
Regardless of discretization, extracting the domain directly from the input data (bars with horizontal lines) without a proper privacy mechanism breaks the end-to-end DP guarantees, providing highly informative features.
This enables the adversary to achieve near-perfect accuracy in all cases, rendering the synthetic data non-private regardless of the discretizer or generative model.
This performance is equivalent to that of using the default domain extraction/discretization strategy (grey bars), i.e., uniform discretization with direct domain extraction.
\descr{Provided Domain/DP Domain Extraction.}
By contrast, using methods that respect the end-to-end DP pipeline, i.e., either assuming a provided domain (bars with crosses) or extracting the domain with DP (bars with circles), substantially reduces the adversary's success rate.
With only one exception (when using the k-means discretizer with provided domain), the attack success rate is no better than random guessing. %
This has several important implications, as discussed next.
First, extracting the domain in a DP-compliant way is sufficient to protect against GroundHog~\citep{stadler2022synthetic}'s adversary.
Their success drops significantly even in settings that could be considered non-private, i.e., (discretizer, generator)-$\epsilon$ values of (1, 100), (100, 1), (100, 100), and even (1, 1,000), as shown in Figure~\ref{fig:attack_100} and~\ref{fig:attack_1_1000} (see Appendix~\ref{app:plots}).
The attack becomes effective at higher discretizer $\epsilon$ values, i.e., (1,000, 1) and (1,000, 1,000) (see Figure~\ref{fig:attack_1000_1} and~\ref{fig:attack_1000_1000}); also, recall that it achieves nearly 100\% success when the domain is directly extracted from the data.
This suggests that the effectiveness of the GroundHog attack may primarily be due to domain extraction rather than inherent vulnerabilities in the model.\footnote{These results are specific to GroundHog~\citep{stadler2022synthetic}. Studying the impact of DP domain extraction on other MIAs as well as other models besides PrivBayes and MST, is left to future work.}
To further validate this, we run additional experiments on a target record that is farther away from the others but still within their domain (see Figure~\ref{fig:attack_in} in Appendix~\ref{app:plots}) and observe that the attack's success remains close to random across all $\epsilon$ values.
Second, adopting a DP domain extraction strategy could help address privacy vulnerabilities identified by prior research~\citep{annamalai2024what, ganev2025elusive} in popular model implementations and libraries~\citep{ping2017datasynthesizer, qian2023synthcity} that directly extract the domain from the input data.
%
%
In other words, incorporating such techniques could make DP generative model implementations more robust and better align them with end-to-end DP guarantees.
Finally, while extracting the domain in a DP way slightly reduces, on average, the adversary's success compared to using a provided data domain, this may come at the cost of utility.
Therefore, practitioners should prefer using a trusted, provided data domain when available (e.g., codebooks for census data), rather than spending additional privacy budget to extract it.
However, further research is needed to explore these trade-offs and investigate enhanced methods for DP domain extraction.
\section{Conclusion}
This paper focused on an important yet overlooked issue in implementations of DP generative models: how to extract data domain
We show that extracting the data domain directly from the input, which is unfortunately common in the wild~\citep{ping2017datasynthesizer, qian2023synthcity}, breaks DP guarantees and leaves models vulnerable.
We also find that, while using a provided domain (e.g., from public data) is preferable, extracting it with DP can also defend against MIAs, even at large $\epsilon$ values.
Overall, we are confident that our research will shed light on the importance of the integrity of end-to-end DP pipelines when developing and releasing DP generative models.
Our work also highlights the need for further analysis of membership inference attacks against DP generative models, e.g., understanding the extent to which the privacy leakage they exploit may be due to issues like domain extraction rather than inherent vulnerabilities in the models.
%\bibliography{mybib}
\input{no_comments.bbl}
\bibliographystyle{iclr2025_conference}
%
\appendix
\section{More Details on the Experimental Framework}
\label{app:elems}
We now provide details of the experimental framework introduced in Section~\ref{sec:fram}, specifically, DP data extraction methods, DP discretization strategies, DP generative models, and dataset.
\descr{DP Domain Extraction.}
To estimate the domain of numerical data given a privacy budget, $\epsilon$, we implement the algorithm by \citet{desfontaines2020lowering}, also included in the popular OpenDP library~\citep{opendp2021smartnoise}.
It derives bounds using a noisy histogram over an exponential range $[-2^{m}, 2^{m}]$ (with $m$ typically set to 32), determined by iteratively reducing a threshold until at least one bin exceeds it, using the highest and lowest bin edges above the threshold as the domain bounds.
\descr{DP Discretizers.}
We use the following four methods to make the four discretizers satisfy DP (note that the data domain, privacy budget, and number of bins $b$ are provided as input to all discretizers).
For the DP implementation, we use primitives of two well-known open-source libraries, namely, Harvard's OpenDP~\citep{opendp2021smartnoise} and IBM's Diffprivlib~\citep{holohan2019diffprivlib}.
\begin{itemize}
\item \textit{Uniform} divides the data domain into $b$ intervals of equal width.
It does not consume any privacy budget and relies solely on the provided data domain to determine bin edges.\smallskip
\item \textit{Quantile} distributes data such that each bin contains approximately an equal fraction of data points, specifically $1/b$.
The privacy budget $\epsilon$ is split evenly across a given number of bins, with each quantile calculated using $\epsilon/b$.
We use the method proposed by~\citet{smith2011privacy}, which samples quantile values from a discrete distribution.
Each $q_i$ is computed as $(x_{i+1} - x_i) \cdot \exp(-\epsilon |i - \alpha n|)$, where $x_i$ is the value at index $i$ in the sorted dataset, $\alpha$ is the target quantile.\smallskip
\item \textit{K-means} employs a standard k-means clustering algorithm to group the data into clusters and then splits them into non-overlapping intervals.
It is based on~\citep{su2016differentially}, which adds Geometric noise~\citep{ghosh2009universally} to the counts of the nearest neighbors for cluster centers and Laplace to the sum of values per dimension.
However, some clusters may occasionally be empty, resulting in fewer than $b$ bins.\smallskip
\item \textit{PrivTree}~\citep{zhang2016privtree} is a tree-based method that recursively splits the data domain into subdomains.
It ensures DP by adding Laplace noise~\citep{dwork2006calibrating} to the count at each step.
Subdomains are further split if the noisy count exceeds a threshold, $\tau$; otherwise, they form leaves, with bin edges corresponding to the domains of all leaves.
The threshold parameter $\tau$ is set to ${1}/{b}$, making $b$ an upper limit for the actual number of bins produced.
\end{itemize}
\descr{DP Generative Models.}
The two DP generative models we use, PrivBayes~\citep{zhang2017privbayes} and MST~\citep{mckenna2021winning}, rely on the {\em select–measure–generate} paradigm~\citep{mckenna2021winning}, %
as they: 1) select a collection of (low-dimensional) marginals, 2) measure them privately with a noise-addition mechanism, and 3) generate synthetic data consistent with the measurements.
PrivBayes~\citep{zhang2017privbayes}
uses a Bayesian network to select $k$-degree marginals by optimizing the mutual information between them, using the Exponential mechanism~\citep{dwork2006our}.
Then, propagating though the network, the model relies on the Laplace mechanism~\citep{dwork2006calibrating} to measure noisy counts and translate them to conditional marginals, which could later be sampled to generate synthetic data.
%
MST~\citep{mckenna2021winning}
forms a maximum spanning tree (an undirected graph) of the underlying correlation graph by selecting all one-way marginals and a collection of two-way marginals.
These marginals are noisily measured via the Gaussian mechanism~\citep{mcsherry2007mechanism}.
Finally, to create new data, the measurements are processed through Private-PGM~\citep{mckenna2019graphical}.
\descr{Wine Dataset}~\citep{dua2017data}. As mentioned, our experiments are run on the Wine dataset, which consists of 4,898 wine samples, each described by 11 continuous physicochemical attributes, with the goal of modeling wine quality.
\section{Additional Plots}
\label{app:plots}
In Figure~\ref{fig:attack_100} and~\ref{fig:attack_1000}, we present additional results related to running the GroundHog attack~\citep{stadler2022synthetic} on PrivBayes and MST -- specifically, with a target record outside the domain of the remaining data with $\epsilon=1/100 \text{ and } 1/1,000$, respectively.
Figure~\ref{fig:attack_in} also shows results with a target record inside the domain with $\epsilon=1, 100 \text{ and } 1,000$.
We discuss these results in Section~\ref{sec:exp}.
\begin{figure*}[t!]
\centering
\begin{subfigure}{0.8\linewidth}
\includegraphics[width=0.99\linewidth]{plots/legend.pdf}
\end{subfigure}
\centering
\begin{subfigure}{0.3275\linewidth}
\includegraphics[width=0.99\linewidth]{plots/graph_1_100.pdf}
\caption{Discretizer ($\epsilon=1$), \\Generator ($\epsilon=100$)}
\end{subfigure}
\hfill
\begin{subfigure}{0.3275\linewidth}
\includegraphics[width=0.99\linewidth]{plots/graph_100_1.pdf}
\caption{Discretizer ($\epsilon=100$), \\Generator ($\epsilon=1$)}
\end{subfigure}
\hfill
\begin{subfigure}{0.3275\linewidth}
\includegraphics[width=0.99\linewidth]{plots/graph_100_100.pdf}
\caption{Discretizer ($\epsilon=100$), \\Generator ($\epsilon=100$)}
\end{subfigure}
\smallskip
\caption{\small Privacy leakage with \emph{provided} domain and \emph{extracted} domain (w/ and w/o DP) of the four DP discretizers ($\epsilon=1 \text{ or } 100$) and two DP generative models ($\epsilon=1 \text{ or } 100$) on a target record \emph{outside} the domain of the remaining data.}
\label{fig:attack_100}
\end{figure*}
\begin{figure*}[t!]
\centering
\begin{subfigure}{0.8\linewidth}
\includegraphics[width=0.99\linewidth]{plots/legend.pdf}
\end{subfigure}\\
\begin{subfigure}[t]{0.3275\linewidth}
\includegraphics[width=0.99\linewidth]{plots/graph_1_1000.pdf}
\caption{Discretizer ($\epsilon=1$), \\Generator ($\epsilon=1,000$)}
\label{fig:attack_1_1000}
\end{subfigure}
\hfill
\begin{subfigure}[t]{0.3275\linewidth}
\includegraphics[width=0.99\linewidth]{plots/graph_1000_1.pdf}
\caption{Discretizer ($\epsilon=1,000$), \\Generator ($\epsilon=1$)}
\label{fig:attack_1000_1}
\hfill
\end{subfigure}
\begin{subfigure}[t]{0.3275\linewidth}
\includegraphics[width=0.99\linewidth]{plots/graph_1000_1000.pdf}
\caption{Discretizer ($\epsilon=1,000$), \\Generator ($\epsilon=1,000$)}
\label{fig:attack_1000_1000}
\end{subfigure}
\smallskip
\caption{\small Privacy leakage with \emph{provided} domain and \emph{extracted} domain (w/ and w/o DP) of the four DP discretizers ($\epsilon=1 \text{ or } 1,000$) and two DP generative models ($\epsilon=1 \text{ or } 1,000$) on a target record \emph{outside} the domain of the remaining data.}
\label{fig:attack_1000}
\end{figure*}
\begin{figure*}[t!]
\centering
\begin{subfigure}{0.8\linewidth}
\includegraphics[width=0.99\linewidth]{plots/legend.pdf}
\end{subfigure}
\centering
\begin{subfigure}{0.3275\linewidth}
\includegraphics[width=0.99\linewidth]{plots/graph_1_1_in.pdf}
\caption{Discretizer ($\epsilon=1$), \\Generator ($\epsilon=1$)}
%
\end{subfigure}
\hfill
\begin{subfigure}{0.3275\linewidth}
\includegraphics[width=0.99\linewidth]{plots/graph_100_100_in.pdf}
\caption{Discretizer ($\epsilon=100$), \\Generator ($\epsilon=100$)}
%
\end{subfigure}
\hfill
\begin{subfigure}{0.3275\linewidth}
\includegraphics[width=0.99\linewidth]{plots/graph_1000_1000_in.pdf}
\caption{Discretizer ($\epsilon=1,000$), \\Generator ($\epsilon=1,000$)}
\end{subfigure}
\smallskip
\caption{\small Privacy leakage with \emph{provided} domain and \emph{extracted} domain (w/ and w/o DP) of the four DP discretizers ($\epsilon=1, 100 \text{ or } 1,000$) and two DP generative models ($\epsilon=1, 100 \text{ or } 1,000$) on a target record \emph{inside} the domain of the remaining data.}
\label{fig:attack_in}
\end{figure*}
\end{document}
%%%%% NEW MATH DEFINITIONS %%%%%
\usepackage{amsmath,amsfonts,bm}
% Mark sections of captions for referring to divisions of figures
\newcommand{\figleft}{{\em (Left)}}
\newcommand{\figcenter}{{\em (Center)}}
\newcommand{\figright}{{\em (Right)}}
\newcommand{\figtop}{{\em (Top)}}
\newcommand{\figbottom}{{\em (Bottom)}}
\newcommand{\captiona}{{\em (a)}}
\newcommand{\captionb}{{\em (b)}}
\newcommand{\captionc}{{\em (c)}}
\newcommand{\captiond}{{\em (d)}}
% Highlight a newly defined term
\newcommand{\newterm}[1]{{\bf #1}}
% Figure reference, lower-case.
\def\figref#1{figure~\ref{#1}}
% Figure reference, capital. For start of sentence
\def\Figref#1{Figure~\ref{#1}}
\def\twofigref#1#2{figures \ref{#1} and \ref{#2}}
\def\quadfigref#1#2#3#4{figures \ref{#1}, \ref{#2}, \ref{#3} and \ref{#4}}
% Section reference, lower-case.
\def\secref#1{section~\ref{#1}}
% Section reference, capital.
\def\Secref#1{Section~\ref{#1}}
% Reference to two sections.
\def\twosecrefs#1#2{sections \ref{#1} and \ref{#2}}
% Reference to three sections.
\def\secrefs#1#2#3{sections \ref{#1}, \ref{#2} and \ref{#3}}
% Reference to an equation, lower-case.
\def\eqref#1{equation~\ref{#1}}
% Reference to an equation, upper case
\def\Eqref#1{Equation~\ref{#1}}
% A raw reference to an equation---avoid using if possible
\def\plaineqref#1{\ref{#1}}
% Reference to a chapter, lower-case.
\def\chapref#1{chapter~\ref{#1}}
% Reference to an equation, upper case.
\def\Chapref#1{Chapter~\ref{#1}}
% Reference to a range of chapters
\def\rangechapref#1#2{chapters\ref{#1}--\ref{#2}}
% Reference to an algorithm, lower-case.
\def\algref#1{algorithm~\ref{#1}}
% Reference to an algorithm, upper case.
\def\Algref#1{Algorithm~\ref{#1}}
\def\twoalgref#1#2{algorithms \ref{#1} and \ref{#2}}
\def\Twoalgref#1#2{Algorithms \ref{#1} and \ref{#2}}
% Reference to a part, lower case
\def\partref#1{part~\ref{#1}}
% Reference to a part, upper case
\def\Partref#1{Part~\ref{#1}}
\def\twopartref#1#2{parts \ref{#1} and \ref{#2}}
\def\ceil#1{\lceil #1 \rceil}
\def\floor#1{\lfloor #1 \rfloor}
\def\1{\bm{1}}
\newcommand{\train}{\mathcal{D}}
\newcommand{\valid}{\mathcal{D_{\mathrm{valid}}}}
\newcommand{\test}{\mathcal{D_{\mathrm{test}}}}
\def\eps{{\epsilon}}
% Random variables
\def\reta{{\textnormal{$\eta$}}}
\def\ra{{\textnormal{a}}}
\def\rb{{\textnormal{b}}}
\def\rc{{\textnormal{c}}}
\def\rd{{\textnormal{d}}}
\def\re{{\textnormal{e}}}
\def\rf{{\textnormal{f}}}
\def\rg{{\textnormal{g}}}
\def\rh{{\textnormal{h}}}
\def\ri{{\textnormal{i}}}
\def\rj{{\textnormal{j}}}
\def\rk{{\textnormal{k}}}
\def\rl{{\textnormal{l}}}
% rm is already a command, just don't name any random variables m
\def\rn{{\textnormal{n}}}
\def\ro{{\textnormal{o}}}
\def\rp{{\textnormal{p}}}
\def\rq{{\textnormal{q}}}
\def\rr{{\textnormal{r}}}
\def\rs{{\textnormal{s}}}
\def\rt{{\textnormal{t}}}
\def\ru{{\textnormal{u}}}
\def\rv{{\textnormal{v}}}
\def\rw{{\textnormal{w}}}
\def\rx{{\textnormal{x}}}
\def\ry{{\textnormal{y}}}
\def\rz{{\textnormal{z}}}
% Random vectors
\def\rvepsilon{{\mathbf{\epsilon}}}
\def\rvtheta{{\mathbf{\theta}}}
\def\rva{{\mathbf{a}}}
\def\rvb{{\mathbf{b}}}
\def\rvc{{\mathbf{c}}}
\def\rvd{{\mathbf{d}}}
\def\rve{{\mathbf{e}}}
\def\rvf{{\mathbf{f}}}
\def\rvg{{\mathbf{g}}}
\def\rvh{{\mathbf{h}}}
\def\rvu{{\mathbf{i}}}
\def\rvj{{\mathbf{j}}}
\def\rvk{{\mathbf{k}}}
\def\rvl{{\mathbf{l}}}
\def\rvm{{\mathbf{m}}}
\def\rvn{{\mathbf{n}}}
\def\rvo{{\mathbf{o}}}
\def\rvp{{\mathbf{p}}}
\def\rvq{{\mathbf{q}}}
\def\rvr{{\mathbf{r}}}
\def\rvs{{\mathbf{s}}}
\def\rvt{{\mathbf{t}}}
\def\rvu{{\mathbf{u}}}
\def\rvv{{\mathbf{v}}}
\def\rvw{{\mathbf{w}}}
\def\rvx{{\mathbf{x}}}
\def\rvy{{\mathbf{y}}}
\def\rvz{{\mathbf{z}}}
% Elements of random vectors
\def\erva{{\textnormal{a}}}
\def\ervb{{\textnormal{b}}}
\def\ervc{{\textnormal{c}}}
\def\ervd{{\textnormal{d}}}
\def\erve{{\textnormal{e}}}
\def\ervf{{\textnormal{f}}}
\def\ervg{{\textnormal{g}}}
\def\ervh{{\textnormal{h}}}
\def\ervi{{\textnormal{i}}}
\def\ervj{{\textnormal{j}}}
\def\ervk{{\textnormal{k}}}
\def\ervl{{\textnormal{l}}}
\def\ervm{{\textnormal{m}}}
\def\ervn{{\textnormal{n}}}
\def\ervo{{\textnormal{o}}}
\def\ervp{{\textnormal{p}}}
\def\ervq{{\textnormal{q}}}
\def\ervr{{\textnormal{r}}}
\def\ervs{{\textnormal{s}}}
\def\ervt{{\textnormal{t}}}
\def\ervu{{\textnormal{u}}}
\def\ervv{{\textnormal{v}}}
\def\ervw{{\textnormal{w}}}
\def\ervx{{\textnormal{x}}}
\def\ervy{{\textnormal{y}}}
\def\ervz{{\textnormal{z}}}
% Random matrices
\def\rmA{{\mathbf{A}}}
\def\rmB{{\mathbf{B}}}
\def\rmC{{\mathbf{C}}}
\def\rmD{{\mathbf{D}}}
\def\rmE{{\mathbf{E}}}
\def\rmF{{\mathbf{F}}}
\def\rmG{{\mathbf{G}}}
\def\rmH{{\mathbf{H}}}
\def\rmI{{\mathbf{I}}}
\def\rmJ{{\mathbf{J}}}
\def\rmK{{\mathbf{K}}}
\def\rmL{{\mathbf{L}}}
\def\rmM{{\mathbf{M}}}
\def\rmN{{\mathbf{N}}}
\def\rmO{{\mathbf{O}}}
\def\rmP{{\mathbf{P}}}
\def\rmQ{{\mathbf{Q}}}
\def\rmR{{\mathbf{R}}}
\def\rmS{{\mathbf{S}}}
\def\rmT{{\mathbf{T}}}
\def\rmU{{\mathbf{U}}}
\def\rmV{{\mathbf{V}}}
\def\rmW{{\mathbf{W}}}
\def\rmX{{\mathbf{X}}}
\def\rmY{{\mathbf{Y}}}
\def\rmZ{{\mathbf{Z}}}
% Elements of random matrices
\def\ermA{{\textnormal{A}}}
\def\ermB{{\textnormal{B}}}
\def\ermC{{\textnormal{C}}}
\def\ermD{{\textnormal{D}}}
\def\ermE{{\textnormal{E}}}
\def\ermF{{\textnormal{F}}}
\def\ermG{{\textnormal{G}}}
\def\ermH{{\textnormal{H}}}
\def\ermI{{\textnormal{I}}}
\def\ermJ{{\textnormal{J}}}
\def\ermK{{\textnormal{K}}}
\def\ermL{{\textnormal{L}}}
\def\ermM{{\textnormal{M}}}
\def\ermN{{\textnormal{N}}}
\def\ermO{{\textnormal{O}}}
\def\ermP{{\textnormal{P}}}
\def\ermQ{{\textnormal{Q}}}
\def\ermR{{\textnormal{R}}}
\def\ermS{{\textnormal{S}}}
\def\ermT{{\textnormal{T}}}
\def\ermU{{\textnormal{U}}}
\def\ermV{{\textnormal{V}}}
\def\ermW{{\textnormal{W}}}
\def\ermX{{\textnormal{X}}}
\def\ermY{{\textnormal{Y}}}
\def\ermZ{{\textnormal{Z}}}
% Vectors
\def\vzero{{\bm{0}}}
\def\vone{{\bm{1}}}
\def\vmu{{\bm{\mu}}}
\def\vtheta{{\bm{\theta}}}
\def\va{{\bm{a}}}
\def\vb{{\bm{b}}}
\def\vc{{\bm{c}}}
\def\vd{{\bm{d}}}
\def\ve{{\bm{e}}}
\def\vf{{\bm{f}}}
\def\vg{{\bm{g}}}
\def\vh{{\bm{h}}}
\def\vi{{\bm{i}}}
\def\vj{{\bm{j}}}
\def\vk{{\bm{k}}}
\def\vl{{\bm{l}}}
\def\vm{{\bm{m}}}
\def\vn{{\bm{n}}}
\def\vo{{\bm{o}}}
\def\vp{{\bm{p}}}
\def\vq{{\bm{q}}}
\def\vr{{\bm{r}}}
\def\vs{{\bm{s}}}
\def\vt{{\bm{t}}}
\def\vu{{\bm{u}}}
\def\vv{{\bm{v}}}
\def\vw{{\bm{w}}}
\def\vx{{\bm{x}}}
\def\vy{{\bm{y}}}
\def\vz{{\bm{z}}}
% Elements of vectors
\def\evalpha{{\alpha}}
\def\evbeta{{\beta}}
\def\evepsilon{{\epsilon}}
\def\evlambda{{\lambda}}
\def\evomega{{\omega}}
\def\evmu{{\mu}}
\def\evpsi{{\psi}}
\def\evsigma{{\sigma}}
\def\evtheta{{\theta}}
\def\eva{{a}}
\def\evb{{b}}
\def\evc{{c}}
\def\evd{{d}}
\def\eve{{e}}
\def\evf{{f}}
\def\evg{{g}}
\def\evh{{h}}
\def\evi{{i}}
\def\evj{{j}}
\def\evk{{k}}
\def\evl{{l}}
\def\evm{{m}}
\def\evn{{n}}
\def\evo{{o}}
\def\evp{{p}}
\def\evq{{q}}
\def\evr{{r}}
\def\evs{{s}}
\def\evt{{t}}
\def\evu{{u}}
\def\evv{{v}}
\def\evw{{w}}
\def\evx{{x}}
\def\evy{{y}}
\def\evz{{z}}
% Matrix
\def\mA{{\bm{A}}}
\def\mB{{\bm{B}}}
\def\mC{{\bm{C}}}
\def\mD{{\bm{D}}}
\def\mE{{\bm{E}}}
\def\mF{{\bm{F}}}
\def\mG{{\bm{G}}}
\def\mH{{\bm{H}}}
\def\mI{{\bm{I}}}
\def\mJ{{\bm{J}}}
\def\mK{{\bm{K}}}
\def\mL{{\bm{L}}}
\def\mM{{\bm{M}}}
\def\mN{{\bm{N}}}
\def\mO{{\bm{O}}}
\def\mP{{\bm{P}}}
\def\mQ{{\bm{Q}}}
\def\mR{{\bm{R}}}
\def\mS{{\bm{S}}}
\def\mT{{\bm{T}}}
\def\mU{{\bm{U}}}
\def\mV{{\bm{V}}}
\def\mW{{\bm{W}}}
\def\mX{{\bm{X}}}
\def\mY{{\bm{Y}}}
\def\mZ{{\bm{Z}}}
\def\mBeta{{\bm{\beta}}}
\def\mPhi{{\bm{\Phi}}}
\def\mLambda{{\bm{\Lambda}}}
\def\mSigma{{\bm{\Sigma}}}
% Tensor
\DeclareMathAlphabet{\mathsfit}{\encodingdefault}{\sfdefault}{m}{sl}
\SetMathAlphabet{\mathsfit}{bold}{\encodingdefault}{\sfdefault}{bx}{n}
\newcommand{\tens}[1]{\bm{\mathsfit{#1}}}
\def\tA{{\tens{A}}}
\def\tB{{\tens{B}}}
\def\tC{{\tens{C}}}
\def\tD{{\tens{D}}}
\def\tE{{\tens{E}}}
\def\tF{{\tens{F}}}
\def\tG{{\tens{G}}}
\def\tH{{\tens{H}}}
\def\tI{{\tens{I}}}
\def\tJ{{\tens{J}}}
\def\tK{{\tens{K}}}
\def\tL{{\tens{L}}}
\def\tM{{\tens{M}}}
\def\tN{{\tens{N}}}
\def\tO{{\tens{O}}}
\def\tP{{\tens{P}}}
\def\tQ{{\tens{Q}}}
\def\tR{{\tens{R}}}
\def\tS{{\tens{S}}}
\def\tT{{\tens{T}}}
\def\tU{{\tens{U}}}
\def\tV{{\tens{V}}}
\def\tW{{\tens{W}}}
\def\tX{{\tens{X}}}
\def\tY{{\tens{Y}}}
\def\tZ{{\tens{Z}}}
% Graph
\def\gA{{\mathcal{A}}}
\def\gB{{\mathcal{B}}}
\def\gC{{\mathcal{C}}}
\def\gD{{\mathcal{D}}}
\def\gE{{\mathcal{E}}}
\def\gF{{\mathcal{F}}}
\def\gG{{\mathcal{G}}}
\def\gH{{\mathcal{H}}}
\def\gI{{\mathcal{I}}}
\def\gJ{{\mathcal{J}}}
\def\gK{{\mathcal{K}}}
\def\gL{{\mathcal{L}}}
\def\gM{{\mathcal{M}}}
\def\gN{{\mathcal{N}}}
\def\gO{{\mathcal{O}}}
\def\gP{{\mathcal{P}}}
\def\gQ{{\mathcal{Q}}}
\def\gR{{\mathcal{R}}}
\def\gS{{\mathcal{S}}}
\def\gT{{\mathcal{T}}}
\def\gU{{\mathcal{U}}}
\def\gV{{\mathcal{V}}}
\def\gW{{\mathcal{W}}}
\def\gX{{\mathcal{X}}}
\def\gY{{\mathcal{Y}}}
\def\gZ{{\mathcal{Z}}}
% Sets
\def\sA{{\mathbb{A}}}
\def\sB{{\mathbb{B}}}
\def\sC{{\mathbb{C}}}
\def\sD{{\mathbb{D}}}
% Don't use a set called E, because this would be the same as our symbol
% for expectation.
\def\sF{{\mathbb{F}}}
\def\sG{{\mathbb{G}}}
\def\sH{{\mathbb{H}}}
\def\sI{{\mathbb{I}}}
\def\sJ{{\mathbb{J}}}
\def\sK{{\mathbb{K}}}
\def\sL{{\mathbb{L}}}
\def\sM{{\mathbb{M}}}
\def\sN{{\mathbb{N}}}
\def\sO{{\mathbb{O}}}
\def\sP{{\mathbb{P}}}
\def\sQ{{\mathbb{Q}}}
\def\sR{{\mathbb{R}}}
\def\sS{{\mathbb{S}}}
\def\sT{{\mathbb{T}}}
\def\sU{{\mathbb{U}}}
\def\sV{{\mathbb{V}}}
\def\sW{{\mathbb{W}}}
\def\sX{{\mathbb{X}}}
\def\sY{{\mathbb{Y}}}
\def\sZ{{\mathbb{Z}}}
% Entries of a matrix
\def\emLambda{{\Lambda}}
\def\emA{{A}}
\def\emB{{B}}
\def\emC{{C}}
\def\emD{{D}}
\def\emE{{E}}
\def\emF{{F}}
\def\emG{{G}}
\def\emH{{H}}
\def\emI{{I}}
\def\emJ{{J}}
\def\emK{{K}}
\def\emL{{L}}
\def\emM{{M}}
\def\emN{{N}}
\def\emO{{O}}
\def\emP{{P}}
\def\emQ{{Q}}
\def\emR{{R}}
\def\emS{{S}}
\def\emT{{T}}
\def\emU{{U}}
\def\emV{{V}}
\def\emW{{W}}
\def\emX{{X}}
\def\emY{{Y}}
\def\emZ{{Z}}
\def\emSigma{{\Sigma}}
% entries of a tensor
% Same font as tensor, without \bm wrapper
\newcommand{\etens}[1]{\mathsfit{#1}}
\def\etLambda{{\etens{\Lambda}}}
\def\etA{{\etens{A}}}
\def\etB{{\etens{B}}}
\def\etC{{\etens{C}}}
\def\etD{{\etens{D}}}
\def\etE{{\etens{E}}}
\def\etF{{\etens{F}}}
\def\etG{{\etens{G}}}
\def\etH{{\etens{H}}}
\def\etI{{\etens{I}}}
\def\etJ{{\etens{J}}}
\def\etK{{\etens{K}}}
\def\etL{{\etens{L}}}
\def\etM{{\etens{M}}}
\def\etN{{\etens{N}}}
\def\etO{{\etens{O}}}
\def\etP{{\etens{P}}}
\def\etQ{{\etens{Q}}}
\def\etR{{\etens{R}}}
\def\etS{{\etens{S}}}
\def\etT{{\etens{T}}}
\def\etU{{\etens{U}}}
\def\etV{{\etens{V}}}
\def\etW{{\etens{W}}}
\def\etX{{\etens{X}}}
\def\etY{{\etens{Y}}}
\def\etZ{{\etens{Z}}}
% The true underlying data generating distribution
\newcommand{\pdata}{p_{\rm{data}}}
% The empirical distribution defined by the training set
\newcommand{\ptrain}{\hat{p}_{\rm{data}}}
\newcommand{\Ptrain}{\hat{P}_{\rm{data}}}
% The model distribution
\newcommand{\pmodel}{p_{\rm{model}}}
\newcommand{\Pmodel}{P_{\rm{model}}}
\newcommand{\ptildemodel}{\tilde{p}_{\rm{model}}}
% Stochastic autoencoder distributions
\newcommand{\pencode}{p_{\rm{encoder}}}
\newcommand{\pdecode}{p_{\rm{decoder}}}
\newcommand{\precons}{p_{\rm{reconstruct}}}
\newcommand{\laplace}{\mathrm{Laplace}} % Laplace distribution
\newcommand{\E}{\mathbb{E}}
\newcommand{\Ls}{\mathcal{L}}
\newcommand{\R}{\mathbb{R}}
\newcommand{\emp}{\tilde{p}}
\newcommand{\lr}{\alpha}
\newcommand{\reg}{\lambda}
\newcommand{\rect}{\mathrm{rectifier}}
\newcommand{\softmax}{\mathrm{softmax}}
\newcommand{\sigmoid}{\sigma}
\newcommand{\softplus}{\zeta}
\newcommand{\KL}{D_{\mathrm{KL}}}
\newcommand{\Var}{\mathrm{Var}}
\newcommand{\standarderror}{\mathrm{SE}}
\newcommand{\Cov}{\mathrm{Cov}}
% Wolfram Mathworld says $L^2$ is for function spaces and $\ell^2$ is for vectors
% But then they seem to use $L^2$ for vectors throughout the site, and so does
% wikipedia.
\newcommand{\normlzero}{L^0}
\newcommand{\normlone}{L^1}
\newcommand{\normltwo}{L^2}
\newcommand{\normlp}{L^p}
\newcommand{\normmax}{L^\infty}
\newcommand{\parents}{Pa} % See usage in notation.tex. Chosen to match Daphne's book.
\DeclareMathOperator*{\argmax}{arg\,max}
\DeclareMathOperator*{\argmin}{arg\,min}
\DeclareMathOperator{\sign}{sign}
\DeclareMathOperator{\Tr}{Tr}
\let\ab\allowbreak
\begin{thebibliography}{38}
\providecommand{\natexlab}[1]{#1}
\providecommand{\url}[1]{\texttt{#1}}
\expandafter\ifx\csname urlstyle\endcsname\relax
\providecommand{\doi}[1]{doi: #1}\else
\providecommand{\doi}{doi: \begingroup \urlstyle{rm}\Url}\fi
\bibitem[{A29WP}(2014)]{eu2014opinion}
{A29WP}.
\newblock {Opinion on anonymisation techniques}.
\newblock
\url{https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp216_en.pdf},
2014.
\bibitem[Annamalai et~al.(2024)Annamalai, Ganev, and
De~Cristofaro]{annamalai2024what}
Meenatchi Sundaram Muthu~Selva Annamalai, Georgi Ganev, and Emiliano
De~Cristofaro.
\newblock {``What do you want from theory alone?'' Experimenting with Tight
Auditing of Differentially Private Synthetic Data Generation}.
\newblock In \emph{USENIX Security}, 2024.
\bibitem[De~Cristofaro(2024)]{cristofaro2024synthetic}
Emiliano De~Cristofaro.
\newblock {Synthetic Data: Methods, Use Cases, and Risks}.
\newblock \emph{IEEE S\&P Magazine}, 2024.
\bibitem[Desfontaines(2020)]{desfontaines2020lowering}
Damien Desfontaines.
\newblock \emph{Lowering the cost of anonymization}.
\newblock PhD thesis, ETH Zurich, 2020.
\bibitem[Du \& Li(2024)Du and Li]{du2024towards}
Yuntao Du and Ninghui Li.
\newblock {Towards Principled Assessment of Tabular Data Synthesis Algorithms}.
\newblock \emph{arXiv:2402.06806}, 2024.
\bibitem[Dua \& Graff(2017)Dua and Graff]{dua2017data}
Dheeru Dua and Casey Graff.
\newblock {UCI Machine Learning Repository}.
\newblock \url{https://archive.ics.uci.edu/dataset/186/wine+quality}, 2017.
\bibitem[Dwork et~al.(2006{\natexlab{a}})Dwork, Kenthapadi, McSherry, Mironov,
and Naor]{dwork2006our}
Cynthia Dwork, Krishnaram Kenthapadi, Frank McSherry, Ilya Mironov, and Moni
Naor.
\newblock {Our data, ourselves: Privacy via distributed noise generation}.
\newblock In \emph{EuroCrypt}, 2006{\natexlab{a}}.
\bibitem[Dwork et~al.(2006{\natexlab{b}})Dwork, McSherry, Nissim, and
Smith]{dwork2006calibrating}
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith.
\newblock {Calibrating noise to sensitivity in private data analysis}.
\newblock In \emph{TCC}, 2006{\natexlab{b}}.
\bibitem[{EDPB}(2024)]{eu2024opinion}
{EDPB}.
\newblock {Opinion 28/2024 on certain data protection aspects related to the
processing of personal data in the context of AI models}.
\newblock
\url{https://www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf},
2024.
\bibitem[{FCA}(2024)]{fca2024using}
{FCA}.
\newblock {Using Synthetic Data in Financial Services}.
\newblock
\url{https://www.fca.org.uk/publication/corporate/report-using-synthetic-data-in-financial-services.pdf},
2024.
\bibitem[Ganev et~al.(2025{\natexlab{a}})Ganev, Annamalai, and
De~Cristofaro]{ganev2025elusive}
Georgi Ganev, Meenatchi Sundaram Muthu~Selva Annamalai, and Emiliano
De~Cristofaro.
\newblock {The Elusive Pursuit of Reproducing PATE-GAN: Benchmarking, Auditing,
Debugging}.
\newblock \emph{TMLR}, 2025{\natexlab{a}}.
\bibitem[Ganev et~al.(2025{\natexlab{b}})Ganev, Annamalai, Mahiou, and
De~Cristofaro]{ganev2025importance}
Georgi Ganev, Meenatchi Sundaram Muthu~Selva Annamalai, Sofiane Mahiou, and
Emiliano De~Cristofaro.
\newblock {The Importance of Being Discrete: Measuring the Impact of
Discretization in End-to-End Differentially Private Synthetic Data}.
\newblock \emph{arXiv:2504.06923}, 2025{\natexlab{b}}.
\bibitem[Ghosh et~al.(2009)Ghosh, Roughgarden, and
Sundararajan]{ghosh2009universally}
Arpita Ghosh, Tim Roughgarden, and Mukund Sundararajan.
\newblock {Universally utility-maximizing privacy mechanisms}.
\newblock In \emph{STOC}, 2009.
\bibitem[Hayes et~al.(2019)Hayes, Melis, Danezis, and
De~Cristofaro]{hayes2019logan}
Jamie Hayes, Luca Melis, George Danezis, and Emiliano De~Cristofaro.
\newblock {LOGAN: Membership Inference Attacks against Generative Models}.
\newblock In \emph{PoPETs}, 2019.
\bibitem[Hod \& Canetti(2024)Hod and Canetti]{hod2024differentially}
Shlomi Hod and Ran Canetti.
\newblock {Differentially Private Release of Israel's National Registry of Live
Births}.
\newblock \emph{arXiv:2405.00267}, 2024.
\bibitem[Holohan et~al.(2019)Holohan, Braghin, Mac~Aonghusa, and
Levacher]{holohan2019diffprivlib}
Naoise Holohan, Stefano Braghin, P{\'o}l Mac~Aonghusa, and Killian Levacher.
\newblock {Diffprivlib: the IBM differential privacy library}.
\newblock \url{https://github.com/IBM/differential-privacy-library}, 2019.
\bibitem[Hu et~al.(2024)Hu, Wu, Li, Long, Garrido, Ge, Ding, Forsyth, Li, and
Song]{hu2024sok}
Yuzheng Hu, Fan Wu, Qinbin Li, Yunhui Long, Gonzalo~Munilla Garrido, Chang Ge,
Bolin Ding, David Forsyth, Bo~Li, and Dawn Song.
\newblock {SoK: Privacy-Preserving Data Synthesis}.
\newblock In \emph{IEEE S\&P}, 2024.
\bibitem[Jordon et~al.(2022)Jordon, Szpruch, Houssiau, Bottarelli, Cherubin,
Maple, Cohen, and Weller]{jordon2022synthetic}
James Jordon, Lukasz Szpruch, Florimond Houssiau, Mirko Bottarelli, Giovanni
Cherubin, Carsten Maple, Samuel~N Cohen, and Adrian Weller.
\newblock {Synthetic Data--what, why and how?}
\newblock \emph{arXiv:2205.03257}, 2022.
\bibitem[Mahiou et~al.(2022)Mahiou, Xu, and Ganev]{mahiou2022dpart}
Sofiane Mahiou, Kai Xu, and Georgi Ganev.
\newblock {dpart: Differentially Private Autoregressive Tabular, a General
Framework for Synthetic Data Generation}.
\newblock \emph{TPDP}, 2022.
\bibitem[McKenna et~al.(2019)McKenna, Sheldon, and
Miklau]{mckenna2019graphical}
Ryan McKenna, Daniel Sheldon, and Gerome Miklau.
\newblock {Graphical-model based estimation and inference for differential
privacy}.
\newblock In \emph{ICML}, 2019.
\bibitem[McKenna et~al.(2021)McKenna, Miklau, and Sheldon]{mckenna2021winning}
Ryan McKenna, Gerome Miklau, and Daniel Sheldon.
\newblock {Winning the NIST Contest: A scalable and general approach to
differentially private synthetic data}.
\newblock \emph{JPC}, 2021.
\bibitem[McSherry \& Talwar(2007)McSherry and Talwar]{mcsherry2007mechanism}
Frank McSherry and Kunal Talwar.
\newblock {Mechanism design via differential privacy}.
\newblock In \emph{FOCS}, 2007.
\bibitem[Meeus et~al.(2023)Meeus, Guepin, Cretu, and
de~Montjoye]{meeus2023achilles}
Matthieu Meeus, Florent Guepin, Ana-Maria Cretu, and Yves-Alexandre
de~Montjoye.
\newblock {Achilles' Heels: vulnerable record identification in synthetic data
publishing}.
\newblock \emph{arXiv:2306.10308}, 2023.
\bibitem[Microsoft(2022)]{microsoft2022iom}
Microsoft.
\newblock {IOM and Microsoft release first-ever differentially private
synthetic dataset to counter human trafficking}.
\newblock
\url{https://www.microsoft.com/en-us/research/blog/iom-and-microsoft-release-first-ever-differentially-private-synthetic-dataset-to-counter-human-trafficking/},
2022.
\bibitem[{NASEM}(2020)]{nasem2020census}
{NASEM}.
\newblock \emph{{2020 Census Data Products: Data Needs and Privacy
Considerations: Proceedings of a Workshop}}.
\newblock The National Academies Press, 2020.
\bibitem[{ONS}(2023)]{ons2023synthesising}
{ONS}.
\newblock {Synthesising the linked 2011 Census and deaths dataset while
preserving its confidentiality}.
\newblock
\url{https://datasciencecampus.ons.gov.uk/synthesising-the-linked-2011-census-and-deaths-dataset-while-preserving-its-confidentiality/},
2023.
\bibitem[{OpenDP}(2021)]{opendp2021smartnoise}
{OpenDP}.
\newblock {SmartNoise SDK: Tools for Differential Privacy on Tabular Data}.
\newblock \url{https://github.com/opendp/smartnoise-sdk}, 2021.
\bibitem[Ping et~al.(2017)Ping, Stoyanovich, and Howe]{ping2017datasynthesizer}
Haoyue Ping, Julia Stoyanovich, and Bill Howe.
\newblock {DataSynthesizer: Privacy-Preserving Synthetic Datasets}.
\newblock In \emph{SSDBM}, 2017.
\bibitem[Qian et~al.(2023)Qian, Davis, and Van Der~Schaar]{qian2023synthcity}
Zhaozhi Qian, Rob Davis, and Mihaela Van Der~Schaar.
\newblock {Synthcity: a benchmark framework for diverse use cases of tabular
synthetic data}.
\newblock In \emph{NeurIPS Datasets and Benchmarks Track}, 2023.
\bibitem[Shokri et~al.(2017)Shokri, Stronati, Song, and
Shmatikov]{shokri2017membership}
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov.
\newblock {Membership Inference Attacks against Machine Learning Models}.
\newblock In \emph{IEEE S\&P}, 2017.
\bibitem[Smith(2011)]{smith2011privacy}
Adam Smith.
\newblock Privacy-preserving statistical estimation with optimal convergence
rates.
\newblock In \emph{STOC}, 2011.
\bibitem[Stadler et~al.(2022)Stadler, Oprisanu, and
Troncoso]{stadler2022synthetic}
Theresa Stadler, Bristena Oprisanu, and Carmela Troncoso.
\newblock {Synthetic Data -- Anonymization Groundhog Day}.
\newblock In \emph{USENIX Security}, 2022.
\bibitem[Su et~al.(2016)Su, Cao, Li, Bertino, and Jin]{su2016differentially}
Dong Su, Jianneng Cao, Ninghui Li, Elisa Bertino, and Hongxia Jin.
\newblock {Differentially private k-means clustering}.
\newblock In \emph{CODASPY}, 2016.
\bibitem[{UK ICO}(2023{\natexlab{a}})]{ico2023privacy}
{UK ICO}.
\newblock {Privacy-enhancing technologies (PETs)}.
\newblock
\url{https://ico.org.uk/media/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/privacy-enhancing-technologies-1-0.pdf},
2023{\natexlab{a}}.
\bibitem[{UK ICO}(2023{\natexlab{b}})]{ico2023synthetic}
{UK ICO}.
\newblock {Synthetic data to test the effectiveness of a vulnerable person's
detection system in financial services}.
\newblock
\url{https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/privacy-enhancing-technologies/case-studies/synthetic-data-to-test-the-effectiveness-of-a-vulnerable-persons-detection-system-in-financial-services/},
2023{\natexlab{b}}.
\bibitem[Vietri et~al.(2020)Vietri, Tian, Bun, Steinke, and Wu]{vietri2020new}
Giuseppe Vietri, Grace Tian, Mark Bun, Thomas Steinke, and Steven Wu.
\newblock {New oracle-efficient algorithms for private synthetic data release}.
\newblock In \emph{ICML}, 2020.
\bibitem[Zhang et~al.(2016)Zhang, Xiao, and Xie]{zhang2016privtree}
Jun Zhang, Xiaokui Xiao, and Xing Xie.
\newblock {Privtree: A differentially private algorithm for hierarchical
decompositions}.
\newblock In \emph{SIGMOD}, 2016.
\bibitem[Zhang et~al.(2017)Zhang, Cormode, Procopiuc, Srivastava, and
Xiao]{zhang2017privbayes}
Jun Zhang, Graham Cormode, Cecilia~M Procopiuc, Divesh Srivastava, and Xiaokui
Xiao.
\newblock {Privbayes: Private data release via bayesian networks}.
\newblock \emph{ACM TODS}, 2017.
\end{thebibliography}