Re-identification Risk

The primary attack vector relies on quasi-identifiers—attributes like date of birth, gender, and ZIP code that are not unique on their own but become highly identifying when combined. An attacker cross-references these combined attributes with external datasets, such as voter registration rolls or public health records, to triangulate an individual's identity. The uniqueness of a record in the population, measured by the proportion of records with identical quasi-identifier combinations, is the foundational metric of this risk.

• Example: Latanya Sweeney's seminal work demonstrated that 87% of the U.S. population could be uniquely identified using only 5-digit ZIP code, gender, and date of birth.
• Mitigation: Applying k-anonymity ensures each released record is indistinguishable from at least k-1 other records, directly reducing the granularity of quasi-identifier groupings.

Re-identification risk is directly proportional to the volume and granularity of auxiliary data an adversary possesses. This includes public social media profiles, commercial data brokers, and historical data breaches. A synthetic dataset that perfectly preserves statistical fidelity may inadvertently encode rare combinations that are uniquely linkable when an attacker brings external knowledge to bear. The risk is not theoretical; researchers have demonstrated re-identification of individuals in anonymized taxi trip data and Netflix Prize datasets by correlating timestamps with public reviews.

• Key Concept: The privacy-utility trade-off dictates that higher fidelity to the source data inherently increases the risk of encoding rare, linkable records.
• Defense: Formal differential privacy provides a mathematical guarantee that the output is indistinguishable regardless of any auxiliary information an adversary may possess.

A sophisticated attack where an adversary does not seek to extract full records but to determine whether a specific individual's data was included in the model's training set. This is a binary classification task for the attacker, exploiting differences in the model's confidence scores between data it has seen and unseen data. For synthetic data, a successful membership inference attack on the generator model can reveal the presence of an individual in the sensitive source dataset, even if the synthetic records themselves appear novel.

• Mechanism: Attackers train shadow models on similar data distributions to mimic the target model's behavior and learn the statistical signatures of membership.
• Implication: This attack vector is particularly dangerous in medical and financial contexts where mere inclusion in a dataset (e.g., a study on a specific disease) constitutes a privacy violation.

Beyond identity, the risk extends to inferring sensitive attributes (e.g., income, health status, political affiliation) from non-sensitive public features. A synthetic dataset that preserves complex correlations between attributes can leak private information. For instance, if a generative model accurately captures the correlation between a specific genetic marker and a disease, an attacker who knows an individual's genetic marker can infer their disease status from the synthetic data's statistical structure.

• Attack Vector: Attribute inference attacks leverage Bayesian inference on the joint distribution learned by the generative model.
• Mitigation: Disentangled representations in VAEs and GANs can isolate sensitive attributes, allowing for controlled manipulation or removal before data synthesis.

When a generative model overfits to the training data, it can memorize and later regurgitate exact or near-exact replicas of real records. Model inversion attacks exploit this by querying the model's output space to reconstruct prototypical representations of the training data. In the context of synthetic data, a generator that has memorized a rare individual's record may produce a synthetic sample that is a verbatim copy, making re-identification trivial.

• Detection: Out-of-distribution detection and nearest-neighbor distance tests between synthetic and real records can flag memorized samples.
• Prevention: DP-SGD (Differentially Private Stochastic Gradient Descent) clips and noises gradients during training to mathematically bound the influence of any single training example, preventing memorization.

Risk compounds over time. An individual's data released in multiple supposedly anonymized or synthetic datasets across different time periods can be linked to form a longitudinal profile. This temporal linkage attack uses the stability of certain quasi-identifiers over time to connect records from separate releases, progressively eroding privacy. A synthetic dataset released today may be safe in isolation, but when combined with a future release or a past anonymized dataset, the combined information can enable re-identification.

• Challenge: Synthetic data drift occurs when the frozen synthetic distribution diverges from the evolving real-world data, but periodic re-generation creates new linkage opportunities.
• Governance: Data provenance and data lineage tracking are essential to audit the cumulative disclosure risk across multiple data releases over time.