Differentially Private Synthetic Data

The defining characteristic is the epsilon (ε) privacy budget. This parameter provides a quantifiable, mathematical upper bound on information leakage. A lower epsilon (e.g., ε=1) provides stronger privacy than a higher one (e.g., ε=10). This guarantee is immune to post-processing, meaning no analysis performed on the synthetic data can weaken the original privacy promise.

The generator model is trained to capture the joint probability distribution of the sensitive source data. The goal is to produce a new dataset that preserves:

• Marginal distributions: The statistical properties of individual columns.
• Correlations: The relationships between different variables. This allows analysts to run aggregate queries and train downstream models with high utility, even though no real record exists in the output.

Synthetic data generators are typically trained using Differentially Private Stochastic Gradient Descent (DP-SGD). This process involves two critical steps during each training iteration:

• Gradient Clipping: The influence of any single training example is bounded by clipping its gradient's L2 norm to a fixed threshold.
• Noise Injection: Calibrated Gaussian noise is added to the aggregated, clipped gradients before updating the model weights. This prevents the model from memorizing specific records.

A fundamental tension exists between the privacy guarantee (ε) and the utility of the synthetic data. A very strict privacy budget (low ε) requires injecting large amounts of noise, which can obscure rare categories or complex correlations. A looser budget (high ε) preserves more signal but provides a weaker theoretical guarantee. The optimal setting is context-dependent and must be chosen based on the sensitivity of the source data and the requirements of the downstream task.

A primary security property is resilience against membership inference attacks. Because the model never memorizes individual training records, an adversary cannot confidently determine whether a specific person's data was included in the original sensitive dataset by analyzing the synthetic output. This directly addresses a critical vulnerability of non-private generative models.

DP synthetic data is fundamentally different from traditional de-identification or k-anonymity. De-identification merely removes direct identifiers (like names) but leaves quasi-identifiers vulnerable to linkage attacks. DP synthetic data generates entirely new, artificial records. It does not simply mask the original data; it creates a new dataset sampled from a learned, privacy-protected distribution, providing a provable guarantee against re-identification.

Differentially Private Stochastic Gradient Descent is the core algorithm that trains generative models on sensitive data. It operates by:

• Clipping per-example gradients to bound sensitivity
• Injecting calibrated Gaussian noise into the clipped gradients
• Tracking cumulative privacy loss via a Moments Accountant This ensures the generator learns the data distribution without memorizing individual records.

Every synthetic dataset is generated under a finite privacy budget (ε, δ). Key accounting concepts include:

• Composition Theorems: Track how ε accumulates across training iterations
• Moments Accountant: Provides tighter bounds than basic composition, enabling more training steps
• Rényi DP (RDP): An alternative accounting framework that converts to (ε, δ)-DP for reporting Once the budget is exhausted, no further queries on the sensitive source data are permitted.

A critical property of differential privacy that makes synthetic data practical: any computation applied to a DP output cannot weaken the privacy guarantee. This means:

• Data scientists can run arbitrary queries on the synthetic data
• Models can be trained on the synthetic data without additional privacy loss
• The synthetic dataset can be shared with untrusted third parties
• Statistical validity checks do not consume the privacy budget The original sensitive records remain protected regardless of downstream use.

The sensitivity of a query determines the noise scale required for privacy. In synthetic data generation:

• Gradient clipping bounds the L2 sensitivity of each training example
• Lower clipping thresholds reduce sensitivity but may discard useful information
• The noise multiplier is calibrated to achieve the target (ε, δ) given the sensitivity
• Privacy amplification by subsampling reduces effective sensitivity when using mini-batches Tuning these parameters is the central engineering challenge.