Source-linked AI summary
Data Synthesis based on Generative Adversarial Networks
Noseong Park, Mahmoud Mohammadi, Kshitij Gorde, Sushil Jajodia, Hongkyu Park, Youngmin Kim
TL;DR
Existing anonymization and perturbation methods can leak private information or reduce utility. table-GAN uses GANs to synthesize fully fake tables, and experiments report the best trade-off between privacy and model compatibility across evaluated tests. The approach remains limited to categorical, discrete, and continuous values, with strings left for future work.
Problem
Existing privacy methods can permit information leakage or adversely affect released-data utility.
Method
table-GAN uses GANs to generate fully synthetic tables from categorical, discrete, and continuous values.
Results
Across four real-world datasets, table-GAN exhibits the best trade-off between privacy level and model compatibility in statistical, closest-record-distance, and model-compatibility tests.
Takeaways & Limitations
Synthetic tables can be shared without directly disclosing real records while retaining model compatibility.
Takeaways & Limitations
The current method does not yet cover strings and other data types.
Abstract
from arXiv · showhide
Privacy is an important concern for our society where sharing data with partners or releasing data to the public is a frequent occurrence. Some of the techniques that are being used to achieve privacy are to remove identifiers, alter quasi-identifiers, and perturb values. Unfortunately, these approaches suffer from two limitations. First, it has been shown that private information can still be leaked if attackers possess some background knowledge or other information sources. Second, they do not take into account the adverse impact these methods will have on the utility of the released data. In this paper, we propose a method that meets both requirements. Our method, called table-GAN, uses generative adversarial networks (GANs) to synthesize fake tables that are statistically similar to the original table yet do not incur information leakage. We show that the machine learning models trained using our synthetic tables exhibit performance that is similar to that of models trained using the original table for unknown testing cases. We call this property model compatibility. We believe that anonymization/perturbation/synthesis methods without model compatibility are of little value. We used four real-world datasets from four different domains for our experiments and conducted in-depth comparisons with state-of-the-art anonymization, perturbation, and generation techniques. Throughout our experiments, only our method consistently shows a balance between privacy level and model compatibility.
1. INTRODUCTION
Existing privacy techniques can leak information and reduce data utility, making it difficult to achieve privacy and usability simultaneously. The paper proposes table-GAN to synthesize statistically similar tables while supporting privacy and model compatibility.
- Anonymization can leave sensitive attributes exposed, enabling re-identification when attackers use background knowledge or external information sources.
- Data perturbation changes values but can negatively affect the usability of released data.
- table-GAN synthesizes categorical, discrete, and continuous table values using generative adversarial networks.
- Synthetic tables have no one-to-one relationship with real records, preventing re-identification attacks.
- All attribute values in the synthesized tables are fake and protected from attribute disclosure.
- Models trained on carefully synthesized tables can behave similarly to models trained on original tables, a property called model compatibility.
2. RELATED WORK
Related privacy-preserving methods modify identifiers, quasi-identifiers, or values, but can leak information and often weaken utility. The paper positions table-GAN against these limitations through synthetic data generation and broader privacy evaluation.
- Anonymization modifies identifiers and quasi-identifiers, yet background knowledge or external information can enable re-identification.
- k-anonymity groups records into equivalence classes sharing modified quasi-identifiers, while l-diversity and t-closeness address sensitive-attribute disclosure through diversity or distribution constraints.
- Perturbation adds noise or transforms values, but removing noise and recovering original data remain concerns, while utility generally decreases.
- Existing anonymization and perturbation methods may preserve model compatibility, but their privacy leakage and utility trade-off is unsatisfactory.
- Table-GAN targets general relational tables with both continuous and discrete values, unlike prior RNN-based approaches focused on discrete data.
- Membership attacks infer whether records belonged to a model’s training data using black-box access, and the paper adapts this attack to table-GAN.
3. OVERALL ARCHITECTURE
The table-GAN workflow converts records to square matrices, trains the model, generates synthetic records, and shares the resulting table for analysis. Its generation parameters trade privacy against model compatibility.
- The paper addresses re-identification, attribute disclosure, and membership attacks as its three privacy and security concerns.
- Fully synthetic tables avoid directly disclosing real records, making table-GAN strong against re-identification and attribute disclosure by nature.
- Hinge loss slightly disturbs training to balance synthesis quality against the possibility of membership attacks.
- Records are reshaped into square matrices, table-GAN generates synthetic matrices, and the outputs are converted and merged into a shareable table.
- Models trained on the synthetic table should replace models trained on the original table, with parameters controlling privacy and model compatibility.
4. PROPOSED METHOD
Table-GAN synthesizes statistically similar records with three neural networks: a generator, discriminator, and classifier. Its workflow targets model compatibility while preserving semantic consistency in generated tables.
- Architecture: Table-GAN uses a generator, discriminator, and classifier to synthesize records with realistic distributions and consistent attribute-label relationships.The generator produces records, the discriminator distinguishes real from synthetic records, and the classifier predicts labels to help maintain semantic integrity.
- Architecture: The discriminator classifies records as real or synthetic through convolutional layers ending in a sigmoid probability output.Its input is a d × d matrix representing one record, with 1 assigned to real records and 0 to synthetic records during training.
- Workflow: The workflow generates a fake table from the original table, then seeks similar model behavior when models are trained on either table.The stated goal is general model compatibility across machine learning algorithms and tasks.
- Architecture: The generator maps a latent vector z sampled from the unit hypercube through deconvolutional layers into a two-dimensional synthetic record.The generated record is trained through the discriminator’s prediction by back-propagation.
- Architecture: The classifier learns label-attribute correlations from the original table and guides the generator toward semantically correct synthetic records.It can prevent implausible combinations such as gender = “Male” with disease = “Uterine Cancer”; incorrect generations were observed without the classifier.
4.2 Loss Functions
Table-GAN trains its networks with adversarial, information, and classification losses. These losses respectively support realistic synthesis, statistical similarity with controllable privacy, and semantic integrity.
- Loss design: The discriminator uses the original GAN loss, the classifier uses classification loss, and the generator uses all three losses.The generator receives adversarial, information, and classification objectives because it is the central network in synthesis.
- Information loss: Information loss compares first-order means and second-order standard deviations of discriminator features from real and synthetic records.The features are extracted before the discriminator’s sigmoid activation, and discrepancies are measured using L-2 norms.
- Information loss: The hinge-based information loss is zero while mean and standard-deviation discrepancies remain below thresholds δ_mean and δ_sd.These thresholds control privacy: smaller values produce lower privacy and synthetic tables more similar to the original.
- Classification loss: Classification loss measures disagreement between a generated record’s label and the label predicted by the classifier after removing the label attribute from the record.The loss was introduced because synthetic values occasionally failed to match their labels.
- Classification loss: Classification loss often helps recover values that synthetic records omit even at δ_mean = 0 and δ_sd = 0.The paper identifies this as an additional advantage of the classification loss.
4.3 Training Algorithm
Training uses stochastic-gradient updates on mini-batches for scalability, while moving averages approximate global feature statistics required by information loss. After training, generation requires only sampling a latent vector.
- Training procedure: The training algorithm repeatedly updates the discriminator, classifier, and generator using mini-batches until loss values converge.Mini-batch stochastic gradient descent is adopted because all records cannot be loaded simultaneously into GPU memory.
- Training procedure: Exponentially weighted moving averages approximate global means and standard deviations of real and synthetic features during mini-batch training.The method uses a weight w close to 1 for stable estimates and reports w = 0.99.
- Training procedure: Each epoch trains the discriminator with L_D^orig, the classifier with L_C, and the generator with L_G.The passage lists this sequence as discriminator, classifier, then generator training.
- Training procedure: Training required at most 20 minutes in the reported experiments.The paper notes that theoretical deep-learning complexity is cumbersome because training uses many GPU-accelerated operators.
- Generation: After training, sampling a latent vector z and passing it through the generator produces one synthetic record.The paper characterizes generation as lightweight compared with training.
4.4 Scalability Issue
The paper describes two routes for scaling table-GAN synthesis: distributed learning and independent training on table chunks. Chunking reduces runtime linearly with the number of chunks.
- Distributed synthesis: Distributed-learning extensions such as DownpourSGD, ADMM, EASGD, and GoSGD can be applied to scale table-GAN synthesis.The paper notes that TensorFlow supports distributed learning by default and that extensions are straightforward.
- Chunked synthesis: Splitting a table into chunks, training one table-GAN per chunk, and merging generated records yields runtime that decreases linearly with chunk count.The authors used this approach to synthesize large tables in their experiments.
4.5 Membership Attack for table-GAN
The membership attack evaluates whether synthetic-table access can reveal training membership by constructing attack data from shadow table-GANs and discriminator outputs.
- The attack targets the discriminator rather than the classifier because preliminary results showed slightly better success probabilities.
- Attackers receive black-box generator access, synthesize shadow training tables, and train shadow table-GANs from them.
- Shadow discriminators label training and held-out records using predicted real probabilities to create attack samples.
- The researchers merge attack samples and train one attack model per class before attacking the target table-GAN.
5. EXPERIMENTAL ANALYSIS
Experiments across four domains compare table-GAN with anonymization, perturbation, and generative baselines on statistical similarity, privacy leakage, and model compatibility. Table-GAN generally provides the strongest privacy–compatibility balance, while performance varies by dataset and privacy setting.
- Experimental setup: Four real-world tables cover payroll, personal records, health, and airline-market data, with classification or regression labels derived from available attributes.The LACity, Adult, Health, and Airline datasets support different model-compatibility tests based on salary, work hours, diabetes, and ticket price.
- Statistical comparison: Table-GAN with low privacy produces realistic cumulative distributions for LACity salary and Adult work class, while table-GAN and DCGAN reproduce Airline airport-ID ranges.The condensation method and DCGAN fail to synthesize all LACity salary values, while the condensation method is unreliable for airport IDs.
- Statistical comparison: Across all cases, low-privacy table-GAN produces statistically similar synthetic tables; high-privacy table-GAN outperforms DCGAN, while condensation performs worst overall.
- Model compatibility: Health is the clearest advantage for table-GAN: it shows better model compatibility than every baseline and the only practically meaningful compatibility there.
- Model compatibility: Table-GAN is slightly worse than the best ARX or sdcMicro cases on Adult and Airline classification tests, but remains acceptable.
- Model compatibility: In almost all datasets, table-GAN, ARX, and sdcMicro show good model compatibility, with table-GAN outperforming ARX overall.sdcMicro generally performs best because its data modifications are limited, whereas table-GAN remains competitive despite stronger privacy.
- Privacy distance: Table-GAN's low-privacy setting yields average closest-record distances up to tens of times longer than ARX and sdcMicro, with stable average and standard-deviation values.ARX has zero sensitive-attribute distance because it leaves sensitive values unchanged, whereas table-GAN has no one-to-one relationship between original and generated tables.
- Membership attack: Increasing hinge-loss parameters δ_mean and δ_sd reduces membership-attack performance; in Adult, F-1 drops from 0.51 to 0.19.Low privacy permits F-1 and AUCROC values up to 0.64, while high privacy decreases attack performance by 10% in many cases.
6. CONCLUSION
The paper introduces table-GAN for synthesizing relational tables while preserving model compatibility and improving privacy–utility trade-offs. Experiments on large real-world datasets support this trade-off, while future work targets broader data types and better generation quality.
- Table-GAN synthesizes relational tables and achieves model compatibility comparable to anonymization methods that leave sensitive attributes unchanged.
- Across statistical, closest-record-distance, and model-compatibility tests, table-GAN shows the best trade-off between privacy level and model compatibility.The experiments use four real-world datasets with millions of records and tens of attributes.
- The authors plan to extend table-GAN to strings and further improve generation quality.
A. STATISTICAL COMPARISON
Additional cumulative-distribution comparisons show that low-privacy table-GAN maintains strong generation performance across all datasets.
- Low-privacy table-GAN shows very good generation performance in all datasets, while condensation and DCGAN are only occasionally acceptable.