PaperlayerView exact revision on arXiv

Source-linked AI summary

Synthetic Data -- what, why and how?

James Jordon, Lukasz Szpruch, Florimond Houssiau, Mirko Bottarelli, Giovanni Cherubin, Carsten Maple, Samuel N. Cohen, Adrian Weller

arXiv:2205.03257v1cs.LG

TL;DR

Synthetic data aims to support data-science tasks when real data is sensitive, incomplete, scarce, or biased, but its privacy and utility are not automatic. This explainer defines the technology, surveys privacy-preserving and related applications, and concludes that it is useful with careful, context-specific deployment rather than as a replacement for real data.

  • Problem

    Sensitive datasets are valuable for research and innovation, but synthetic data must address privacy, utility, fairness, and linkage challenges without being assumed private by default.

  • Method

    The explainer defines synthetic data and surveys its generation, privacy evaluation, partial synthesis, data linking, software testing, and fairness applications.

  • Results

    Synthetic data can accelerate development and support privacy-preserving research, but privacy guarantees, utility, fairness, and linkage depend on the generation method and use context.

  • Takeaways & Limitations

    Synthetic data is a useful tool for prototyping, testing, and learning under data-access constraints, but final tools should be evaluated and, if necessary, fine-tuned on real data.

  • Takeaways & Limitations

    Fairness may not transfer from synthetic to real data, and general definitions of fair synthetic data remain open problems.

Abstract

from arXiv · show

This explainer document aims to provide an overview of the current state of the rapidly expanding work on synthetic data technologies, with a particular focus on privacy. The article is intended for a non-technical audience, though some formal definitions have been given to provide clarity to specialists. This article is intended to enable the reader to quickly become familiar with the notion of synthetic data, as well as understand some of the subtle intricacies that come with it. We do believe that synthetic data is a very useful tool, and our hope is that this report highlights that, while drawing attention to nuances that can easily be overlooked in its deployment.

Executive Summary

Synthetic data offers substantial benefits across privacy, fairness, and development, but its use carries important risks. It is not automatically private or a replacement for real data, and careful evaluation is required.

  • Synthetic data has applications in privacy, fairness, and data augmentation, but each application brings both potential impact and risks.
  • Synthetic data can accelerate development, reduce software lifecycle costs, and contribute to data democratisation when combined with secure research environments and federated learning.
  • Synthetic data is not automatically private because it can leak information from its source data and remain vulnerable to privacy attacks.
  • Privacy-guaranteed synthetic data is a distorted version of real data, so models and inferences based on it carry additional risks and require real-data evaluation or fine-tuning.
  • Outliers and low-probability events are difficult to capture privately without either reducing statistical accuracy or risking disclosure of individuals’ information.
  • Privacy is a property of the data-generating mechanism rather than an individual synthetic dataset, making direct empirical privacy evaluation insufficient.
  • Black-box generative models can produce high-dimensional synthetic data while making accuracy and privacy difficult to estimate across data points.

1 Introduction

Synthetic data is motivated by the need to use valuable but sensitive data without careless sharing. It can support learning, prototyping, validation, and responsible innovation, although safe deployment frameworks remain incomplete.

  • Sensitive, high-dimensional datasets can improve decision-making and innovation but are vulnerable to privacy attacks and constrained by regulations such as GDPR and CCPA.
  • Synthetic data is model-generated data intended to adjust privacy release, resemblance to real data, historical bias, or hypothetical scenarios.
  • Synthetic data can enable learning across datasets while preserving privacy and help prototype, verify, and validate data-driven models.
  • Its applications offer substantial opportunities but require tailored solutions, and systematic frameworks for safe, responsible deployment are still missing.

2 What is Synthetic Data?

Synthetic data is generated by a purpose-built model or algorithm to solve data-science tasks, with forms ranging from neural networks to simulations. The paper examines what synthetic data can replace or support, emphasizing weaker inference, linkage challenges, and privacy trade-offs.

  • 2 What is Synthetic Data?: Synthetic data is data generated by a purpose-built mathematical model or algorithm to solve one or more data-science tasks.
  • 2 What is Synthetic Data?: Synthetic-data generators include GANs, VAEs, agent-based and econometric models, and stochastic differential-equation systems.
  • 2 What is Synthetic Data?: Synthetic data has long provided ground truth useful for developing and evaluating machine-learning pipelines.
  • 2 What is Synthetic Data?: The recent growth of data-protection regulation has increased interest in using synthetic data instead of real data to reduce disclosure risk.
  • 2 What is Synthetic Data?: Synthetic data does not automatically solve privacy or bias problems: trained generators may memorise data, while untrained generators are private but limited by predetermined configurations.
  • 2.1.1 How should we approach doing things with synthetic data?: Conclusions from analysis and hypothesis testing are necessarily weaker with synthetic data, requiring adjusted statistical significance.
  • 2.1.2 Data Linking: Independently synthesised datasets can break one-to-one matches, creating a need for minimally privacy-leaking linkage methods.
  • 2.2 Combining Synthetic Data with Other Technologies: Federated learning trains across decentralised datasets without pooling them, while private synthetic data may help select algorithms before evaluation on distributed real data.

3 Why use Synthetic Data?

Synthetic data supports private release, software testing, de-biasing, what-if generation, and data labelling. Its usefulness depends on matching the data’s required semantic, statistical, privacy, and deployment properties to the application.

  • Three prominent machine-learning application areas are private data release, de-biasing and fairness, and data augmentation for robustness.
  • Private Data Release: Synthetic data can reduce barriers to accessing regulated data and support development partnerships, provided synthetic-data models lead to the same conclusions as real-data development.
  • Private Data Release: For software testing, semantic correctness and structural properties may matter without statistical correctness, allowing greater privacy or utility at the same privacy level.
  • Private Data Release: Training on private synthetic data may miss important statistical structure, motivating greater focus on the privacy of trained models.
  • De-biasing: Synthetic data can reduce historical-bias amplification across multiple black-box pipelines, but causal what-if generation remains sensitive to assumptions and introduces model risk.
  • Data Labelling: Synthetically generated labelled data offers a cost-efficient way to obtain training data for deep neural networks in computer vision.

4 Privacy in Machine Learning - An Overview

The paper frames privacy through potential adversaries, their knowledge, and the harms caused by information disclosure. It introduces differential privacy as a contrastive, algorithm-level guarantee against such attacks.

  • Threat model: Privacy analysis begins with an adversary who may cause harm if too much information about an individual is revealed.The paper motivates privacy through the contrast between an individual’s prior information and what an algorithm’s output reveals.
  • Threat model: Membership inference tests whether a targeted individual was included in the algorithm’s input data.Its privacy relevance depends on whether dataset membership itself reveals information about the individual.
  • Threat model: Attribute inference recovers additional attributes using prior knowledge and an algorithm’s output, with privacy judged relative to whether the individual contributed data.The paper emphasizes improvement over the counterfactual where the individual was absent from the training data.
  • Threat model: Reconstruction attacks seek to extract entire records from the training dataset using an algorithm’s output.Unlike membership and attribute inference, reconstruction is not necessarily targeted at a particular individual.
  • Differential privacy: Differential privacy requires randomized algorithm outputs to remain similar on adjacent datasets, limiting information leakage and bounding adversarial attacks.The guarantee applies under worst-case assumptions about adversarial prior knowledge, algorithm knowledge, and computing power.
  • Differential privacy: Differential privacy implies that analyses of an output are approximately unchanged whether or not an individual contributes a record.The paper also describes this guarantee in Bayesian terms, as limiting changes in posterior beliefs and log-odds.

5 Utility, Fidelity and Privacy of Synthetic Data.

Synthetic data must balance utility, fidelity, and privacy, while recognizing that these goals can conflict. The paper therefore argues for use-case-specific generation rather than a universal synthetic dataset.

  • Core attributes: Synthetic data is meaningful only when it is sufficiently useful and similar to real data while remaining different enough to address the original data’s shortcomings.The paper identifies utility, fidelity, and privacy as the three fundamental attributes of synthetic data generation.
  • Core attributes: Utility measures usefulness for specified tasks, often by comparing models trained on real and synthetic data and examining performance or fairness metrics.The paper mentions Train on Synthetic, Test on Real as one evaluation approach.
  • Core attributes: Fidelity directly measures how well synthetic data statistically matches real data, rather than evaluating it indirectly through task performance.Fidelity may concern selected marginals or relationships between variables.
  • Trade-offs: Fidelity and utility are linked but not synonymous: fidelity can decrease while utility remains unchanged, potentially leaving room for improved privacy.This means optimizing one dimension does not fully determine the others.
  • Trade-offs: Privacy depends on information revealed about the real data, and its required strength varies between settings such as secure internal use and public release.Differential privacy supports systematic analysis of generation algorithms, but the privacy of an individual released sample is less precisely understood.
  • Trade-offs: Higher fidelity generally reduces privacy, so private synthetic data cannot be expected to serve every use case equally well.The paper recommends grouping use cases by required fidelity and generating datasets with user-specified privacy guarantees.
  • Desiderata: A good generator should provide syntactical accuracy, privacy, statistical accuracy, and efficiency, but no systematic framework currently satisfies all four simultaneously.The paper describes conflicts between accurate correlation preservation and differential privacy, including a general computational impossibility result.
  • Use-case-specific design: Synthetic data should be generated for a specific use case so relevant statistical properties can be preserved while others are omitted to support privacy.The paper explicitly rejects trying to make synthetic data too general.

6 Auditing Synthetic Data

Auditing synthetic data privacy is useful but cannot replace formal guarantees. The paper surveys attack-based, algorithm-level, leakage-based, and dataset-level evaluations, emphasizing their distinct scopes and limitations.

  • Formal versus empirical privacy: Differential privacy cannot be established from a synthetic dataset alone because it is a property of the generating algorithm.Empirical checks may test an algorithm for violations but cannot prove differential privacy.
  • Formal versus empirical privacy: Algorithm-level DP verification uses queries or known attacks to search for violations and understand privacy behavior.These tools may help select meaningful ε values in context.
  • Formal versus empirical privacy: Statistical verification cannot prove differential privacy and would require many samples across many input datasets for meaningful confidence, making it computationally intractable.The burden increases for complex outputs such as generated datasets.
  • Evaluation approaches: Leakage estimation quantifies privacy against a specified threat model and can support black-box analysis without formal modeling of the generator.Its main limitation is that the result remains tied to the chosen threat model or attack.
  • Dataset-level evaluation: NNDR compares synthetic-data distances with distances from a hold-out test set, but requires such a test set and can miss revealing holes around real records.A method may satisfy NNDR while still exposing where real records should be.
  • Evaluation approaches: Privacy auditing asks whether attacks can reveal information about users, providing an intuitive way to assess and compare synthetic data systems.The paper presents adversarial evaluation as an active research direction for synthetic data.
  • Attack-based evaluation: Shadow modelling evaluates membership and attribute-inference risk by simulating many generator runs with auxiliary data.The paper notes that auditing also requires transparency about how the generator was produced.
  • Open research: Privacy evaluation remains a nascent and challenging research area, with prospective attack directions involving GAN outputs and reproduced aggregate statistics.The paper treats these directions as open research rather than settled auditing methods.

7 Private Synthetic Data Generation

Private synthetic data generation must manage the high dimensionality of released datasets and the tension among privacy, utility, fidelity, and fairness. The paper surveys private generators and partially synthetic alternatives, whose practical suitability depends on the use case.

  • Generation challenges: Synthetic data occupies the same value space as real data, enabling substitution for real data and direct similarity comparisons.This property distinguishes synthetic data from many other privacy-preserving outputs.
  • Generation challenges: Private generators can reduce this difficulty because their complexity need scale with feature dimensionality rather than the number of generated rows.Directly constructing an accurate private dataset may instead require a large privacy budget.
  • Private generators: Differential privacy applies to the generating algorithm, not to a single synthetic dataset realization.A concrete output is neither private nor non-private in isolation under this notion.
  • Private generators: A common approach privately trains a generator and then samples synthetic records from it, with post-processing allowing arbitrarily many outputs.Training an ε-DP generator can nevertheless produce conservative privacy guarantees and lower utility.
  • Outliers and fairness: Private synthetic data suppresses outliers, which can reduce utility in tasks such as fraud detection and under-represent minority groups.The paper connects the difficulty of hiding uniquely identifying outliers with a fairness concern.
  • Outliers and fairness: Privacy and fairness can conflict because fairness requires utility for minority groups while privacy hides individual contributions, including minority-group contributions.The paper cites a view that current mechanisms cannot simultaneously achieve privacy, fairness, and utility.
  • Generation methods: Private generation methods include DPSGD-based neural models, PATE-based approaches, Bayesian networks, copulas, and marginal-distribution methods.The paper states that where privacy should be enforced remains an open question, with examples applying it to generators or discriminators.

8 De-biased Synthetic Data Generation

Fair synthetic data generation aims to address bias in datasets through generative models and fairness criteria, but translating fairness across predictors and real-world distributions remains unresolved.

  • Approaches: Fair synthetic data generation reframes dataset de-biasing as learning a generative model that produces data satisfying specified fairness notions.Some approaches use causal modelling to identify generation strategies aligned with the targeted fairness definition.
  • Fairness notions: Fairness Through Unawareness requires predictors to exclude protected attributes, whereas Demographic Parity requires predictions to be independent of them.Demographic Parity is stronger because unprotected attributes can indirectly encode protected attributes.
  • Fairness notions: Causal graphical approaches can enforce Demographic Parity by deleting edges originating from variables with protected attributes among their causal predecessors.This may degrade performance because those variables can remain useful predictors of the target.
  • Open problems: Predictors trained on fair synthetic data may not remain fair on real data because fairness depends on the feature distribution.General definitions of fair synthetic data and guarantees for predictors trained on it remain open problems.
  • Evaluation: Fair synthetic data is a younger and less-developed research area than work on fair predictors, with evaluation often comparing predictor outputs under varied protected attributes.These evaluations target whether bias has been removed from the generated data.
  • Approaches: A causal GAN approach selectively drops edges using a known causal graph, while a loss-penalty GAN trades fairness against synthetic-data fidelity through a hyperparameter.The loss-based approach may still generate unfair data when fairness constraints reduce fidelity.

9 Data Augmentation

Synthetic data augmentation enlarges training sets, especially where domain structure offers few simple transformations, but its benefit depends on generating sufficiently diverse samples.

  • Purpose: Synthetic data augmentation enlarges datasets with additional training samples and can act as a regulariser that reduces downstream model variance.This use case is described as one of the most successful applications of synthetic data so far.
  • Domain differences: Synthetic-data augmentation is especially promising for less-structured domains such as generic tabular data, where image-style transformations have no close parallel.Images can often be augmented through rotations, flipping, or cropping, while generic tabular data lacks comparable structure.
  • Generalisation: The central goal is generalisability: a learned generator should produce realistic training-like samples that help models perform on unseen data.The approach commonly learns a generative model such as a GAN from available training data.
  • Generalisation: Generated samples must differ sufficiently from the originals to provide augmentation benefits, although this dissimilarity requirement is weaker than for privacy or fairness.Samples that are too similar offer no benefit over training on the original data alone.
  • Model design: Data augmentation requires a generative model tailored to the target domain, and additional restrictions may be needed to enforce useful dissimilarity.A perfect GAN generator can perform poorly for semi-supervised learning, while a less accurate generator can perform well.

10 Generative Modelling - An Overview

Generative modelling spans explicit and implicit approaches for producing samples with learned statistical properties across data types. The overview highlights differing computational, scalability, controllability, and evaluation challenges.

  • Taxonomy: The generative-modelling taxonomy groups likelihood-maximising models into explicit and implicit families according to whether their density function is explicitly defined.Explicit models sample from distributions arising from the model definition, balancing data complexity against computational tractability.
  • Explicit models: Variational Auto-Encoders use tractable lower bounds for non-tractable log-likelihoods, but poorly calibrated approximations may miss the target distribution.Markov-chain methods instead use repeated stochastic sampling as an approximation strategy.
  • Implicit models: Implicit models reveal distributions through sampling rather than explicit density definitions, but examples such as Generative Stochastic Networks face scalability issues.GANs use adversarially trained generator and discriminator networks, with variants adding conditioning, convolutional structure, or information-theoretic controls.
  • Evaluation: GANs are popular, but their implicit nature makes rigorous trust-building methodologies and metrics difficult to develop.This challenge affects estimates of the accuracy and privacy of generated datasets.
  • Data types: The field covers model families and applications across specific data types, with Figure 2 providing an overview of the taxonomy.The discussion extends beyond image-focused GAN research to tabular, time-series, audio, and video generation.
  • Data types: Generative models must be adapted to data type: tabular synthesis requires column, row, and table constraints, while time-series, audio, and video require temporal or sequential modelling.Image synthesis commonly involves pixel generation through image-to-image or text-to-image transformations.

11 Messages from Industry/Start-ups

Industry views synthetic data as an emerging technology under pressure for adoption, particularly where privacy limits data access. They also stress that synthetic data accelerates work but does not clearly replace real data.

  • Adoption: Synthetic data remains younger than established AI and machine-learning applications, so significant research is still required before its benefits are fully realised.Industry pressure for private synthetic data is increasing alongside broader AI adoption.
  • Privacy: Industries seek empirical evidence about differential privacy’s practical implications, including attack susceptibility and the meaning of its parameters.Theoretical privacy guarantees alone are difficult for industry to trust without supporting empirical evidence.
  • Real-data boundary: Views differ on whether synthetic data can wholly replace real data, with some expecting continued real-data use and others anticipating future replacement.An impossibility result challenges completely general-use synthetic datasets, while a relaxed result leaves room for narrower possibilities.
  • Practical role: Synthetic data is framed as an enabling technology that can make otherwise impossible or resource-intensive processes more feasible.Examples include accessing data across legislative borders and speeding model development by providing earlier access to data-like material.

12 Conclusion

Synthetic data is promising and widely applicable, but using current methods safely requires caution and substantially more research, including societal research.

  • Synthetic data has a wide variety of applications.
  • The costs of errors are substantial in privacy and fairness applications.
  • Current synthetic-data methods should be implemented with caution.
  • More research is needed from both machine-learning and societal perspectives.
Loading 2205.03257v1…