II · THE IDEA · ARTIFICIAL INTELLIGENCE
Synthetic Data Generation with Differential Privacy
▶ Listen · narrated
Hospitals, banks and census offices hold tables they cannot share. Differentially private generators offer a third path: release synthetic data with a formal guarantee attached.
At a glance
- Goal
- Release synthetic rows that preserve utility under a DP bound
- Two routes
- Private GANs; graphical-model estimation then sampling
- Guarantee
- Differential privacy bounds influence of any single record
- Output
- A shareable table, not the trained discriminator or raw data
Think of a locked recipe book you may not photocopy. Instead you are allowed to taste dishes cooked from it while wearing gloves that slightly numb your tongue, then write your own cookbook from those blurred tastings. Guests cook from your book and never touch the original.
Differentially private synthetic data works in that spirit. A generative model—either a GAN trained with noisy gradients, or a graphical model fitted to noisy statistics—learns patterns under a mathematical cap on how much any one person’s row can affect the result. What you publish is new rows drawn from that learned pattern, plus a statement of the privacy bound. Analysts get a table they can sort, join and model. They do not get the real rows, and the bound limits how much those real rows could have shaped what they see.
Two mechanisms dominate the verified line of work.
DP-GAN-style training applies differential privacy to discriminator updates: per-example (or per-lot) gradient clipping bounds sensitivity; Gaussian or similar noise calibrated to that sensitivity and to the target (epsilon, delta) is added before the optimiser step. The generator receives gradients only through this private discriminator path and, after training, may be sampled without further access to the private set. Composition theorems account for the sequence of private steps across epochs.
Graphical-model approaches measure selected low-dimensional marginals (or related statistics) with noise sufficient for differential privacy, estimate a compact factorisation of the joint, and sample synthetic records from that model. Privacy attaches to the measurement step; sampling is post-processing. Utility hinges on whether the measured workload and chosen structure capture dependencies required downstream.
Limitations are structural. Tight budgets increase noise and erode rare cells and higher-order dependence. GANs may mode-collapse or underfit under strong noise; graphical models miss edges they were never allowed to measure well. Evaluation should report task-level metrics under stated epsilon, not only average marginal error. Post-processing immunity means arbitrary computation on the released synthetic table does not consume more privacy budget, which is why bulk row release is attractive compared with interactive query answer systems.
Look closer
Noise enters the learning step, not the finished rows
In a differentially private GAN, the privacy mechanism acts on the discriminator’s gradient updates during training. Clipping and calibrated noise limit how much any one training record can pull those gradients. The generator never sees the private table directly; it learns only through this already-noised signal. The synthetic rows that later leave the system are ordinary samples from the trained generator—they are not themselves re-noised cell by cell.
Graphical models estimate a private joint, then sample
A different family of methods builds a compact graphical model of the data distribution under differential privacy. Low-dimensional marginals or other sufficient statistics are measured with noise, a structure is chosen or inferred, and the resulting model is used to draw synthetic records. Utility then depends on whether the chosen structure captures the dependencies that downstream analysts actually need.
Utility and privacy pull in opposite directions
Tighter privacy forces more noise into estimation or into gradient steps. That noise blurs rare combinations, weakens long-range correlations and can distort tails. The practical question is never whether synthetic data matches the original row for row—it must not—but whether the queries and models people will run still behave acceptably after the privacy spend.
The story
Sensitive tables create a familiar stalemate. Analysts want joint distributions, correlations and enough volume to train models. Data holders cannot hand over the raw rows. Aggregated releases and hand-built redactions help only a narrow set of questions, and they often still leak through differencing or linkage. Synthetic data generation with differential privacy tries to break the stalemate by training a generative process under a formal privacy bound, then publishing samples from that process instead of anything that came from a real person.
Two broad lines of work dominate the idea. One trains generative adversarial networks with differentially private optimisation. A discriminator is updated on real and generated batches, but its gradients are clipped and mixed with calibrated noise so that the presence or absence of any single training record has a bounded effect on the transcript of the training run. The generator is trained against this discriminator and, once training ends, can be sampled freely. Because the privacy cost was paid on the learning path, releasing many synthetic rows need not multiply the privacy loss the way releasing many query answers on the raw table would.
The other line estimates a graphical model under differential privacy. Rather than learning a deep generator, it privately measures selected marginals or other statistics, fits a factored approximation to the joint distribution, and draws synthetic records from that approximation. The appeal is interpretability and, on some tabular regimes, more reliable recovery of the low-order structure that analysts actually query. The cost is expressiveness: a misspecified graph cannot invent dependencies the private measurements never supported.
In both cases the published object is synthetic data—rows that look like the original schema—paired with a privacy accounting that states how much any individual’s record could have influenced the release. Downstream users run ordinary tools on the synthetic table. They do not need a trusted curator for every new query, which is the operational win. The scientific win is narrower and harder: the synthetic joint must be close enough on the statistics that matter, after noise has done its work. Rare groups, long tails and subtle conditional relationships are where that closeness most often fails, and where honest reporting of limits matters as much as the method itself.
Nothing in the setup claims that synthetic rows are anonymous copies of real people. They are draws from a model trained under a bound. If the model memorised, the bound was meant to limit how much; if the model underfit, utility suffers before privacy does. Choosing epsilon, clipping norms, which marginals to measure, and how to evaluate utility on held-out tasks are the engineering decisions that separate a usable release from a private but empty one.
Why it mattered then
When differentially private GANs and graphical-model estimators for private synthetic data were written up, institutions already faced rising demand for microdata and rising legal and ethical cost for sharing it. Classical query systems under differential privacy answered fixed questions well but scaled poorly when every new analyst needed a new workload. Generative release promised a different contract: pay the privacy cost once while training or estimating, then hand out a table that ordinary software could consume. That matched how economists, epidemiologists and machine-learning practitioners actually worked—on flat files, not on interactive privacy APIs—and it reframed synthetic data from a heuristic anonymisation trick into something that could carry a proof-style guarantee.
Why it matters now
Open models, shared benchmarks and cross-organisation collaboration still stall on data access. Differential privacy on the generative path remains one of the few ways to publish high-dimensional stand-ins without pretending that suppression and binning are enough. The same tension persists: tighter budgets degrade utility on the thin parts of the distribution, and evaluation must check the tasks people care about, not only average error on a few marginals. As more teams fine-tune and evaluate on tabular and mixed-type data they cannot lawfully pool, private synthetic generators stay a practical instrument rather than a curiosity—provided the privacy accounting and the utility report travel with the file.
The surprising detail
The synthetic rows need not be noised at release time. In the GAN route the noise was spent on clipped gradients during training; once the generator exists, sampling is free with respect to the privacy ledger. That separation—privacy on the learning transcript, ordinary draws afterwards—is easy to miss if one expects every published cell to carry fresh randomness.
What is disputed
Reported utility depends heavily on dataset, privacy budget, chosen marginals or architecture, and the downstream task. Papers on private GANs and on graphical-model estimators do not establish a single winner across regimes; where evidence is thin, treat method choice as empirical rather than settled.
Remember this
Private synthetic data pays for privacy while learning a generator or a graphical model, then releases ordinary samples so analysts can work without touching the original rows.
Test yourself
A team trains a differentially private GAN on a hospital table, then publishes 500,000 synthetic rows. A second team publishes the same number of answers to new SQL queries on the raw table, each answered under differential privacy. Why might the first team’s privacy ledger grow far more slowly with the volume of output than the second team’s?
In the DP-GAN case the privacy cost is charged on the noised, clipped training updates. After training, sampling the generator does not re-access the private records, so additional synthetic rows need not multiply privacy loss the way additional raw-table queries do. In the interactive query case each new answer touches the private data again and adds to the cumulative spend.
Go deeper
- [1802.06739] Differentially Private Generative Adversarial Network · arxiv.org
- [1901.09136] Graphical-model based estimation and inference for differential privacy · arxiv.org
Image: Original diagram, The Daily Triptych. Licence: Original work. Source.