Subgroup Membership Inference Audits of Differentially Private Synthetic Text

Abstract

Synthetic data releases are increasingly proposed in the literature as a means of sharing realistic data replicas in lieu of sensitive private datasets. Even when the worst-case privacy leakage of such releases is bounded by means of differential privacy (DP), in practice a residual risk remains. Membership inference attack (MIA) audits are conducted to empirically quantify this risk. However, existing methods only measure average-case risk for randomly drawn records, which might conceal the risk to vulnerable subgroups. To highlight this issue, we define a subgroup-targeted membership inference game in which the target pool is an explicit parameter, and instantiate it with an audit of 32 proxies under three scenarios with different levels of attacker knowledge, across four datasets, three generators (DP-SGD fine-tuning, API-based prompting, and activation steering), and five privacy budgets. The audit shows that synthetic releases leak subgroup membership and that prior attacks systematically underestimate this leakage. DP is effective at the aggregate level: it substantially reduces average leakage at every budget we test. Three observations temper this picture. First, the remaining leakage is concentrated rather than spread out: under DP, a tenth of the records carries roughly 40% of it. Second, the protection DP delivers in practice is uneven: within its worst-case guarantee, the noise removes more of the measured leakage from random records than from high-risk ones---and a merged-pool audit that scores both record types against shared negatives confirms this at the record level. Third, \emph{which} records leak proves to be a property of the release mechanism rather than of the record alone, so record-level risk cannot be assessed independently of the release.

Authors 5

Yidan Sun, Viktor Schlegel, Srinivasan Nandakumar, Siew Kei Lam, Anil Anthony Bharath

Specification

Official page

arxiv.org/abs/2609.09848

Source:arXiv (Atom API + RSS)·T1·observed 4 h ago·high

Arxiv announce type

cross

Source:arXiv (Atom API + RSS)·T1·observed 4 h ago·high

arXiv id

2609.09848

Source:arXiv (Atom API + RSS)·T1·observed 4 h ago·high

Categories

cs.CR, cs.AI

Source:arXiv (Atom API + RSS)·T1·observed 4 h ago·high

PDF

arxiv.org/pdf/2609.09848

Source:arXiv (Atom API + RSS)·T1·observed 4 h ago·high

Primary category

cs.CR

Source:arXiv (Atom API + RSS)·T1·observed 4 h ago·high

Published

11 Sept 2026

Source:arXiv (Atom API + RSS)·T1·observed 4 h ago·high

Each value shows its source, tier and observation time. Conflicting claims are kept side by side and flagged — never averaged. How AI Atlas records facts →

Provenance