DP Synthetic Data

Hospitals train AI on patient records. Census bureaus publish demographic tables. Banks share fraud patterns with researchers. In every case the goal is the same: release what the data says without revealing who said it.

The naive fix — strip names and IDs — has been broken dozens of times. In 1997, Latanya Sweeney re-identified 87 % of Massachusetts residents from a supposedly anonymized medical file using only ZIP code, birth date, and sex. Names were gone; the people were not.

Differential privacy (DP), formalized by Cynthia Dwork and colleagues around 2006, takes a different route. Instead of hiding information after the fact, it adds calibrated random noise before any answer leaves the database. The guarantee is mathematical: whether or not your record is in the dataset, the published output looks almost the same. No adversary — no matter how much side information they hold — can gain more than a tiny, controlled advantage by learning you were in the study.

Differentially private synthetic data pushes this further. Rather than answering individual queries with noise, it publishes an entirely synthetic dataset — fake rows that no real person ever lived, but whose aggregate statistics (means, histograms, correlations) are close to those of the original. Analysts run any analysis they like on the synthetic copy; the privacy budget is spent once, at generation time.

The tension is fundamental: more accuracy demands less noise; more privacy demands more noise. The parameter $\varepsilon$ (epsilon) controls the trade-off. Small $\varepsilon$ is strong privacy; large $\varepsilon$ is more utility. There is no free lunch, and the P vs NP landscape of the underlying combinatorics makes some generation methods provably hard to compute.

The demo below shows a tiny real dataset of 20 points drawn from two clusters. The generator measures the mean and standard deviation of each coordinate, adds Laplace noise scaled to $1/\varepsilon$, then draws a fresh synthetic sample from the noisy parameters.

<!-- {{c_html_intro}} -->
<div class="controls">
  <label for="eps-slider">{{label_epsilon}} <strong id="eps-val">1.0</strong></label>
  <input id="eps-slider" type="range" min="0.1" max="10" step="0.1" value="1.0">
  <button id="btn-regen" type="button">{{btn_regenerate}}</button>
</div>
<canvas id="plot" width="480" height="320"></canvas>
<div class="legend">
  <span class="dot real"></span> {{legend_real}}
  <span class="dot synth"></span> {{legend_synth}}
</div>
<div id="stats-box" class="stats-box"></div>

/* {{c_css_intro}} */
* { box-sizing: border-box; }
body { font-family: system-ui, sans-serif; margin: 0; color: #222; }
.controls { display: flex; align-items: center; gap: .6rem; flex-wrap: wrap; margin-bottom: .5rem; font-size: .92rem; }
label { font-weight: 600; }
input[type=range] { flex: 1 1 120px; accent-color: #1d3557; }
button { font: 600 13px system-ui; padding: .35rem .8rem; background: #1d3557; color: #fff; border: none; border-radius: 7px; cursor: pointer; }
canvas { display: block; border: 1px solid #cdd9e3; border-radius: 10px; background: #f8fafc; max-width: 100%; }
.legend { display: flex; gap: 1rem; font-size: .84rem; margin: .4rem 0; }
.dot { display: inline-block; width: 10px; height: 10px; border-radius: 50%; margin-right: 4px; }
.dot.real { background: #1d6fa5; }
.dot.synth { background: #e05c2b; }
.stats-box { font-size: .82rem; color: #445; margin-top: .3rem; line-height: 1.6; }

// Code not found

Slide epsilon toward 0.1 (strong privacy) and the synthetic cloud drifts far from the original. Slide it toward 10 (weak privacy) and the two overlap almost perfectly. The real points are never revealed — only the noisy statistics used to generate the synthetic ones.

The formal guarantee of differential privacy says: for any two datasets $D$ and $D'$ that differ in exactly one row, and for any output $S$,

$$\Pr[\mathcal{M}(D) \in S] \leq e^{\varepsilon} \cdot \Pr[\mathcal{M}(D') \in S] + \delta$$

where $\mathcal{M}$ is the randomized mechanism. When $\delta = 0$ this is called pure DP; small $\delta > 0$ gives the slightly weaker but more practical approximate DP.

• Sensitivity: the maximum change one row can cause in the statistic. For a count query over $n$ records, sensitivity is $1/n$; for a mean it can be much larger. Noise must be scaled to sensitivity divided by $\varepsilon$.
• The Laplace mechanism: add noise drawn from $\text{Lap}(0, \Delta/\varepsilon)$ to each real-valued answer, where $\Delta$ is the $\ell_1$-sensitivity. Simple, optimal for pure DP on numeric queries.
• Composition: run $k$ queries with budget $\varepsilon$ each and the total privacy loss is at most $k\varepsilon$ (basic composition) or roughly $\varepsilon\sqrt{k\ln(1/\delta)}$ (advanced composition). A fixed budget must be divided among all queries.
• The hardness barrier: privately releasing a synthetic dataset that matches all low-degree statistics simultaneously requires sample complexity exponential in the data dimension under standard cryptographic assumptions (Ullman & Vadhan, 2011). Practical algorithms target restricted families of statistics — marginals, histograms, workload-specific queries — and accept either weaker guarantees or approximation.

This is not a bug. It reflects the same information-theoretic tension that runs through differential privacy and randomized algorithms: you cannot extract signal without paying a noise tax, and computing the optimal synthetic release is in general as hard as breaking the cryptographic primitives that underpin the hardness proof.

Differentially private synthetic data is moving from theory to production in several high-stakes domains:

• Healthcare: hospitals and biobanks generate synthetic patient cohorts for drug-trial simulations and AI model training, enabling research on rare conditions without exposing anyone's records. The NHS and several US hospital networks have run pilot programs using DP synthetic data.
• Census and statistics: the US Census Bureau used differential privacy in the 2020 decennial census, one of the largest DP deployments in history. The synthetic micro-data it released let researchers run custom tabulations without seeing real household records.
• AI training data: large language models and image classifiers trained on synthetic DP data can be deployed without triggering GDPR data-minimization rules, because the training set contains no real individuals.
• Financial crime: banks share DP synthetic transaction logs with regulators and peer institutions to build joint fraud-detection models without revealing customer identities or proprietary patterns.
• Software testing: developers seed test environments with synthetic data that behaves like production, eliminating the accidental leakage that comes from using real records in staging systems.

The common thread: share the shape of the data, not the data itself. Differential privacy makes that phrase into a theorem rather than a wish.

For decades, privacy was a policy — a set of rules about who could see what. Differential privacy makes it a theorem: given $\varepsilon$ and $\delta$, any adversary's advantage is bounded, regardless of what they already know. Synthetic data extends that theorem to cover not just individual queries but entire datasets released for open analysis.

The price is real. Strong privacy shrinks utility; the best synthetic generation algorithms are computationally expensive; and the hardness results from theoretical computer science say there is no general escape. The parameter $\varepsilon$ is not a technical detail — it is the honest answer to the question "how much does this person's data actually matter to what you're publishing?"

As more data flows through the world, the ideas behind differential privacy and DP synthetic data are becoming the engineering bedrock of trustworthy AI and open science. Learning what $\varepsilon$ costs is the first step toward spending it wisely.