Practical privacy metrics for synthetic data

TL;DR

This paper introduces new privacy risk measures for synthetic data, implemented in the R package synthpop, focusing on identity and attribute disclosure risks with practical evaluation on real datasets.

Contribution

It extends the synthpop package to include measures of disclosure risk, specifically RepU and DiSCO, for better privacy assessment of synthetic data.

Findings

RepU and DiSCO effectively measure disclosure risks.

Some apparent disclosures are due to known data relationships.

The methods help identify and exclude high-risk disclosures.

Abstract

This paper explains how the synthpop package for R has been extended to include functions to calculate measures of identity and attribute disclosure risk for synthetic data that measure risks for the records used to create the synthetic data. The basic function, disclosure, calculates identity disclosure for a set of quasi-identifiers (keys) and attribute disclosure for one variable specified as a target from the same set of keys. The second function, disclosure.summary, is a wrapper for the first and presents summary results for a set of targets. This short paper explains the measures of disclosure risk and documents how they are calculated. We recommend two measures: $RepU$ (replicated uniques) for identity disclosure and $DiSCO$ (Disclosive in Synthetic Correct Original) for attribute disclosure. Both are expressed a \% of the original records and each can be compared to similar measures calculated from the original data. Experience with using the functions on real data found that some apparent disclosures could be identified as coming from relationships in the data that would be expected to be known to anyone familiar with its features. We flag cases when this seems to have occurred and provide means of excluding them. This paper was originally written as a vignette for the R package synthpop, with substantial changes added in February 2026 for synthpop version 1.9-3.