Synthetic Data, Similarity-based Privacy Metrics, and Regulatory (Non-)Compliance

TL;DR

This paper critically examines the limitations of similarity-based privacy metrics in ensuring regulatory compliance for synthetic data, highlighting their inability to prevent re-identification and linkability risks.

Contribution

It provides a detailed analysis and counter-examples demonstrating that similarity-based metrics are insufficient for privacy guarantees and overlook key regulatory considerations.

Findings

Similarity-based metrics do not prevent re-identification.

They fail to address linkability risks.

They ignore the motivated intruder test.

Abstract

In this paper, we argue that similarity-based privacy metrics cannot ensure regulatory compliance of synthetic data. Our analysis and counter-examples show that they do not protect against singling out and linkability and, among other fundamental issues, completely ignore the motivated intruder test.