Is Synthetic Data Safe?
Have concerns? Try our Support Assistant or visit the Support page.
Synthetic data involves a natural balance between data quality and privacy protection. Datasets that more closely reflect the original data may offer greater analytical value, while also requiring careful consideration of privacy risks. As a data owner, you are responsible for deciding whether a synthetic dataset is sufficiently safe and useful for your intended purpose.
There is no single, universal metric that determines whether synthetic data is “safe.” Unlike traditional anonymization techniques, synthetic data does not have widely accepted numeric thresholds (such as k-anonymity ≥ X). Instead, the safety of synthetic data depends on context; including the sensitivity of the underlying data, the intended use, and the organisation’s tolerance for residual risk.
This does not mean synthetic data is unsafe or unusable. In practice, synthetic data is already being used across the public sector, research, and industry. In Singapore, the Personal Data Protection Commission recognizes synthetic data as a practical Privacy-Enhancing Technology (PET) and has published guidance on how to assess its safety and manage residual risks.
Mirage has aligned our risk-based approach to PDPC’s guidance, as well as research and industry best practices.
Our Approach
We provide:
- A privacy-preserving generation option (see more): DP-Copula offers formal, mathematically defined privacy protection using Differential Privacy, allowing users to explicitly bound worst-case membership inference risk.
- Attack-based privacy metrics (see more):
Mirage provides attack-based privacy metrics aligned with PDPC guidance on evaluating disclosure risk through realistic attack scenarios, including:- Singling-out attacks
- Membership inference attacks
- Linkability attacks
- Attribute inference attacks (overall and column-level)
- Heuristic privacy metrics (see more):
In addition, Mirage provides simple privacy metrics such as exact row leakage detection, similarity distances, and outlier detection. These checks are widely used in industry because they are fast, intuitive, and easy to interpret. While research shows that they are not sufficient on their own, Mirage uses them as complementary signals to surface obvious red flags, support understanding, and guide iterative tuning.
Recommendations
We recommend the following to users:
- Generate the synthetic data and review the privacy metrics first.
- Assess acceptability in context
Interpret the results in light of your data-sharing context and existing safeguards, such as whether the data is shared internally or externally, who can access it, and what contractual or governance controls are in place. - Strengthen protection if needed
If the observed risks are higher than acceptable, consider switching to DP-Copula and lowering your Max Membership Inference Attack (MIA) Risk to enforce a stronger, formally bounded privacy guarantee. - Iterate and re-evaluate
Confirm that risks have been reduced without unnecessarily sacrificing data utility.
Can SDG Enable Down-Classification?
Yes, synthetic data can support down-classification for data sensitivity (i.e., Non-Sensitive/ Sensitive-Normal/ Sensitive-High), but only if it meaningfully reduces direct and reasonably expected harm should the data be disclosed. As specified in IM8 Data Classification, the Information Sensitivity Framework (ISF) considers the impact of unauthorised disclosure of individual and entity data.
Synthetic data is a form of data treatment that may reduce data sensitivity because it changes the impact of unauthorised disclosure: even if the data is exposed, the direct and reasonably expected harm to real individuals or entities is materially lower, since the records do not correspond to real persons.
The assessment of whether synthetic records correspond to real persons should be supported by privacy metrics such as those we provide. In particular, attack-based metrics like Singling-Out Protection, Membership Inference Protection, Linkability Protection, and Attribute Inference Protection measures whether data points can be tied to a specific individual.
Example:
An original dataset containing patient-level records with age, diagnosis, treatment history, and outcomes would cause serious damage to an individual if leaked and thus would likely be classified as Sensitive-High.
After generating synthetic data that preserves overall statistical patterns (e.g. prevalence of conditions, treatment trends) but contains no real patient records, the dataset may no longer enable reasonable individual-level linkage. The dataset can then be classified based on residual dataset-level risks.
