Privacy
This option should be selected if your goal is to generate synthetic data with formal, quantifiable privacy guarantees and explicit control over worst-case membership inference risk.
This could apply to the following scenarios:
- Sharing synthetic data for analysis while reducing the risk of exposing whether a specific individual was in the training data.
- Generating synthetic datasets for use cases with higher privacy requirements and clear risk thresholds.
The recommended model is Differentially Private Gaussian Copula (DP-Copula).
Differentially Private Gaussian Copula (DP-Copula)
This page is suitable for both non-technical and technical users looking to understand how DP-Copula generates privacy-preserving synthetic data.
Differentially Private Gaussian Copula (DP-Copula) is a privacy-preserving synthetic data generator built on the well-established Gaussian Copula model. It incorporates Differential Privacy (DP) to provide formal, quantifiable privacy protection, making it suitable for users with higher privacy requirements.
Differential Privacy is a mathematical framework that limits how much any single individual can influence the model’s output, resulting in a provable upper bound on worst-case privacy risk. In DP-Copula, this bound is explicitly defined by the user through privacy parameters such as Max Membership Inference Attack (MIA) Risk.
For example, if you set a Max Membership Inference Attack (MIA) Risk of 0.3 (our default setting), DP-Copula guarantees that no attacker can infer whether any specific individual was included in the training data with a probability higher than 30%, even in the worst case when an attacker uses advanced attack techniques, or has substantial background knowledge from other data sources.
DP-Copula applies Differential Privacy (DP) to the Gaussian Copula model to provide formal privacy guarantees, while keeping the same underlying modelling approach. It learns the same types of patterns as a standard Gaussian Copula, but does so in a way that limits how much any single individual can influence the result.
A Gaussian Copula generates synthetic data by:
- Learning the distribution of each column, and
- Learning how columns relate to each other (e.g. correlations), before sampling new data that follows these patterns.
DP-Copula follows the same process, but with additional privacy protections:
- Noise is added to summary statistics used to learn column distributions and relationships, so they do not reveal exact information about the original data.
- Individual influence is bounded during training, ensuring no single record can disproportionately affect the model.
Synthetic data is then generated using these privacy-protected statistics, rather than the true values.
The U.S. National Institute of Standards and Technology (NIST) recognizes Differential Privacy as a leading framework for bounding worst-case membership inference attack risk. Learn more about Differential Privacy here.
How to choose your privacy parameters
The default privacy settings are calibrated through internal evaluation to balance privacy protection and data utility and are designed to avoid extreme values while providing meaningful protection. For most users, these defaults are a safe starting point and only need adjustment if stronger privacy guarantees are required or if empirical privacy metrics suggest further tightening.
Mirage lets you control privacy by setting how much worst-case risk you are willing to tolerate, through modifying two settings: Max Membership Inference Attack (MIA) Risk and Delta. Ranges and default values are calibrated through internal testing to balance privacy protection and data quality.
Max Membership Inference Attack (MIA) Risk
- Suggested range [0.1, 0.9], Default value 0.3
- Max MIA Risk defines the maximum probability, in the worst case, that an attacker could correctly infer whether a specific individual was included in the training data.
- Lower value → stronger privacy protection
- Higher value → weaker privacy protection
- Lowering Max MIA Risk strengthens privacy, but may reduce some aspects of data quality.
Delta
- Suggested Range [0.00001, 0.5], Default value 1/ Number of rows
- Delta represents a very small failure allowance for the privacy guarantee. It accounts for the fact that, in theory, privacy guarantees cannot always be achieved perfectly 100% of the time.
- Smaller delta → stricter, more conservative privacy guarantee
- Larger delta → weaker guarantee
- Delta does not represent everyday privacy risk. Instead, it caps the probability of rare cases where we cannot certify that the privacy guarantee holds.
Epsilon (ε)
- Behind the scenes, Mirage also computes a third Differential Privacy parameter called Epsilon (ε). You only need to consider this if you are already familiar with Differential Privacy concepts.
-
Find out about Epsilon (ε)
Advanced users familiar with Differential Privacy may know about Epsilon (ε). For transparency, Mirage computes the Epsilon value based on the user’s MIA Risk and Delta, but we encourage users to reason about privacy in terms of worst-case privacy risk, which is more intuitive and directly comparable to empirical metrics.
Epsilon is the standard Differential Privacy parameter used in research and industry to describe the strength of a privacy guarantee. It controls how much the model’s output is allowed to change due to the presence or absence of any single individual in the training data. Epsilon can be thought of as a privacy budget: each part of the model “spends” some privacy cost, and the total privacy leakage must stay within this budget.
- Smaller epsilon → stronger privacy protection
- Larger epsilon → weaker privacy protection
Epsilon is used to compare privacy guarantees across DP systems, but there is no universal agreement on what constitutes a “good” epsilon value for synthetic data across all contexts. For examples of values used in practical implementation, you can refer to this blogpost on real-world deployments of DP algorithms.
Although epsilon is theoretically unbounded, in Mirage it is constrained by the allowed ranges of Max MIA Risk and Delta. As a result, users can expect the derived epsilon to fall within a moderate and well-calibrated range, typically around 0.1 to 3.
There are no universal thresholds for the "right" privacy settings, as appropriate values depend on factors like your data sensitivity, intended use, and risk tolerance. A practical approach is to start by deciding how much worst-case risk you are willing to accept, and then use the other privacy metrics to validate the outcome.
- Start with Max MIA Risk as your primary decision. This represents your explicit tolerance for worst-case membership inference risk.
- Keep Delta small and close to the default unless you have a strong reason to change it.
- After generation, review our empirical privacy metrics to check whether the synthetic data behaves consistently with your intended privacy level.
- If the empirical privacy metrics do not align with your expectations, you can iteratively adjust Max MIA Risk and regenerate the data.
When adjusting Differential Privacy settings, users may observe that empirical privacy metrics do not always improve consistently, and may fluctuate across different synthetic data generations or evaluation runs. This is expected, as empirical privacy metrics are based on simulated attacks, which are influenced by randomness in the training data, the synthetic data generation process, and the evaluation algorithms themselves.
Differential Privacy, however, provides a formal, theoretical guarantee that places a strict upper bound on the worst-case membership inference attack risk across all possible datasets and attacker strategies. Strengthening Differential Privacy settings reduces this worst-case bound, but does not guarantee that any single empirical measurement will decrease. In practice, Differential Privacy is most effective at protecting against membership inference attacks, and may not directly improve all other empirical privacy metrics.
