Post

Synthetic Estimators for Privacy Risk: Enabling Safe Health Data Sharing

Posted Updated
By
13 min read
Synthetic Estimators for Privacy Risk: Enabling Safe Health Data Sharing

Guide

Table of Contents

Introduction

Sharing individual-level datasets (especially health data) is essential for research, machine learning, and policy development. However, releasing microdata introduces the risk that individuals could be re-identified using publicly available information.

Re-identification risk refers to:

The probability that an adversary can correctly match a record in a dataset to a real person in the population Regulations such as HIPAA, GDPR, and Canadian privacy law require that this risk be “very small” before datasets can be released. Therefore, we need accurate risk estimators that:

  • Model realistic attacks
  • Estimate probability of successful identification
  • Allow data custodians to balance privacy and data utility

Traditional methods rely on population uniqueness, but uniqueness alone does not guarantee low re-identification probability. For example, datasets may have low uniqueness yet still have high matching probability.

This motivated the development of synthetic population–based estimators, where synthetic data are used to estimate the matching probability between sample and population.

Context and Problem Statement

When organizations share microdata (row-level data about individuals), they typically remove direct identifiers such as names or social insurance numbers. However, even after removing these fields, individuals can still be re-identified using combinations of other attributes that indirectly reveal identity. These attributes are called quasi-identifiers (QIs). In a typical data sharing scenario, the released dataset is a sample from a larger population, and an attacker may possess external information about some individuals (e.g., age, gender, postal code) from public records or personal knowledge. The attacker attempts to match these attributes with records in the dataset to identify a specific individual. Therefore, re-identification risk analysis focuses on the set of variables that could plausibly be known by an adversary and used for matching.

Variable Categories in Privacy-Preserving Data Sharing

Variables are usually categorized into three main groups:

1. Direct Identifiers Uniquely identify a person on their own and must always be removed. Examples:

Direct Identifier Example Description
Name Full legal name
Social Insurance Number / SSN National ID number
Passport number Government-issued passport number
Exact address Full street address
Phone number Mobile or landline number
Email Personal or work email address

2. Quasi-Identifiers (QIs) Attributes that are not unique individually but can identify individuals when combined with other attributes. These are the main focus of re-identification risk analysis. Examples:

Quasi-Identifier Attribute Example Description
Date of birth or age Year, month, or full date of birth
Gender or sex Male, female, other
Postal code / ZIP code Geographic postal area
Ethnicity or race Demographic group
Occupation Job title or profession
Education level Highest degree or schooling
Marital status Single, married, divorced, etc.
Geographic region City, state, province, or country
Household size Number of people in household

For example, the combination (date of birth, gender, ZIP code) has been shown to uniquely identify a large percentage of the U.S. population.

3. Sensitive Attributes

Variables containing confidential information that must be protected but are not used for identification. Examples:

Sensitive Attribute Example Description
Disease diagnosis Medical condition or illness
Income Financial earnings
Medical treatments Procedures or medications
Survey responses Answers to confidential surveys

Identifying Quasi-Identifiers

The first step in re-identification risk analysis is identifying which variables in a dataset should be treated as quasi-identifiers. This process usually involves three considerations:

  1. Replicability
    The value is stable over time and likely to remain consistent for an individual.
    Example: birth year or gender is replicable; mood or temporary symptoms are not.

  2. Availability
    The attribute may be known by acquaintances or available in external data sources such as voter registries, social media, public records, or census data.

  3. Distinguishability
    The attribute has enough variability to help distinguish individuals from each other.

Variables satisfying these criteria are treated as quasi-identifiers. In practice, identifying QIs is often done through:

  • Expert knowledge of the domain
  • Review of external datasets available to attackers
  • Statistical analysis of uniqueness or equivalence class sizes
  • Privacy frameworks (HIPAA Safe Harbor, GDPR guidance)

Equivalence Classes and Re-Identification Risk

Once QIs are identified, records that share identical values on these variables form equivalence classes. The size of an equivalence class determines how easily an individual can be singled out. If an equivalence class contains only one record, the individual is considered unique, which implies a higher re-identification risk.

The fundamental problem addressed in this post is:

Estimating the probability that a record in the released dataset can be matched to a real person in the population using quasi-identifiers, even when the true population distribution is unknown.

Formal Problem Formulation for Re-Identification Risk

To formally measure re-identification risk, the problem is formulated using a dataset that is assumed to be a sample drawn from a larger population. Let $D_r$ denote the released microdata sample containing $n$ records, and let the underlying population contain $N$ individuals. An adversary attempts to identify individuals by matching records based on quasi-identifiers (QIs). Records that share identical QI values form an equivalence class. For each record $k$ in the sample, $f_k$ represents the size of its equivalence class in the sample dataset, while $F_k$ represents the size of the corresponding equivalence class in the full population. The key challenge is that $F_k$ is unknown because the population dataset is not available. Therefore, the objective of the estimation problem is to approximate the probability of successful re-identification under different attack scenarios.

The formulation defines two main match rates:

  • Population-to-sample risk: Measures the probability that an attacker selecting an individual from the population can find the corresponding record in the released dataset.
  • Sample-to-population risk: Measures the probability that an attacker selecting a record from the dataset can correctly identify the individual in the population.

Since population equivalence class sizes are unknown, synthetic population datasets $D_p$ and synthetic samples $D_s$ are generated to approximate these quantities and estimate the overall re-identification risk.

Notation

Symbol Meaning
$D_r$ Real microdata sample
$D_p$ Synthetic population dataset
$D_s$ Synthetic microdata sample
$n$ Sample size
$N$ Population size
$f_k$ Sample equivalence class size
$F_k$ Population equivalence class size

These definitions allow formal computation of risk metrics.

Attack Scenarios and Risk Metrics in Re-Identification

Two main attack scenarios are modeled.

4.1 Population-to-Sample Attack

This section describes the population-to-sample attack scenario, where an adversary selects an individual from the overall population and tries to find their corresponding record in the released dataset using quasi-identifiers. The probability of a successful match depends on how many people share the same quasi-identifier values in the sample. This metric helps assess how easily someone from the population could be re-identified if their attributes are known.

Attacker workflow:

  • Selects a person from the population
  • Uses quasi-identifiers
  • Attempts to find the matching record in the dataset

Probability of success:

\[A = \frac{1}{N} \sum_{k=1}^{n} \frac{1}{f_k}\]

Where:

  • $f_k$ = sample equivalence class size

Interpretation: If many individuals share the same QI values, identification probability decreases.

4.2 Sample-to-Population Attack

This section covers the sample-to-population attack scenario, which is often considered the most realistic risk in practice. Here, an adversary starts with a record from the released dataset and tries to identify the corresponding individual in the broader population using quasi-identifiers. The risk metric quantifies how likely it is that a record in the dataset can be uniquely matched to someone in the population, even when the true population distribution is unknown.

Attacker workflow:

  • Selects a record in the released dataset
  • Searches population data sources
  • Attempts to identify the corresponding individual

Risk metric:

\[B = \frac{1}{n} \sum_{k=1}^{n} \frac{1}{F_k}\]

Where:

  • $F_k$ = population equivalence class size

This is usually the most realistic attack scenario.

However, $F_k$ is unknown in practice.

Therefore we need estimators to approximate it.

Synthetic Population Estimator

The synthetic population estimator addresses the key challenge in re-identification risk estimation: the true population equivalence class size $F_k$ is unknown because the full population dataset is not available. Instead of trying to estimate $F_k$ directly with strong statistical assumptions, this method approximates the population distribution by generating a synthetic population from the observed microdata sample.

Let $D_r$ denote the released microdata sample with $n$ records drawn from a population of size $N$. Using the quasi-identifiers in $D_r$, a generative model (such as a copula model) is fitted to learn the joint distribution of these variables. This model is then used to generate a synthetic population dataset $D_p$ with $N$ records that mimics the statistical structure of the real population. From this synthetic population, a synthetic sample $D_s$ of size $n$ is drawn using simple random sampling. The two synthetic datasets simulate the real-world situation where a dataset is a sample from a population.

The equivalence class sizes $F_k$ can now be computed directly within the synthetic population $D_p$, allowing the sample-to-population match probability to be estimated by calculating the proportion of records whose quasi-identifier combinations uniquely or narrowly match individuals in the synthetic population. By repeating this process across synthetic datasets, the estimator approximates the probability that an adversary selecting a record from the released dataset can correctly match it to an individual in the population.

This simulation-based strategy avoids unrealistic independence assumptions and better captures dependencies among quasi-identifiers, leading to more accurate estimates of re-identification risk.

Summary of Synthetic Population Estimator Procedure

Step 1 — Learn population distribution
From microdata $D_r$.

Step 2 — Generate synthetic population
$D_p \sim P(X)$ with size $N$.

Step 3 — Sample synthetic dataset
$D_s \sim D_p$ with size $n$.

Step 4 — Compute risk

Using synthetic population equivalence classes:

\[\hat{B} = \frac{1}{n} \sum_{k=1}^{n} \frac{1}{\hat{F}_k}\]

Where $\hat{F}_k$ is derived from synthetic data.

This simulation approximates the real attack process.

Role of Synthetic Data in Privacy Research

Synthetic data frameworks are often combined with privacy risk estimation methods to assess the safety of data sharing.

Researchers evaluate synthetic datasets using metrics such as:

  • Re-identification risk
  • Attribute disclosure risk
  • Membership inference risk

This leads to the development of risk estimation frameworks, such as the synthetic estimator for re-identification risk.

To know more about synthetic data generation models and frameworks, please refere to the related posts:

To know more about disclosure risks and re-identification attacks for healthcare data, please refere to the related posts:

  • Disclosure Risks and Re-Identification Attacks for Healthcare Data Link to the post

Simulation Study and Evaluation

A simulation study is used to evaluate the accuracy and robustness of different re-identification risk estimators by comparing their estimated risk values with the true risk under controlled conditions. First, several datasets that represent realistic population data are selected, often including health or demographic datasets with diverse quasi-identifiers and sufficient sample sizes. These datasets are treated as the true population, from which random microdata samples are drawn to simulate the real-world scenario where only a subset of the population is released.

During the simulation, key parameters are varied to test estimator performance under different conditions. For example, the sampling fraction (the ratio of sample size to population size) is randomly selected across a wide range to represent situations where datasets cover a small portion or a large portion of the population. In addition, different subsets of quasi-identifiers are selected to simulate datasets with varying levels of identifiability and complexity.

For each simulation run, the true re-identification risk is calculated directly from the population, and the estimators are then applied to the sample to obtain estimated risk values. The performance of each estimator is evaluated using metrics such as estimation error, typically defined as the difference between the estimated risk and the true risk. Visualization methods such as box plots or error distributions are commonly used to assess bias and variability across simulation runs.

Finally, a sensitivity analysis is conducted to evaluate how robust the estimators are to uncertainties in key parameters, such as errors in the assumed population size. This helps determine whether the estimator remains reliable when real-world inputs are imperfect or partially unknown.

Formally, if $B$ represents the true sample-to-population re-identification risk and $\hat{B}$ is the estimated risk, the estimation error used to evaluate the estimator is:

$ \text{Error} = \hat{B} - B $

A smaller value of ∣Error∣ indicates a more accurate estimator.

Key Challenges in Re-Identification Risk Estimation

Estimating re-identification risk is challenging because the true conditions under which an adversary might attempt to identify individuals are rarely fully known. One major difficulty is the lack of access to the complete population dataset, which means the true population equivalence class sizes $F_k$ cannot be directly observed and must be estimated from the sample. Another challenge arises from the complex dependencies between quasi-identifiers such as age, geography, and ethnicity; assuming these attributes are independent often leads to inaccurate risk estimates because real-world demographic variables are highly correlated.

Additionally, the sampling fraction of the dataset relative to the population can significantly affect risk, since larger samples increase the probability that an attacker will find a match. The availability of external data sources also introduces uncertainty, as adversaries may combine the released dataset with public registries, social media information, or other datasets to perform linkage attacks. Finally, high-dimensional quasi-identifier combinations can create many unique or rare records, making datasets appear safe when using simple metrics like uniqueness while still allowing relatively high probabilities of correct identification.

These challenges make it necessary to use more realistic modeling approaches, such as simulation or synthetic population methods, to better approximate real-world re-identification risks.

Conclusion

In summary, synthetic data generation frameworks offer a promising approach for quantifying and mitigating re-identification risk in health data sharing. By leveraging synthetic populations and advanced estimators, organizations can more accurately assess disclosure risks and make informed decisions about data release. However, challenges remain, including the need for realistic modeling of adversary knowledge, handling high-dimensional data, and accounting for uncertainties in population parameters. Ongoing research and simulation studies are essential to refine these methods and ensure that privacy-preserving data sharing remains both effective and practical in real-world settings.

Resources

Truthworthy and Privacy-Preserving AI, Data Sharing
ML synthetic estimator privacy risk re-identification health data quasi-identifiers synthetic data simulation data sharing
This post is licensed under CC BY 4.0 by the author.