SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
\begin{array}{l} \mathcal {K L} \left( \right.p (\mathbf {x}) \left\| \right. \int \prod_ {j = 1} ^ {p} \frac {d}{d \mathbf {x} _ {j}} D _ {j} ^ {- 1} \left(\mathbf {x} _ {j}, \mathbf {z}; \theta_ {j} ^ {*} (\phi)\right) p (\mathbf {z}) d \mathbf {z}\left. \right) = \mathcal {K L} \left( \right.p (\mathbf {x}) \left\| \right. \int \prod_ {j = 1} ^ {p} q _ {j} \left(\mathbf {x} _ {j} | \mathbf {z}; \phi\right) p (\mathbf {z}) d \mathbf {z}\left. \right) \\ = \mathcal {K L} \left(p (\mathbf {x}) \left\| \int q (\mathbf {x} | \mathbf {z}; \phi) p (\mathbf {z}) d \mathbf {z}\right) \right. \\ = \mathcal {K L} \left(p (\mathbf {x}) \left\| \int \frac {p (\mathbf {x}) q (\mathbf {z} | \mathbf {x} ; \phi)}{q (\mathbf {z} ; \phi)} p (\mathbf {z}) d \mathbf {z}\right) \right. \\ = \mathcal {K L} \left(p (\mathbf {x}) \| p (\mathbf {x}) \int \frac {p (\mathbf {z}) q (\mathbf {z} | \mathbf {x} ; \phi)}{q (\mathbf {z} ; \phi)} d \mathbf {z}\right) \\ = \mathbb {E} _ {p (\mathbf {x})} \left[ - \log \int \frac {p (\mathbf {z}) q (\mathbf {z} | \mathbf {x} ; \phi)}{q (\mathbf {z} ; \phi)} d \mathbf {z} \right] \\ \leq \mathbb {E} _ {p (\mathbf {x})} \left[ \int q (\mathbf {z} | \mathbf {x}; \phi) \log \frac {q (\mathbf {z} ; \phi)}{p (\mathbf {z})} d \mathbf {z} \right] \\ = \iint p (\mathbf {x}) q (\mathbf {z} | \mathbf {x}; \phi) \log \frac {q (\mathbf {z} ; \phi)}{p (\mathbf {z})} d \mathbf {z} d \mathbf {x} \\ = \iint p (\mathbf {x}) q (\mathbf {z} | \mathbf {x}; \phi) \log \frac {q (\mathbf {z} ; \phi)}{p (\mathbf {z})} d \mathbf {x} d \mathbf {z} \\ = \int q (\mathbf {z}; \phi) \log \frac {q (\mathbf {z} ; \phi)}{p (\mathbf {z})} d \mathbf {z} \\ = \mathcal {K L} (q (\mathbf {z}; \phi) \| p (\mathbf {z})) \\ <   \epsilon , \\ \end{array}
$$
by Jensen's inequality, Fubini-Tonelli theorem, and the assumptions. The proof is complete.
A.5 Closed Form Loss
$$
\begin{array}{l} 2 \cdot \int_ {0} ^ {1} \rho_ {\alpha} \left(\mathbf {x} _ {j} - D _ {j} (\alpha , \mathbf {z}, \theta_ {j})\right) d \alpha = (2 \tilde {\alpha} _ {j} - 1) \mathbf {x} _ {j} + (1 - 2 \tilde {\alpha} _ {j}) \gamma^ {(j)} (\mathbf {z}) \\ + \sum_ {m = 1} ^ {M} b _ {m} ^ {(j)} (\mathbf {z}) \left(\frac {1 - d _ {m} ^ {3}}{3} - d _ {m} - \max  (\tilde {\alpha} _ {j}, d _ {m}) ^ {2} + 2 \max  (\tilde {\alpha} _ {j}, d _ {m}) d _ {m}\right), \\ \end{array}
$$
where  $D_{j}(\tilde{\alpha}_{j},\mathbf{z};\theta_{j}) = \mathbf{x}_{j}$ ,  $\tilde{\alpha}_{j} = \frac{\mathbf{x}_{j} - \gamma^{(j)}(\mathbf{z}) + \sum_{m=0}^{m_{0}} b_{m}^{(j)}(\mathbf{z}) d_{m}}{\sum_{m=0}^{m_{0}} b_{m}^{(j)}(\mathbf{z})}$ , and  $D_{j}(d_{m_{0}},\mathbf{z};\theta_{j}) \leq \mathbf{x}_{j} \leq D_{j}(d_{m_{0}+1},\mathbf{z};\theta_{j})$ .
A.6 Discretization of Estimated CDF
To ensure appropriate discretization of the estimated CDF for ordinal variables, we propose a post-ad-hoc discretization step [53]. We focus on the case where  $p = 1$  and  $q = 0$  for brevity. We denote the set of observed possible values for the ordinal variable as  $x^{(1)}, x^{(2)}, \dots, x^{(m)}$ . The discretization algorithm for the estimated CDF is presented in Algorithm 1, and we provide an example of the discretization algorithm's outcome in Figure 2.
Algorithm 1 Discretization of Estimated CDF
Input  $\{x^{(1)},x^{(2)},\dots ,x^{(m)}\}$  , Estimated CDF  $\hat{F} (\cdot ;\theta)$    
Output Discretized CDF  $\hat{F}^* (\cdot ;\theta)$    
(1) Compute  $\hat{F} (x^{(i)} - 0.5;\theta)$  and  $\hat{F} (x^{(i)} + 0.5;\theta)$  for  $i = 1,\dots ,m$    
(2) Discretization: For  $i = 1,\dots ,m$ $\begin{array}{rlr}{\hat{F}^* (x^{(i)};\theta)} & {\coloneqq} & {\hat{F}^* (x^{(i - 1)};\theta)}\\ & {+} & {\hat{F} (x^{(i)} + 0.5;\theta) - \hat{F} (x^{(i)} - 0.5;} \end{array}$
where  $\hat{F}^{*}(x^{(0)};\theta)\coloneqq 0$
(3) Ensure monotonicity: For  $i = 1,\dots ,m - 1$  , if  $\hat{F}^{*}(x^{(i)};\theta) > \hat{F}^{*}(x^{(i + 1)};\theta)$
$$
\hat {F} ^ {*} (x ^ {(i + 1)}; \theta) := \hat {F} ^ {*} (x ^ {(i)}; \theta).
$$
Figure 2: Discretized CDF for ordinal variable educational-num of adult dataset. 'estimate' indicates  $\hat{F} (\cdot ;\theta)$ , 'calibration' indicates  $\hat{F}^{*}(\cdot ;\theta)$ , and 'empirical' indicates the empirical CDF of the observed dataset.
A.7 Membership Inference Attack
[47] propose the customized membership inference attack method of [54] to attack the GAN-based synthesizer. Similarly, we propose the customized membership inference attack method of [54] to attack the VAE-based synthesizer.
Assumption 3 ([54]). In the membership inference attack, the attacker attacks the target model under the following assumptions:
(A1) The attacker is only allowed for black-box access, where the attacker can only supply inputs to the model and receive the model's output(s).
(A2) The attacker can obtain as many outputs as they want from a target model to attack.
(A3) The real and synthetic datasets should not have common records.
(A4) The attacker knows the algorithm and architecture of the target model.
Denote  $D_{train}^{*}$  and  $D_{test}^{*}$  as the real training and test datasets. Under Assumption 3, the overall steps of the membership inference attack are outlined below:
1. Generate shadow training and test datasets  $D_{train}^{(i)}, D_{test}^{(i)}, i = 1, \dots, C$  from  $M^*$  by (A1), where  $M^*$  is the model attacker wants to attack. By (A2), the attacker is allowed to obtain shadow datasets such as  $|D_{train}^{(i)}| = |D_{train}^*|$  and  $D_{train}^{(i)} \cap D_{test}^{(j)} = \emptyset$ , for  $i = 1, \dots, C$ . Under (A3),  $D_{train}^{(i)} \cap D_{train}^* = \emptyset$ , for  $i = 1, \dots, C$ .
2. Train shadow models  $M_{1}, \dots, M_{C}$  under (A4), i.e., each shadow model is trained similarly to the target model  $M^{*}$ .
3. For  $i = 1,\dots ,C$
(a) Obtain representation vectors  $\mathbf{z}$  from the encoder of  $M_{i}$  with the input of  $D_{train}^{(i)}$ . Then, attacking training records are  $(\mathbf{y},\mathbf{z},in)$ .
(b) Obtain representation vectors  $\mathbf{z}$  from the encoder of  $M_{i}$  with the input of  $D_{test}^{(i)}$ . Then, attacking training records are  $(\mathbf{y},\mathbf{z},out)$ .
where  $\mathbf{y}$  is the labels of shadow dataset records. And we assume that  $\mathbf{y}$  consists of the MLu classification target.
4. Merge all attack training records,  $(\mathbf{y},\mathbf{z},in/out)$ .
5. For each class of  $\mathbf{y}$ , train attack model which is a binary classification model which classifies in/out based on the representation vectors  $\mathbf{z}$ .
6. Now it is ready to attack.
Note that we use the representation vector of VAE instead of the output of the GAN discriminator [47].
A.8 Dataset Descriptions
- covertype: https://www.kaggle.com/datasets/uciml/forest-cover-type-dataset
- credit: https://www.kaggle.com/c/home-credit-default-risk
- loan: https://www.kaggle.com/datasets/teertha/personal-loan-modeling
adult: https://www.kaggle.com/datasets/uciml/adult-census-income
- cabs: https://www.kaggle.com/datasets/arashnic/taxi-pricing-with-mobility-analytics?select  $\equiv$  test.csv
- kings: https://www.kaggle.com/datasets/harlfoxem/housesalesprediction
Table 8: Description of datasets. #C represents the number of continuous and ordinal variables. #D denotes the number of discrete variables.
Dataset	Train/Test Split	Regression Target	Classification Target	#C	#D
covertype	45k/5k	Elevation	Cover_Type	10	1
credit	45k/5k	AMT_CREDIT	TARGET	10	9
loan	4k/1k	Age	Personal Loan	5	6
adult	40k/5k	age	income	5	9
cabs	40k/1k	Trip Distance	Surge_Pricing_Type	6	7
kings	20k/1k	long	condition	11	7
A.9 Experimental Settings
We run all experiments using Geforce RTX 3090 GPU, and our experimental codes are all available with pytorch.
Table 9: Hyper-parameter settings for tabular dataset experiments.
Model	epochs	batch size	learning rate	β (or decoder std range)	d	M
CTGAN	300	500	0.0002	2	-
TVAE	200	256	0.005	[0.1, 1]	2	-
CTAB-GAN	150	500	0.0002	2	-
DistVAE	100	256	0.001	0.5	2	10
Table 10: The number of model parameters for tabular dataset experiments.
Model	covtype	credit	adult	loan	cabs	kings
CTGAN	20k	32k	52k	13k	30k	51k
TVAE	10k	12k	13k	6k	10k	10k
CTAB-GAN	12k	13k	14k	5k	12k	15k
DistVAE	10k	12k	13k	6k	10k	16k
Table 11: Classifier and regressor used to evaluate synthetic data quality. The names of all parameters used in the description are consistent with those defined in corresponding packages.
Tasks	Model	Description
Regression	Linear Regression	Package: statsmodels api.sm.OLS, setting: without intercept, defaulted values
Random Forest	Package: sklearnensemble.RandomForestRegressor, setting: random_state=0, defaulted values
Gradient Boosting	Package: sklearnensembleGradientBoostingRegressor, setting: random_state=0, defaulted values
Classification	Logistic Regression	Package: sklearn-linear_model.LogisticRegression, setting: multi_class='ovr', fit_intercept=False, defaulted values
Random Forest	Package: sklearnensemble.RandomForestClassifier, setting: random_state=0, defaulted values
Gradient Boosting	Package: sklearnensembleGradientBoostingClassifier, setting: random_state=0, defaulted values
A.10 Detailed Experimental Results
(a) covtype
(b) credit
(c) loan
Figure 3: Empirical and estimated CDFs of continuous and count variables (Monte Carlo approximated with 5000 samples). We standardize covariates and remove observations outside the  $1\%$  and  $99\%$  percentile range.
(a) adult
(b) cabs
Figure 4: Empirical and estimated CDFs of continuous and count variables (Monte Carlo approximated with 5000 samples). We standardize covariates and remove observations outside the  $1\%$  and  $99\%$  percentile range.
(c) kings
Table 12: MLu metrics (MARE,  $F_{1}$ ). Mean and standard deviation values are obtained from 10 repeated experiments.  $\uparrow$  denotes higher is better and  $\downarrow$  denotes lower is better.
(a)
Dataset	covertype	credit	loan
Model	MARE ↓	F1 ↑	MARE ↓	F1 ↑	MARE ↓	F1 ↑
Baseline	0.035	0.718	0.064	0.927	0.020	0.948
CTGAN	0.058±0.007	0.227±0.030	0.593±0.150	0.914±0.006	0.258±0.020	0.842±0.109
TVAE	0.079±0.007	0.504±0.032	0.260±0.135	0.091±0.286	0.124±0.033	0.785±0.288
CTAB-GAN	0.065±0.004	0.493±0.027	0.887±0.351	0.913±0.005	0.247±0.019	0.887±0.026
DistVAE(β=0.5)	0.044±0.002	0.605±0.006	0.763±0.068	0.926±0.001	0.249±0.007	0.914±0.009
DistVAE(β=1)	0.045±0.001	0.557±0.007	0.774±0.035	0.926±0.000	0.249±0.005	0.897±0.002
DistVAE(β=5)	0.063±0.001	0.443±0.018	0.870±0.022	0.904±0.010	0.249±0.005	0.893±0.005
(b)
Dataset	adult	cabs	kings
Model	MARE ↓	F1 ↑	MARE ↓	F1 ↑	MARE ↓	F1 ↑
Baseline	0.216	0.854	0.565	0.743	0.001	0.695
CTGAN	0.297±0.030	0.796±0.022	0.721±0.046	0.674±0.024	0.001±0.000	0.579±0.035
TVAE	0.238±0.006	0.809±0.016	0.642±0.035	0.689±0.031	0.010±0.005	0.687±0.041
CTAB-GAN	0.321±0.036	0.730±0.069	0.894±0.116	0.582±0.047	0.001±0.000	0.608±0.022
DistVAE(β=0.5)	0.232±0.004	0.825±0.009	0.803±0.129	0.707±0.010	0.001±0.000	0.640±0.002
DistVAE(β=1)	0.234±0.006	0.822±0.003	0.760±0.062	0.725±0.004	0.001±0.000	0.644±0.003
DistVAE(β=5)	0.327±0.008	0.751±0.010	0.839±0.042	0.447±0.009	0.002±0.000	0.637±0.004
Figure 5: Machine learning utilities for compared models and real tabular datasets.
For a detailed comparison of the models and their performance, we present the paired (MARE,  $F_{1}$ ) scores for all tabular datasets in Figure 5. A better score, indicating a superior performance in terms of MLu, is represented by a dot located in the upper left corner. Notably, Figure 5 consistently demonstrates that DistVAE achieves the best or at least competitive MLu across all tabular datasets. TVAE exhibits a notably low  $F_{1}$  score in the credit dataset because it fails to handle the highly imbalanced discrete target variable. This comparative analysis highlights the strong MLu performance of DistVAE and the specific limitations of TVAE in certain scenarios.
Table 13: Correlation structure similarity. 'CorrDist' represents  $L_{2}$  distance between the correlation matrix of synthetic and real datasets. Mean and standard deviation values are obtained from 10 repeated experiments. Lower is better.
Dataset	covertype	credit	loan	adult	cabs	kings
Model	CorrDist	CorrDist	CorrDist	CorrDist	CorrDist	CorrDist
CTGAN	2.167±0.419	2.323±0.362	2.282±0.177	1.788±0.217	1.679±0.129	2.839±0.246
TVAE	1.969±0.146	4.021±0.451	2.404±0.408	2.231±0.269	3.136±0.686	2.665±0.296
CTAB-GAN	2.351±0.185	2.696±0.275	2.073±0.110	2.387±0.470	2.532±0.225	3.411±0.399
DistVAE(β=0.5)	1.179±0.090	2.072±0.162	1.654±0.050	0.830±0.078	1.481±0.071	1.559±0.135
DistVAE(β=1)	2.359±0.018	2.229±0.102	1.910±0.019	0.746±0.042	1.495±0.047	1.621±0.149
DistVAE(β=5)	2.946±0.007	3.161±0.006	2.113±0.015	3.186±0.007	1.930±0.004	5.339±0.006
Table 14: Marginal statistical similarity. K-S denotes the KolmogorovSmirnov statistic and 1-WD represents the 1-Wasserstein distance. Mean and standard deviation values are obtained from 10 repeated experiments. Lower is better.
(a) Continuous
Dataset	covertype	credit	loan
Model	K-S	1-WD	K-S	1-WD	K-S	1-WD
CTGAN	0.080±0.011	0.108±0.014	0.132±0.017	0.088±0.013	0.112±0.055	0.061±0.016
TVAE	0.088±0.008	0.156±0.018	0.156±0.036	0.200±0.035	0.162±0.024	0.201±0.024
CTAB-GAN	0.073±0.011	0.096±0.014	0.140±0.021	0.111±0.013	0.181±0.070	0.153±0.023
DistVAE(β=0.5)	0.032±0.003	0.041±0.005	0.088±0.014	0.089±0.004	0.060±0.010	0.048±0.003
DistVAE(β=1)	0.049±0.001	0.079±0.001	0.084±0.008	0.093±0.002	0.056±0.003	0.054±0.002
DistVAE(β=5)	0.064±0.001	0.112±0.000	0.146±0.003	0.113±0.001	0.057±0.003	0.056±0.002
(b) Continuous
Dataset	adult	cabs	kings
Model	K-S	1-WD	K-S	1-WD	K-S	1-WD
CTGAN	0.323±0.126	0.086±0.017	0.045±0.007	0.060±0.011	0.109±0.012	0.116±0.016
TVAE	0.477±0.053	0.414±0.070	0.098±0.008	0.139±0.023	0.195±0.018	0.213±0.046
CTAB-GAN	0.275±0.122	0.178±0.053	0.086±0.008	0.118±0.015	0.188±0.035	0.128±0.019
DistVAE(β=0.5)	0.209±0.064	0.114±0.009	0.044±0.003	0.067±0.003	0.110±0.008	0.089±0.003
DistVAE(β=1)	0.138±0.041	0.111±0.007	0.046±0.002	0.068±0.003	0.115±0.007	0.093±0.002
DistVAE(β=5)	0.115±0.005	0.234±0.002	0.052±0.001	0.074±0.002	0.120±0.002	0.137±0.002
(c) Discrete
Dataset	covertype	credit	loan
Model	K-S	1-WD	K-S	1-WD	K-S	1-WD
CTGAN	0.591±0.003	1.629±0.011	0.061±0.008	0.147±0.024	0.070±0.010	0.076±0.013
TVAE	0.238±0.042	0.606±0.033	0.583±0.045	1.566±0.116	0.193±0.028	0.221±0.043
CTAB-GAN	0.052±0.028	0.180±0.126	0.034±0.006	0.076±0.018	0.039±0.011	0.046±0.013
DistVAE(β=0.5)	0.023±0.010	0.073±0.046	0.020±0.003	0.046±0.006	0.019±0.005	0.027±0.008
DistVAE(β=1)	0.011±0.005	0.036±0.025	0.018±0.001	0.042±0.003	0.011±0.002	0.015±0.005
DistVAE(β=5)	0.109±0.003	0.379±0.014	0.027±0.001	0.068±0.004	0.009±0.002	0.013±0.005
(d) Discrete
Dataset	adult	cabs	kings
Model	K-S	1-WD	K-S	1-WD	K-S	1-WD
CTGAN	0.065±0.008	0.463±0.051	0.069±0.016	0.238±0.036	0.140±0.018	0.529±0.064
TVAE	0.479±0.048	5.228±0.273	0.411±0.088	1.202±0.212	0.405±0.034	1.262±0.099
CTAB-GAN	0.169±0.018	0.745±0.294	0.086±0.013	0.443±0.074	0.255±0.027	0.979±0.107
DistVAE(β=0.5)	0.037±0.004	0.248±0.026	0.060±0.017	0.241±0.084	0.022±0.004	0.071±0.012
DistVAE(β=1)	0.031±0.004	0.239±0.019	0.070±0.003	0.292±0.010	0.023±0.003	0.073±0.008
DistVAE(β=5)	0.070±0.002	0.457±0.010	0.083±0.003	0.326±0.011	0.059±0.002	0.204±0.011
Table 15: Privacy preservability: Distance to closest record (DCR) between real training and synthetic datasets (R&S), between the same real training datasets (R), and between the same synthetic datasets (S). Mean and standard deviation values are obtained from 10 repeated experiments. Higher is better.
(a)
Dataset	covertype
Model	R&S	R	S
CTGAN	0.715±0.026	0.329±0.000	0.514±0.094
TVAE	0.676±0.031	0.329±0.000	0.482±0.025
CTAB-GAN	0.892±0.031	0.329±0.000	0.011±0.005
DistVAE(β=0.5)	0.765±0.008	0.329±0.000	0.819±0.010
DistVAE(β=1)	0.878±0.008	0.329±0.000	0.906±0.009
DistVAE(β=5)	0.907±0.012	0.329±0.000	0.939±0.008
(b)
Dataset	credit
Model	R&S	R	S
CTGAN	0.624±0.033	0.452±0.000	0.592±0.061
TVAE	0.627±0.118	0.452±0.000	0.423±0.212
CTAB-GAN	0.715±0.025	0.452±0.000	0.014±0.006
DistVAE(β=0.5)	0.692±0.012	0.452±0.000	0.742±0.012
DistVAE(β=1)	0.700±0.006	0.452±0.000	0.750±0.005
DistVAE(β=5)	0.718±0.007	0.452±0.000	0.757±0.007
Dataset	loan
Model	R&S	R	S
CTGAN	0.249±0.017	0.109±0.000	0.243±0.024
TVAE	0.298±0.057	0.109±0.000	0.154±0.026
CTAB-GAN	0.272±0.024	0.109±0.000	0.076±0.051
DistVAE(β=0.5)	0.244±0.025	0.109±0.000	0.245±0.020
DistVAE(β=1)	0.238±0.019	0.109±0.000	0.241±0.023
DistVAE(β=5)	0.243±0.015	0.109±0.000	0.240±0.025
(d)
Dataset	adult
Model	R&S	R	S
CTGAN	0.063±0.017	0.000±0.000	0.000±0.000
TVAE	0.277±0.039	0.000±0.000	0.000±0.000
CTAB-GAN	0.152±0.064	0.000±0.000	0.000±0.000
DistVAE(β=0.5)	0.060±0.040	0.000±0.000	0.005±0.001
DistVAE(β=1)	0.048±0.027	0.000±0.000	0.003±0.000
DistVAE(β=5)	0.177±0.002	0.000±0.000	0.001±0.000
(e)
Dataset	cabs
Model	R&S	R	S
CTGAN	0.353±0.006	0.332±0.000	0.341±0.010
TVAE	0.339±0.008	0.332±0.000	0.195±0.015
CTAB-GAN	0.423±0.025	0.332±0.000	0.012±0.023
DistVAE(β=0.5)	0.364±0.004	0.332±0.000	0.368±0.005
DistVAE(β=1)	0.364±0.004	0.332±0.000	0.367±0.004
DistVAE(β=5)	0.368±0.003	0.332±0.000	0.365±0.005
(f)
Dataset	kings
Model	R&S	R	S
CTGAN	0.550±0.016	0.199±0.000	0.447±0.030
TVAE	0.603±0.091	0.199±0.000	0.414±0.053
CTAB-GAN	0.596±0.030	0.199±0.000	0.122±0.135
DistVAE(β=0.5)	0.540±0.009	0.199±0.000	0.600±0.013
DistVAE(β=1)	0.552±0.008	0.199±0.000	0.605±0.014
DistVAE(β=5)	0.692±0.013	0.199±0.000	0.763±0.015
Table 16: Privacy preservability: Membership inference attack performance. Mean and standard deviation values are obtained from 10 repeated experiments.
(a)
Dataset	covertype
Model	Accuracy	AUC
TVAE	0.499±0.007	0.499±0.007
DistVAE(β=0.5)	0.500±0.003	0.500±0.003
(b)
Dataset	credit
Model	Accuracy	AUC
TVAE	0.500±0.001	0.500±0.001
DistVAE(β=0.5)	0.500±0.001	0.500±0.001
(c)
Dataset	loan
Model	Accuracy	AUC
TVAE	0.497±0.015	0.497±0.015
DistVAE(β=0.5)	0.502±0.006	0.502±0.006
(d)
Dataset	adult
Model	Accuracy	AUC
TVAE	0.493±0.017	0.493±0.017
DistVAE(β=0.5)	0.500±0.000	0.500±0.000
(e)
Dataset	cabs
Model	Accuracy	AUC
TVAE	0.480±0.033	0.480±0.033
DistVAE(β=0.5)	0.498±0.003	0.498±0.003
(f)
Dataset	kings
Model	Accuracy	AUC
TVAE	0.507±0.025	0.507±0.025
DistVAE(β=0.5)	0.502±0.004	0.502±0.004
Table 17: Privacy preservingability: Attribute disclosure performance with  $F_{1}$  score. Mean and standard deviation values are obtained from 10 repeated experiments. Lower is better.
(a) covtype
Model	Number of neighbors (k)
1	10	100
CTGAN	0.161±0.030	0.175±0.029	0.155±0.041
TVAE	0.356±0.086	0.357±0.091	0.349±0.094
CTAB-GAN	0.200±0.035	0.225±0.042	0.238±0.033
DistVAE(β=0.5)	0.308±0.025	0.338±0.037	0.313±0.035
DistVAE(β=1)	0.264±0.024	0.294±0.036	0.282±0.029
DistVAE(β=5)	0.141±0.019	0.135±0.013	0.115±0.011
(b) credit
Model	Number of neighbors (k)
1	10	100
CTGAN	0.319±0.009	0.330±0.009	0.323±0.011
TVAE	0.615±0.147	0.618±0.143	0.614±0.145
CTAB-GAN	0.322±0.007	0.332±0.012	0.331±0.010
DistVAE(β=0.5)	0.339±0.013	0.337±0.011	0.315±0.012
DistVAE(β=1)	0.339±0.010	0.324±0.005	0.301±0.004
DistVAE(β=5)	0.332±0.007	0.317±0.007	0.293±0.007
(c) loan
Model	Number of neighbors (k)
1	10	100
CTGAN	0.439±0.027	0.447±0.022	0.426±0.033
TVAE	0.611±0.153	0.602±0.152	0.596±0.157
CTAB-GAN	0.475±0.048	0.443±0.027	0.435±0.030
DistVAE(β=0.5)	0.505±0.043	0.465±0.038	0.439±0.032
DistVAE(β=1)	0.449±0.038	0.440±0.035	0.423±0.031
DistVAE(β=5)	0.458±0.013	0.441±0.035	0.416±0.031
(d) adult
Model	Number of neighbors (k)
1	10	100
CTGAN	0.234±0.012	0.255±0.021	0.261±0.023
TVAE	0.318±0.081	0.318±0.080	0.307±0.080
CTAB-GAN	0.199±0.032	0.202±0.032	0.205±0.031
DistVAE(β=0.5)	0.270±0.018	0.280±0.021	0.268±0.015
DistVAE(β=1)	0.264±0.006	0.276±0.005	0.260±0.007
DistVAE(β=5)	0.205±0.005	0.187±0.003	0.166±0.002
(e) cabs
Model	Number of neighbors (k)
1	10	100
CTGAN	0.238±0.009	0.246±0.006	0.231±0.010
TVAE	0.385±0.079	0.383±0.079	0.381±0.081
CTAB-GAN	0.235±0.010	0.236±0.008	0.237±0.011
DistVAE(β=0.5)	0.251±0.010	0.241±0.007	0.225±0.005
DistVAE(β=1)	0.246±0.010	0.240±0.006	0.227±0.008
DistVAE(β=5)	0.238±0.010	0.220±0.009	0.199±0.005
(f) kings
Model	Number of neighbors (k)
1	10	100
CTGAN	0.200±0.009	0.257±0.032	0.269±0.036
TVAE	0.338±0.045	0.349±0.046	0.345±0.044
CTAB-GAN	0.111±0.068	0.111±0.088	0.123±0.114
DistVAE(β=0.5)	0.293±0.019	0.310±0.041	0.301±0.050
DistVAE(β=1)	0.281±0.016	0.306±0.039	0.290±0.041
DistVAE(β=5)	0.215±0.010	0.221±0.036	0.205±0.038