SMOTE and Mirrors: Exposing Privacy Leakage from Synthetic Minority Oversampling
Authors: Georgi Ganev
MohammadReza Nazari
Rees Davison
Amirhassan Fallah Dizche
XINMIN WU
Ralph Abbey
Jorge G Silva
Emiliano De Cristofaro
Venue: ICLR 2026 Poster (2026)
Keywords: smote
synthetic data generation
privacy attacks
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We propose two novel assumption-free attacks on SMOTE -- a distinguishing and a reconstruction attack -- both achieving near-perfect performance.

Abstract: The Synthetic Minority Over-sampling Technique (SMOTE) is one of the most widely used methods for addressing class imbalance and generating synthetic data.
Despite its popularity, little attention has been paid to its privacy implications; yet, it is used in the wild in many privacy-sensitive applications.
In this work, we conduct the first systematic study of privacy leakage in SMOTE:
We begin by showing that prevailing evaluation practices, i.e., naive distinguishing and distance-to-closest-record metrics, completely fail to detect any leakage and that membership inference attacks (MIAs) can be instantiated with high accuracy.
Then, by exploiting SMOTE's geometric properties, we build two novel attacks with very limited assumptions: DistinSMOTE, which perfectly distinguishes real from synthetic records in augmented datasets, and ReconSMOTE, which reconstructs real minority records from synthetic datasets with perfect precision and recall approaching one under realistic imbalance ratios.
We also provide theoretical guarantees for both attacks.
Experiments on eight standard imbalanced datasets confirm the practicality and effectiveness of these attacks.
Overall, our work reveals that SMOTE is inherently non-private and disproportionately exposes minority records, highlighting the need to reconsider its use in privacy-sensitive applications and as a baseline for assessing the privacy of modern generative models.

Published as a conference paper at ICLR 2026
SMOTE AND MIRRORS: EXPOSING PRIVACY LEAK- AGE FROM SYNTHETIC MINORITY OVERSAMPLING
Georgi Ganev 1.2
Reza Nazari'
Rees Davison'
Amir Dizche' Xinmin Wu'
Ralph Abbey!
Jorge Silva' UC Riverside
Emiliano De Cristofaro
SAS
UCL
gwr.gi.ganeeess.com
ABSTRACT
The Synthetic Minority Over-sampling Technique (SMOTE) is one of the most widely used methods for addressing class imbalance and generating synthetic data. Despite its popularity, little attention has been paid to its privacy implications: yet, it is used in the wild in many privacy-sensitive applications. In this work, we conduct the first systematic study of privacy leakage in SMOTE: we begin by showing that prevailing evaluation practices, i.e., naive distinguishing and distance-to-clee tot-------s--eeecoooeeooeee----e record metrics, completely fail to detect any leakage and that membership inference attacks (MIAs) can be instantiated with high accuracy. Then, by exploiting SMOTE's geometric properties, we build two novel attacks with very limited assumptions: DistinSMOTE, which perfectly distinguishes real from synthetic records in augmented datasets, and ReconSMOTE, which reconstructs real minority records from synthetic datasets with perfect precision and recall approaching one under realistic imbalance ratios. We also provide theoretical guarantees for both attacks. Experiments on eight standard imbalanced datasets confirm the practicality and effectiveness of these attacks. Overall, our work reveals that SMOTE is inherently non non-private and disproportionately exposes minority records, highlighting the need reconsider its use crivacy-sensitive applications and as baseline for assessing the privacy of modern generative models.
INTRODUCTION
From rare disease diagnosis to fraud detection, machine learning tasks can be profoundly affected by severe class imbalance, where instances of interest - the minority class are much rarer than the majority class (He & Garcial 2009). Models often underperform under these conditions, exhibiting biases toward the majority and failing to capture the minority reliably (Chen et al. 2024a). One of the most influential and widely adopted approaches to address this is the Synthetic Minority Over-sampling Technique (SMOTE) (Chawla et al.) 2002), which augments the imbalanced data by upsampling or generating synthetic samples of the underrepresented class through linear interpolation between minority records. Due to its simplicity and effectiveness, SMOTE continues play central role in real-world applications. To put things in context, the SMOTE paper has been cited nearly 40k times, Microsoft Azure offers built-in SMOTE components (Microsoft) 2024 2025). and most MLaaS services support it (Google Cloud, 2025 AWS 2025). Overall, SMOTE is primarily used in two contexts: 1) a data augmentation technique for machine learning classifiers, and 2) as synthetic data generation method to facilitate data sharing.
Data Augmentation. SMOTE was originally proposed as a preee-eiiinguupsapllnngn technique to augment the real dataset, thus improving classifier performance, especially F1 score and recall, when trained on the augmented data. Practitioners rely on SMOTE a wide range of medical applications, including cancer diagnosis (Fotouhi et al. 2019). heart-related discases (Muntasir Nishat et al. 2022 El-Sofany et al. 2024), diabetes prediction (Ramezankhani et al.) 2016) Alghamdi et al. 2017). genetic risk prediction (Kosolwattana et al. 2023), etc. Beyond medicine, SMOTE is widely applied
in finance, particularly for credit-card fraud detection (Zhao & Bai 2022 Khalid et al. 2024 and predicting customer churn (Peng al. 2023 Out al. 2024).
Synthetic Data. SMOTE has also gained traction as a method for generating synthetic tabular data. Often used baseline for more advanced models like GANs and VAE, SMOTE has been shown

---

Published as a conference paper at ICLR 2026
Augmented Data
reol
X
SNOTE O
Naive
MIA
DistinSMOTE
DisTHSMOOTS
0.01 1 0.01
0.68 1 0.07
1.00 + 0.00
X
Xisa
Synthetic Data
Xind
SMOrTe
Ki
Syethattin
Naive
MIA
ReconSMOTE
X
SNOTEE C
0.16 + 0.10 0.93 + 0.02
1.00 + 0.00
ReesuSMOTT
Table Performance privacy attacks vs. SMOTE. Naive refers to the current privacy evaluation prac- tices. MIAs are applied to SMOTE for the first time. DistinSMOTE and ReconSMOTE our novel attacks.
Figure 1: DistinSMOTE and ReconSMOTE attacks vs. augmented//ynthhtii data generated by SMOTE.
to perform on par with, or even better than, generative approaches (Manousakas & Aydöre 2023 Kindji et al. 2024). Moreover, its extensive use baseline has led to modern diffusion based models (not explicitly designed with privacy in mind) to be characterized as seeaacy-preeevingg simply because they outperform SMOTE, pattern repeatedly observed in top-tier machine learning publications (Kotelnikov et al.) 2023] Zhang et al.] [2024] [aag et al. 20244] Mueller et al. (025).
SMOTE is also applied for medical synthetic data (Kaabachi et al., 2025). and beyond machine
learning research, it has been recognized as a promising technique for improving access to census
data by public sector entities (ONS) 2019: ADR Wales 2025).
Although not originally designed with privacy in mind, SMOTE is extensively used in sensitive public-facing applications that process personal data. However, its privacy risks have often been overlooked or significantly underestimated. In this paper, we fill this gap by studying whether, why, and how much privacy leakage occurs from using SMOTE either as data augmentation method or as a standalone synthetic data generator.
Roadmap.
We begin by showing that SMOTE appears to have no privacy leakage when evaluating through the current practice of training a classifier to distinguish real from synthetic records in augmentation settings or that of measuring the distance from synthetic to real records (more precisely, the distance to closest record, or DCR (Zhao et al.) 2021)). We refer to the former as naive distinguishing and the latter as naive metrics. We also instantiate 1t our knowledge, for the first time-a Membership Inference Attack (MIA) (Shokri et al., 2017 Stadler al., 2022) against SMOTE, showing that attackers can accurately infer whether a target record was part of the real training data.
Next, we propose two novel near-perfect privacy attacks with minimal and realistic assumptions: Distinguishing (DistinSMOTE) and a Reconstruction attack (ReconSMOTE). Both only assume access single augmented or synthetic dataset and knowledge that SMOTE generated it (see Figure []. By exploiting SMOTE's geometric properties, DistiMOE distinguishes real from synthetic records in augmentation settings, while the more ambitious ReconSMOTE reconstructs real minority records from synthetic data. We also provide a theoretical analysis for both attacks, showing they run at worst in On?2d+ n(kr)²), where n, d, and i denote, respectively, the number of input records, features, and SMOTE neighbors, and represents the data imbalance ratio. While quadratic in n, the complexity remains practical (especially with optimized search), with both attacks running within minutes on all datasets we experiment with.
DistinsMOTE achieves perfect precision and recall, while ReCOnSMOTE reaches perfect precision which is more critical in privacy attacks (Carlini et al. 2022) with recall increasing exponentially (with rate s r/k), reaching under realistic parameter values (A- = 5, r Z 20).
Our experiments, summarized in Table D on eight standard imbalanced datasets demonstrate that:
Naive distinguish (0.01 precision//metries (0.16 accuracy) completely underestimate risks.
State-of-the-an MIAs achieve 0.68 AUC on augmented and 0.93 on synthetic data for 100 vulnerable targets, although being time-consuming. Also, sensitivity of targets increases when classifiers are trained on augmented vs. real data, yielding a 17% rise in MIA AUC.
DistinSMOTE perfectly detects the real records in an augmented dataset.
ReconSMoTE achieves perfect precision when reconstructing real minority records from single synthetic dataset. While its average recall is 0.85, it reaches for imbalance ratios of 20 or higher, consistent with our theoretical analysis.
2

---

Published as a conference paper at ICLR 2026
Implications. Our findings provide further evidence that privacy cannot be treated as afterthought when applying non-private techniques like SMOTE in sensitive settings. Its use not only risks exposing individual records but can also undermine trust in data-driven systems that rely synthetic data. Overall, our work has the following real-world implications for reseancher/praatttioneess
1. SMOTE is fundamentally non-private: its interpolation process makes privacy leakage inherent, not a matter of flawed implementation.
2. Minority records are disproportionatel at risk: the very samples SMOTE aims to amplify and make more representative are also the most exposed.
3. SMOTE and DCR are unreliable: evaluating SMOTE with privacy metrics like DCR gives a misleading assessment of its privacy and should not be used to validate other generative models.
4. Caution is critical: performance gains from oversampling must be weighed vs. privacy risks.
2 PRELIMINARIES
Notation. Let Dreat = (X, 3) be a training dataset, where X C RRad is the feature matrix consisting of n samples with d-dimensional feature vectors and y E {0, 1)" the corresponding binary labels.
The dataset consists of no majority and nı minority records, with imbalance ratio r no > 1. In practice, no >> R1. which makes learning directly from the minority class challenging.
SMOTE (Chawla et al. 2002) addresses class im- balance by generating synthetic minority samples; see Algorithm [ To create synthetic record, random minority record from Dreat is selected, one of its k nearest minority neighbors is chosen, and a new point is generated by interpolating along the line segment between them. Repeating this process yields Day with 70-11 new samples, balancing the class distribution. The synthetic data can be used as standalone synthetic dataset (D sym or to form an augmented dataset Dang D real e.g., to improve classification performance.
Algorithm 1 SMOTE (Chawla et al. 2002)
Require: Real dataset Dreal Require: Number of neighbors k
Ensure: Augmented data Dang = Dreat Dayns
or Synthetic data Dayn
1 Filter minority X X [X [i] Breat [1]=
2 Compute mı [X l: nh0 = Dreat
3
while DDay. Ru -21 do
4 Randomly pick 3; E xXheal
5
Find & nearest neighbors of 21, (2::) Randomly choose 2jj E N(x:)
D syns
6
Sample ~ [ 1)
Generate Jagn 4- 37 + u(xz 2%))
Privacy Attacks. Membership Inference At-
Add (Zaga; 1) to Dayo
tacks (MIAs) (Shokri et al. 2017, Stadler et al.]
10 end while
2022) and Reconstruction A Attakks Dinur & Nis-
Sim 2003 Annamalai et al., 2024a) are standard tools to empirically measure privacy leakage in
ML. In MIAs, the adversary aims to infer whether a target record (IT,, yr) was part of the training dataset Dreat- The attack can be framed repeated binary classification game: the adversary is given either a classifier (or a synthetic dataset) trained on Dreat, or one trained on the neighboring D' Dreat Dreat \ (IT, yr), and infers which dataset was used. To do so, the adversary typically exploits differences in model behavior - such as prediction confidences on the target, or statistical features extracted from synthetic data.
In a reconstruction attack, the adversary aims to recover any full real records (i.c., an untargeted attack) from access released model or synthetic data. These attacks often assume access to auxiliary information, such as public data, accurate statistics, or limited query access to Dreal-
We also consider distinguishing attacks, which are somewhat related to MIAs but focus on whether a record comes from the population-level data distribution rather than from the specific dataset used to train the model. In the context of SMOTE, we use these attacks to distinguish unlabelled records in Daug as either real (Dreat) or synthetic (Dayn), since Dreat O D 0.
RELATED WORK
As discussed in Section I SMOTE is widely used for data augmentation and synthetic data generation across various domains. Despite its popularity, prior work has focused primarily on its utility, while its privacy risks remain largely unexplored.
3

---

Published as a conference paper at ICLR 2026
SMOTE has recently served as baseline in several diffusion-basee generative models (Kotelnikov et al. 2023 Zhang et al.) 2024 Pang et al. 2024 Mueller et al. (025). all published at top-tier machine learning venues. A common pattern across these studies is the "SMOTE DCR" workflow: they rely on the Distance to Closest Record (DCR) (Zhao et al. 2021) as the primary privacy proxy, consistently reporting smaller DCR values for SMOTE and interpreting this evidence that the newly proposed models are ppreccci.....iingg...m Kotelnikov et al. (2023) additionally employ the "full black-box" attack from (Chen et al. 2020), which still reduces to DCR as its core signal.
More recently. this view has been challenged by Sidorenko & Tiwald (2025), who show that some diffusion models (Kotelnikov al. 2023] Mueller et al.) 2025) actually achieve lower DCR values than SMOTE, thereby leaking more information about the training data. However. DCR itself has been shown to be an inadequate privacy metric- - it consistently underestimates leakage (Houssiau et al. 2022: Annamalai et al., 2024b; Ganev & De Cristofaro 2025) and does not correlate with leakage detected by MIAS (Yao et al. 2025). To the best of our knowledge, despite its prominent role as a baseline, SMOTE has not yet been systematically evaluated with fate-of-the-ar MIAs any model-specific attacks. This leaves a critical gap in understanding SMOTE's true privacy risks and calls into question the validity of privacy claims across recent line of generative-mode research.
PRIVACY ATTACKS VS. SMOTE
In this section, we present our two novel privacy attacks that expose privacy leakage from SMOTE.
4.1 ADVERSARIAL MODEL
Assumptions. For both attacks, we assume an adversary with access to single dataset generated by SMOTE (Daug for DistinSMOTE and Dayn for ReconSMOTE). The adversary knows that the original SMOTE algorithm (Chawla et al., 2002) was applied (Algorithm []] and is aware of its parameters, specifically, the number of neighbors i and the real data imbalance ratio r (in practice, these can be approximated from the released dataset). The adversary relies solely the geometrical properties of SMOTE to achieve its goals- either distinguishing or reconstruction. Unlike prior privacy attacks, no further knowledge is required: e.g., the adversary does not need access to public/representativ data, repeated inference or generation, the model parameters, numerous shadow models or a meta-classifier (as in MIAs (taader et al. 2022 Houssiau et al. 2022; Annamalai al. 2024b)), or published
(accurate) aggregate statistics (as in reconstruction Dinur & Nissim 2003 Dick et al. (023)).
Objectives. For DistinSMOTE, the adversary aims to distinguish the real minority records from synthetic ones from observing D Dang. whereas for ReconSMOTE, to reconstruct them from D Dayn- We focus on minority records from underrepresented regions of the feature space because they often correspond to the most vulnerable individuals. Such records carry the greatest privacy risks: they are easier to single out, more likely to be re-identified, and any disclosure disproportionately affects the individuals they represent (Kulynych et al. 20222] Stadler et al. (022). Indeed, regulators, including the UK Information Commissioner's 's Office (COO 2022), have explicitly stressed the need to protect minority and outlier records.
We measure the attacks success using precision (the fraction of identified records that are truly real) and recall (the fraction of successfully identified real records), two standard metrics that together give a comprehensive view of performance. In privacy attacks, precision is especially critical, since even a handful of correctly identified records with high confidence constitute serious breach (Carlini et al. 2022). While secondary, capturing large fraction of minority records is also important.
Data Assumptions. Our theoretical analysis of Distin and ReconSMOTE relies the following three realistic assumptions about the feature structure of the real minority records (X1 and k:
Assumption (Real-valued features). All features in Xeeat are real-valued.
Assumption (Global non-collinearity). No three distinct feature vectors in X7aat are collinear. Assumption (Minimum k)) The number of neighbors, k 2 3.
In other words, all features are continuous and no three points lie on the same line. These assumptions align naturally with (high-ding (igh-diimensoona) continuous data, are non-restrictive in practice, and, crucially, are satisfied by all datasets in our main experiments (see Section 5). Moreover, assuming k > 3
4

---

Published as a conference paper at ICLR 2026
is necessary uniquely identify the intersection point of the lines formed by vectors connecting neighboring points, and is a standard, practical choice in typical SMOTE configurations (default is 5).
4.2 DISTINGUISHING ATTACK
we outline the DistinSMOTE attack, which distinguishes real minority records from synthetic ones within augmented dataset. The attack exploits the fact that, among any three collinear points, the middle one must be synthetic, since real points are non-collinear and SMOTE generates points strictly between them. The algorithm begins by searching from the convex hull of the minority records and iteratively explores neighbors inwards. When a collinear triplet is found, its midpoint is pruned from the candidate with real points, and its neighbors are added to the queue for further inspection.
In Algorithmm 2
Complexity. The nearest-neighbor search is the main cost. With brute-force search (O(nd) per query), each of the n records requires finding kr neighbors (O(nd) and checking all neighbor pairs ((()))))), yielding a worst-case complexity of O + )²) In practice, optimized methods (e.g., KD/ball trees) reduce search to (log n.) for small d (d < 32 in our main datasets). Also, since k and are typically (small) constants, the effective complexity is much lower, and the algorithm completes in under three minutes on all main datasets.
Accuracy Analysis. We analyze DistinSMOTE, with the theorem below formalizing the theoretical
correctness of its labeling rule, achieving perfect precision and recall.
Theorem 1 (DistinSMOTE perfect precision &
recall). Under Assumptions [77 the labeling rule in the Dist tinSMOTE attack achieves perfect precision and recall (with probability 1).
Algorithm 2 DistinSMOTE
Require: Augmented data Dang
Require: Number of neighbors k imbalance ratio
Sketch Proof. By SMOTE construction, each syn- thetic point lies strictly on the line segment be- tween two real points (Esym T2 u(xz xr,)
Ensure: Detected real minority records C*
Filter minority X2ug+ - [i] [Bug
Initialize candidate set C' +- X ang
Under the global non-collinearity assumption, no three real points are collinear, so any line in D Daug containing at least three points con- sists of exactly two real endpoints F; 2y E X1 reat and or more synthetic interior points Emi Imgy ... E X1 syn
3 Initialize queue queue <- H (X D convex hull
Initialize visited set V <- 0 while queue o 0 do for record zs E queue if x4, E V and x; E C² then
Add x, to V
Find 2 k nearest neighbors of 2s, N(x:)
DistinSMOTE follows this labeling rule: it finds lines via local search (lines 9-11 of Algorithm 2
for pairs of neighbors (x), E (2x,)) do
11
r; Ty. 2y' are collinear then Identify middle point Im E {ar, Ty, #x] Remove 2m from C*; Add zm to V Add N (x n Cd queue end if end for
and marks interior points as synthetic and end-
12
points real (lines 12-13), while any real point not on such a line (i.e., not used in interpolation) is also labeled real. The local search guarantees
13
15
all points are visited efficiently, and the labeling rule ensures all synthetic points are removed and all real points preserved. This leads to perfect precision and recall (with probability 1, except for negligible numerical precision effects that do not occur in practice).
16
17
end if
18
end for
end while
20 return C²
4.3 RECONSTRUCTION ATTACK
Algorithm 3 presents the ReconSMOTE attack, which operates solely on synthetic data. The attack relies on two main intuitions: 1) synthetic records lie along line segments connecting real minority points, so these lines can be detected by finding three more collinear samples, and 2) such lines intersect exactly at the original real points. The algorithm begins by iteratively defining lines, searching each point and two of its neighbors for collinear triplets, and then extending them with additional collinear neighbors. For each line, the mean of its points is stored as a midpoint, providing compact representation of the line's location. Next, the algorithm examines pairs of midpoints to identify intersection points of the corresponding lines, which serve as candidate real records. Finally, retain only intersections supported by at least three distinct lines, filtering spurious candidates.
5

---

Published as a conference paper at ICLR 2026
Complexity. The worst-case time complexity is very similar to DistinSMOTE, i.e. On²2d+) (kr))). While there are two additional factors, namely, ((nkr) for checking neighbors after identifying a collinear triplet and On²²) for finding line intersections, these dominated by existing terms and can he ignored. The practical complexity is much lower, and the attack runs in at most three minutes on all main datasets.
Accuracy Analysis. Next, we analyze ReconSMOTE; the following theorems give theoretical guaran- tees for its reconstruction rule, achieving perfect precision and lower bound on expected recall. Theorem (ReconSMOTE perfect precision). Under Assumptions / the records reconstructed by ReconSMOTE are guaranteed to be real, i.e., the attack achieves perfect precision (with probability I).
Sketch Proof. By SMOTE construction, each symthetic point lies on a segment strictly between two real endpoints. Accordingly, every detected line in X (obtained from collinear sets identified by the local search in lines 8-17 of Algorithm B corresponds uniquely to pair of real records. The local search correctly groups all synthetic points from that pair into single collinear set without introducing spurious collinearities.
Under the global non-collinearity assumption, the only point lying on three or more such lines is their shared real endpoint. ReconSMOTE exploits this by intersecting detected lines (lines 23-25) and
retaining only points supported by least three distinct lines (line 27). Since synthetic points lie on exactly one SMOTE line. whereas real endpoints lie on three or more, any retained intersection must be a true real point. Hence, every reconstructed record real, so precision 1 (with probability 1). D
For clarity and tractability, the next theorem uses a simplified formulation with directed edges and a Poisson approximation, giving a conservative bound (the approximate bound) that ignores over- lapping neighbor relations in the SMOTE graph. Theorem 3 (ReconSMOTE expected recall (ap- proximate)). ) Let X = no-ni Under As-
Algorithm 3 ReconSMOTE
Require: Synthetic data Dagn
Require: Number of neighbors k imbalance ratio
Ensure: Reconstructed real minority records R²
Filter minority X x [i]]Beyn[i)] [i]=1]
Initialize reconstructed set Rt 0 and
2,k
line support map S +
7 and using Poisson approxima- tion (treating the number of synthetic points
sumptions
3 Initialize set of lines L + 0, midpoints M + Initialize visited set V + 0 for record x; E X!_ do if ş V then
per segment as Poisson), the expected recall of ReconSMOTE satisfies:
7 Add m; to V
E Reeaal N
(L)
8
Find 2 k nearest neighbors of ir. N N1xs)
R(1-c-1
1+
1+ 12
for pairs of neighbors (1),,z)) E N (a:) do
if 25, 22. 24 are collinear then Form initial line (Ir zr,, xy,, ar)): Add æ; my to V for neighbor x, E N(x,,) \ (2,, Ty, 22 do if v. collincar with line (N,,,,, my zn) then Add x. to line (2s, 2z. dz);; Add on, to V end if end for
max 0,
2
I1
12
Sketch Proof. At each generation step, SMOTE
13
first selects a minority record z; uniformly from the n1 available, and then one of its k nearest neighbors Ij uniformly. Thus, each of the n, k possible sinority-neighhee
14
16
17
Add line to C
(directed) segments
18
Compute mean of line points and add to M
is chosen with probability 1
n,k at every step.
end if end for
Let Cij denote the number of synthetic points
20
generated on segment (x,, x,). Since each of the no - synthetic points is assigned indepen-
21
end if
22
end for
dently to a segment with probability 1 k the vector of all Ciyy follows a multinomial distribu- tion with E:, Cjj = no-11,, and each Cij is marginally distributed as Binom Binom(nio- (no-11: k )- For analytic tractability, we approximate this by Poisson(A) with mean À = m,k standard when fg- n2 is large and aik small, which holds in practice.
23 for pairs of midpoints (mp, my) E .M do Compute intersection point x² of lines corresponding to my and my Add x" to I²* and record support line indices {p, 2) in S(x")
25
26 end for
Filter points in R with S(x 2 3
21
This is
28 return R²
A segment is reconstructed if C.j 2 3. The probability of this is Pedge = Pr(Poisson(A) 2 3]
1 1-e 1 + + ) Now consider a fixed record T,, and let S, denote the number of reconstructed

---

Published as a conference paper at ICLR 2026
segments incident to it. Therefore, [[S;] Pedge- Moreover, by Assumption once S; 2 3, the point 2; is uniquely identifiable, since three non-collinear reconstructed segments suffice to triangulate its location. To lower bound Pr(S; 2 3), observe that [[S:] [[S, < 2) { 2 3)] I
2 Pr(S; S 2) + k Pr(S; 2 3} (since S I k). As Pr(S: < 2] = Pr(S, 2 3), this yields B[S 2 + (k: 2) Pr(S, 2 3/, hence Pr(S, 3)
E[S. k Padg Atd-
This is the probability that is identifiable. Since recall is the fraction of minority records that are identifiable, its expectation equals the average of these probabilities over all n1 records. Because each is treated symmetrically in SMOTE and we look at directed segments, the average equals the bound derived above. Hence we obtain the stated lower bound on the expected recall.
Remarks. By rearranging Equation we get R S ドーニ e + + )) which in turn means [[Recall] 1 as À oC, with convergence rate exponential in X(= Ro Rgk -
In Appendix A we provide more detailed analysis and derive tighter bound without the simplifi- cations Theorem we call it the exact bound. Finally, Appendix B between the bounds under various conditions.
we visualize the differences
5 EXPERIMENTAL EVALUATION
We now evaluate the effectiveness of our novel attacks, along with additional methods geared to assess privacy leakage in SMOTE, both as a data augmentation and synthetic data generation technique. Specifically, we consider: 1) current practices such as naive distinguish (via a classifier) and privacy metrics (i.e., DCR from synthetic to real records (Zhao et al. [222 ). 2) state-of-the-art Membership Inference Attacks (MIAs) (Shokri al. 2017 Carlini
2022), which to the best of our knowledge have not yet been applied against SMOTE, and 3) the Dist DistinSMoN SSSTTE and ReconSMOTE attacks. Overall results are summarized in Table
Datasets. We conduct our main experiments on eight standard imbalanced datasets, each with a bi- nary classification task, obtained from the imbleam library (Lemaitre et al.) 2017) (originally from the UCI ML Repository) and used in prior work (Ding 2011; Rosenblatt et al., 2025) These datasets vary significantly in size (336 to 11,183 records), dimen- sionality (6 to 32 features), imbalance ratios (8.6 to 130), and prediction task (target), as shown in Table
Dataset
Target
d
ecoli
imU
8.6
336
7
abalone
9.7
4,177
10
car eval solar flare m0
vgood
12
1,728
21
M-0
19
1,389
32
car eval 4
vgood
26
1,728
21
yeast_me2
ME2
28
1,484
8
mammography
minority
42
11,183
6
abalone_19
19
130
4,177
10
Implementations. We use the standard im- bleam (Lemaitre et al.] (017)) implementation of SMOTE and sklearn (Pedregosa et al.] (01T) for classifiers. Both Dist DistinSMTTE and ReconSMOTE are highly efficient, running in under three minutes on any dataset from Table 2 on an Apple M4 MacBook with 24GB RAM. The naive methods are similarly fast, while the MIAS take up to 30 minutes per dataset. We will release the source code for our attacks along with the final version of the paper.
Table 2: Main datasets overview, where r denotes the imbalance ratio (no/na), the number of records, and d the number of features.
5.1 AUGMENTED DATA
We compare the three approaches on augmented data, with results for all datasets shown in Table
Naive Distinguish is a popular but arguably misguided approach for telling apart real and synthetic records by training a classifier (Snoke et al. 2018 El Emam et al.) 2022 Qian et al., 2023 DataCebo 2025). Half of the real and half of the synthetic data used to train Random Forest classifier, with testing performed on the remaining data. For each dataset, we run 5 independent SMOTE generations and train 5 classifiers per run, reporting averaged results. The method severely underestimates privacy risk (see the two leftmost columns in Table 33 precision and recall 2s 0) as is capable of capturing only distributional differences, not record-leve leakage.
MIA. Next, we evaluate MIAS (Shokri et al., 2017 Carlini et al. 2022) using the repeated classifica- tion game from Section 2 For given target record, we train 200 classifiers (a multi-layer perceptron
7

---

Published as a conference paper at ICLR 2026
Dataset
r
Naive distinguish
MIA
DistinSMOTE Daug
Daug
Dreal (AUC)
Daug (AUC)
(Precision)
(Recall)
(Precision)
(Recall)
ccoli
8.6
0.00
0.00
0.00 + 0.00
0.50 + 0.04
0.50 0.05
1.00 0.00
1.00 - 0.00
abalone
9.7
0.03 + 0.03
0.00
0.01
0.57 0.03
1.00 0.00
1,00
- 0.00
car car_eval_34
12
0.01 + 0.02
0.01
0.01
0.60
0.03
0.73
1.00 +.00
1.00
- 0.00
solar_flare flarralrammmma __
19
0.01
0.03
0.00
0.79
0.97
1.00 +.00
0.00
car eval
0.00
0.00
+
0.59
1.00
1.00 + 0.00
yeast me2
28
0.00
+ 0.00
+
0.04
+.57
1.00 0.00
1.00
+ 0.00
mammography
42
0.01
+ 0.02
0.00
0.53
0.56
1.00
1.00
= 0,00
abalone_19
130
0.00
+ 0.00
0.00 0.00
0.55
0.80 0.12
0.99 - 0.02
1.00
1 0.00
average
0.00 + 0.01 0.00 1 0.00 0.58 1 0.03 0.68 1 0.07 1.00 + 0.00
1.00 1 0.00
Table 3: Privacy attacks vs. augmented data.
Dataset
Naive metries (Accuracy)
MIA (AUC)
ReconSMOTE (Rocall)
(Precision)
ccoli
8.6
0.19 + 0.15
0.93 + 0.05
1.00 + 0.00
0.43 = 0.02
abalone
9.7
0.21 + 0.17
0.65 + 0.07
1.00 + 0.00
0.62 : 0.01
car_eval_34
12
0.00
+ 0.00
0.97 + 0.01
1.00 +00
0,83 : 0.03
oolar_flare_md
19
0.03
0.06
1.00 0.00
1.00 0.00
0,95 + 0.02
car_eval_4 _4
26
0.01
0.04
+
1.00 0.00
1.00 0.00
yeast me2
0.20 0.12
0.99 + 0.01
1.00 0.00
1.00 + 0.00
mammography
42
0,25 - 0.15
0.90
0.00
1.00 + 0.00
abalone.19
130
0.37 + 0.14
1.00 + 0.00
1.00 0.00
1.00 + 0.00
average
0.16 + 0.10
0.93 + 0.02 1.00 + 0.00 0.85 + 0.01
Table 4: Privacy attacks vs. synthetic data.
with two hidden layers) on augmented datasets generated via SMOTE: half of the training datasets include the target record, and half exclude it. We then use the elassifiers' predictions on the target to simulate an adversary's ' confidence in distinguishing membership, and calculate AUC. Following prior work (Ye al., 2024, Guépin et al. 2024). we train target-specific attacks in a leave-one-our setting, which provides a more accurate estimate of privacy leakage. This procedure is repeated for 100 randomly selected targets (or all minority records), and we report the average. Overall, this requires training roughly 20k SMOTE models and classifiers per dataset.
Looking at Table (fourth column), the average AUC 0.68, with half of the datasets exceeding 0.7, which indicates substantial privacy leakage. The lowest scores appear in datasets with the smallest imbalance (ecoli and abalone), where the proportion of synthetic data is relatively low. Mammography also shows low score, likely because its large number of records reduces the influence of any single individual. These results are therefore not entirely surprising.
We also conduct additional MIA experiment, training classifiers solely the real data, to test the intuition that SMOTE enhances the sensitivity of minority records in the augmented data, as they directly contribute to generating synthetic samples. As expected, targets become more vulnerable when augmentation is applied - average AUC increases by 17% (comparing the third and fourth columns in Table 3). Larger imbalance further amplifies this effect. While similar intuitions have been noted previously (Rosenblatt et al. 2025), they were not supported by empirical evidence.
Dist DistinSMOTE. Finally, we DistinSMOTE on 25 SMOTE generations and report average preci- sion/recall (two rightmost columns in Table (3. As expected from our analysis, we achieve perfect results across all datasets and imbalance levels. This shows that merely knowing SMOTE was used for augmentation is enough for an adversary to perfectly identify real records with minimal effort.
5.2 SYNTHETIC DATA
Next, we evaluate all attacks synthetic data; Table 4
Naive Metrics. A widely used approach for evaluating privacy in synthetic data is the Distance to Closest Record (DCR) (Zhao et al. 2021). which measures the average distance between synthetic and real records. DCR has been commonly applied to SMOTE and modern diffusion models (Kotelnikov
et al.
2023 Zhang et al. 2024 Pang et al. 2024
Mueller et al. 2025), but its interpretation is
8

---

Published as a conference paper at ICLR 2026
limited an average distance alone provides little insight into privacy risks. To address this, use linkability attack (Giomi et al., 2022), which builds on DCR and reports the accuracy with which an adversary could link two partial feature sets of real record using synthetic data. For each dataset, we train 5 SMOTE models and evaluate linkability 5 times with varying feature subsets.
The results unstable (see the leftmost column in Table 4): datasets yield large variances that render
scores differ from zero only for low-
dimensional settings (d I 10), while higher-dimensions DCR unreliable. This expected, as DCR treats all features equally and is known be inadequate privacy measure (Annamalai et al. 2024b Ganev & De Cristofaro 2025
Yao et al. 2025).
MIA. We evaluate MIAs on synthetic data using the repeated classification game (similar to Sec- 5.1I. We rely on the GroundHog attack (Stadler ct al. 2022), one of the most popular MIAs for synthetic tabular data. GroundHog extracts statistical features from generated datasets such as column-wis wise minimum, mean, median, maximum, and pairwise correlations and uses them to train a meta-classifier, which is then applied to unlabeled real and synthetic feature sets. To generate training features, we train 400 SMOTE models for in/out training features and another 200 SMOTE models for in/out testing features. Repeating this for 100 targets yields about 60k models per dataset.
As shown in Table (second column), this results in substantial pri- vacy leakage: AUC exceeds 0.9 in all but one dataset. The exception is abalone. which has the second-lowen imbalance ratio and the second-largest number of records, potentially leading to lower sensi- tivity. When imbalance increases (abalone.199 19). the MIA AUC rises to 1. Overall, these results demonstrate that SMOTE-generated data highly susceptible to MIAs, even beyond trivial cases where data domain characteristics mainly drive leakage (Ganev et al. 2025a b).
1.0
abalomo 20 sour Fare,
0.8
ana
0.6
saxere
Empltiall
Lower bound (ncaet) Lower bound (upprosimate)
ReconSMOTE. Next, we apply ReconSMOTE 25 SMOTE genera- tions per dataset, reporting average precision/recall (last two columns in Table 4). The attack achieves perfect precision on all datasets, which, as motivated in Section 4 is the most critical metric for re- construction. Recall is also very high (see Figure 2 with an average of 0.85. It increases quickly with class imbalance, reaching 1 when r 2 20. The recall values (per dataset) are line with the expected approximate/exact bounds predicted by Theorem Jnd
0.0
20
50
Imbalance ratio (llgg.
Figure ReconSMOTE recall and lower bounds (per dataset).,
1.0
0.8
To further validate the expected bounds at finer granularity, we vary the imbalance ratio {5, 10, 20, 25, 50, 75, 100} across all datasets and plot the average performance increases exponentially with (for fixed k). reaching around im- balance 20. Overall, these findings highlight the risks of relying on SMOTE for synthetic data generation: in realistic settings, adversary can reconstruct all real records with perfect confidence.
0.8
Figure 3 As expected, recall
0.2
Prccain
20
50
100
Imbolance ratio (log)
Figure
ReconSMOTE perfor-
mance varying r (all datasets).
5.3 TAKE-AWAYS
We show that MIAS achieve high AUC across numerous targets vs. SMOTE: 0.68 against classifiers trained on augmented data and 0.93 against synthetic data. Moreover, the sensitivity of minority records increases by an average of 17% when classifiers are trained on augmented rather than original training data. Finally, our attacks, DistinSMOTE and ReconSMOTE, are able to i) distinguish real minority records from synthetic ones in augmented data, and ii) reconstruct real minority records from synthetic data with minimal assumptions and near-perfect accuracy.
6 DistinSMOTE AND ReconSMOTE WITH RELAXED ASSUMPTIONS
In this section, we test the robustness of our attacks, DistinSMOTE and ReconSMOTE, on aug- mented/synthetic data while relaxing our assumptions one at a time, e.g.. using high-dimensional data, mixed-type data, and k 2; results are shown in Table 6 and i Appendix C Additionally, in Appendix(C [ we evaluate our attacks on perturbed SMOTE datasets (i.e., linear interpolation with added random noise) and provide a heuristic for running the attacks without knowledge of & and r.

---

Published as a conference paper at ICLR 2026
High- Sithe-iiensional Data. First, we test how the attacks scale to two high-dimensional datasets up to 96,690 records and 50 features (see Table and Appendix for results and details about the higgs and miniboone datasets, both with 25). Both DistinSMOTE and ReconSMOte achieve perfect precision and recall and, as analyzed in Section 4 scale well with n and d, taking no more than 8 minutes per dataset, which is highly practical.
Myxed-Type Data. Next, we show that our attacks also apply to mixed-type data, relaxing Assump- tion [ see Table 6 and Appendix for details on the cardio and churn datasets, each containing an equal mix of numerical/cateeorica features, and with r = 25. To generate data, we use SMOTE- NC (Chawla et al., 2002) introduced in the original SMOTE paper and designed for mixed data via the standard imblearn implementation (Lemaitre et al.) 2017). For the attacks, we simply ignore categorical features and operate on the continuous ones. As before, we obtain perfect precision and very high recall on both datasets. This approach can also be applied to one-hot encoded data.
SMOTE with 2. Finally, we evaluate the attacks on the eight main datasets using SMOTE with k = 2, relaxing (ssuuptioon] in Appendix C). The performance of DistinSMOTE remains unaffected, achieving perfect precision and recall, as expected. As for ReconSMOTE, average recall drops to 0.52 (a 39% decrease compared to SMOTE with k 5 in Table 4 because each real record participates in fewer lines, making it harder to reach the support threshold; only records that serve as neighbors to other records beyond their two closest neighbors can be successfully reconstructed. Precision remains perfect as all reconstructed points are still accurate. Nevertheless, reconstructing half the real minority records with perfect confidence is serious privacy breach.
CONCLUSION
Our work highlights the fundamental privacy limitations of SMOTE (Chawla et al. 2002), one of the most widely adopted techniques for improved learning imbalanced data. The effectiveness of our novel, near assumption-free attacks (DistinSMi) -ecords-precinn the ones SMOTE aims to better represent- are exposed to significant, previously underestimated privacy risk. Importantly, this also shows that using SMOTE as baseline with DCR to evaluate privacy is unreliable and can provide false sense of security. Nonetheless, SMOTE remains an effective and easy-to-use technique in non-privacy-sensitte the primary concern. We are confident our findings will be valuable to researchers and practitioners deploying solutions that process or release sensitive data, motivate them to avoid SMOTE as a privacy benchmark, and encourage them to adopt more robust privacy-preserve
and ReconSMOTE), demonstrates that real minority
applications where utility is
techniques.
Limitations and Future Work. Our attacks currently operate on continuous data and are primarily tested on the original SMOTE implementation. While certain numerical instabilities/edge cases are theoretically possible (c.g.. synthetic point appearing collinear with two unrelated real points), their probability is effectively zero in high- high-dimensional datasets with high numerical precision, and we did not observe any such case in our experiments. Additionally, our findings generalize to many SMOTE variants- such as BorderlineSMOTE. (Han et al.) (0055), ADASYN (He et al. 2008). methods (Douzas et al. 2018 as
SVMSMOTE (Nguyen et al.) 2009), and cluster/hybrid-baat they all rely on line-segment interpolation to generate synthetic samples. In contrast, our attacks are unlikely to be successful against variants like G-SMOTE (Douzas & Bacao 2019) and GI- SMOTE (Chen et al. 2024b). which generate synthetic points within regions rather than strictly along lines. Nevertheless, these variants are not inherently vuinerable to MIAs. Extending our attacks and developing robust defenses for such methods is promising direction for future work.
and are still likely to remain
Privacy-preserinng variants of SMOTE have also been proposed under the framework of Differential Privacy (Dwork et al. 2006 2014), including DP-SMOTE (Lui 2022), which adds noise when estimating point distributtios//earess neighbors, and SMOTE-DP (Zhou et al. 2025), which combines SMOTE with a DP generative model. However, SMOTE- DP largely ignores SMOTE's increased sensitivity of minority records (Lau & Pusserat-Palmbart a gap we confirm empirically (see Section[S.I). As none of these approaches provides open- source implementations, leave evaluating their effectiveness to future work.
2021 Lut 2022; Rosenblatt et al. 2025).
10

---

Published as a conference paper at ICLR 2026
Ethics Statement. Our work does not involve attacking live systems private datasets. Our goal is to demonstrate the importance of emphasizing privacy considerations and relying on established notions of privacy when processing sensitive, imbalanced data in critical domains.
We have only used Large Language Models (LLMs) to aid or polish writing. We performed all literature review, research ideation, and theoretical derivations.
Reproducibility Statement. We make considerable efforts to make our work reproducible. We clearly state all assumptions throughout the paper, provide detailed references and step-by-step explanations for accessing and preparing the datasets and privacy attacks used in our evaluation, and include pseudocode for our attacks. Last, we release the source for attacks and experiments: https://gitthu..comm
REFERENCES
ADR Wales. Scoping and Evaluation of Synthetic Data to Enhance Access to Data. https://adrwaaes /rgp/pp pontten//uploads/22///////// B4///OLD-syyttetic-ddaaee synthetic-data pdf] 2025.
Manal Alghamdi, Mouaz Al-Mallah, Steven Keteyian, Clinton Brawner, Jonathan Ehrman, and Sherif Sakr. Predicting Diabetes Mellitus using SMOTE and Ensemble Machine Learning Approach: The Henry Ford Exercise Testing (FIT) Project. PloS ONE, 2017.
Meenatchi Sundaram Muthu Selva Annamalai, Andrea Gadotti, and Luc Rocher. A Linear Reconstruction Approach for Attribute Inference Attacks against Synthetic Data. In USENIX Security, 2024a.
Meenatchi Sundaram Muthu Selva Annamalai, Georgi Ganev, and Emiliano De Cristofaro, "What do you want from theory alone?" Experimenting with Tight Auditing of Differentially Private Synthetic Data Generation. In USENIX Security, 2024b.
AWS. Transform Data. https://docs.awt www.aaazaao......oo.o...aaa...o.
awazon. www.aaaw......aa...aa..ammm....e httpc/////aggeeeeeeaa/a/////a/a/
itransformhhtme html 2025.
Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership Inference Attacks from First Principles. In IEEE S&P, 2022.
Nitesh V Chawla, Kevin W Bowyer. Lawrence O Hall, and W Philip Kegelmeyer. SMOTE: Synthetic Minority Over-sampling Technique. JAIR, 2002.
Dingfan Chen, Ning Yu, Yang Zhang, and Mario Fritz. GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Models. In ACM CCS, 2020.
Wuxing Chen, Kaixiang Yang. Zhiwen Yu, Yifan Shi, and CL Philip Chen. A Survey on Imbalanced Learning: Latest Rescarch, Applications and Future Directions. Artif. Intell. Rev., 2024a.
Yiheng Chen, Jinbai Zou, Lihai Liu, and Chuanbo Hu. Improved Oversampling Algorithm for Imbalanced Data Based on K-Ncarest Neighbor and Interpolation Process Optimization. Symmetry, 2024b.
DataCebo. SDMetrics. /ttpss://ocss sdv. dww/ sdmetricttccc/ 2025.
Travis Dick, Cynthia Dwork, Michael Kearns, Terrance Liu, Aaron Roth, Giuseppe Vietri, ct al. Confidence- Ranked Reconstruction of Census Microdata from Published Statisties. PNAS, 2023.
7ejin Ding. Diversified Ensemble Classifiess for Highly Inbalanced Data Learning and Their Application in Bioinformatiis. PhD thesis, Georgia State University, 2011.
Irit Dinur and Kobbi Nissim. Revealing Information while Preserving Privacy. In PODS, 2003.
Georgios Douzas and Fernando Bacao, Geometric SMOTE Geometrically Enhanced Drop-in Eeplacement for
SMOTE. Inf. Sci., 2019.
Georgios Douzas. Fernando Bacao, and Felix Last. Improving Imbalanced Learning through a Heuristic
Oversampling Method Based on K-Means and SMOTE. Inf. Sci., 2018.
Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating Noise to Sensitivity in Private Data Analysis. In TCC, 2006.
Cynthia Dwork, Aaron Roth, et al. The Algorithmic Foundations of Differential Privacy, Foundations and Trends in Theoretical Computer Science, 2014.
Khaled El Emam, Lucy Mosquera, Xi Fang, and Alaa El-HHusuna.. Utility Metrics for Evaluating Synthetic Health Data Generation Methods: Validation Study. JMIR Med. Inform, 2022.
Hosam El- El-Sof,ny, Belgacem Bouallegue, and Yasser M Abd El-Latif. A Proposed Technique for Predicting Heart Disease Using Machine Learning Algorithms and an Explainable AI Method. Sci. Rep., 2024.
Sara Fotouhi, Shahrokh Asadi, and Michael W Kattan. A Comprehensive Data Level Analysis for Cancer
Diagnosis Imbalanced Data. J. Biomed. Inform., 2019.
Georgi Ganev and Emiliano De Cristofaro. The Inadequacy of Similarity- -ased Privacy Metries: Privacy Attacks Against "Truly Anonymous" Synthetic Datasets. In IEEE S&P, 2025.
11

---

Published as a conference paper at ICLR 2026
Georgi Ganev, Meenatchi Sundaram Muthu Selva Annamalai, Sofiane Mahiou, and Emiliano De Cristofaro. The Importance of Being Discrete: Mcasuring the Impact Discretization End-to-Enn Differentially Private Synthetie Data. In ACM CCS, 2025a.
Georgi Ganev, Meenatchi Sundaram Muthu Selva Annamalai, Sofiane Mahiou, and Emiliano De Cristofaro. Understanding the Imppct of Data Domain Extraction on Synthetic Data Privacy. In ICLR SynthData, 2025b.
Matteo Giomi, Franziska Boenisch, Christoph Wehmeyer, and Borbála Tasnádi. A Unified Framework for Quantifying Privacy Risk in Synthetic Data. PoPETS, 2022.
Google Cloud. Learn about datasct transformaations Understand preprocessing. balancing, stratification, and dataset suitability for machine learning. hhtpps//cloudd wwwgle.coo//eeeeeeeooooooooooooe www/veetee-aai/eeeeeceaoaaaaaaee air.aarratgeeeeiieeeeeeeee ai/coss/ htt.:aaouu__dtttet_teeeee
2025.
Florent Guépin, Nataša Krčo, Matthicu Mecus, and Ales-Alex de Montjoye. Lost in the Averages:
A New Specific Sctup to Evaluate Membership Inference Attacks Against Machine Learning Models. arXiv:2405. 14433, 2024.
Hui Han, Wen- Yuan Wang, and Bing-Huan Mao. Borderline-SMOTE A New Over-Sampling Method in Imbalanced Data Sets Learning. In ICIC, 2005.
Haibo He and Edwardo Garcia. Learning from Imbalanced Data. IEEE TKDE, 2009.
Haiho Hc, Yang Bai, Edwardo A. Garcia, and Shutao Li. ADASYN: Adaptive Synthetic Sampling Approach for Imbalanced Learning. In IJCNN, 2008
Florimond Houssiau, James Jordon, Samuel Cohen, Owen Daniel, Andrew Elliott, James Geddes, et al.
TAPAS: A Toolbox for Adversarial Privacy Auditing of Synthetic Data. In NewrIPS SymtheticDDaa4411, 2022.
ICO. Chapter 5: privacy-enhancing technologies (PETs). https://cco.. wow.co......oooooooo arg..u//mediaaabutt-eeoeo ico/
consultations/402 (10e//2144///e wttp://haaaee----nnnnssstaaaaaaa pets. pdf], 2022.
Bayrem Kaabachi, Jérémic Despraz, Thierry Meurers, Karen Otte, Mehmed Halilovic, Bogdan Kulynych, et al.
A Scoping Review of Privacy and Utiity Metrics in Medical Synthetic Data. NPJ Digit. Med., 2025.
Abdul Rehman Khalid, Nsikak Owoh, Omair Uthmani, Moses Ashawa, Jude Osamor, and John Adejoh. Enhancing Credit Card Fraud Detection: An Ensemble Machine Learning Approach, BDCC, 2024.
Charbel N Kindji. Lina Maria Rojas- SojjasBaraaooa, Elisa Fromont, and Tanguy Urvoy. Under the Hood of Tabular Data Generation Models: Benchmarks with Extensive Tuning. arXiv:2406. 12945, 2024.
Tanapol Kosolwattana, Chenang Liu, Renjie Hu, Shizhong Han, Hua Chen, and Ying Lin. A Self-inspected Adaptive SMOTE Algorithm (SASMOTE) for Highly Imbalanced Data Classification in Healthcare. BioData
Min., 2023.
Akim Kotelnikov, Dmitry Baranchuk, Ivan Rubachev, and Artem Babenko. TabDDPM: Modelling Tabular Data
with Diffuusio Models. In ICML, 2023.
Bogdan Kulynych, Mohammad Yaghini, Giovanni Cherubin, Michael Veale, and Carmela Troncoso. Disparate Vulnerability to Membership Inference Attacks. PoPETS, 2022.
Ashly Lau and Jonathan Techniques. In TPDP, 2021.
Statistical Privacy Guarantees of Machine Learning Preprocessing
Guillaume Lemaitre, Fernando Nogueira, and Christos K Aridas. Imbalanced-leam: A Python Toolbox to Tackle the Curse of Imbalanced Datasets in Machine Learning. JMLR, 2017.
Yuliaa Lut. Privacy-Aware Data Analysis: Recent Developments for Statistics and Machine Learning. PhD thesis, Columbia University, 2022. Chapter 3; Private Tools for Imbalanced Learning.
Dionysis Manousakas and Sergüil Aydöre. On the Usefulness of Synthetic Tabular Data Generation. ICML
DMLR, 2023.
Microsoft. SMOTE,
reference/smon 2024.
Microsoft. Example pipelines & datasets for Azure Machine Learning designer. https://leean..iica
com/ us/ www.zureemacciieeeeeeeeeee// learning/ sampses-dsiiegeeeeer
designer] 2025.
Markus Mueller, Kathrin Gruber, and Dennis Fok. Continuous Diffusion for Hixed-Type Tabular Data. In ICLR, 2025.
Mirza Muntasir Nishat, Fahim Faisal, Ishrak Jahan Ratul, Abdullah Al-Monsur, Abrar Mohammad Ar-Rafi, Sarker Mohammad Nasnullah, et al. A Comprehensive Investigation the Performances Different Machine I Learning Classifiers with SMOTE-ENN Oversampling Technique and Hyperparamcter Optimization for Imbalanced Heart Failure Dataset. Sci. Program., 2022.
2022.
Hien M. Nguyen, Eric W. Cooper, and Katsuari Kamei. Borderline Over-sampling for Imbalanced Data Classification. IJKESDP, 2009.
ONS. Synthetic Data for Public Good. Ittpes//aataccieeccmmpsssoo gwv.noo.....oooooooooooooooooo.. htt. data-for-public-good 2019.
12

---

Published as a conference paper at ICLR 2026
Shimaa Ouf, Kholoud T Mahmoud, and Manal A Abdel-Faatah. A Proposed Hybrid Framework to Improve the Accuracy of Customer Churn Prediction in Telecom Industry. J. Big Data, 2024.
Wei Wei Pang. Masoumeh Shafieinejad. Lucy Liu, Stephanie Hazlewood. and He. ClavaDDPM: Aulti-relational
Data Synthesis with Cluster-guided Diffusion Models. In NewrIPS, 2024.
Fabian Pedregosa, Gaël Varoquaux, Alexandre Gramfort, Vincent Michel, Bertrand Thirion, Olivier Grisel, et al.
learn: Machine Learning in Python. JMLR, 2011.
Ke Peng. Yan Peng, and Wenguang Li. Rescarch on Customer Churn Prediction and Model Interpretability
Analysis. PloS ONE, 2023.
Zhaozhi Qian. Rob Davis, and Mihaela van der Schaar. Synthcity: A Benchmark Framework for Diverse Use Cases of Tabular Synthetic Data. In NeurlPS Datasets and Benchmarks Track, 2023.
Azra Ramezankhani, Omid Pournik, Jamal Shahrabi, Fereidoun Azizi, Farzad Hadaegh, and Davood Khalili. The Impact of Oversampling with SMOTE on the Performance of 3 Classifiers in Prediction of Type Diabetes.
MDM, 2016.
Lucas Rosenblatt, Yuliia Lut, Eitan Turok, Marco Avella-Medina, and Rachel Cummings. Differential Privacy Under Class Imbalance: Methods and Empirical Insights. In ICML, 2025.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership Inference Attacks against Machine Learning Models. In JEEE S&P, 2017.
Andrey Sidorenko and Paul Tiwald. Privacy-Preserving Tabular Synthetic Data Generation Using TaGularARGN. NNi:25508.06647 2025.
Joshua Snoke, Gillian M Raab, Beata Nowok, Chris Dibben, and Alcksandra Slavkovic. General and Specific Utility Measures for Synthetic Data. JRSSA, 2018.
Theresa Stadler, Bristena Oprisanu, and Carmela Troncoso. Synthetic Data - Anonymisation Groundhog Day. In USENIX Security, 2022.
Joaquin Vanschoren, Jan N Van Rijn, Bernd Bischl, and Luis Torgo. OpenMI.: networked science in machine learning. ACM SIGKDD Explor, 2014.
Zexi Yao, Nataša Krčo, Georgi Ganev, and Yves-Alexandre de Montjoye. The DCR Delusion: Measuring the Privacy Risk of Synthetic Data. ESORICS, 2025.
Jiayuan Ye, Anastasia Borovykh, Soufiane Hayou, and Reza Shokri. Leave-one-out Distinguishability in
Machine Learning. In ICLR, 2024.
Hengrui Zhang, Jiani Zhang, Balasubramaniam Srinivasan, Zhengyuan Shen, Xiao Qin, Christos Faloutsos, et al.
Mixed- Tabular Data Synthesis with Score-hased Diffusion in Latent Space. In ICLR, 2024.
Zhihong Zhao and Tongyuan Bai. Financial Fraud Detection and Prediction in Listed Companies Using SMOTE and Machine Learning Algorithms. Entropy, 2022.
Zilong Zhao, Aditya Kunar, Robert Birke, and Lydia Y Chen. CTAB-GAN: Effecttvve Table Data Synthesizing.
In ACML, 2021.
Yan Zhou, Bradley Malin, and Murat Kantarcioglu. SMOTE-DP: Improving Privacy-Utility Tradeoff with Synthetic Data. arXiv:2506.01907, 2025.
A TIGHTER LOWER BOUND ON ReconSMOTE RECALL
In this section, we derive tighter lower bound on the recall of ReconSMoTE by relaxing two of the assumptions in Section 4.3) namely the Poisson approximation and the one-directional counting of C.j. Specifically, we use the exact Binomial distributions and count Cij in both directions to obtain more accurate values.
Recall that at each step of the SMOTE algorithm, we choose an I, X1 real uniformly at random and then independently select one of its i nearest neighbors uniformly at random. To capture this structure, we represent the minority data by a KNN graph G = (X) E), where edges E represent the neighboring relations among the minority samples. As before, we use N(xx)) to denote the k nearest points to 2; from the minority set. For each v; E X1 X| we add an edge Fg- whenever I, (x,).. Each synthetic data generated by SMOTE is associated with exactly one edge. Let denote the probability that nearest-neighhor relation is mutual; i.c., the probability that if x. E N (x;) then also 2; E Naz)). In this case, synthetic point lies on E,4z if it was generated along Ei-ij or along Es If a = 1, then all nearest- neighhor edges are mutual, and a = 0 corresponds to a completely sidd nearest-neighbo graph, for which we usually refer to those edges exclusive.
Recall that an edge is reconstructed if at least three synthetic records lie on its segment, and a real I4 is identifiable if there exist three reconstructed edges incident to 24. We denote the number of
13

---

Published as a conference paper at ICLR 2026
synthetic data points generated between 2; and z; by Ctj. For generating each synthetic point, SMOTE performs these selections independently. assigning every new sample to exactly one of the n,k directed edges with equal probability k)) This independence is not additional assumption - follows directly from the random sampling mechanism of SMOTE. Consequently, the vector of all C2y follows multinomial distribution with Eig Cij n1-B1,
n1, and each component
Cij is marginally Binom((o--1)) mikk
Because some directed edges in the SMOTE KNN graph represent mutual neighbor relationships, certain edges overlap. We address this by distinguishing between one- way and mutual edges. Let Biy = I[x; E (I²)) and 2j E [I:)} (muutuality indicator) with Pr Bij = 1) = a. Then
Ci. Bi 0 Binom no R1i )
C.
Bij
22 Binom no R1. mik
Consider the following assumption regarding the structure of neighboring relations around each real minority record.
Assumption 4 (Local non-degeneracy). For any 2; E Ieat all edges {Ei-s 2s E N2;))) have pairwise distinct directions.
In the analysis of this section, we Assumption in place of Assumption 2 (global non-collinearity). as it is a weaker, localized condition sufficient for establishing the lower bound on reconstruction recall. In particular, if Assumption 2 holds, then Assumption 4 automatically follows. Under
Assumption 4 the intersection of any three reconstructed edges incident to x; uniquely identifies Tq.
Lemma (Reconstructed edge probability). For any edge G.
Pr(Ci, 2 33-(1-a)) Pr Pr(Biiom(ng -1: ) 2 3 Pr PrBiooom(no nn,, xxk 2 PPdggon
Sketch Proof. Condition By and compute the average. If Biy 0, then only one direction contributes to the count; if B,y = 1, both directions do.
Lemma 2 (Lower-bound on per-node identifiability). Fix T3 E X and its k outgoing directed edges (Fa-ej : 33 E Nxx)).. Then, we have
l Pedge (a) - =: Lids
Pr(z; identifiable) 2 max 0,
(2)
k 2
and this lower hound is tight.
Sketch Proof. Declare an edge reconstructed if Ci5 2 3 and set E == 11C 2 3]. Let S.
Σト= D. From Lemma each edge has marginal Pr TT = 1} = Pedge (a), so
E|S:] = k Podge (a). Then, we have
E[S.] = [[S, I(S < 2]] + E(S. 2 3]] < 2| < 2) E 2 3)|
(since S; S l: a.s.)
2 Pr(S < 2)+ k Pr(S. 2 3).
Since Pr[S, 2] = - Pr(S, 2 3). we obtain
E S S + (k: - 2) Pr(S, 2 3},
hence
[|S.] -2 1: Pedge (a) 2
Pr[S: > 3)
k
Truncating at 0 accommodates the trivial case k Pedge (a) < 2.
Moreover, the bound cannot be improved using only the edge-wise success probabilities. Consider constructing (ETEc, ) so that S, Σ ETe,, takes values only in k3.. Choose the mixture weights so that [[S.] = Pedgo (a). In this case, the inequality holds with equality, meaning that the lower bound is tight.
0
14

---

Published as a conference paper at ICLR 2026
n,=100, a=0
n,=100,
1.012
km3
km5
Km5
3.5
1.008
Exatt/ AAgrrokrata retoo
Porfect agrecment
Poffect agreement
1,006
AAgerox
3.0
1,002
2.0
1.000
1.5
0.
1.0
10
20
30
70
10
20
30
60
70
0 rmmbalanc ratio)
r Uimbalance ratio)
(a) 0
(b) 0.1
Figure 4: Exact/approximate hound ratios for two levels of mutuality.
m10000 a=0.5
n;=100, d-0.5
200
1.0
1.0
175
0.8
0.8
3
75-
0.4
50-
0.2
25
k-20
10
30
40
50
(a) Lower bound Lia vs. r
(b) Hcatmap of Lia over (r, k))
Figure 5: Comparison of two visualizations of the exact bound.
nt
1.0
0.8
0.6
0.4
(mutual edge probabilit)
Figure Exact bound as function for different imbalance ratios r.
Theorem (ReconSMOTE expected recall (exact)). Under Assumptions and we have
E Recall = Ej #(x; E X/haa æ; identifiable]]
2 Lid=
(3)
where Lia is defined in Equation 2
Sketch Proof. By Lemma have Pr(a, identifiable) 2 Lid for every i,
E|Recall] = n1
Pr(z, identifiable) 2 Lid-
15

---

Published as a conference paper at ICLR 2026
Dataset
DistinSMOTE
ReCOnSMOTE
(Precision)
(Recall)
(Precision)
(Recall)
higgs
25
47,976
28
1.00
0.00
1.00 = 0.00
1.00 + 0.00
1.00 0.00
miniboone
25
96,690
50
1.00 = 0.00
1.00 = 0.00
1.00 = 0.00
1.00 - 0.00
Table 5: Privacy attacks vs, augmented/synthetic data with high-dimensional data.
Dataset
n
d
DistinSMOTE (Precision)
ReconSMOTE
(num, cat)
(Recall)
(Precision)
(Recall)
cardio
25
7,256
(5, 6)
1.00 0.00
1.00 +: 0.00
1.00 + 0.00
0.98 + 0.00
churn
25
8,269
(5, 5)
1.00 + 0.00
1.00 = 0.00
1.00 + 0.00
0.98 + 0.01
Table 6: Privacy attacks vs. augmentedssyttetic data with mixed-type data.
Dataset
DistinSMOTE
ReconSMOTE
(Precision)
(Recall)
(Precision)
(Recall)
ecoli
8.6
1.00 + 0.00
1.00 + 0.00
1.00 + 0.00
0.43 + 0.06
abalone
9.7
1.00 + 0.00
1.00 + 0.00
1.00 + 0.00
0.42 0.02
car eval
12
1.00 + 0.00
1.00 = 0.00
1 0.00
0.61 0.02
folae_flare_m0
19
1.00 + 0.00
1.00 + 0.00
1.00 1 0.00
0.40 + 0.02
car_eval_4
26
1.00
0.00
1.00 0.00
1.00 0.00
0.60 + 0.00
yeast_me2
28
1.00
0.00
1.00 0.00
1.00
0.58
mammography
42
1.00
0.00
1.00 0.00
1.00 0.00
0.61 0.01
abalone_19
130
1.00 = 0.00
1. 1.00 = 0.00
1.00 + 0.00
0.49 #
average
1.00 0.00
1.00 = 0.00
1.00 + 0.00
0.52 0.02
Table Privacy attacks vs. augmentod/synthetic data by SMOTE with
B LOWER BOUNDS OF ReconSMOTE RECALL VISUALIZATIONS
To complement the theoretical results in Section 4.3 (exact bound, Lia), we visualize the bounds under different conditions.
(approximate bound, Aia) and Appendix A
We start by showing the ratio between the exact bound and the approximate bound as function of the imbalance ratio in Figure 4 When = 0 (Figure 4a)). the approximate bound closely matches the exact one for all k; especially for larger imbalance ratio. In contrast, even a small amount of mutuality (a 0.1; Figure 4b) introduces noticeable deviation of the lower bound.
Next, in Figure 5 we focus on the exact bound Lia under varying imbalance ratios r and neighborhood sizes & (with 1 100 and a = 0.5 fixed). Figure 5a shows that Lia steadily increases as the oversampling ratio r rises. For small k even a moderate oversampling ratio results significant identifiability. However, for larger k. higher oversampling ratio is required. The heatmap in illustrates this interaction. the upper-left area, where is small and r is large, Lid quickly approaches 1. This indicates almost perfect identifiability. In contrast, in the lower-right area, where & is large and r is small, Lia is close to zero. This suggests that the reconstructed edges are not dense enough reach high identifiability. Overall, these plots confirm the trade-off: identifiability improves with oversampling, but its efficiency depends strongly on the neighborhood parameter k.
Finally, Figure presents the exact bound Lid as function of a for several imbalance ratios r. The curves illustrate the sensitivity of Lid to the graph structure. For example, when r 10, small increases in a would lead to substantial changes in Lid, highlighting how mutuality in the KNN graph strongly influences privacy leakage.
C DistinSMOTE AND ReconSMOTE WITH RELAXED ASSUMPTIONS
In this section, we present results for our attacks under relaxed assumptions on high- siggh-immessonal data (T) mixed-type data (Table (b). SMOTE with A = 2 (Table (7). and perturbed data (Table 2 For the first two experiments, we use datasets different from the eight main datasets in Table Namely, we use higgs and miniboone from OpenML (Vanschoren et al. 2014] as high nigh-dimensional data, and cardio and chur from Kaggle as mixed-type data. These datasets used in relevant prior work (Kotelnikov et al. 2023). For datasets, the minority class is undersampled so the imbalance is 25. The results of the first three experiments are discussed in Section 6
16

---

Published as a conference paper at ICLR 2026
DistinSMOTE
SMOTE augmented data w/ noise per column (Prec./Rec.)
noise 10 10
noise
10-
noise
10-
noise = 10
tol. = 10
0.96
1.00
0.88
1.00
0.04
1.00
0.04
1.00
tol. 10
0.91
0.99
0.91
0.99
0.07
1.00
0.04
1.00
tol. = 10-6
0,41
0.80
0.37
0.78
0.07
0.93
0.04
0,92
tol. 10
0.09
0.31
0.09
0.31
0.06
0.82
0.06
0.80
Table 8: DistinSMOTE perturbed augmented data, on yeast.me2.
ReconSMOTE
SMOTE synthetic data w/ noise per column (Prec./Rec.)
noise = 10
10
noise
10
noise = 10
noise 10
tol. = 10 10
1.00
1.00
0.86
0.96
0.00
0.00
0.00
0.00
tol. 10-7
1.00
1.00
0.96
1.00
0.00
0.00
0.00
0.00
tol. 10
0.99
0.97
0.85
0.84
0.71
0.10
0.00
0.00
tol. 10
0.63
0.61
0.55
0.53
0.10
0.09
0.00
0.00
Table 9: ReconSMOTE perturbed synthetic data, on yeast me2.
Next, we discuss the results of the forth experiment running our attacks on perturbed SMOTE data.
SMOTE with Perturbed Linear Interpolation. We test the robustness of our attacks on perturbed data by adding column- wise noise in the range {10-10, 10-7 10-5, 10-3) ensuring that no synthetic record lies exactly on the line between its generating real records (see Table and ( Similarly, we use tolerance levels in the same range for detecting lines/intersections within our attacks. We use the yeast_met dataset from our main experiments (Table 2
Perhaps surprisingly, both DistinsMOTE and ReconSMoTE remain highly effective when the added noise is small (< 10-"), achieving near-perfect performance. This shows that our attacks can generalize to SMOTE variants that use non-strictly linear interpolation. However, the performance of both attacks drops sharply when larger noise is injected though such noise levels would likely degrade downstream utility as well. Across all noise settings, we observe a consistent trend: for each noise level, both attacks achieve their best precision (the more important metric, already discussed) when the tolerance parameter matches the injected noise level.
Finally, we relax another assumption runniin our attacks without prior knowledge of k and r.
SMOTE with Unknown i: and r. We describe heuristics for running DistinSMOTE and ReconSMOTE without knowing SMOTE's parameters i and In practice, precise estimates unnecessary: the neighborhood search only needs to be wide enough to include the real records that generated a given (synthetic) record. Overestimating Thus, simple strategy would be to skip parameter estimation altogether and simply use a large neighborhood search (e.g., 10-25% of the dataset).
does not reduce precision/recall, it only increases runtime.
To estimate & or more accurately, the adversary can reuse the same sub- uub-procedures employed in the attacks. For given record, large neighborhood search (e.g.. 10-25% of the dataset) identifies all neighbors on the same line. For augmented data, the adversary can locate an endpoint (a real record), run a second search around it, and infer: the number of lines pointing to this record (an overestimate of k). and ii) the number of records per line (a rough approximation of r r/k). For synthetic data, the adversary can instead detect three intersecting lines around the record, identify their intersection (a real record), and proceed as above. Repeating this procedure and averaging yields stable estimates.
17


Reviews:
[{"review_id": "jNU3K99WKf", "reviewer": "Reviewer_G3wE", "summary": "This paper presents a systematic privacy analysis of SMOTE (Synthetic Minority Oversampling Technique), one of the most widely used methods for addressing class imbalance in machine learning. The authors show that existing privacy evaluation metrics, including naive classifiers and DCR, completely fail to detect leakage. While standard membership inference attacks achieve a high success rate against SMOTE-generated data, they still substantially underestimate the true extent of privacy leakage. They further introduce two novel geometry-based attacks: DistinSMOTE, which perfectly distinguishes real minority records from synthetic ones in augmented datasets, and ReconSMOTE, which reconstructs the original minority records from only the synthetic data with theoretically perfect precision and high recall. Supported by formal proofs, theoretical bounds, and experiments on eight benchmark datasets, the paper concludes that SMOTE is inherently non-private, exposing the very minority individuals it aims to protect, and calls for a reevaluation of its use in privacy-sensitive applications.", "questions": "- Given that many real-world datasets are mixed-type, do you believe these attacks constitute a realistic privacy threat, or mainly a theoretical warning?\n- The paragraph describing the assumptions of adversary model is inconsistent (Section 4.1). It first states that the adversary can approximate (k) and (r) from the released dataset, but then claims that no access to public data or published aggregate statistics is required.\n- The table reference in line 97 is incorrect; it should refer to Table 2, not Table 1.\n- Please also address my concerns raised in the weaknesses section, as resolving them could lead me to raise my score.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The paper tackles an important and long-overlooked issue in synthetic data privacy by revealing that SMOTE’s interpolation mechanism can inherently leak information about real minority records. This problem is well-motivated, timely, and relevant to both theoretical and applied ML communities.\n- The paper is clearly written and visually well-presented. The pseudocode, figures, and tables effectively communicate both the attack logic and empirical findings, making the complex geometric reasoning easy to follow.\n- The proposed attacks are original and analytically grounded rather than heuristic. DistinSMOTE and ReconSMOTE exploit the geometric structure of SMOTE in a principled way, offering both theoretical depth and conceptual elegance.\n- The experimental results, though limited in data complexity, convincingly demonstrate that existing privacy metrics underestimate leakage while the proposed methods reveal substantial vulnerabilities. This provides strong empirical support for the paper’s central claim.", "weaknesses": "- The three core assumptions of this work are too idealized to hold in most real-world settings. Most real datasets (especially in medicine or finance) contain categorical or mixed-type features, violating Assumption 1. Even in continuous data, collinearity or near-collinearity often occurs due to correlated features or duplicated records, which could break Assumption 2.\n\n- Theorem 3’s recall bound relies on overly idealized assumptions of independence and uniform sampling that do not hold in real SMOTE graphs, where neighbor relationships overlap and edges share endpoints. The uniform segment probability ignores heterogeneous data densities, and in high-dimensional spaces, line intersections are rarely exact and must rely on numerical thresholds that introduce errors. As a result, the bound offers useful intuition but overestimates recall under realistic, dependent, and noisy conditions.\n\n- No experiments show how the attacks behave when collinearity, floating-point noise, or categorical features are introduced.\n\n- The datasets used in the experiments are relatively simple and do not fully reflect the complexity or real-world settings of the SMOTE applications discussed in the introduction.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "jZMusqojm7", "reviewer": "Reviewer_cZmi", "summary": "The paper studies the privacy vulnerability of SMOTE, a technique for augmenting imbalanced data or generating synthetic data. The paper presents two attacks against SMOTE that exploit the fact that SMOTE generates new points by interpolating real points. The first can perfectly distinguish SMOTE-generated datapoints from real datapoints in an augmented dataset under suitable assumptions. The second reconstructs real points from SMOTE-generated data. Both attacks are empirically evaluated and compared with existing MIAs and distance-based attacks. Both attacks have extremely high accuracy, while the baselines do not.", "questions": "- Lines 181-182: how can the number of neighbours and imbalance ratio be approximated?\n- Would setting $k = 2$ be an effective defence against the attacks?\n- Do the attacks work if applied against one-hot encoded categorical data? Does SMOTE even make sense in this case?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 4, "contribution": 4, "strengths": "The paper clearly shows that SMOTE is not suitable to any privacy-sensitive application, whereas previous evaluations, especially distance-based ones, are less convincing. The writing of the paper is good, and the principles of the attacks are explained clearly.\n\nWhile SMOTE is not considered a serious synthetic data generation method in the machine learning community, the citations in the paper show that SMOTE is seriously considered in other important research communities. The results of the paper show that it should not be. The new attacks are so accurate that releasing SMOTE-generated synthetic data is not far from releasing real data, and if releasing real data is acceptable, generating synthetic data does not make sense.\n\nThe results also demonstrate a flaw in most empirical privacy evaluations. Typical evaluations only use generic metrics like DCR or attacks like MIAs that can be applied to many methods without modifications. However, these do not rule out the possibility that an attack targeted at a specific method could lead to a much higher privacy loss than suggested by generic metrics, which is what this paper shows for SMOTE.\n\nIn summary, though the scope of the paper is limited to SMOTE, there are enough wider implications in the work to warrant publication in ICLR once some technical issues with the theory (described below) are resolved.", "weaknesses": "There are some incorrect technicalities in Theorems 1 and 2. For Theorem 1, it is possible that a SMOTE-generated point happens to be collinear with two real points other than the points it was interpolated from. In this case, one of the unrelated real points could be the midpoint of the line between the three, and it would be classified as a synthetic point, while the generated points would be classified as real. \n\nTheorem 2 has a similar issue: it is possible that three generated points from different real points just happen to be collinear. If that happens multiple times, ReconSMOTE could reconstruct points that are not real. Also in Theorem 2, global collinearity does not guarantee that any intersection of more than three lines is a real point. It is possible to draw three lines intersecting at one point, and pick 2 points from each line to be real points, such that no three of the 6 real points are collinear. \n\nHowever, all of these issues are very unlikely to happen in practice, so they can likely be fixed by adding some reasonable assumption. For example, I would not be surprised if the probability of these happening is 0 when the real datapoints are sampled from a continuous distribution in $d$-dimensions.\n\nIn addition, the proofs of Theorems 1 and 2 should show that looking at a subset of nearest neighbours of a point is sufficient instead of looking at all points (line 9 in Algorithm 1 and line 8 in Algorithm 2).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "lI82JmgvwY", "reviewer": "Reviewer_grKo", "summary": "The paper investigates the empirical privacy of the widely used data augmentation/synthetic data generation method, SMOTE. They argue that common empirical privacy mettrics such as DCR severely underestimate privacy leakage of SMOTE and introduce two new attacks that exploit SMOTES geometric interpolation to perfectly distinguish real from synthetic samples and reconstruct minority records from synthetic data. These attacks have almost perfect recall on a number of benchmark datasets highlighting the privacy problems of relying on SMOTE in sensitive domains.", "questions": "1. I don’t believe the main finding, that SMOTE is non-private is particularly novel/insightful. It seems well known that SMOTE is not (empirically) private as shown by a number of DCR results in the line of literature on tabular diffusion models such as [2,3] which already note SMOTEs poor privacy characteristics. Therefore the central claim of the paper is that these DCR results \"underestimate\" the true privacy leakage which again is not a new insight i.e, it is shown in [4]. Can the authors expand on why their work is novel?\n2. The claim that “SMOTE remains one of the most widely applied algorithms for medical synthetic data” seems overstated. Kaabachi et al. (2025) report SMOTE as only a small fraction of methods used, with GAN-based approaches dominating. I find it hard to believe the motivation for this paper i.e., 1) SMOTE is used a lot in practice for privacy-sensitive synthetic data and 2) is claimed as a ‘privacy preserving' method.\n3. Wouldn’t adding a small amount of noise to the synthetic point generated from SMOTE hinder your proposed attack since the synthetic points will no longer be collinear? The paper should include more results using naive defenses such as this to show it is robust.\n4. The datasets used are small-scale in both the number of rows and columns. Can you discuss the the computational scalability for larger, high-dimensional datasets?\n5. How realistic is the assumption that k >= 3 for low-dimensional datasets like Abalone where d=6?\n\n[1] Kaabachi, Bayrem, et al. \"A scoping review of privacy and utility metrics in medical synthetic data.\" *NPJ digital medicine* 8.1 (2025): 60.\n\n[2] Kotelnikov, Akim, et al. \"Tabddpm: Modelling tabular data with diffusion models.\" *International conference on machine learning*. PMLR, 2023.\n\n[3] Zhang, Hengrui, et al. \"Mixed-type tabular data synthesis with score-based diffusion in latent space.\" arXiv preprint arXiv:2310.09656 (2023).\n\n[4] Ganev, Georgi, and Emiliano De Cristofaro. \"On the Inadequacy of Similarity-based Privacy Metrics: Reconstruction Attacks against``Truly Anonymous Synthetic Data''.\" (2023).", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 2, "strengths": "- The paper is clearly and concisely written, making it easy to follow.\n- The proposed attacks have strong empirical results across a range of benchmark datasets and attack settings.\n- The proposed attack, is as far as I am aware novel in the sense of exploiting SMOTEs interpolation algorithm with the added benefit that it is relatively “lightweight” as it avoids the use of shadow models.", "weaknesses": "- The main contribution -- that SMOTE leaks information and is non-private, is not conceptually new. Most practitioners already recognize that SMOTE, based on linear interpolation, offers no privacy guarantees and a long-line of work in tabular diffusion models (which is cited by this paper) even shows this empirically via DCR.\n- The paper stops short of offering mitigation strategies of SMOTE, beyond briefly mentioning differential privacy approaches as future work.\n- The framing (“SMOTE is inherently non-private”) overemphasizes a result that, while empirically validated, is expected and offers modest new understanding to the synthetic data community without suggesting defenses.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "vGReTa6Ukq", "reviewer": "Reviewer_Jfyn", "summary": "The authors study the privacy leakage of SMOTE in the cases of data augmentation on imbalanced datasets with minority classes, and synthetic data generation. They propose two privacy attacks DistinSMOTE and ReconSMOTE, both achieving perfect precision while naive methods completely fail to detect any privacy leakage. The authors also claim to be the first to run a membership inference attack (MIA) against SMOTE. The state-of-the-art MIAs achieve high AUC, especially in the synthetic data generation case, which provides further evidence that SMOTE is fundamentally non-private.", "questions": "* Wouldn't the proof of Theorem 2 also require Assumption 4 (which is found in appendix A) to support the claim \"the only point lying on three or more such lines is the shared real endpoint.\"?\n* It can be stated more clearly in both the statement and proof of Theorem 3, that the segments/edges are directed, which is required for computing the probabilities.\n* In Theorems 3 and 4, the proofs rely on the conclusion that each $C_{i j}$ is distributed according to the binomial distribution. This skips a step in the proof that the vector of all $C_{i j}$ has a multinomial distribution with $\\sum_{i j} C_{i j} = n_0 - n_1$ which is exactly the number of synthesized points, and then we can conclude that $C_{i j}$ are marginally binomial.\n* The proofs can be made stronger and more formal if they were based on the steps of the algorithms.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "* The paper studies an important problem, namely the privacy leakage of SMOTE.\n* The paper proposes two privacy attacks DistinSMOTE (Algorithm 2) and ReconSMOTE (Algorithm 3) for the cases of data augmentation and synthetic data generation, respectively. \n* The strength of the proposed privacy attacks are supported by both theoretical results (Theorems 1 - 4) and empirical evidence (Section 4).", "weaknesses": "* The proofs can be written more clearly and carefully. There are some gaps in the proofs and they are somewhat informal. \n* There are no correctness proofs for algorithms (2 & 3), and the proofs of the theorems (1 - 4) are not based on the steps of algorithms (2 & 3).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)