Synthetic data re-identification — de-anonymized patients from synthetic health records
Date: 2025-03
Affected: Healthcare organizations using synthetic data for AI training and analytics; any organization assuming synthetic data is privacy-safe without formal guarantees (differential privacy, k-anonymity verification)
Attack vector: membership-inference
Category: research-demonstrated
Severity: High

Researchers demonstrated that synthetic health records generated by state-of-the-art generative models (including fine-tuned LLMs and GANs) could be linked back to real patients in the original training dataset. Using membership inference attacks combined with auxiliary public data (voter rolls, social media), the researchers re-identified 23% of individuals whose data was in the synthetic dataset's training set. The attack exploits the fact that generative models memorize and reproduce statistical patterns from training data, and when the training data contains rare attribute combinations (e.g., rare disease + age + zip code), the synthetic data preserves these identifying patterns. The finding challenges the widespread assumption that synthetic data is inherently privacy-safe.

Impact: 23% re-identification rate destroys the assumption that synthetic data is inherently anonymous; HIPAA/GDPR exposure for healthcare organizations; synthetic data must be treated as pseudonymous, not anonymous, unless formal privacy guarantees are verified

Mitigations:
Differential privacy guarantees during synthetic data generation (not just utility metrics)
Re-identification risk testing before any synthetic data release
Rare attribute suppression: remove or generalize combinations with <5 occurrences in training data
Formal privacy audit: k-anonymity / l-diversity / t-closeness verification on synthetic output

Architectural layers (MAESTRO):
label: Data Operations
notes: Synthetic data generation preserves identifying patterns from training data
role: origin
label: Foundation Models
notes: Model memorization enables re-identification via membership inference
role: propagation
label: Evaluation & Observability
notes: Synthetic data privacy evaluation did not test for re-identification attacks
role: blind-spot
label: Security & Compliance
notes: Privacy compliance assumed synthetic = anonymous — no formal privacy guarantee verified
role: blind-spot