disclosure_risk: Disclosure risk of synthetic microdata

In SynthesizerPlus: Synthetic Data Generation with Copulas, Evaluation and Multi-Format I/O

Disclosure risk of synthetic microdata

Description

Measures the two classical disclosure risks of a synthetic version of confidential microdata (census, survey, register data), from the point of view of an intruder who knows the key variables (quasi-identifiers such as age, sex and region) of a person in the real data.

• Identity disclosure – replicated uniques. Records whose combination of key variables is unique in the real data are the most exposed. The share of these real uniques whose key combination also occurs exactly once in the synthetic data (replicated_uniques, Nowok, Raab and Dibben, 2016) indicates how many synthetic records could be taken for a real, identifiable person.

• Attribute disclosure – correct attribution probability (CAP). For every real record, the intruder looks up the synthetic records with the same key values and predicts each target (sensitive) variable: the most frequent category, or the median for numeric targets. cap is the share of real records for which the prediction is correct (numeric targets: within tolerance relative error or abs_tolerance absolute error), among those with at least one matching synthetic record. cap_baseline is the same share when the intruder ignores the synthetic data and predicts the overall mode or median; cap_uniques restricts the CAP to real uniques. A CAP close to the baseline means that the synthetic data reveal little beyond what is known from population-level statistics (Taub et al., 2018).

Numeric key variables are matched exactly; coarsen them first (e.g. age in years or 5-year bands) if they are continuous.

Usage

disclosure_risk(
  real,
  synthetic,
  keys,
  target = NULL,
  ignore = NULL,
  tolerance = 0.1,
  abs_tolerance = 0
)

Arguments

real, synthetic	Data frames with the key and target variables.
keys	Character vector of key variables (quasi-identifiers).
target	Character vector of sensitive variables for attribute disclosure (optional).
ignore	Optional columns to leave out entirely, typically direct identifiers (which differ between real and synthetic files and would otherwise hide exact copies).
tolerance	Relative tolerance for a correct prediction of numeric targets (default 0.1, i.e. 10 percent).
abs_tolerance	Absolute tolerance for numeric targets (default 0). A prediction is correct if |\hat y - y| \le \max(\mathrm{tolerance} \cdot |y|, \mathrm{abs\_tolerance}). A purely relative tolerance is (essentially) zero for a true value of 0, so use abs_tolerance for targets with meaningful zeros (e.g. income of non-earners), in the units of the target.

Value

An object of class sp_disclosure with elements replicated_uniques, real_unique_rate (share of real records that are unique on the keys), exact_copies (share of synthetic records that are identical to some real record on all common variables except ignore) and a data frame attribute with, per target, match_rate, cap, cap_baseline and cap_uniques.

References

Nowok, B., Raab, G. M. and Dibben, C. (2016). synthpop: Bespoke creation of synthetic data in R. Journal of Statistical Software, 74(11), 1–26. \Sexpr[results=rd]{tools:::Rd_expr_doi("10.18637/jss.v074.i11")}

Taub, J., Elliot, M., Pampaka, M. and Smith, D. (2018). Differential correct attribution probability for synthetic data: an exploration. In Privacy in Statistical Databases, LNCS 11126, 122–137. Springer. \Sexpr[results=rd]{tools:::Rd_expr_doi("10.1007/978-3-319-99771-1_9")}

Examples

syn <- synthesize(mtcars, seed = 1)
disclosure_risk(mtcars, syn, keys = c("cyl", "gear", "am"), target = "mpg")

# census-like microdata with a direct identifier
fit <- fit_synthesizer(census_sim, id_cols = "person_id", by = "employment")
syn <- generate(fit, seed = 1)
disclosure_risk(census_sim, syn, keys = c("age", "sex", "region"),
                target = c("income", "education"), ignore = "person_id")

SynthesizerPlus documentation built on Oct. 16, 2026, 5:10 p.m.