Pith. sign in

REVIEW 4 major objections 7 minor 52 references

The paper claims that no single membership-inference attack is reliably dominant against tabular generative models, and that ensembling attacks is the safer strategy for an adversary facing an unknown generator and dataset.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

No single membership inference attack dominates across tabular generative models, and unsupervised ensembles of attacks achieve better average rankings.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection Solid empirical case that no single MIA dominates and ensembling helps; internal claims hold, but external validity is unproven and the weighted-mean ensemble is test-set fitted. the 4 major comments →

arxiv 2509.05350 v1 pith:HOQXQGWI submitted 2025-09-02 cs.CR cs.LG

Ensembling Membership Inference Attacks Against Tabular Generative Models

Joshua Ward , Yuxuan Yang , Chi-Hua Wang , Guang Cheng This is my paper
classification cs.CR cs.LG
keywords membership inference attackssynthetic tabular datagenerative modelsprivacy auditingensemble methodsregret minimizationdecision theorybenchmark evaluation
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks a practical question: if an adversary must pick one membership-inference attack to audit a synthetic tabular dataset of unknown provenance, which attack should they choose? Running a large benchmark of 9 tabular generators, 57 datasets, and 5 seeds, it finds that no single attack is best across the board; even the top individual attack is only the strongest in about 16% of states. The paper then shows that simple ensembles of attacks—averaging scores, weighted averaging, or majority voting—consistently rank higher on average and avoid the worst failures of any single method. The core message is that an adversary who must commit before seeing the target minimizes regret by combining attacks rather than trusting one.

Core claim

Under a no-box threat model where the adversary sees only the released synthetic table plus a reference dataset, the paper constructs 2,565 (generator, seed, dataset) states and evaluates eight membership-inference attacks. It finds no strictly dominant strategy: the best individual attack, a local-density plagiarism measure, is top-ranked in at most 16.2% (AUC) and 19.1% (TPR@FPR=0.1) of states, and attack scores are only weakly correlated with frequent disagreements. Repeating the benchmark with three unsupervised ensembles, it finds that weighted-mean and majority-vote ensembles achieve significantly better mean ranks (e.g., 3.68 versus 5.46 for AUC) and higher top-3 proportions than ever

What carries the argument

The argument rests on four pieces: (1) the state space Ω of (generator, seed, dataset) triples, treated as a decision problem where the adversary must commit to an attack before knowing the state; (2) mean relative rank as the payoff measure, which rewards consistent near-top performance over occasional best performance; (3) three unsupervised score-aggregation rules—arithmetic mean, weighted mean with weights set by benchmark win rates, and majority voting over median-thresholded binary decisions; and (4) leave-one-out marginal contribution, which ranks how much each attack improves the ensemble when removed. The underlying mechanism is signal diversity: because attacks exploit different le

Load-bearing premise

The benchmark's 9 generators with default settings and 57 datasets must represent the situations a real adversary actually faces; if real deployments concentrate in a regime where one generator type and one attack dominate, the ensemble's regret advantage may not transfer.

What would settle it

Run the same attack-versus-ensemble comparison on a fresh, non-overlapping collection of tabular generators and datasets, including high-dimensional datasets with more than 100 columns (which the current study excluded). If any single attack, such as the local-density plagiarism measure, achieves a better mean rank than all three ensembles on AUC, or is top-ranked in a majority of states, the paper's central claims fail for that domain.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Privacy auditors should deploy ensembles of attacks rather than relying on any single method, since every individual attack is empirically best in only a small fraction of states.
  • Ensemble attacks provide a more realistic threat model for defenders: an adversary does not need to know which attack will be optimal, only that averaging a few diverse attacks will perform well on average.
  • New membership-inference attacks should be evaluated by how much diversity they add to an ensemble, not only by their standalone accuracy; individually weak but uncorrelated attacks can be more valuable than the individually best attack.
  • Ensemble performance improves as attacks are added up to roughly 7–11 diverse configurations, then plateaus, so a modest portfolio of diverse attacks is sufficient.
  • Any future attack that is approximately orthogonal to existing ones has the potential to improve ensemble-based privacy auditing even without achieving state-of-the-art individual performance.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Inference: The no-dominance result is inherently tied to this benchmark's composition; if a real deployment concentrates on one generator family (e.g., mostly diffusion models), a single attack that does well on that family could dominate in practice, so the ensemble's advantage is conditional on deployment diversity.
  • Inference: The leave-one-out findings suggest a constructive research direction: design new attacks explicitly to minimize pairwise correlation with existing attacks, rather than to maximize standalone AUC, as such attacks would boost ensemble performance even if they never win individually.
  • Inference: Because ensemble attacks are stronger than any single attack, defenders should assess worst-case privacy leakage against an ensemble adversary; this raises the practical bar for what counts as safe synthetic data release and strengthens the case for differentially private generation.
  • Inference: The ensembling logic likely transfers to membership-inference auditing of non-tabular generators (images, text), where attacks also exploit diverse signals, though the paper only benchmarks tabular data.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper studies the choice of a membership-inference attack (MIA) against tabular generative models as a decision problem under uncertainty. The authors construct a benchmark of 9 generative models (mostly via Synthcity with default hyperparameters), 57 OpenML-CC18 datasets (restricted to ≤100 columns), and 5 seeds, and evaluate 8 no-box attacks by AUC and TPR at fixed FPR. They report that no attack is strictly dominant, with the best individual attack (DPI) being the top performer in only 16.2% of states. They then propose three unsupervised ensembles—mean, weighted mean, and majority voting—and show that these achieve better mean ranks and higher top-3 proportions than any individual attack. A leave-one-out analysis claims that individually weaker attacks often contribute more to ensemble performance, and a scaling experiment shows gains from around 7 attacks with diminishing returns after roughly 11.

Significance. If the results hold, the paper provides the largest public benchmark of MIA performance for tabular generators, with 2565 (model, dataset, seed) states, open-source code, and a sensible shift from dataset-conditional means to rank-based evaluation. The negative finding that no single attack dominates is an informative empirical result, and the observation that low-performing, uncorrelated attacks can improve ensembles is a useful direction for attack design. The paper's practical recommendation to deploy attack portfolios is valuable for auditors. However, the strength of the ensemble conclusion is currently limited by three issues: the weighted-mean ensemble is tuned on the same benchmark used for evaluation, the raw-score averaging is not scale-invariant, and the 'regret-minimizing' terminology is not backed by an actual regret calculation. These are addressable in revision.

major comments (4)
  1. [§4.2, Table 2, Figure 1] The Weighted Mean Ensemble assigns weights 'based on Figure 1', i.e., the proportion of states in the same benchmark Ω where each attack had the highest AUC. The headline result in Table 2 (mean rank 3.683 for weighted-mean AUC vs. 5.455 for DPI) is therefore an in-sample evaluation of a method whose weights were chosen using the labels of that exact evaluation set. While an adversary may legitimately use public benchmark results as a prior, the comparison is not a fair out-of-sample assessment and the label 'unsupervised' is misleading. Please either (i) learn weights on a disjoint split of Ω (by seed or dataset) and evaluate on the held-out split, or (ii) clearly report the weighted-mean ensemble as a benchmark-fitted reference and base the central claim on the mean and majority-voting ensembles.
  2. [§4.2, §5.1] Mean and Weighted Mean sum raw attack scores s_i^a. The constituent attacks have incompatible scales: DCR/DCR-Diff produce negative distances, DOMIAS and Gen-LRA produce density/likelihood ratios, DPI produces a KNN ratio, LOGAN produces a discriminator probability, and MC produces a 0/1 count. Without per-attack normalization (e.g., rank or z-score within the query set), the average can be dominated by the attack with the largest numerical range. The manuscript notes sensitivity to outliers but provides no normalized baselines. Since the central claim is that ensembles improve over individual attacks, please add normalized variants and report whether the rank improvements in Table 2 persist.
  3. [§3.1, §5.1] The paper frames the problem as regret minimization but measures mean rank and top-3 proportion. Regret in the stated decision-theoretic setup is R(A,ω)=max_i u(A_i,ω)-u(A,ω), and expected regret under a uniform prior is the average of these payoff differences. Mean rank is not the same quantity unless payoffs are linearly related to ranks, and it says nothing about worst-case regret. In fact, Table 2 shows that ensembles have lower PBest than some individual attacks, so a minimax-regret claim is not supported. Please either compute expected/worst-case regret in AUC/TPR units or replace 'regret-minimizing' with 'average-rank-improving' throughout the abstract and conclusions.
  4. [§3.2, §6.1] The state space is restricted to 57 OpenML-CC18 datasets with at most 100 columns, with generators trained using default hyperparameters. Section 6.1 extends the conclusions to practical deployment, stating that ensemble attacks are 'a more realistic and immediate threat model' and that practitioners should prefer attack portfolios. These recommendations require evidence that the benchmark is representative of deployment regimes (e.g., high-dimensional tabular data, tuned generators, non-OpenML distributions). The paper provides no sensitivity analysis or external validation. Please add a limitations paragraph that scopes the claims to the evaluated benchmark, or provide additional experiments on the excluded high-dimensional datasets/tuned models.
minor comments (7)
  1. [§5.2, Table 3] The sentence beginning 'For each MIA, we compute While DPI...' is garbled; the contribution metric is undefined. Please clarify whether the values are mean ranks of leave-one-out contributions, and define how 'rank contribution' is computed exactly.
  2. [Table 2 caption] The caption says 'For each synthetic dataset we report...' but rows are methods; specify the aggregation unit (e.g., states, datasets) and whether standard errors are across states or seeds.
  3. [Figure 4 and §5.1] The text states a mean rank improvement of 3.39 for AUC; the figure caption reports 3.15 for TPR@FPR=0.1. Clarify which number corresponds to which metric and report all.
  4. [§2.4] The equation for DCR-Diff incorrectly uses fDCR for both DCR and DCR-Diff; use distinct notation.
  5. [§3.2] The claim 'largest tabular synthetic data privacy experiment to date' should be supported by a brief comparison to prior benchmark sizes, or softened.
  6. [Figures 2-3] Correlation/disagreement heatmaps are shown for a single state (Credit, TabSyn); the text uses them to support general diversity. It would be helpful to state that these are representative and report summary statistics across states.
  7. [§6.2] Typo: 'substantially enhances overall ensemble effectiveness' should be 'enhance'.

Circularity Check

1 steps flagged

Benchmark is largely self-contained; the one partial circularity is the weighted-mean ensemble, whose weights are taken from the same benchmark used for evaluation, but the core ensemble finding also holds for unweighted variants.

specific steps
  1. fitted input called prediction [Section 4.2 (Weighted Mean Ensemble), evaluated in Section 5.1 / Table 2]
    "Here, we assign a weight vector based on Figure 1 where each attack is given a weighting based on the proportion of states that attack achieved the best AUC as given these experiments are public and adversary could now use this information as some set of priors."

    The weights w_a are the empirical proportions of benchmark states where each attack achieved the best AUC, computed over the same 9-generator, 57-dataset, 5-seed state space Ω that is later used for evaluation. Table 2 then reports the Weighted Mean Ensemble's mean rank on that same Ω. The weighted ensemble's leading mean rank (3.683 vs. 5.455 for DPI) is therefore partly an in-sample fit: the weighting vector is a summary of the very evaluation outcomes being measured, not an independent or out-of-sample choice. This is narrow circularity, not the whole derivation: the unweighted Mean Ensemble (4.303) and Majority Voting Ensemble (3.706) also beat every individual attack on AUC mean rank, so the central ensemble claim does not depend on the fitted weights.

full rationale

This is an empirical benchmarking paper, not a formal derivation, and most of its load-bearing claims are self-contained against the constructed benchmark. The 'no strictly dominant attack' conclusion is a direct empirical finding over the state space defined in Section 3.2; it is not equivalent to its inputs by construction, even though the benchmark's representativeness is an external-validity question rather than a circularity. The attacks DPI and Gen-LRA are prior self-authored works, but they appear as benchmark entries being compared, not as justifications for the paper's central premise, so this self-citation is not load-bearing. The only concrete circular element is the Weighted Mean Ensemble: its weights are derived from Figure 1, which summarizes exactly the same benchmark runs on which Table 2 evaluates the ensemble. Thus the weighted ensemble's advantage is partly a retrodiction of the benchmark's own outcomes. However, the paper's main ensemble claim survives without this variant because the unweighted Mean and Majority Voting ensembles also achieve better mean ranks than every individual attack across the reported metrics. No uniqueness theorem is imported from the authors, no ansatz is smuggled in via self-citation, and no known result is merely renamed. On balance, the weighted-mean step is a partial in-sample fitting, but the central conclusions have independent empirical content, warranting a moderate score rather than a higher circularity finding.

Axiom & Free-Parameter Ledger

2 free parameters · 4 axioms · 0 invented entities

The paper introduces no new entities. Its free parameters are limited to ensemble-specific tuning (weighted mean weights derived from the benchmark, majority vote median thresholds). The main axioms are the threat model choice and the representativeness of the benchmark corpus, which are standard domain assumptions rather than ad hoc constructions.

free parameters (2)
  • Weighted-mean ensemble weights = proportion of states each attack achieved best AUC (Figure 1)
    Set from the benchmark itself in Section 4.2, used only for the weighted mean ensemble.
  • Majority vote thresholds = per-attack median score
    Heuristic threshold chosen by hand in Section 4.2; affects voting decisions.
axioms (4)
  • domain assumption No-box threat model is the relevant evaluation setting
    Section 2.3 argues black-box and shadow-box attacks are trivially defeated by not releasing model details. The paper's conclusions are bounded by this assumption.
  • domain assumption Reference dataset R is sampled from the same population as the training set
    Stated in Section 2.3 and used by all calibrated attacks. If the adversary only has an approximate reference, attack rankings could change.
  • domain assumption OpenML-CC18 datasets and the 9 chosen generators represent the tabular synthesis deployment space
    Section 3.2 constructs the state space from these; the no-dominant-strategy conclusion is an empirical statement about this corpus.
  • domain assumption Fixed 80:20 train/test split with 5 seeds is sufficient to characterize model behavior
    Section 3.2 follows prior recommendations [12] but the seed count is small.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Ensembling Membership Inference Attacks Against Tabular Generative Models." pith.science (2026). https://pith.science/paper/HOQXQGWI

@misc{pith2026250905350,
  author       = {Pith},
  title        = {Pith review of: Ensembling Membership Inference Attacks Against Tabular Generative Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HOQXQGWI}},
  note         = {Machine review of arXiv:2509.05350}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Membership Inference Attacks (MIAs) have emerged as a principled framework for auditing the privacy of synthetic data generated by tabular generative models, where many diverse methods have been proposed that each exploit different privacy leakage signals. However, in realistic threat scenarios, an adversary must choose a single method without a priori guarantee that it will be the empirically highest performing option. We study this challenge as a decision theoretic problem under uncertainty and conduct the largest synthetic data privacy benchmark to date. Here, we find that no MIA constitutes a strictly dominant strategy across a wide variety of model architectures and dataset domains under our threat model. Motivated by these findings, we propose ensemble MIAs and show that unsupervised ensembles built on individual attacks offer empirically more robust, regret-minimizing strategies than individual attacks.

Figures

Figures reproduced from arXiv: 2509.05350 by Chi-Hua Wang, Guang Cheng, Joshua Ward, Yuxuan Yang.

Figure 1
Figure 1. Figure 1: Proportion of instances each MIA had the highest AUC of all other attacks across all generative models, datasets, and [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Mean correlations of various MIAs across datasets [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 4
Figure 4. Figure 4: Advantage distributions for various success metrics. In the absence of a dominant strategy, we compare a random [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Mean AUC and TPR@FPR=0.1 for Majority Voting as ensemble size grows. We find that ensembles see improvement at [PITH_FULL_IMAGE:figures/full_fig_p009_5.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

52 extracted references · 28 canonical work pages · 4 internal anchors

  1. [1]

    Meenatchi Sundaram Muthu Selva Annamalai, Borja Balle, Jamie Hayes, Georgios Kaissis, and Emiliano De Cristofaro. 2025. The Hitchhiker’s Guide to Efficient, End-to-End, and Tight DP Auditing. arXiv:2506.16666 [cs.CR] https://arxiv.org/ abs/2506.16666

    arXiv 2025

  2. [2]

    Mantovani, Jan N

    Bernd Bischl, Giuseppe Casalicchio, Matthias Feurer, Frank Hutter, Michel Lang, Rafael G. Mantovani, Jan N. van Rijn, and Joaquin Vanschoren. 2019. OpenML Benchmarking Suites

    work page 2019

  3. [3]

    Vadim Borisov, Kathrin Seßler, Tobias Leemann, Martin Pawelczyk, and Gjergji Kasneci. 2023. Language Models are Realistic Tabular Data Generators. arXiv:2210.06280 [cs.LG] https://arxiv.org/abs/2210.06280

    Pith/arXiv arXiv 2023

  4. [4]

    Terzis, and Florian Tramèr

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, A. Terzis, and Florian Tramèr. 2021. Membership Inference Attacks From First Principles. , 1897- 1914 pages. https://api.semanticscholar.org/CorpusID:244920593

    2021

  5. [5]

    Dingfan Chen, Ning Yu, Yang Zhang, and Mario Fritz. 2020. GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Models. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Com- munications Security (CCS ’20) . ACM, Virtual Event, USA, 343–362. https: //doi.org/10.1145/3372297.3417238

    arXiv 2020

  6. [6]

    Cheung, Hobie H.-B

    Jackie C.K. Cheung, Hobie H.-B. Lee, Xiaodan Zhu, Behzad Shayegh, and Lili Mou. 2025. Error Diversity Matters: An Error-Resistant Ensemble Method for Unsupervised Dependency Parsing. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 39. AAAI Press, Philadelphia, PA, USA, 25119–25127. https://doi.org/10.1609/aaai.v39i23.34697

    work page doi:10.1609/aaai.v39i23.34697 2025

  7. [7]

    Lingxi Cui, Huan Li, Ke Chen, Lidan Shou, and Gang Chen. 2024. Tabular Data Augmentation for Machine Learning: Progress and Prospects of Embracing Generative AI. arXiv:2407.21523 [cs.LG] https://arxiv.org/abs/2407.21523

    Pith/arXiv arXiv 2024

  8. [8]

    Conor Durkan, Artur Bekasov, Iain Murray, and George Papamakarios. 2019. Neural spline flows. In Advances in Neural Information Processing Systems, Vol. 32. Curran Associates Inc., Vancouver, Canada, 7627–7638

    work page 2019

  9. [9]

    Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. 2006. Cali- brating noise to sensitivity in private data analysis. In Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3 . Springer, Berlin, Heidelberg, 265–284

    work page 2006

  10. [10]

    George, H

    E. George, H. Chipman, and R. McCulloch. 2006. Bayesian Ensemble Learning. In Pattern Recognition and Machine Learning . MIT Press, Cambridge, MA, 265–272. https://doi.org/10.7551/mitpress/7503.003.0038

    work page doi:10.7551/mitpress/7503.003.0038 2006

  11. [11]

    Steven Golob, Sikha Pentyala, Anuar Maratkhan, and Martine De Cock. 2024. Pri- vacy Vulnerabilities in Marginals-based Synthetic Data. arXiv:2410.05506 [cs.CR] https://arxiv.org/abs/2410.05506

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  12. [12]

    Florent Guépin, Nataša Krčo, Matthieu Meeus, and Yves-Alexandre de Montjoye

    work page

  13. [13]

    Jamie Hayes, Luca Melis, George Danezis, and Emiliano De Cristofaro. 2017. LOGAN: Membership Inference Attacks Against Generative Models. Pro- ceedings on Privacy Enhancing Technologies 2019 (2017), 133 – 152. https: //api.semanticscholar.org/CorpusID:52211986

    work page 2017

  14. [14]

    Benjamin Hilprecht, Martin Härterich, and Daniel Bernau. 2019. Monte Carlo and Reconstruction Membership Inference Attacks against Generative Models. Proceedings on Privacy Enhancing Technologies 2019 (2019), 232 – 249. https: //api.semanticscholar.org/CorpusID:199546273

    work page 2019

  15. [15]

    Florimond Houssiau, James Jordon, Samuel N Cohen, Owen Daniel, Andrew Elliott, James Geddes, Callum Mole, Camila Rangel-Smith, and Lukasz Szpruch

  16. [16]

    Membership Inference Attacks on Machine Learning: A Survey

    Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dobbie, Philip S. Yu, and Xuyun Zhang. 2022. Membership Inference Attacks on Machine Learning: A Survey. arXiv:2103.07853 [cs.LG] https://arxiv.org/abs/2103.07853

    work page internal anchor Pith review Pith/arXiv arXiv 2022

  17. [17]

    Matthew Jagielski, Jonathan Ullman, and Alina Oprea. 2020. Auditing differ- entially private machine learning: how private is private SGD?. In Proceedings of the 34th International Conference on Neural Information Processing Systems (Vancouver, BC, Canada) (NIPS ’20). Curran Associates Inc., Red Hook, NY, USA, Article 1862, 12 pages

    work page 2020

  18. [18]

    Mishaal Kazmi, Hadrien Lautraite, Alireza Akbari, Qiaoyue Tang, Mauri- cio Soroco, Tao Wang, Sébastien Gambs, and Mathias Lécuyer. 2024. PANORAMIA: Privacy Auditing of Machine Learning Models without Retraining. Ensembling Membership Inference Attacks Against Tabular Generative Models AISec ’25, October 13–17, 2025, Taipei, Taiwan arXiv:2402.09477 [cs.CR]...

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  19. [19]

    J. Z. Kolter, Hariharan Manikandan, and Yiding Jiang. 2023. Language models are weak learners. https://doi.org/10.48550/arXiv.2306.14101

    Pith/arXiv arXiv doi:10.48550/arxiv.2306.14101 2023

  20. [20]

    Akim Kotelnikov, Dmitry Baranchuk, Ivan Rubachev, and Artem Babenko

  21. [21]

    Qinyi Liu, Mohammad Khalil, Ronas Shakya, and Jelena Jovanovic. 2024. Scaling While Privacy Preserving: A Comprehensive Synthetic Tabular Data Generation and Evaluation in Learning Analytics. arXiv:2401.06883 [cs.CR] https://arxiv. org/abs/2401.06883

    Pith/arXiv arXiv 2024

  22. [22]

    Y. Liu. 2011. Create weak learners with small neural networks by balanced ensemble learning. In 2011 IEEE International Conference on Signal Processing, Communications and Computing (ICSPCC) . IEEE, Xi’an, China, 1–4. https://doi. org/10.1109/ICSPCC.2011.6061781

    work page arXiv 2011

  23. [23]

    arXiv:2209.15421 [cs.LG]

    TabDDPM: Modelling Tabular Data with Diffusion Models. arXiv:2209.15421 [cs.LG]

    Pith/arXiv arXiv

  24. [24]

    Cohen, and Kenneth R

    Noboru Matsuda, Andrew Lee, William W. Cohen, and Kenneth R. Koedinger

    work page

  25. [25]

    Ibtissam Medarhri, Chaimae Chekira, J. M. C. de Gea, and Mohamed Hosni. 2025. Constructing Ensembles: A Diversity-Driven Approach with Correlation and Q-Statistics. , 6 pages. https://doi.org/10.1109/AI2E64943.2025.10983592

    work page arXiv 2025

  26. [26]

    Yixin Liu, Thalaiyasingam Ajanthan, Hisham Husain, and Vu Nguyen. 2024. Self-supervision improves diffusion models for tabular data imputation

    work page 2024

  27. [27]

    Fatemehsadat Mireshghallah, Kartik Goyal, Archit Uniyal, Taylor Berg- Kirkpatrick, and Reza Shokri. 2022. Quantifying Privacy Risks of Masked Lan- guage Models Using Membership Inference Attacks. arXiv:2203.03929 [cs.LG] https://arxiv.org/abs/2203.03929

    Pith/arXiv arXiv 2022

  28. [28]

    Vamsi K. Potluru, Daniel Borrajo, Andrea Coletta, Niccolò Dalmasso, Yousef El-Laham, Elizabeth Fons, Mohsen Ghassemi, Sriram Gopalakrishnan, Vikesh Gosai, Eleonora Kreačić, Ganapathy Mani, Saheed Obitayo, Deepak Paramanand, Natraj Raman, Mikhail Solonin, Srijan Sood, Svitlana Vyetrenko, Haibei Zhu, Manuela Veloso, and Tucker Balch. 2024. Synthetic Data Ap...

    Pith/arXiv arXiv 2024

  29. [29]

    Zhaozhi Qian, Bogdan-Constantin Cebere, and Mihaela van der Schaar. 2023. Synthcity: facilitating innovative use cases of synthetic data in different data modalities. https://doi.org/10.48550/ARXIV.2301.07573

    Pith/arXiv arXiv doi:10.48550/arxiv.2301.07573 2023

  30. [30]

    Matthieu Meeus, Florent Guepin, Ana-Maria Creţu, and Yves-Alexandre de Montjoye. 2024. Achilles’ Heels: Vulnerable Record Identification in Synthetic Data Publishing . Springer Nature Switzerland, Cham, Switzerland, 380–399. https://doi.org/10.1007/978-3-031-51476-0_19

    doi:10.1007/978-3-031-51476-0_19 2024

  31. [31]

    Schapire

    R. Schapire. 2004. The strength of weak learnability. Machine Learning 5 (2004), 197–227. https://doi.org/10.1007/BF00116037

    doi:10.1007/bf00116037 2004

  32. [32]

    Aivin V Solatorio and Olivier Dupriez. 2023. Realtabformer: Generating realistic relational and tabular data using transformers

    2023

  33. [33]

    Theresa Stadler, Bristena Oprisanu, and Carmela Troncoso. 2022. Synthetic Data – Anonymisation Groundhog Day. In 31st USENIX Security Symposium (USENIX Security 22) . USENIX Association, Boston, MA, 1451–1468. https: //www.usenix.org/conference/usenixsecurity22/presentation/stadler

    work page 2022

  34. [34]

    Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, Yann Ollivier, and Hervé Jégou. 2019. White-box vs black-box: Bayes optimal strategies for mem- bership inference. In Proceedings of the 36th International Conference on Machine Learning (Proceedings of Machine Learning Research, Vol. 97) . PMLR, Long Beach, CA, USA, 5558–5567

    work page 2019

  35. [35]

    Namjoon Suh, Xiaofeng Lin, Din-Yin Hsieh, Merhdad Honarkhah, and Guang Cheng. 2023. AutoDiff: combining Auto-encoder and Diffusion model for tabular data synthesizing. arXiv:2310.15479 [stat.ML] https://arxiv.org/abs/2310.15479

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  36. [36]

    Marshall, Severin Elvatun, Helga M.B

    Vibeke Binz Vallevik, Aleksandar Babic, Serena E. Marshall, Severin Elvatun, Helga M.B. Brøgger, Sharmini Alagaratnam, Bjørn Edwin, Narasimha R. Veerara- gavan, Anne Kjersti Befring, and Jan F. Nygård. 2024. Can I trust my fake data – A comprehensive quality assessment framework for synthetic tabular data in healthcare. International Journal of Medical In...

    work page arXiv 2024

  37. [37]

    Boris van Breugel, Hao Sun, Zhaozhi Qian, and Mihaela van der Schaar. 2023. Membership Inference Attacks against Synthetic Data through Overfitting De- tection. arXiv:2302.12580 [cs.LG]

    Pith/arXiv arXiv 2023

  38. [38]

    Namjoon Suh, Xiaofeng Lin, Din-Yin Hsieh, Mehrdad Honarkhah, and Guang Cheng. 2023. AutoDiff: combining Auto-encoder and Diffusion model for tabular data synthesizing. https://openreview.net/forum?id=XhxOCXlXSh

    2023

  39. [39]

    Joshua Ward, Chi-Hua Wang, and Guang Cheng. 2025. Privacy Auditing Synthetic Data Release through Local Likelihood Attacks. arXiv:2508.21146 [cs.LG] https: //arxiv.org/abs/2508.21146

    Pith/arXiv arXiv 2025

  40. [40]

    Watson, Kristin Blesch, Jan Kapar, and Marvin N

    David S. Watson, Kristin Blesch, Jan Kapar, and Marvin N. Wright. 2023. Ad- versarial Random Forests for Density Estimation and Generative Modeling. In Proceedings of The 26th International Conference on Artificial Intelligence and Statistics (Proceedings of Machine Learning Research, Vol. 206) , Francisco Ruiz, Jen- nifer Dy, and Jan-Willem van de Meent ...

    work page 2023

  41. [41]

    Lei Xu, Maria Skoularidou, Alfredo Cuesta-Infante, and Kalyan Veeramacha- neni. 2019. Modeling Tabular data using Conditional GAN. In Advances in Neural Information Processing Systems , Vol. 32. Curran Associates, Inc., Van- couver, Canada, 7335–7345. https://proceedings.neurips.cc/paper/2019/hash/ 254ed7d2de3b23ab10936522dd547b78-Abstract.html

    work page 2019

  42. [42]

    Joshua Ward, Chi-Hua Wang, and Guang Cheng. 2024. Data Plagiarism Index: Characterizing the Privacy Risk of Data-Copying in Tabular Generative Models. arXiv:2406.13012 [cs.LG] https://arxiv.org/abs/2406.13012

    Pith/arXiv arXiv 2024

  43. [43]

    Jinsung Yoon, Lydia N Drumright, and Mihaela Van Der Schaar. 2020. Anonymiza- tion through data synthesis using generative adversarial networks (ads-gan).IEEE journal of biomedical and health informatics 24, 8 (2020), 2378–2388

    work page 2020

  44. [44]

    Jinsung Yoon, James Jordon, and Mihaela van der Schaar. 2019. PATE-GAN: Generating Synthetic Data with Differential Privacy Guarantees. In International Conference on Learning Representations . OpenReview.net, New Orleans, LA, USA, 1–15. https://openreview.net/forum?id=S1zk9iRqF7

    work page 2019

  45. [45]

    Hengrui Zhang, Jiani Zhang, Zhengyuan Shen, Balasubramaniam Srinivasan, Xiao Qin, Christos Faloutsos, Huzefa Rangwala, and George Karypis. 2024. Mixed- Type Tabular Data Synthesis with Score-based Diffusion in Latent Space. In The Twelfth International Conference on Learning Representations . OpenReview.net, Vienna, Austria, 4Ay23yeuz0. https://openreview...

    work page 2024

  46. [46]

    Yao and Yong Liu

    X. Yao and Yong Liu. 1999. Ensemble learning via negative correlation. Neural networks : the official journal of the International Neural Network Society 12 10 (1999), 1399–1404. https://doi.org/10.1016/S0893-6080(99)00073-8

    doi:10.1016/s0893-6080(99)00073-8 1999

  47. [47]

    Shuhan Zheng and Nontawat Charoenphakdee. 2023. Diffusion models for missing value imputation in tabular data. arXiv:2210.17128 [cs.LG] https: //arxiv.org/abs/2210.17128

    Pith/arXiv arXiv 2023

  48. [48]

    Xiaojun Zhou, Jingyi He, and Chunhua Yang. 2021. An ensemble learning method based on deep neural network and group decision making. Knowl. Based Syst. 239 (2021), 107801. https://doi.org/10.1016/j.knosys.2021.107801 8 APPENDIX 8.1 Metric Definitions 8.1.1 AUC-ROC (Area Under the Receiver Operating Characteris- tic Curve). The area under the curve formed ...

    work page arXiv 2021

  49. [50]

    Procopiuc, Divesh Srivastava, and Xiaokui Xiao

    Jun Zhang, Graham Cormode, Cecilia M. Procopiuc, Divesh Srivastava, and Xiaokui Xiao. 2017. PrivBayes: Private Data Release via Bayesian Networks. ACM Trans. Database Syst. 42, 4, Article 25 (Oct. 2017), 41 pages. https://doi.org/ 10.1145/3134428

    doi:10.1145/3134428 2017

  50. [2009]

    InProceedings of the Annual Conference of the Cognitive Science Society

    A Computational Model of How Learner Errors Arise from Weak Prior Knowledge. InProceedings of the Annual Conference of the Cognitive Science Society. Cognitive Science Society, Austin, TX, USA, 1288–1293. https://escholarship. org/uc/item/[paper_id]

    work page

  51. [2022]

    Tapas: a toolbox for adversarial privacy auditing of synthetic data

  52. [2024]

    arXiv:2405.15423 [cs.LG] https://arxiv.org/abs/2405.15423

    Lost in the Averages: A New Specific Setup to Evaluate Membership Inference Attacks Against Machine Learning Models. arXiv:2405.15423 [cs.LG] https://arxiv.org/abs/2405.15423

    work page arXiv

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.