Jul 2026· ACM Transactions on Privacy and Security· Vol 29, pp. 1 - 23· 0 citations· 42 references
TL;DR
Experimental results demonstrate that PPGM-GAN outperforms state-of-the-art privacy-preserving generative models, producing high-utility synthetic data under the same privacy constraints.
Abstract
High-quality data are essential for machine learning and data-driven research, yet data scarcity and privacy concerns remain major obstacles in many domains. Generative models have recently emerged as a promising approach to synthesize data that follow the same statistical distribution as real datasets. However, generative models are vulnerable to membership inference attacks, which threaten data confidentiality by exploiting model outputs to infer whether specific samples were used in training. Existing defense strategies struggle to simultaneously preserve data utility and provide robust privacy protection. To address this challenge, we propose our PPGM-GAN, a Privacy-Preserving GAN for synthetic data against membership inference attack to balance both data utility and data privacy. PPGM-GAN balances privacy and utility through a privacy-utility tradeoff function that quantifies and optimizes both aspects under different adversarial knowledge. To enhance data utility, we incorporate conditional generation and key-attribute screening to ensure sufficient representation of infrequent attribute values. Additionally, differential privacy is employed during training to prevent overfitting and reduce privacy leakage. Experimental results demonstrate that PPGM-GAN outperforms state-of-the-art privacy-preserving generative models, producing high-utility synthetic data under the same privacy constraints.
This paper studies embedding-space privacy as a representation-level learning problem. Rather than altering raw records directly, the proposed framework applies embeddingspace transformation to full-record representations through Gaussian perturbation and adversarial representation sanitization. The method is evaluated through ablation across utility metrics, linkage attacks, attribute-inference attacks, and membership-inference tests. The primary empirical evaluation uses a synthetic fusion recommendation benchmark built from MovieLens [1], [2] 32M behavior and Adult-derived demographics [3], while a secondary synthetic medical benchmark is used to examine cross-domain transferability under more constrained conditions. The strongest results appear in the recommendation experiments. Under grouped demographic privacy evaluation, the combined condition preserves recommendation utility with $N D C G {@} K=0.6312$ while reducing exact and entity linkage from 0.7090/0.7204 to 0.0001/0.0000. Sensitive-target attacker performance remains near the majority baseline, supporting the claim of empirical privacy improvement without visible ranking degradation in that benchmark. The healthcare experiments also demonstrate meaningful embedding transformation and linkage reduction, though the current benchmark remains datalimited and therefore less conclusive for utility-focused evaluation. Overall, the findings support the conclusion that embeddingspace transformation can preserve downstream utility while substantially reducing linkage risk and sensitive-information recoverability under explicit attacker evaluation. The findings support embedding-space transformation as a practical privacypreserving strategy for embedding-driven AI systems under explicit attacker evaluation.
D. Panagoulias, Evangelia-Aikaterini Tsichrintzi, E. Sakkopoulos· International Conference on...· 0 citations
: The increasing deployment of deep learning models has raised important concerns regarding data privacy. In particular, Membership Inference Attacks (MIAs) aim to determine whether a specific data sample was used to train a model, potentially exposing sensitive information. To address this issue, we propose Risk Score guided Knowledge Distillation (RS-KD), a defense mechanism that dynamically adapts the distillation process according to a privacy risk score estimated from the output characteristics of a teacher model. This risk estimation enables the identification of samples that are more vulnerable to MIAs, allowing the framework to selectively regulate the uncertainty introduced during distillation. Experimental results on benchmark datasets demonstrate that RS-KD significantly reduces the effectiveness of black-box MIAs while preserving predictive performance, achieving a favorable privacy–utility trade-off.
R. Kassa, Kamel Adi, Abdelkamel Tari· Proceedings of the 23rd Inte...· 0 citations
FISGuard reduces the ProjRes attack AUC to near the random-guessing level of 0.5 in most settings, while maintaining downstream task performance close to that of the undefended model and introducing only limited computational overhead, thereby achieving a favorable privacy--utility trade-off.
This work considers normalized histograms as distribution estimators and characterize the asymptotically optimal domain-aware privacy mechanism within a specific class of DP mechanisms, and introduces PubMix, a public-data-aware DP mechanism that can be used in histogram-based data synthesis pipelines.
Sajani Vithana, Sangwon Jung, Haoyang Hu et al.· arXiv.org· 0 citations
A federated deep learning framework that systematically integrates adaptive privacy noise mechanisms and trust-weighted aggregation within a distributed architecture that ensures the protection of sensitive data during collaborative analysis through precise differential privacy control and advanced neural network models is presented.
