SYNNER synthetic data generator framework

Rule based approaches

Rule-based approaches rely on domain expertise and predefined statistical rules to generate synthetic data, rather than learning directly from source datasets. These methods typically incorporate publicly available statistics, ontologies, or schema constraints to simulate realistic data that reflect expected distributions and logical relationships within a given domain.

Publicly Available Data Approach to Realistic Synthetic EHR (PADARSER), ¹⁶ for example, uses publicly available health statistics and care flows to generate realistic EHR. Care flows are generated from clinical practice guidelines, without using real patient data. Although the use of expert knowledge is helpful in creating realistic data, it is not transferable to other domains.

Graph Differential Dependencies (GDDx) ¹⁷ is a schema-driven knowledge graph generator. The generation process relies on expert-defined schemas that impose constraints on the relationships between entities. While this ensures structural coherence, it requires significant domain knowledge, which limits the generalizability of the approach across different contexts.

Synthpop ¹¹ uses conditional distributions to generate synthetic data. It models each column of the source data as a conditional distribution, where the value of a given attribute is sampled based on previously generated attributes in the same row. This creates a more realistic version of each entry in the resulting synthetic data. However, synthetic data generators based on conditional probabilities usually face a vanishing distribution problem when there are too many features and not enough data to support those features. As each feature is conditionally sampled, the subset of eligible entities becomes increasingly narrow. In cases where no entities exist with a given combination of previously selected features, the generation process may fail due to an empty distribution. This issue can lead to the vanishing gradient problem, ²⁷ where generators that use conditional distributions can leak individuals from the source data that match less frequent combinations of feature values. In neural networks, the vanishing gradient problem occurs when the values used to update the internal parameters become extremely small as they are passed backward through many layers. This makes it hard for the earlier layers to adjust their weights, which in turn slows down or even blocks the training process. ²⁸ In embedding processes, the vanishing gradient problem progressively reduces the embedding vector magnitudes during training, which can happen when similarity measures such as cosine similarity fall into saturation regions, or when positive and negative pairs produce nearly identical distances. As a result, the embeddings lose their ability to distinguish between inputs. ²⁹ In both scenarios, the vanishing gradient problem can be understood as a form of forgetting.

Machine learning approaches

Unlike rule-based methods, machine learning approaches generate synthetic data by learning directly from source data, rather than relying solely on expert knowledge. These approaches can learn the underlying patterns and distributions in the data, enabling the generation of high-fidelity synthetic data.

GANs ²⁶ have been widely used to generate discrete and continuous tabular data. One example is medGAN, ¹² an autoencoder combined with a GAN that aims to learn the distributions of multi-label discrete features in a medical context. The autoencoder helps the GAN learn the distribution of the variables by putting the data into a latent or encoded space. The synthetic encoded data are then decoded back into discrete variables. However, GANs may leak sensitive information, particularly when trained on small datasets or when feature distributions are highly imbalanced. ¹⁴ At the same time, GANs can undergo mode collapse, ³⁰ which results in the GAN producing the same entity over and over instead of a representative variety of entities. When experiencing mode collapse, the generator produces only a narrow subset of possible outputs rather than reflecting the full diversity of the data. This means that, although the generated samples may look realistic, they fail to represent all variations present in the original dataset. Instead of capturing all possible modes of the data (e.g., different classes, variations, or styles), the generator keeps producing very similar samples, preventing the model from generating a full range of realistic data. ³¹

DPGAN ¹⁴ is a differentially private GAN that improves on medGAN. DPGAN uses the Wasserstein distance, ³² as opposed to Jensen-Shannon divergence or Kullback–Leibler divergence ³³ to approximate the difference between the probability distributions of the real data and the generated data. DPGAN achieves high-quality data point generation while also ensuring the protection of individuals. This is done by adding noise to the Wasserstein gradient during training. Although DPGAN improves on the mode collapse and gradient vanishing problems, the method cannot produce multi-relational data.

Conditional Tabular GAN (CTGAN ¹³ ) is a generative model specifically designed to address the unique challenges of tabular data synthesis. Traditional tabular data often include a combination of continuous and discrete variables, making modeling difficult, especially when continuous variables have multiple modes or when discrete variables are imbalanced. Unlike standard deep learning or statistical methods, which often struggle with this complexity, CTGAN introduces a conditional generator that effectively models the joint distribution of tabular data. This approach enables it to generate realistic synthetic rows that reflect the structure and variability of the original dataset.

TabularARGN ¹⁸ is an auto-regressive neural network architecture designed specifically to generate high-quality, privacy-preserving synthetic tabular data. TabularARGN addresses the unique challenges of real-world datasets, including mixed data types, missing values, and variable-length sequences, by modeling all possible conditional probabilities between features. This design enables advanced features such as conditional generation, missing value imputation, and fairness-aware synthesis, while maintaining DP safeguards.

Knowledge graph embeddings

To overcome the limitations of rule-based and machine learning approaches (e.g., reliance on domain-specific knowledge, lack of generalizability, and risk of privacy leakage), KGEs offer a promising alternative. KGE methods represent entities and their relationships in a continuous vector space, effectively capturing complex, multi-relational structures without requiring explicit rules or full generative modeling.

Traditionally, embeddings have been used to visualize clusters of high-dimensional data in low-dimensional space, providing a way to naturally group similar entities without explicitly sorting them together. Moreover, they are more effective forms of representing knowledge to encode known information that allows inference and reasoning,^34–36 making them particularly suitable for synthetic data generation scenarios where preserving underlying data semantics and generalization across domains are essential.

Static knowledge graphs (knowledge graphs that encode facts that are assumed to be universally or permanently true) are not suitable for embedding time-series or time-linked events, where many facts are only valid within a specific time frame. TKG embedding models aim to capture dynamic patterns and evolving relationships over time. While earlier models relied on random sampling to generate negative training examples, more recent work has shown that generating plausible but false negative samples using adversarial techniques improves the quality of the learned embeddings. ²⁵ This results in more semantically rich and temporally-aware representations—an important feature for modeling longitudinal data such as patient histories.

The training architecture proposed in Tissot and Pedebos ²⁵ improves on previous work by choosing more likely false facts to use as training data for the GAN instead of uniform random sampling. This creates a more semantically rich TKG embedding. After training the 5 different TKG models, the methods that were trained using the proposed adversarial model yielded slightly better results.

Despite the growing interest in KGEs for tasks such as clustering, reasoning, and representation learning, their application in the context of synthetic data generation remains relatively underexplored. Although existing studies demonstrate their effectiveness in capturing structured patterns and performing semantic reasoning, their potential to produce synthetic data has not been fully realized, particularly in sensitive domains like healthcare. Our work aims to bridge this gap by leveraging KGE techniques as the foundation for SYNNER, a synthetic data generator designed to preserve utility while enhancing privacy through embedding-based sampling.

Embeddings generation

To address the dependency between features in the source data, we use embeddings to organize entities into a multidimensional space where similar instances are naturally grouped together. We use KRAL (https://github.com/hextrato/kral), an unsupervised learning approach based on KGEs, ³⁵ to generate embedding spaces that capture feature similarities and patterns present in the original datasets (see Figure 1(a)). KRAL has been chosen for its ability to handle not only categorical, but also continuous features when embedding a knowledge graph. While embeddings for categorical features are learned using translational projections of entities and relations, continuous features are embedded along a random choice of a dimension d in the k -dimensional space. For example, in a k -dimensional space with k = 128 , the range of values corresponding to a continuous feature “heart rate” is randomly chosen to fit in dimension 25, while another continuous feature “continuous feature” might be randomly set to fit in dimension 74. Specifically, each dataset is partitioned into training and testing sets as shown in Table 1. The KGE algorithm is then applied directly to the original data, learning the relationships between the nodes (entities) and edges (features and their corresponding values) and encoding them as vectors in a k -dimensional space. This phase (Figure 1(A.1)) is performed without the target label, since our objective is to evaluate to what extent the embeddings are capable of effectively capturing signals from categorical and continuous features in each dataset, by reproducing the original prediction task now using embeddings solely as input.

After generating the embeddings based on the training set, we applied the learned transformations to generate embeddings for the test set. This approach ensures that the test embeddings are derived solely from the relationships captured in the training phase, without introducing additional information from the test set itself. In the next step (Figure 1(A.2)), the embeddings are evaluated in the same label prediction task proposed for each original dataset, so that we can assess their ability to capture meaningful patterns and relevant structures. In general, this step enables us to quantify the amount of meaningful signal that can be captured from each dataset, and to estimate how effectively the synthetic data could represent the underlying structure of the original data.

In k -dimensional spaces, the choice of k directly affects the ability of the embeddings to capture the complexity and nuances of the original data. Although lower dimensionality improves computational efficiency, it may fail to preserve critical data patterns during embedding generation. ⁴¹ To help determine optimal dimensionality, the KGE algorithm was tested in a preliminary evaluation using a rule-based synthetic data generator ⁴² configured to project entities into multiple k -dimensional spaces in separate experimental runs, allowing us to systematically assess how dimensionality and noise influence the quality of synthetic data (further details are presented in Section “Results”). Finally, we decided to use k = 32 for all datasets. Although all datasets are very similar in terms of size and shape, we observed that when the same k used during the embedding process is able to capture signals in the form of embedding vectors, it is correlated with noise and the complexity of relationships within the data. The results are presented in Table 2 and discussed in Section “Embeddings Evaluation.”

OPEN IN VIEWER

Table 2.

Evaluation of embeddings as input features for prediction tasks across all benchmark datasets.

Dataset	Macro F1 score		Relative performance
	Original data	Embeddings	(F1 e m b e d d i n g s / F1 o r i g i n a l )
Fetal health	0.9159	0.8059	0.8799
Infant health	0.3721	0.3823	1.0274
Stroke prediction	0.2514	0.2360	0.9387
Genetic disorder
Class	0.5279	0.4383	0.8303
Subclass	0.3077	0.1681	0.5463
Avila Bible	0.9932	0.9040	0.9102
Polish bankruptcy	0.7250	0.4153	0.5728
Mushroom classification	1.0000	0.9977	0.9977

Macro F1 scores are compared between models trained on original data and embedding representations. The relative F1 performance quantifies the signal preservation achieved by embeddings.

Synthetic data generation: Embedding space sampling

Following an initial validation of the effectiveness of the embeddings in a predictive task, we re-run the embedding process using the same KGE algorithm, this time incorporating class labels (see Figure 1B). Integrating label information into the embedding process enables embeddings to capture label-dependent patterns and relationships. As a result, entities that exhibit similar features or associations with specific labels are embedded in close proximity within the latent space.

Cluster quality

To refine the quality of each cluster, we introduce a maximum neighbor constraint ( N m a x ), which limits the number of neighbors considered when finding the nearest neighbors. This constraint helps reduce the influence of densely populated regions, thereby avoiding synthetic samples that disproportionately reflect global distributional characteristics at the expense of preserving localized structure. Building on the above considerations and to balance privacy with data utility, we examine how radius, outlier frequency, and local data density interact to select appropriate values for R m a x , N m i n , and N m a x . We perform a density analysis in the embedding space to analyze how different radius values influence the percentage of outliers, high-density regions, and the average number of neighbors in the embedding space.

An illustrative example based on the Fetal Health dataset is shown in Figure 2. For a given pair of neighbor constraints [ N m i n , N m a x ] , we examine how variations in R m a x affect outlier identification and cluster density. In the presented example, where [ N m i n , N m a x ] = [ 16 , 32 ] , if an outlier tolerance of 10% is acceptable, that is, the synthetic dataset will contain approximately 10% fewer instances than the original data, the minimum required value for R m a x is approximately 0.18. At this threshold, around 80% of the resulting clusters will be formed with at least N m a x = 32 neighbors. The remaining 20% of clusters comprise between 16 and 31 neighbors, which still satisfy the constraint N m i n while supporting the generation of synthetic instances that respect local density without overfitting to densely populated regions. Finally, the same analysis provides the average number of neighbors found. When R m a x = 0.18 , clusters corresponding to each target instance will have approximately 56 neighbors ( 10 1.75 ). This configuration maintains a meaningful neighborhood size for synthetic sampling while limiting the risk of privacy leakage. Note that these parameters are dataset-specific and need to be tuned to balance the number of outliers against excessive generalization in the generated synthetic dataset.

OPEN IN VIEWER

Figure 2.

Density analysis for the Fetal Health dataset in the embedding space. The number of neighbors within varying radius thresholds is plotted (log scale), showing the trade-off between outlier frequency (¡16 neighbors) and local density (>32 neighbors). Results guide the selection of the maximum cluster radius ( R m a x ) and neighbor constraints.

Data utility

Finally, we evaluate how each resulting synthetic dataset performs as a training set in the original label prediction task. We analyze the resulting F1 score from the test set, comparing two models: (a) One trained with the original training data and (b) another trained with synthetic data generated from the original training set. There are no specific expectations regarding the F1 score resulting from synthetic data, but we use these results to assess the representativeness of synthetic data with respect to the original data. These results are presented in Table 3 and discussed in Section “Synthetic data evaluation”.

OPEN IN VIEWER

Table 3.

Comparison of predictive performance between models trained on original training data versus synthetic data generated by SYNNER.

Dataset	Macro F1 score		Radius	Relative Performance
	Original	Synthetic	R m a x	(F1 s y n t h e t i c / F1 o r i g i n a l )
Fetal health	0.9159	0.7454	0.170	0.8139
Infant health	0.3721	0.3670	0.050	0.9863
Stroke prediction	0.2514	0.1702	0.155	0.6769
Genetic disorder
Class	0.5279	0.4317	0.125	0.8178
Subclass	0.3077	0.1707	0.125	0.5548
Avila Bible	0.9932	0.6046	0.135	0.6088
Polish bankruptcy	0.7250	0.3618	0.065	0.4990
Mushroom classification	1.0000	0.9919	0.030	0.9919

Macro F1 scores, maximum radius used for sampling, and relative F1 performance are reported. Results highlight dataset-specific trade-offs in representativeness and generalization.

Differential privacy

Now that we have a synthetic version of the original training set, to ensure its practical applicability, it is essential to evaluate how well the synthetic dataset balances data utility and privacy protection. One concern when generating synthetic data is the risk of reconstructing sensitive or confidential information. When synthetic samples are too closely aligned with real data points, especially in high-dimensional representations, there is a risk that models trained on the combined datasets may overfit or expose patterns that could compromise individual privacy. In other words, the integration of real and synthetic data, particularly those generated from embedding spaces, could inadvertently improve a model’s predictive performance to the extent that it enables the reconstruction of sensitive or missing information from the original data.

To assess the trade-off between data utility and privacy, we propose evaluating how well synthetic datasets perform in prediction tasks when combined with the original dataset and/or their corresponding embeddings (see Figure 1(C)). We run prediction tasks on each feature assuming the scenario in which an attacker gains access to all versions of the same dataset: Synthetic data (Syn), the embedding representations along with the embedding model (Emb), and original data (DS), except for one missing feature that could represent, for example, a critical health indicator of a patient. In this setting, the attacker: (C1) Using only DS, would rely on the available patient records to train a model and infer the missing value (for example, a health indicator); (C2) when adding Emb, privacy risks could increase if encoded relationships preserve too much information; similarly, (C3) the addition of Syn could potentially improve model quality, leading to the exposure of sensitive patient data.

Taking into account this adversarial scenario, we quantified the attempt to reconstruct the missing value through a comparative evaluation in four experimental settings: (1) Inference using only the original dataset DS; (2) inference using the DS+Emb; (3) inference using DS+Syn; and (4) inference using DS+Emb+Syn. In each setting, we evaluate the predictive performance of each feature, ensuring DP so that Emb and Syn cannot be used to reveal sensitive data or reproduce information beyond the original dataset. Therefore, if a feature in the synthetic data increases the likelihood of inferring its real counterpart, it should be reconsidered to maintain an appropriate balance between utility and privacy, potentially by modifying it through techniques such as noise injection. These results are discussed in Section “Differential privacy evaluation”.

Embeddings evaluation

As described in the first step of the SYNNER pipeline (Figure 1(A)), we generate embedding representations for the training and test partitions of the original datasets, without including the target labels, as they could influence the relationships learned. Once the embeddings were generated, we evaluated their utility as synthetic data by using XGBoost to predict the original labels. The results are shown in Table 2.

An interesting exception occurs in the Infant Health dataset, where embeddings slightly outperform the original data (Macro F1 = 0.3823 vs. 0.3721). We interpret this as an effect of the embedding transformation, which acts as a denoising and regularization mechanism. By projecting categorical feature-value pairs into a continuous vector space, embeddings smooth local irregularities and emphasize co-occurrence patterns, thereby reducing noise and sparsity. In this dataset, which contains many categorical attributes with uneven distributions, embeddings appear to better capture correlations that are harder to exploit directly from raw features, resulting in a modest performance gain.

When comparing results to the same task performed on the original datasets, we observed that embeddings typically achieve lower performance, as some signal is lost during the embedding process. In each dataset, the loss ratio in a prediction task relative to the original data varies with data complexity and the difficulty of predicting the target label. For example, in the Mushroom dataset, widely considered straightforward and easy to resolve, embeddings maintain a high predictive performance. In contrast, in the subclass prediction task in the Genetic Disorder dataset, embeddings achieve only 50% of the same performance as the original data.

Furthermore, in the Infant Health dataset, we observed that the F1 score using embeddings improved by nearly 3% compared to the original dataset. Although designed to reduce dimensionality, the embedding transformation can also enhance representation by capturing correlations between similar feature-value pairs, as becomes more evident in inherently difficult-to-learn prediction tasks.

Overall, this assessment confirms that embeddings can preserve data patterns. Most importantly, since embeddings typically underperform compared to the original data, they may provide a suitable level of privacy for subsequent synthetic data generation steps.

Synthetic data evaluation

In this section, we evaluate the effectiveness of our synthetic data generation framework by analyzing several key factors, including comparisons between density-based and random sampling approaches and the influence of radius and neighbor constraints in balancing trade-offs between privacy, utility, and generalizability. We also examine how these parameters affect class-level prediction performance and discuss the implications of dataset-specific parameter tuning. The results are reported in Table 3 and Figures 3 and 4.

OPEN IN VIEWER

Figure 3.

Impact of varying the maximum radius ( R m a x ) on predictive performance (Macro F1 score) in the Fetal Health dataset. Increasing R m a x expands clusters (from an average of 65 to 762 neighbors) but reduces F1 performance, showing that larger clusters dilute local structure and reduce the fidelity of synthetic data. Smaller radii preserve more of the original predictive signal, while larger radii reduce local fidelity but may provide stronger privacy by preventing overly close synthetic samples.

OPEN IN VIEWER

Figure 4.

Effect of varying minimum and maximum neighbor constraints ( N m i n and N m a x ) on Fetal Health predictive performance. As neighbor ranges increase ([4,8] → [256,512]), synthetic data becomes more generalized, and Macro F1 scores decline. Results highlight the importance of neighborhood constraints for preserving minority structures and preventing excessive generalization.

As discussed previously, unlike the embedding evaluation in the previous section, we used embeddings learned from the full original datasets, including target labels, to improve the semantic reliability of synthetic data generated from latent representations. The resulting synthetic records retain a substantial portion of the discriminative structure of the original data when we incorporate class labels into the KGE process. For example, as shown in Table 3, in the Fetal Health dataset, although the F1 score decreases from 0.9159 (original) to 0.7454 (synthetic), the retention ratio of 0.8139 reflects how strongly signals can be preserved during the embedding and synthetic data generation processes. Similarly, in the Mushroom dataset, the synthetic-based model achieves a macro F1 score of 0.9919, indicating minimal information loss, as expected for an easy-to-resolve task. However, in tasks with more granular class structures, such as when predicting the subclass label in the Genetic Disorder dataset, the drop in performance is more noticeable (ratio = 0.5548), highlighting the challenge of maintaining class separability in complex label spaces, which is consistent with when evaluating the embedding representation for the same dataset.

From a clinical perspective, these observed performance gaps carry essential implications. For example, in the Fetal Health dataset, a 10%–15% reduction in the Macro F1 score does not imply that models trained solely on synthetic data can be safely applied in patient care. Even modest declines in predictive accuracy could translate into an increase in Type II errors (false negatives)—instances in which a pathological or high-risk case is incorrectly classified as normal. Instead, these results demonstrate that synthetic datasets preserve sufficient predictive signal to support model screening, prototyping, and hypothesis generation. In practice, synthetic data can help identify promising approaches while maintaining privacy. Still, final models must be retrained and independently validated on the original clinical data to ensure safety and reliability.

Differential privacy evaluation

As mentioned in Section “Differential privacy”, we conducted a DP Evaluation to assess the balance between utility and privacy on the generated synthetic data. This task is performed through a label prediction task, considering a critical scenario in which an attacker gains access to the original and synthetic data, embeddings, and the embedding model, then tries to predict a missing feature value, such as some sensitive information about a patient.

As illustrated in Figure 1(C), three experimental settings were considered, using only the original dataset (DS), DS + Embeddings (Emb), and DS + the synthetic dataset generated (Syn). A fourth scenario is added to the experiment (the attacker owns DS + Emb + Syn), representing the maximum data exposure situation. For each feature in each resulting synthetic dataset, we evaluate its predictive potential. For continuous features, we use the Mean Reciprocal Rank (MRR) metric ⁴⁷ to assess how closely the predictions match the actual values. This is done after discretizing each feature’s range into bins based on the standard deviation observed in the training set. For categorical features, we compute the F1 score, with a focus on predicting less frequent class values. To avoid trivial classification tasks dominated by the majority class, we select target values that occur in approximately 5%–10% of the dataset whenever possible. Figure 5 presents our evaluation results for all benchmark datasets using the XGBoost algorithm as a predictor.

OPEN IN VIEWER

Figure 5.

Differential privacy evaluation across benchmark datasets. Predictive performance (F1 for categorical features, MRR for continuous) is shown under four adversarial conditions: Using only the original dataset (DS), DS+Synthetic (DS+Syn), DS+Embeddings (DS+Emb), and DS+Syn+Emb. While embeddings alone rarely improve inference, the inclusion of synthetic data substantially improves prediction for some features (e.g., Infant Health: CXR, XRR, LF), underscoring both utility gains and privacy risks. (a) Genetic Disorder features—RR: Respiratory Rate(breaths/min); HR: Heart Rate(rates/min); FU: Follow-up; BA: Birth asphyxia; ABD: Autopsy shows birth defect; FA: Folic acid details; SMI: H/O serious maternal illness; RE: H/O radiation exposure(x-ray); SA: H/O substance abuse; IVF: Assisted conception IVF/ART; HA: History of anomalies in previous offspring; PA: No.of previous abortion; BD: Birth defects; BTR: Blood test result; PA: Patient Age; BCC: Blood cell count(mCL); WBCC: White Blood cell count. (b) Infant Health features—BA: Birth Asphyxia; HD: Hyp Distrib; HO2: Hypoxia O2; CO2; CXR: Chest X-Ray; GR: Grunting; LVHR: LVH Report; LBO2: Lower Body O2; RUQO2: RUQ O2; CO2R: CO2 Report; XRR: X-Ray Report; Dis: Disease; GR: Grunting Report; Age; LVH; DF: Duct Flow; CM: Cardiac Mixing; LP: Lung Parenchyma; LF: Lung Flow. (c) Fetal Health features—HT: Histogram Tendency; HNZ: Histogram number of zeroes; HNP: Histogram number of peaks; BV: Baseline Value; ASTV: Abnormal Short Term Variability. (d) Stroke features—SS: Smoking Status; WT: Work Type; HD: Heart Disease; HT: Hypertension; AGE: Age; AGL: Average Glucose Level; BMI. (e) Avila features—F1; F2; F3; F4; F5; F6; F7; F8; F9; F0. and (f) Polish Bankruptcy features—X1 to X64.

These datasets were chosen for their diverse feature sets and distinctive performance trends. We observed that combining the original dataset with embeddings alone does not significantly improve the F1 and MRR scores for any of the evaluated features. In contrast, incorporating synthetic data leads to notable performance gains across several features (e.g., CXR, XRR, and LF) in the Infant Health dataset (see Figure 5(b)). Although this underscores the potential of synthetic data to enhance model effectiveness, it also raises concerns about inadvertently exposing sensitive patterns. If performance improvements exceed acceptable privacy thresholds, mitigation strategies such as adding calibrated noise during generation (or post hoc to the synthetic data) can help reduce re-identification or leakage risks. Alternatively, increasing the N m i n constraint can further safeguard against exposing sensitive outliers in sparsely populated regions of the embedding space.

When performance improvements suggest potential privacy leakage, it is essential to implement safeguards that limit the risk of revealing sensitive information without compromising the usefulness of the resulting synthetic data. To that end, we evaluated two complementary strategies: (a) Increasing the minimum number of neighbors ( N m i n ) considered during synthetic data generation, which reduces the risk of modeling outliers in sparse regions and makes each synthetic instance to be created based on the statistical distribution of a larger local cluster; and (b) injecting controlled noise into the resulting synthetic dataset, which helps obscure sensitive feature correlations while maintaining high-quality data generation.

Figure 4 shows how increasing the number of minimum and maximum neighbors used to generate synthetic data can negatively affect the performance of the resulting synthetic dataset. This evaluation compares synthetic versions generated using [ N m i n , N m a x ] ranges from [ 4 , 8 ] to [ 256 , 512 ] . As the number of neighbors increases, synthetic data generation prioritizes broader generalization over local specificity. Consequently, we observe a steady decline in both individual label prediction performance and the overall macro F1 score in the original evaluation task when using the resulting synthetic data as the training set. Increasingly diluted clusters cause this performance degradation as more neighbors are aggregated, consistently affecting all features in the dataset, potentially helping reduce the risk of data leakage or sensitive data reconstruction.

We also evaluated the effect of introducing calibrated noise directly into the resulting synthetic dataset, aiming to obscure fine-grained patterns that could otherwise enable re-identification or reveal rare feature combinations. We experimented with two noise injection strategies: (a) Adding noise only to specific target features considered more privacy sensitive or highly predictive, and (b) applying noise uniformly across all features in the dataset. In Figure 6, we contrast these two strategies with the idea of increasing [ N m i n , N m a x ] described above, aiming to address privacy concerns related to the three features in the Infant Health dataset. We observed that increasing the number of nearest neighbors has less impact on performance compared to adding controlled noise to the synthetic data, since SYNNER assigns higher weights to neighbors closer to the center of each cluster (i.e., each synthetic target instance), regardless of the total number of neighbors considered (Figure 6(A)). Furthermore, we found that adding noise only to features identified as sensitive to reconstruction does not necessarily reduce privacy risks by the same proportion, mainly when those features can be inferred from combinations of other features (Figure 6(B)). Only after adding 100% noise, which fully randomized the target features, the performance of the synthetic model dropped to the same level observed in the original data. This suggests that applying controlled noise across all features may be a more effective strategy to mitigate potential data leakage (Figure 6(C)).

OPEN IN VIEWER

Figure 6.

Comparison of three strategies to mitigate privacy leakage in the Infant Health dataset: (a) Increasing nearest neighbor constraints, (b) adding noise to specific sensitive features (CXR = Chest X-Ray; XRR = X-Ray Report, LF = Lung Flow), and (c) adding noise across all features. Results show that global noise injection is most effective at reducing predictive performance for sensitive features, suggesting it as a stronger safeguard than targeted feature noise or neighborhood expansion alone.

Finally, we analyzed duplicate records using two benchmark datasets: (a) Mushroom (in Table 6), which consists entirely of categorical features, and (b) Avila Bible (in Table 7), which contains continuous features (except for the target label), all normalized to similar scales. We compared the characteristics of the original datasets with their corresponding synthetic versions generated by four tools, including SYNNER.

OPEN IN VIEWER

Table 6.

Analysis of duplicate and unique instances in the mushroom dataset when synthetic data are generated by different tools (synthpop, ARGN, Conditional tabular generative adversarial network (CTGAN), SYNNER).

Synthetic	% Unique	Duplicate ratio	F1 score
Approach	Instances	(regarding original)	(original task)
Original	94.74%	–	1.0000
Synthpop	40.70%	7.05%	0.9988
ARGN	48.78%	52.51%	0.9994
CTGAN	83.39%	12.00%	0.9351
SYNNER	48.69%	37.28%	0.9919

Percentages of unique instances, duplicate ratios relative to the original dataset, and F1 scores for the original classification task are reported. Results show that while SYNNER generates fewer unique records than CTGAN, it achieves higher predictive accuracy, placing it in an intermediate position that balances utility and duplication risk.

OPEN IN VIEWER

Table 7.

Analysis of duplicate and unique instances in the avila Bible dataset under different synthetic generation tools.

Synthetic	% Unique	Duplicate ratio	Macro F1 score	Avg Min Diff
approach	instances	(regarding original)	(original task)	(L2 norm)
Original	99.94%	–	0.9932	0.93589
Synthpop	98.37%	1.43%	0.9294	0.51521
ARGN	100.00%	0.01%	0.6256	0.71424
Conditional tabular generative adversarial network (CTGAN)	100.00%	0.00%	0.2276	1.01658
SYNNER	100.00%	0.00%	0.6046	0.82237

Continuous variables were rounded to one decimal place when computing duplicates. Metrics reported include percentage of unique instances, duplicate ratios relative to the original dataset, macro F1 scores, and average minimum pairwise Euclidean distance (“Avg Min Diff”) as a measure of similarity between records. Results indicate that SYNNER avoids generating exact duplicates, while achieving a similarity profile (“Avg Min Diff”) closer to the original dataset than other methods, balancing fidelity with privacy preservation.

We considered two instances in the Mushroom dataset to be duplicates if they shared identical values across all features. In the original training set, nearly 95% of the instances are unique. As expected, synthetic data generation tools may reproduce this tendency to duplicate records. Synthpop, ARG, and SYNNER generated synthetic datasets in which only about 50% of the instances were unique, yet they still maintained high predictive accuracy in the test set. Synthpop was also effective in avoiding duplication of instances from the original data ( 7%). CTGAN, on the other hand, produced far fewer internal duplicate records and just 12% duplicates of the original data, but showed a notable drop in performance, with nearly a 7% reduction in the F1 score, suggesting that the resulting synthetic data loses utility as much as it becomes more randomly generated. Although SYNNER stays in an intermediate position when balancing internal versus original duplicates, the resulting synthetic data still performs accurately in the prediction task.

In the Avila Bible dataset, we considered two instances as duplicates if they shared identical values after rounding each continuous feature to one decimal place. In the original training set, there are only a few duplicates (actually very similar instances), and only Synthpop produced internal and original duplicates at a ration of less than 2% of the resulting synthetic dataset, leading to a higher prediction performance, but also raising concerns about privacy and data leakage. For each instance, we also computed its closest pair, defined as the minimum Euclidean distance (L2 norm) over all feature values, reported in Table 7 as ”Avg Min Diff”. The less the difference, the more similar the instances are within the resulting dataset. SYNNER approximates the best when instances differ from each other in the original data.

Finally, we computed the number of unique instances and the duplicate ratio in each of the evaluated datasets (original and synthetic versions produced by our approach), as shown in Table 8. We highlight the large number of duplicates in the original Stroke Prediction dataset when considering categorical features only, with less than 3% of its instances being unique, a behavior captured by SYNNER, which generated only 3.46% of unique synthetic combinations of categorical values, also reflected in the high duplication ratio compared to the original data (only ∼ 3% instances in the synthetic version are distinct from those in the original data).

OPEN IN VIEWER

Table 8.

Comparison of unique instance percentages and duplicate ratios between original datasets and SYNNER-generated synthetic versions.

Dataset	% Unique instances (original)		% Unique instances (SYNNER)		Duplicate ratio (regarding original)
	Categorical (only)	With continuous	Categorical (only)	With continuous	Categorical (only)	With continuous
Fetal health	98.19%	98.77%	100.00%	100.00%	0.00%	0.00%
Infant health	89.15%	–	85.64%	–	11.51%	–
Stroke prediction	2.98%	99.76% ( a )	3.46%	91.96% ( b )	96.97%	0.20% ( c )
Genetic disorder ( d )	100.00%	100.00%	100.00%	100.00%	0.00%	0.00%
Avila Bible ( e )	−	99.94%	–	100.00%	–	0.00%
Polish bankruptcy ( f )	−	99.94%	−	100.00%	−	0.00%
Mushroom classification	94.74%	–	48.69%	–	37.28%	–

Results are reported separately for categorical-only features and continuous-inclusive features (rounded as indicated). Findings illustrate dataset-specific duplication behaviors in both original and synthetic data. While some duplicates appear in SYNNER-generated data, these are not intentional replications of original records; rather, they arise from the probabilistic sampling process, where feature values are drawn independently from the distributions of nearest neighbors, which reflects the balance between preserving local feature distributions and minimizing overfitting to individual records.

( a , b , c ) continuous variables rounded as int.

( d , e , f ) all continuous variables rounded with 1 decimal place.

Our privacy analysis evaluates empirical resilience against adversarial privacy attacks. While these simulations demonstrate robustness, they do not constitute a formal DP guarantee. Thus, we report empirical reductions in privacy risk but do not claim provable DP compliance. We acknowledge that highly sensitive applications, such as those involving the infant health dataset, require stronger safeguards. Several mitigation strategies can reduce leakage risks if our method is deployed in practice. First, formal DP mechanisms can be integrated during training by injecting calibrated noise into gradients or outputs,^48,49 thereby providing provable guarantees that individual records cannot be inferred. Second, data minimization and aggregation strategies should be applied, where rarely occurring or uniquely identifying variables are generalized or grouped to reduce the risk of re-identification. Third, generating synthetic data under DP constraints can serve as a privacy-preserving alternative, particularly in cases where rare events, such as neonatal conditions, could otherwise be memorized by the model. Furthermore, because membership inference attacks ⁵⁰ remain a particularly significant threat in health data scenarios, where an adversary attempts to determine whether the record of a specific individual was part of the training set, our framework could be extended with adversarial training or defenses based on DP to mitigate this risk further. Finally, robust access control and audit mechanisms should be implemented to monitor the use of trained models with limited exposure of potentially sensitive outputs.

Real-world applicability

A central motivation for SYNNER is its potential use in clinical settings, where hospitals often need predictive models but face critical constraints on sharing sensitive patient data. In such scenarios, external companies or research groups may offer candidate solutions, yet they cannot be granted access to the original clinical data at the outset. SYNNER provides a practical pathway to overcome this barrier by enabling hospitals to generate synthetic datasets that preserve a substantial fraction of the original predictive signal (approximately 83.2% in our experiments).

Consider a real-world example: A hospital needs to develop a predictive model but cannot grant immediate access to its clinical data. In this scenario, SYNNER enables the hospital to generate synthetic datasets that capture a significant portion of the predictive signal while maintaining robust privacy safeguards. These synthetic datasets can be shared with external research groups or companies for prototyping models without direct access to the original clinical data.

Internally, the hospital can then evaluate candidate models against held-out real test data, thus quantifying the performance gap between models trained on synthetic data and those trained on the original data. This screening step substantially reduces the number of external agents that ultimately require access to sensitive clinical data, ensuring that only the most robust approaches move forward and thereby minimizing exposure risks.

However, it is essential to note that synthetic data alone is not intended for the final deployment of clinical models. Their role is to support pre-evaluation and model screening, allowing institutions to identify promising approaches while preserving patient privacy. The representativeness of synthetic datasets, even when relatively high, does not guarantee preservation of all feature dependencies or subgroup-specific relationships. Therefore, once candidate models have been identified, they must undergo independent validation and retraining on the original, unseen clinical data as an indispensable step to confirm reliability and safety before deployment. In this sense, the contribution of SYNNER is to enable privacy-preserving prototyping and collaboration, not to replace validated clinical models.

SYNNER’s built-in DP evaluation further strengthens this workflow by quantifying privacy risks and supporting mitigation strategies such as tighter neighborhood constraints or calibrated noise injection. These safeguards should be viewed as mechanisms to measure and manage potential biases in model performance and re-identification risks, rather than as a means to eliminate them.