Most vendor pages say their synthetic data is “private”. Very few say how private, in a way you could check. Differential privacy is the one approach that turns the claim into a number. This writeup explains that number without equations, and what it does and does not buy you.
Why “no row is copied” is not enough
A generator trained on a customer table can produce rows that match no real customer exactly and still give people away. Picture a table with one 97-year-old customer in a small town who spends ten times the average. If the synthetic table contains a 96-year-old in the same ZIP prefix with the same spending pattern, nobody needs an exact copy to work out who that is.
Exact-match checks and “distance to the closest real row” tests catch the crude cases. They cannot prove the absence of subtler exposure, because they only test the attacks you thought of. Differential privacy takes a different route: instead of checking the output, it limits what the generator can learn about any single record in the first place.
What differential privacy actually promises
The promise is this. Take the training data and run the generator twice: once with your record in it, once without. If the method is differentially private, the two results are almost impossible to tell apart. So anything an attacker learns from the synthetic data, they would have learned (nearly) as well if your record had never been used.
That is a strong property. It holds whatever the attacker knows already, and it holds for attacks nobody has invented yet. The price is noise: the training process adds carefully sized randomness so that no single record can pull the model far.
Epsilon and delta, without the formula
Epsilon is the size of “almost”. It caps how much more likely any output becomes because your record was included. Small values, below about 1, give a tight cap. As epsilon grows the cap loosens fast, because the bound works on an exponential scale: an epsilon of 10 is not ten times weaker than 1, it is thousands of times looser.
Delta is the small chance that the cap fails altogether. A sound setting makes delta much smaller than one divided by the number of records, so that the failure is unlikely to hit anyone.
People call epsilon the privacy budget because every use of the data spends some of it. Training a generator spends budget. So does choosing category lists or value ranges by looking at the real data, and so does a second release trained on the same source.
Three details that decide what a number is worth
| Question | Why it matters |
|---|---|
| What is the unit protected? | Per-row privacy protects one transaction. A customer with 300 transactions is protected far less. Ask whether the unit is a row or a person. |
| Where was the budget spent? | If column ranges or category lists were read from the real data without noise, the quoted epsilon covers only part of the process. |
| Is it the total? | Each new dataset generated from the same source with a fresh model spends more. Three releases at epsilon 2 are not one release at epsilon 2. |
What it costs in quality
Noise is not free. The effect is mild on large tables with common patterns and harsh on small tables, rare categories and long tails. A rare product code, a ZIP code with three customers or a fraud label at 0.1% are exactly what a private generator blurs, because learning them precisely would reveal the few records behind them.
That trade-off is the point, not a defect. If your use depends on rare values being reproduced faithfully, differential privacy and that use are in tension, and you should decide which matters more before the trial, not after.
What vendors say about it
On the pages we read on 7 November 2026, none of the synthetic data companies we track stated an epsilon value or a differential privacy guarantee in terms we could quote. Aindo lists a Europrivacy certification, a GDPR certification scheme, on its security page; that is a certification of data protection practice, not a differential privacy parameter. Tonic.ai describes its products around de-identification and generation. The absence on public pages does not mean a vendor lacks the feature. It means you have to ask, and get the answer in writing.
Questions to send before a trial
- Is differential privacy applied during training? If so, what epsilon and delta, and for which unit (row or person)?
- Is any preprocessing done on the real data outside the privacy budget?
- How is the budget accounted for across repeated releases from the same source?
- Which empirical privacy tests run on each output, and can we see the results?
- Can we choose a stricter setting, and what does the vendor’s own report show about the quality cost?
When you can do without it
Not every project needs a formal guarantee. A staging database used by your own engineers, behind your own access controls, may be fine with de-identified synthetic data and good empirical tests. A dataset you plan to hand to a partner, publish or use to train a model that others will query is a different matter: there, a stated and well-accounted epsilon is the only privacy claim you can defend to someone who does not trust you.
Write the threshold into the brief before you talk to anyone, and judge every vendor’s answer against that line rather than against their slide.