首次评测大模型在表格生成中的隐私泄露风险，发现其极易复制敏感记录。
Risk In Context: Benchmarking Privacy Leakage of Foundation Models in Synthetic Tabular Data Generation
- 用少量种子数据通过上下文学习生成表格，避免训练但易泄露原始记录。
- 大模型在35个真实数据集上隐私泄露率最高，部分达基线54个百分点以上。
- 调整提示词参数可降低泄露风险，同时保持90%以上数据质量，适合低数据场景使用。
合成表格数据对机器学习至关重要，尤其适用于小样本或不平衡数据扩展及隐私保护共享。然而，当前主流生成模型（GAN、VAE、扩散模型）依赖数千条数据，在低数据环境下易过拟合、泄露敏感信息且需频繁重训练。近期工作采用大预训练变换器通过上下文学习（ICL）生成行，仅需少量种子数据且无需参数更新，避免重训练。但ICL会原样重复种子行，引入新隐私风险，此前仅在文本领域被研究。在表格合成中，单行可能标识个人，该风险严重性尚不明确。本文首次构建基准，对比三种基础模型（GPT-4o-mini、LLaMA 3.3 70B、TabPFN v2）与四种基线，在35个真实世界表格（健康、金融、政策）上评估统计保真度、下游任务效用和成员推理泄露。结果表明，基础模型隐私风险始终最高；LLaMA 3.3 70B在1%误报率下真阳性率比最安全基线高54个百分点。GPT-4o-mini与TabPFN也高度易受攻击。绘制隐私-效用前沿图显示，CTGAN与GPT-4o-mini具有更好权衡。因子实验发现，三个零成本提示调整——小批量、低温、使用摘要统计——可使最坏情况AUC降低14点，稀有类别泄露降低39点，同时保持超过90%保真度。本基准为低数据合成中的更安全应用提供实用指南。
原文摘要 · Abstract (English)
Synthetic tabular data is essential for machine learning workflows, especially for expanding small or imbalanced datasets and enabling privacy-preserving data sharing. However, state-of-the-art generative models (GANs, VAEs, diffusion models) rely on large datasets with thousands of examples. In low-data settings, often the primary motivation for synthetic data, these models can overfit, leak sensitive records, and require frequent retraining. Recent work uses large pre-trained transformers to generate rows via in-context learning (ICL), which needs only a few seed examples and no parameter updates, avoiding retraining. But ICL repeats seed rows verbatim, introducing a new privacy risk that has only been studied in text. The severity of this risk in tabular synthesis-where a single row may identify a person-remains unclear. We address this gap with the first benchmark of three foundation models (GPT-4o-mini, LLaMA 3.3 70B, TabPFN v2) against four baselines on 35 real-world tables from health, finance, and policy. We evaluate statistical fidelity, downstream utility, and membership inference leakage. Results show foundation models consistently have the highest privacy risk. LLaMA 3.3 70B reaches up to 54 percentage points higher true-positive rate at 1% FPR than the safest baseline. GPT-4o-mini and TabPFN are also highly vulnerable. We plot the privacy-utility frontier and show that CTGAN and GPT-4o-mini offer better tradeoffs. A factorial study finds that three zero-cost prompt tweaks-small batch size, low temperature, and using summary statistics-can reduce worst-case AUC by 14 points and rare-class leakage by up to 39 points while maintaining over 90% fidelity. Our benchmark offers a practical guide for safer low-data synthesis with foundation models.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。