# PRIVET: PRoximIty leakage detection Via Extreme value Theory

arXiv: https://arxiv.org/abs/2510.24233 · HTML: https://mlsanity.com/paper/2510.24233/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 14 of its 34 references that are in the map.
- First posted on arXiv 28 Oct 2025.

## Builds on (most cited first, 14 of 14)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [Denoising Diffusion Probabilistic Models](https://mlsanity.com/paper/2006.11239/) (2020)
- [DINOv2: Learning Robust Visual Features without Supervision](https://mlsanity.com/paper/2304.07193/) (2023)
- [Billion-scale similarity search with GPUs](https://mlsanity.com/paper/1702.08734/) (2017)
- [Variational Inference with Normalizing Flows](https://mlsanity.com/paper/1505.05770/) (2015)
- [Exposing flaws of generative model evaluation metrics and their unfair treatment of diffusion models](https://mlsanity.com/paper/2306.04675/) (2023)
- [How Faithful is your Synthetic Data? Sample-level Metrics for Evaluating and Auditing Generative Models](https://mlsanity.com/paper/2102.08921/) (2021)
- [PFGM++: Unlocking the Potential of Physics-Inspired Generative Models](https://mlsanity.com/paper/2302.04265/) (2023)
- [A Non-Parametric Test to Detect Data-Copying in Generative Models](https://mlsanity.com/paper/2004.05675/) (2020)
- [Feature Likelihood Divergence: Evaluating the Generalization of Generative Models Using Samples](https://mlsanity.com/paper/2302.04440/) (2023)
- [Bounding Information Leakage in Machine Learning](https://mlsanity.com/paper/2105.03875/) (2021)
- [Fr'echet Wavelet Distance: A Domain-Agnostic Metric for Image Generation](https://mlsanity.com/paper/2312.15289/) (2023)
- [Fast training and sampling of Restricted Boltzmann Machines](https://mlsanity.com/paper/2405.15376/) (2024)
- [PQMass: Probabilistic Assessment of the Quality of Generative Models using Probability Mass Estimation](https://mlsanity.com/paper/2402.04355/) (2024)

## Built on by (most cited first, 1 of 1)

- [Equilibrium Training of Energy-Based Models with Parallel Trajectory Tempering](https://mlsanity.com/paper/2607.27077/) (2026)

## Abstract (arXiv)

Deep generative models are often trained on sensitive data, such as genetic sequences, health data, or more broadly, any copyrighted, licensed or protected content. This raises critical concerns around privacy-preserving synthetic data, and more specifically around privacy leakage, an issue closely tied to overfitting. Existing proximity-based methods mostly assess privacy risk through global criteria, which quantify a model's overall behaviour but cannot attribute risk to an individual record. Sample-level outputs do exist but they are either uncalibrated, discontinuous, or blind to leakage occurring while the model is globally underfit, which limits their practical use. Using extreme value statistics on nearest-neighbor distances, we propose PRIVET, a generic sample-based, modality-agnostic algorithm that assigns an individual proximity leak score to each synthetic sample. These are evaluated under a chosen representation and distance, each synthetic sample being assigned a continuous score measuring how improbable its proximity to the training set is under a no-leakage model. We empirically demonstrate that PRIVET detects memorization and more subtle forms of proximity-based data leakage across diverse data modalities, including settings with very high dimensionality and limited sample sizes such as genetic data, and in underfitting regimes that overfitting-based diagnostics cannot reach by construction. Our analysis further shows that the representation bounds what any distance-based evaluation can detect, existing computer vision embeddings failing to yield perceptually meaningful distances for near-duplicate samples. Accordingly, a low score is evidence of leakage in the chosen metric, while its absence is not a certificate of privacy.