# RAPID: Risk of Attribute Prediction-Induced Disclosure in Synthetic Microdata

arXiv: https://arxiv.org/abs/2602.09235 · HTML: https://mlsanity.com/paper/2602.09235/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 9 of its 38 references that are in the map.
- First posted on arXiv 9 Feb 2026.

## Builds on (most cited first, 9 of 9)

- [XGBoost: A Scalable Tree Boosting System](https://mlsanity.com/paper/1603.02754/) (2016)
- [ranger: A Fast Implementation of Random Forests for High Dimensional Data in C++ and R](https://mlsanity.com/paper/1508.04409/) (2015)
- [A Critical Review on the Use (and Misuse) of Differential Privacy in Machine Learning](https://mlsanity.com/paper/2206.04621/) (2022)
- [The Limits of Differential Privacy (and its Misuse in Data Release and Machine Learning)](https://mlsanity.com/paper/2011.02352/) (2020)
- [Database Reconstruction Is Not So Easy and Is Different from Reidentification](https://mlsanity.com/paper/2301.10213/) (2023)
- [Ensembling Membership Inference Attacks Against Tabular Generative Models](https://mlsanity.com/paper/2509.05350/) (2025)
- [When Machine Learning Models Leak: An Exploration of Synthetic Training Data](https://mlsanity.com/paper/2310.08775/) (2023)
- [Escalation of Commitment: A Case Study of the United States Census Bureau Efforts to Implement Differential Privacy for the 2020 Decennial Census](https://mlsanity.com/paper/2407.15957/) (2024)
- [Beyond the Trade-off Curve: Multivariate and Advanced Risk-Utility Maps for Evaluating Anonymized and Synthetic Data](https://mlsanity.com/paper/2510.23500/) (2025)

## Abstract (arXiv)

Statistical data anonymization increasingly relies on fully synthetic microdata, for which classical identity disclosure measures are less informative than an adversary's ability to infer sensitive attributes from released data. We introduce RAPID (Risk of Attribute Prediction--Induced Disclosure), a disclosure risk measure that directly quantifies inferential vulnerability under a realistic attack model. An adversary trains a predictive model solely on the released synthetic data and applies it to real individuals' quasi-identifiers. For continuous sensitive attributes, RAPID reports the proportion of records whose predicted values fall within a specified relative error tolerance. For categorical attributes, we propose a baseline-normalized confidence score that measures how much more confident the attacker is about the true class than would be expected from class prevalence alone, and we summarize risk as the fraction of records exceeding a policy-defined threshold. This construction yields an interpretable, bounded risk metric that is robust to class imbalance, independent of any specific synthesizer, and applicable with arbitrary learning algorithms. We illustrate threshold calibration, uncertainty quantification, and comparative evaluation of synthetic data generators using simulations and real data. Our results show that RAPID provides a practical, attacker-realistic upper bound on attribute-inference disclosure risk that complements existing utility diagnostics and disclosure control frameworks.