CoRTeC: A Differentially Private Release for Synthetic Tabular Data, Decodable by Any Generator

📌 Highlights

CoRTeC's central idea is to make the privacy-sensitive object a small, inspectable release of noisy counts rather than a trained generator. The release is produced once, and maximum-entropy or frozen-language-model decoders can generate rows from it repeatedly.

The paper reports the strongest headline result for the maximum-entropy decoder at ε = 2: classifier utility on Adult is within 0.02 AUC of a same-sized real sample across three splits. On NHANES and bank marketing, the release remains within 0.05 AUC without the selection step. These gains come with a workload trade-off: fixed cohort and conditional-rate measurements better preserve named outcome rates, while adaptive workloads can fit column pairs more closely.

• Only Stage A reads private rows; decoding, selection, and redraw operate on the release.
• The release provides class balances, class-conditional histograms, cohort sizes, and conditional outcome rates.
• Four controls separate the contributions of the release, selection step, language model, and schema semantics.
• The paper reports no real-row exposure to the model and no generated row copying a real training row.

🎯 Introduction

The paper targets institutions that hold useful but sensitive tabular records, including hospital, insurance, and statistical data. Existing approaches fall into marginal mechanisms, generators trained with differential privacy, and frozen foundation-model methods. The paper argues that these approaches generally spend privacy budget during model training, adaptive candidate rounds, or private scoring rather than producing a single reviewable artifact.

CoRTeC's objective is to satisfy three operational requirements simultaneously: spend privacy once on preselected measurements, allow later decoding by another team or model without another privacy charge, and make the incremental value of a language model measurable. The proposed release is designed around downstream classifier needs and includes conditional outcome-rate cells selected to match deployment-relevant groups.

🔬 Methodology

Stage A forms non-overlapping cohorts from public domains and releases noisy cohort sizes, target balances, class-conditional histograms, and conditional outcome rates. Histograms are used because their sensitivity remains 1 regardless of the number of bins. Class blocks can be released in parallel, and conditional cells form partitions whose rates are post-processing of two noisy counts.

Stage B allocates rows across cohorts and asks either a frozen language model or a maximum-entropy Private-PGM decoder to produce candidate rows from the release. The language-model prompt contains exact released counts and requested counts, not private records. CoRTeC-Select then fits generated rows to the release through iterative proportional fitting, weighted sampling, refinement swaps, and within-bin numerical redraw. The optional Stage C adds a separately budgeted conditional-rate certification procedure.

The privacy proof relies on public cohort formation, sequential composition within query chains, parallel composition across disjoint cohorts and cells, and post-processing for every operation after release generation. The paper states that Algorithms 1 and 2 plus generation are εtotal-differentially private, with optional Stage C adding εcert.

📊 Experiments

The main evaluation uses UCI Adult, NHANES 2017-2018, and bank marketing. The main split uses seed 42; Adult is used for every comparison, controls, ladder, and replication, NHANES is used for the auto-configured clinical evaluation and replication, and bank marketing is used as a third dataset with one split. Comparisons include AIM, MST, DP-2Stage, DP-LLMTGen, and Tab-PE, plus controls for the release without a language model, the language model without a release, and a permuted-target floor.

Fidelity is measured with one-way and two-way total variation and conditional total variation on seen cohort groups and held-out groups. Utility is train-on-synthetic, test-on-real AUC using logistic regression, random forest, and gradient-boosting students. The paper reports that maximum-entropy CoRTeC at ε = 2 comes within 0.02 AUC of a same-sized real sample on Adult across three splits, while NHANES and bank marketing remain within 0.05 AUC without the selection step.

The ablation evidence supports a mechanism-level interpretation: most utility comes from the private release and selection step, while the language model contributes information associated with column names. With a fixed cohort rule, CoRTeC carries named conditional outcome rates more closely than a same-sized real sample, but the paper reports a cost in pairwise-column accuracy. The supplied main-body evidence does not provide complete numeric cells for every baseline or control, so those comparisons should be verified in the full experiment tables before reproducing exact rankings.

• AUC is the utility metric; higher AUC is better. Total variation measures fidelity; lower error is better.
• The primary CoRTeC setting uses ε = 2, α = 0.2, γ = 0.02, and nmin = 150.
• Reference AIM and MST use the authors' private-pgm implementation on the same public bins; their reported comparison uses (ε, δ)-DP with δ = 10⁻⁹.
• DP-2Stage and DP-LLMTGen use DP-SGD with δ = 10⁻⁵, while CoRTeC's release is pure ε-DP with δ = 0.
• At ε = 2, the paper gives the theoretical membership-inference advantage bound as 0.762 and reports the strongest attack far below it.

Figure 1

Caption: Figure 1: The privacy budget is spent once in Stage A. In Stage B, either the maximum-entropy decoder or a frozen language model turns the released statistics into rows, and the selection step matches those rows to the released counts. Everything to the right of the dashed line reads only the release, so it can be repeated without limit.

Why It Matters: This is the core system boundary: only Stage A reads private data, while decoding and selection are repeatable post-processing.

Figure 2

Caption: Figure 2: The cohort of Example 1 as it leaves the institution. (a) The age histogram released for each outcome class over the public bin edges. (b) The relationship shares for each class. Hatched markers show categories whose noised share fell to 0.005 or below. These receive zero weight in the selection step. Every bar is a released number. The decoders read only released numbers like these, together with the class balance, the cohort size and the two conditional cells.

Why It Matters: The example makes the release concrete and shows how class-specific histograms, suppression, and conditional cells become the only information available to downstream decoders.

🔮 Conclusion

CoRTeC demonstrates a useful privacy architecture for synthetic tabular data: release auditable noisy statistics once, then treat generation as replaceable post-processing. The maximum-entropy path shows that the method does not require private fine-tuning or even a language model, while frozen language models can decode the same interface without seeing private rows.

The main evidence supports strong classifier utility at the chosen ε = 2 setting and shows that selection is important for matching released counts. The result is not a universal replacement for adaptive marginal methods or private fine-tuning: fixed workloads trade pairwise fidelity for deployment-named conditional rates, and the privacy model's row-level semantics must match the data contribution structure.

🛠️ Future Research Improvements

The most direct next step is to quantify the workload trade-off more systematically across privacy budgets, bin resolutions, cohort rules, and conditional-cell floors. The paper identifies that fixed workloads can lose accuracy on column pairs, so future work should test hybrid designs that preserve auditable conditional rates while allocating some budget to adaptive pairwise structure.

A second direction is stronger person-level accounting for longitudinal or encounter data, where one person can contribute multiple rows. Further evaluation should also test whether pretrained-model memorization assumptions remain acceptable when the model provider, training corpus, or inference interface changes.

• Compare fixed, auto-configured, and adaptive workloads under matched ε and δ accounting.
• Measure utility and membership risk as the maximum rows-per-person contribution increases.
• Evaluate decoder replacement and vendor-hosted inference under schema drift and changing column semantics.

🏭 Potential Industry Use Scenarios

A hospital or insurer could keep patient-row processing inside its perimeter, release a reviewed file of noisy cohort statistics, and give an external analytics team synthetic rows for classifier development. Conditional-rate cells could represent clinically or operationally named groups, while the selection step keeps generated samples aligned with the released cohort structure.

A government statistics office, bank, or marketing organization could use the same release as a stable interface for multiple downstream generators or modeling teams. The maximum-entropy decoder provides a model-free baseline, while a frozen language model can be swapped in when its public knowledge improves schema interpretation. These scenarios require explicit governance around public domains, bins, cohort rules, row contribution limits, and checks for nearest-record proximity and memorization.

• Privacy-reviewed data sharing for external classifier prototyping.
• Repeatable synthetic-data generation for multiple vendors or internal teams.
• Auditable cohort-level outcome-rate releases for model development and monitoring.

💬 Critical Analysis

The strongest design choice is the separation between measurement and generation. It gives engineers a concrete object to inspect, makes decoder replacement straightforward, and supports a clean ablation of what the language model contributes. The class-conditional histograms and conditional-rate cells are also more directly connected to classifier training and deployment questions than an undifferentiated synthetic table.

The principal weakness is workload dependence. A release can be easy to audit precisely because it measures a limited set of relationships; the paper acknowledges that fixed workloads can lose pairwise fidelity. The ε = 2 headline is informative but does not establish behavior at the smaller budgets often used in private-data benchmarks, and the baseline methods do not all share identical privacy definitions.

For production adoption, the privacy guarantee should be reviewed at the level of people rather than rows, the public schema should be versioned, and the release should be tested against distribution shift and memorization. The paper's reported attack result is reassuring relative to its theoretical bound, but it is not a substitute for threat-model-specific evaluation when pretrained models, external APIs, or repeated downstream releases are involved.

• Strength: one-shot, inspectable privacy accounting with decoder portability.
• Caveat: fixed measurements may underrepresent higher-order or held-out relationships.
• Verification question: how stable are the utility and privacy results below ε = 2 and under multi-row person contributions?
• Verification question: how do model-provider assumptions affect memorization risk when the frozen decoder is externally hosted?