Who Bears Privacy Risk? Model-Dependent Memorization in Synthetic Tabular Data

Abstract

Privacy risk in synthetic tabular data is typically evaluated as an aggregate property: how much leakage exists, rather than who is exposed. But aggregate metrics treat individuals as undifferentiated, hiding whether certain records or subgroups are systematically more exposed than others. If risk is unevenly distributed, a natural but largely unexplored question is whether the choice of generative model itself shifts who bears it. We address this question through per-sample nearest-neighbor memorization analysis across diffusion-based and LLM-based tabular generators on real-world financial and clinical datasets. We find that the training records at highest memorization risk vary substantially across generators, with some model pairs exposing nearly disjoint victim sets, and that the most exposed demographic subgroups shift with the generator deployed: on the financial dataset, diffusion models disproportionately expose lower-income individuals while an LLM-based generator over-exposes higher-income ones; on the clinical dataset, LLM-based models concentrate memorization on a clinically sensitive subpopulation that diffusion models largely spare. Standard aggregate privacy metrics surface neither pattern; in at least one case, a model with more favorable aggregate metrics shifts who is exposed rather than uniformly reducing risk. We argue that model selection for synthetic data generation is implicitly a decision about which subpopulations bear privacy risk, constituting a fairness consideration distinct from aggregate privacy guarantees. Privacy evaluations that rely on aggregate metrics alone may fail to identify the individuals most vulnerable to memorization-based leakage.