Exploring Synthetic Data Validation – privacy, utility and fidelity

The use case is central to discussions around utility and fidelity

Participants of the roundtable emphasised that assessing both utility and fidelity will depend on the purpose of the synthetic data.

Defining a clear and agreed set of goals prior to the generation process will benefit further discussions on utility and fidelity (noting that fidelity is not always required for a synthetic dataset to have utility).

The need to generate and assess synthetic data for each use case could limit incentives to test and adopt this technology. Participants noted that model generalisation – the ability of a deep learning model to learn and properly predict the pattern of unseen data – could be important to drive the adoption of synthetic data.

Generalisation could enable models that generate synthetic data (synthetic data generators) to synthesise data outside of their initial training datasets. Participants felt this could be a potential avenue to expand the utility of synthetic data generators beyond a single use case.

However, challenges such as model drift – the degradation of model performance due to changes in the underlying distribution of data, the target variable, and the relationship between input and output variables – could limit the use of synthetic data to a case-by-case basis.

Generalisation may also reduce the privacy of a synthetic dataset, which we discuss below (see 'The importance of the use case when validating privacy').

Whether synthetic data generators can be generalised to meet multiple use cases is a growing area of industry and academic debate. 

Approaches to validating synthetic data

Discussions around validating utility often differentiate between ‘broad’ and ‘narrow’ measures. ‘Broad’ measures assess the fidelity of the synthetic dataset to the real dataset by quantifying the statistical similarities between the training data and the synthetic dataset. ‘Narrow’ measures compare the differences in model performance, for example inference or prediction, between the original and synthetic dataset.

Broad measures

Participants highlighted that using ‘broad’ measures to retain the statistical properties of the original dataset could enable the use of synthetic data for multiple use cases that require a double of the original data.

Measures to achieve statistical similarity may include comparing univariate and multivariate distributions and the correlations between features.

However, the more similar the synthetic data is to the real data, the higher the risk of re-identification, potentially to the extent where it becomes too difficult to use or share or share the synthetic dataset. This outcome would drastically reduce the utility of the synthetic dataset.

Narrow measures

‘Narrow’ approaches premise that there is no need for a synthetic dataset to perfectly replicate the real data to have value. Instead, narrow approaches assess the utility of synthetic data by comparing the results of a model trained on a synthetic versus real dataset.

However, assessing whether the output of a model trained on synthetic data is sufficiently similar to a model trained on real data can be difficult without an industry standard or a detailed understanding of the acceptable range of difference in model performance.

Mathematical approaches

Participants outlined an additional theoretical basis for validating synthetic data from both a utility and fidelity perspective. They discussed whether it is possible to build mathematical guarantees of fidelity into the synthetic data generator itself, as opposed to a post-hoc assessment of the synthetic dataset or a model trained on synthetic data (as with broad and narrow measures). 

The challenge with this approach would be convincing legal, compliance and/or senior stakeholders that these mathematical ‘guarantees’ are reflected in practice in the generated dataset, without confirming these results with more tried and tested post-generation assessments.

It is likely that post-hoc validation methods (broad or narrow approaches) would still be required to build trust in the synthetic dataset.

Qualitative approaches

Qualitative approaches to synthetic data validation may be used to supplement the techniques outlined above. Participants acknowledged that techniques to validate the utility and fidelity of synthetic data are still nascent.

Developers may therefore need to draw on additional expertise to qualitatively assess whether the data is accurate. 

For a fraud use case, for example, fraud or financial crime experts may be required to assess whether the fraud typologies present in the synthetic dataset match known typologies in the industry. Typologies are a way of describing groups that display different clusters of behaviours or attitudes.

To achieve this, developers would need to standardise the typology formation and explain to experts how the data is behaving in relation to the typology.

Bridging this gap and speaking in the same language could represent a challenge for technical and subject matter experts.

Whilst this approach should be considered as an addition (not replacement) to the approaches outlined above, accessing use case-specific expertise could represent an additional challenge to synthetic data generation. 

The importance of the use case when validating privacy

Validating the privacy of synthetic data should begin by assessing the use case and the required level of accessibility.

For example, the use of synthetic data for internal research and development may (although not always) require less stringent privacy guarantees than synthetic data that is being shared externally.

In such cases, utility and/or fidelity may have greater consideration during the generation process.

Organisations should consider how different forms of synthetic data can pose different identifiability risks, and choose an appropriate release model to mitigate them.

In addition, organisations may differentiate between use cases that require the processing of confidential data versus personal data:

• Confidential information is defined by each individual organisation and may include non-public, sensitive and/or business-related information
• Personal data is information that relates to an identified or identifiable individual and is subject to specific requirements under UK GDPR. 

Organisations in breach of personal data requirements risk regulatory fines, customer compensation claims, legal fees and reputational damage.

They may therefore adopt a higher privacy risk threshold when processing personal data to generate synthetic data. 

To reduce the risk of re-identification from a synthetic dataset, and align with the UK GDPR’s principles of data minimisation and purpose limitation, organisations should only include the properties needed to meet their specific use case, and nothing else. Organisations need to assess whether their synthetic dataset is anonymous or identifiable.

This approach should be prioritised over adding additional properties to enhance the generalisability of a synthetic dataset. 

To navigate the trade-off between privacy and fidelity, organisations might group potential use cases in terms of the type of fidelity and features required and generate multiple synthetic datasets, defining specific privacy requirements for each dataset.

In line with UK GDPR, organisations that take this approach will need to ensure that, where they use personal data to meet additional use cases, this is compatible with the original purpose, they have the consent of the data subjects, or they have a clear obligation or function set out in law.

Validating the privacy of the data versus the generator

Participants debated the various benefits and trade-offs between mathematical notions of privacy (such as differential privacy) versus post-generation assessment of the synthetic dataset.

The debate presided over whether it is possible to build privacy guarantees into the synthetic data generator, or whether post-generation testing of the synthetic data is always required.

One participant mentioned that post-hoc testing may take a similar form to penetration testing, whereby an organisation’s cyber team attempt to re-identify individuals present in the original dataset. 

Mathematical evaluations are useful tools to detect possible flaws in an algorithm or its implementation, but may lead to false guarantees of privacy when there is none.

The Infinite Monkey Theorem (more formally called the Law of Large Numbers), for example, states that a monkey hitting keys at random on a typewriter for an infinite amount of time will eventually replicate any given text, such as the complete works of William Shakespeare.

Applying this theory to synthetic data, one could deduce that a synthetic data generator will eventually generate an exact replica of the real data by chance.

Whilst the likelihood of this occurring is low, it does mean that post-generation testing of the synthetic dataset is needed to affirm mathematical notions of privacy.

Participants noted that convincing legal teams and senior stakeholders that the generated data is actually private is an additional challenge with mathematical notions of privacy. One participant used crash testing as an analogy to illustrate this point.

They stated that customers would feel much safer driving a car that has been thoroughly crash tested over a car that had mathematical ‘guarantees’ of safety built in when it was being developed.

It follows that legal and senior stakeholders will likely prefer additional post-generation testing to confirm that the synthetic dataset is sufficiently private. 

Transitioning to a risk-based model for privacy

Regulators and standard-setting bodies are often asked about precise numbers, metrics or criteria that can guarantee the privacy of a synthetic dataset.

In reality, the only complete privacy guarantee that can be given is if organisations do not create or share synthetic data. As a rule of thumb however, zero risk equates to zero utility for a synthetic dataset.

To drive adoption, the industry could shift to a risk-based model that accepts some level of inherent risk in generating and sharing synthetic data.

This approach aligns with the UK GDPR, as data protection law does not require anonymisation to be completely risk-free. Organisations must be able to mitigate the risk of re-identification until it is sufficiently remote that the information is ‘effectively anonymised’.

They must assess whether the identification of individuals is ‘reasonably likely’ relative to the circumstances of the processing, rather than protect against every hypothetical or theoretical risk of identifiability.

A risk-based model may include risk frameworks and acceptable ranges of risks.

Factors assessed in such a model may include singling out, linkability and inference, the release model (public or closed release), motivated intruders, and the time, cost, and technologies/techniques available for re-identification.

These ranges may be defined by an independent body, such as the IEEE Synthetic Data project, other industry standard-setting initiatives, and/or regulators.

Industry might also need to socialise risk frameworks and ranges with stakeholders within their organisation (seniors, legal and cyber teams) to build trust in the overall approach. 

Risk is not static, therefore, a risk-based model for assessing the privacy of synthetic data will need to be iterative.

For example, the risk of re-identification for a particular synthetic dataset may increase over time as more real data becomes publicly available.

The feasibility and cost-effectiveness of the available means to identify individuals can also change over time.

This means the status of synthetic data – as personal data or anonymous – can change over time.

Moving to and gaining widespread stakeholder buy-in for a risk-based model could help overcome barriers to adoption for synthetic data and build trust in the technology across the data lifecycle.  

This section explores broader approaches for encouraging the adoption of synthetic data in financial services.

It investigates three interdependent approaches discussed during the roundtables:

• Use Case Exploration.
• Standards, Frameworks and Guidance, and
• the Role of the Regulator. 

While these approaches are separated in this paper, we recognise their interdependency. Advancing these three approaches can help build trust in this emerging technology, ensure responsible use in financial services, and drive further synthetic data adoption in the sector.

Use Case Documentation

The most frequently mentioned approach during the roundtables was the exploration of use cases to expand the evidence base for the adoption of synthetic data. Ultimately, participants agreed that synthetic data is not a silver bullet for sharing data in financial services.

Given this, deeper investigation into potential use cases of synthetic data is required to drive adoption in the financial services sector and determine when it's relevant, useful, and when it may not be suitable.

Participants also acknowledged the potential for collaboration between industry, academia, and regulators in producing more tried and tested use cases for synthetic data.

Participants referenced anonymisation techniques, testing the validity of synthetic datasets for specific purposes (eg, identifying fraudulent activity), and augmenting existing datasets to improve their utility for certain financial services applications.

Furthermore, participants noted that effective use cases require thorough documentation. As a minimum, such documentation should include details on how utility was measured, fidelity considerations, privacy trade-offs, and potential biases of a model.

This documentation can fill knowledge gaps, drive synthetic data development, and provide stakeholders with essential information to determine if synthetic data is the right tool for their use case.

Participants agreed that developing and sharing use cases creates a larger evidence base for stakeholders, building trust in this emerging technology and increasing the buy-in needed for synthetic data adoption in financial services.

To this end, the FCA will continue exploring ways to facilitate use case exploration, potentially leveraging its Innovation Services (such as TechSprints or the Digital Sandbox) and convening experts to work collaboratively on targeted, non-competitive use case development.

The ICO is committed to facilitating the development of the responsible and legal use of synthetic data use cases in financial services.

Working with external experts from industry and academia, we are developing case studies which will demonstrate how synthetic data can be used to share data responsibly and legally between financial institutions, while complying with data protection law and mitigating the risks to individuals.

Standards, Frameworks and Guidance

The IEEE outlines that standards form the fundamental building blocks for product development by establishing consistent protocols that can be universally understood and adopted, while also helping to build consumer trust and stakeholder buy-in. 

However, attaining industry standards first requires collaboration among stakeholders to develop a comprehensive understanding of how firms are using synthetic data in industry.

Throughout the roundtable, we observed a high level of interest from industry and academia to engage and to advance discussions to inform future conversations on standards in synthetic data.

Building upon the further exploration of use cases and potential standardisation, participants highlighted the need for practical frameworks and guidance to support synthetic data vendors and industry players in financial services.

These resources would not only facilitate a better understanding of validating synthetic data from the perspectives of utility, fidelity, and privacy but also provide practical, step-by-step guidance for experimenting with this technology.
Frameworks and guidance can equip practitioners with the confidence to navigate the application of synthetic data, ensuring the responsible use of emerging technologies and techniques.

Moreover, these resources could help drive stakeholder buy-in by providing evidence for the technology's effectiveness, thus fostering responsible adoption within financial services.

Role of the Regulator

The Regulatory Horizons Council Closing the Gap report highlights how regulation and regulators play an important role in a landscape that supports innovation in emerging technologies, such as synthetic data. Regulators can serve as conveners of stakeholders to create non-competitive environments that drive collaboration and innovation in synthetic data.

For example, participants mentioned the benefit of the FCA’s Innovation Services, such as TechSprints and the Digital Sandbox, for driving innovation in synthetic data.

Participants recognised that, while further guidance from regulators is essential as a technology matures, it is equally important for regulators to provide space for the creation of industry-led guidance, frameworks, and standards.

In light of this, the ICO and Professor Carsen Maple of the Alan Turing Institute are participating in the IEEE Synthetic Data standards working group, to provide a regulatory and academic perspective to the industry effort.

Regulators can also bring the ecosystem together to collaborate on the unknowns, barriers, and challenges associated with synthetic data in financial services.