PRIVET: PRoximIty leakage detection Via Extreme value Theory

Abstract

Deep generative models are often trained on sensitive data, such as genetic sequences, health data, or more broadly, any copyrighted, licensed or protected content. This raises critical concerns around privacy-preserving synthetic data, and more specifically around privacy leakage, an issue closely tied to overfitting. Existing proximity-based methods mostly assess privacy risk through global criteria, which quantify a model's overall behaviour but cannot attribute risk to an individual record. Sample-level outputs do exist but they are either uncalibrated, discontinuous, or blind to leakage occurring while the model is globally underfit, which limits their practical use. Using extreme value statistics on nearest-neighbor distances, we propose PRIVET, a generic sample-based, modality-agnostic algorithm that assigns an individual proximity leak score to each synthetic sample. These are evaluated under a chosen representation and distance, each synthetic sample being assigned a continuous score measuring how improbable its proximity to the training set is under a no-leakage model. We empirically demonstrate that PRIVET detects memorization and more subtle forms of proximity-based data leakage across diverse data modalities, including settings with very high dimensionality and limited sample sizes such as genetic data, and in underfitting regimes that overfitting-based diagnostics cannot reach by construction. Our analysis further shows that the representation bounds what any distance-based evaluation can detect, existing computer vision embeddings failing to yield perceptually meaningful distances for near-duplicate samples. Accordingly, a low score is evidence of leakage in the chosen metric, while its absence is not a certificate of privacy.