Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This study investigates the unintended privacy risks associated with Real-Synthetic Mix-Training (RSMT), where text-to-image (T2I) synthetic data is used to augment real training datasets. The authors establish a theoretical framework, RSMT Memorization Amplification, demonstrating that the inclusion of synthetic data can lead to increased memorization of sensitive real samples, thereby amplifying privacy leakage. They introduce RSMixLeak, a tool for assessing these risks through membership inference attacks, revealing that both benign and adversarial scenarios can significantly compromise the privacy of real training data.
Incorporating synthetic data in training can paradoxically increase the privacy risks of real samples, leading to greater memorization and leakage.
To overcome data scarcity and privacy constraints in data collection, it has become standard practice across academia and industry to augment real training data with text-to-image (T2I)-generated synthetic data, a paradigm we term Real-Synthetic Mix-Training (RSMT). While substituting synthetic data for sensitive real samples is widely regarded as a means to mitigate privacy exposure of the substituted data, the risk to the remaining real samples that actively participate in training has remained largely unexamined. This work reveals, for the first time, that RSMT can substantially amplify privacy leakage of these real training samples. We establish a theoretical framework, RSMT Memorization Amplification, proving that incorporating synthetic data displaces real samples toward peripheral regions of the mixed feature space, in turn forcing the model to memorize them more aggressively. Guided by this foundation, we propose RSMixLeak to systematically assess this risk through membership inference attacks (MIAs). RSMixLeak comprises two variants depending on the adversary's capability. The non-adversarial variant audits a benign RSMT pipeline with an honest T2I provider, establishing a lower bound on the leakage induced by the intrinsic gap between real and T2I-generated data. The adversarial variant considers an adversary who controls the T2I model or contributes crafted data to the T2I provider, and deliberately enlarges this distributional gap on a target class via either high-level semantic attribute binding or imperceptible pixel-level coating, further amplifying leakage on real training data while improving downstream model utility. Motivated by these findings, we further propose a lightweight leakage propensity indicator computable from real data alone that reliably identifies high-risk datasets unsuitable for entering RSMT, as a self-assessable mitigation.