SMOTE and Mirrors: Exposing Privacy Leakage from Synthetic Minority Oversampling

TL;DR

This work reveals fundamental privacy risks of SMOTE in both data augmentation and synthetic data generation by showing that naive privacy metrics understate leakage while membership inference attacks can succeed. It introduces two novel attacks, DistinSMOTE and ReconSMOTE, which exploit SMOTE's line-segment interpolation to perfectly distinguish real minority records in augmented data and to reconstruct real records from synthetic data, with solid theoretical guarantees and practical complexity $O(n^2 d + n(kr)^2)$. Experiments across eight imbalanced datasets demonstrate substantial leakage and validate the attacks’ effectiveness, challenging the assumption that SMOTE is privacy-friendly. The findings imply that SMOTE is inherently non-private and can disproportionately expose minority records, motivating the search for privacy-preserving alternatives and more robust evaluation practices in privacy-sensitive applications.

Abstract

The Synthetic Minority Over-sampling Technique (SMOTE) is one of the most widely used methods for addressing class imbalance and generating synthetic data. Despite its popularity, little attention has been paid to its privacy implications; yet, it is used in the wild in many privacy-sensitive applications. In this work, we conduct the first systematic study of privacy leakage in SMOTE: We begin by showing that prevailing evaluation practices, i.e., naive distinguishing and distance-to-closest-record metrics, completely fail to detect any leakage and that membership inference attacks (MIAs) can be instantiated with high accuracy. Then, by exploiting SMOTE's geometric properties, we build two novel attacks with very limited assumptions: DistinSMOTE, which perfectly distinguishes real from synthetic records in augmented datasets, and ReconSMOTE, which reconstructs real minority records from synthetic datasets with perfect precision and recall approaching one under realistic imbalance ratios. We also provide theoretical guarantees for both attacks. Experiments on eight standard imbalanced datasets confirm the practicality and effectiveness of these attacks. Overall, our work reveals that SMOTE is inherently non-private and disproportionately exposes minority records, highlighting the need to reconsider its use in privacy-sensitive applications.

Figures (9)

• Figure 1: DistinSMOTE and ReconSMOTE attacks vs. augmented/synthetic data generated by SMOTE.
• Figure 2: Datasets overview, where $r$ denotes the imbalance ratio ($n_0/n_1$), $n$ the number of records, and $d$ the number of features.
• Figure 3: ReconSMOTE recall and lower bounds (per dataset).
• Figure 4: ReconSMOTE performance w/ varying $r$ (all datasets).
• Figure 5: Exact/approximate bound ratios for two levels of mutuality.

Theorems & Definitions (10)

• Theorem 1: DistinSMOTE perfect precision & recall
• proof
• Theorem 2: ReconSMOTE perfect precision
• Theorem 3: ReconSMOTE expected recall (approximate)
• Lemma 1: Reconstructed edge probability
• proof
• Lemma 2: Lower-bound on per-node identifiability
• proof
• Theorem 4: ReconSMOTE expected recall (exact)
• proof