Rémy Chapelle

Bruno Falissard

Statistical properties and privacy guarantees of an original distance-based fully synthetic data generation method

Keywords: synthetic data, Open Science, disclosure control, risk-utility assessment

Introduction:

The amount of data generated by original research is growing exponentially. Publicly releasing them is recommended to comply with the Open Science principles. However, data collected from human participants cannot be released as-is without raising privacy concerns. Fully synthetic data represent a promising answer to this challenge. This approach is explored by the French Centre de Recherche en Épidémiologie et Santé des Populations in the form of a synthetic data generation framework based on Classification and Regression Trees and an original distance-based filtering. The goal of this work was to develop a refined version of this framework and to assess its risk-utility profile with empirical and formal tools, including novel ones developed for the purpose of this evaluation.

Materials and Methods:

Our synthesis framework consists of four successive steps, each of which is designed to prevent specific risks of disclosure. We assessed its performance by applying two or more of these steps to a rich epidemiological dataset. Privacy and utility metrics were computed for each of the resulting synthetic datasets, which were further assessed using machine learning approaches.

Results:

Computed metrics showed a satisfactory level of protection against attribute disclosure attacks for each synthetic dataset, especially when the full framework was used. Membership disclosure attacks were formally prevented without significantly altering the data. Machine learning approaches showed a low risk of success for simulated singling out and linkability attacks. Distributional and inferential similarity with the original data were high with all datasets.

Discussion: This work showed the technical feasibility of generating publicly releasable synthetic data using a multi-step framework. Formal and empirical tools specifically developed for this demonstration are a valuable contribution to this field. Further research should focus on the extension and validation of these tools, in an effort to specify the intrinsic qualities of alternative data synthesis methods.

Conclusion:

By successfully assessing the quality of data produced using a novel multi-step synthetic data generation framework, we showed the technical and conceptual soundness of the Open-CESP initiative, which seems ripe for full-scale implementation.

Introduction

The ClinicalTrials.gov database is the largest clinical trial registry worldwide, and contained less than 2,000 trials at its creation in 2000. Twenty years later, this number has been multiplied by more than 200 [START_REF] Gresham | Update on the clinical trial landscape: analysis of ClinicalTrials.gov registration data[END_REF]. Annual publication statistics show similar trends in the epidemiological field [START_REF] Grant | Historical trends in publications in the International Journal of Epidemiology[END_REF]. Most of the corresponding studies presumably generated original clinical and epidemiological data, which illustrates a massive expansion of research data in the healthcare domain. The value of such data beyond original research projects has been increasingly recognized over the last decades, leading key authors and institutions to recommend their systematic sharing [START_REF] Ohmann | Sharing and reuse of individual participant data from clinical trials: principles and recommendations[END_REF]. The expected benefits of such initiatives include maximizing the value of collected data by encouraging multiple examinations and interpretations as well as minimizing duplicative efforts, hence reducing research costs and lowering human participants burden [START_REF] Ross | Clinical research data sharing: what an open science world means for researchers involved in evidence synthesis[END_REF]. Such considerations are of course not limited to health data, and various calls to share scientific data, results and frameworks are now part of a global "Open Science" movement [START_REF] Mckiernan | How open science helps researchers succeed[END_REF][START_REF] Gruson-Daniel | Mapping the Open Science Movement: Characteristics and Impact on the Research System[END_REF]. Successful projects have already been developed under the Open Science banner. For example, the Global Human Settlement Layer project initiated by the European Joint Research Center has provided hundreds of researchers with open data to assess the sustainability of planet Earth (7). In the healthcare field, however, such achievements seem slower to materialize. This probably stems from privacy concerns, as health data are particularly prone to containing sensitive information [START_REF] Kobayashi | The Privacy and Security Implications of Open Data in Healthcare[END_REF]. In the last decades, several proposals have been made to address these concerns, mainly oriented around de-identifying health information [START_REF] Walsh | Enabling Open-Science Initiatives in Clinical Psychology and Psychiatry Without Sacrificing Patients' Privacy: Current Practices and Future Challenges[END_REF], which in the broad sense means making published data impossible to link with a particular individual [START_REF] Chevrier | Use and Understanding of Anonymization and De-Identification in the Biomedical Literature: Scoping Review[END_REF]. In the statistical community, de-identification is also known as Statistical Disclosure Control (SDC) [START_REF] Lomax | Privacy-preserving data publishing through anonymization, statistical disclosure control, and de-identification[END_REF][START_REF] Hoshino | A firm foundation for statistical disclosure control[END_REF]. In what follows, we will use the terms de-identification, anonymization and SDC indifferently, although other authors may give them distinct operational definitions. Aggregating data to produce summary statistics is a straightforward method of deidentification. However, such data have less utility for research purposes than data at the individual level, also known as microdata [START_REF] Lane | Balancing Access to Health Data and Privacy: A Review of the Issues and Approaches for the Future[END_REF]. In essence, the publication of microdata is more aligned with the Open Science principles than the publication of aggregated data. Their de-identification is, however, tedious. Historically, microdata de-identification has been performed through "anonymization operations". In these approaches, one or several privacy models are chosen, and the original data are altered to conform to them through successive row and column operations, including (if needed) noise addition. Possible privacy models include the so-called k-anonymity and ldiversity. Using them generally requires determining which variables of the microdata can be used to identify members of the underlying population. Depending on their identification capability, such variables are called explicit identifiers (e.g. social security number) or quasiidentifiers (e.g. date of birth). Additionally, some privacy models require users to identify sensitive variables, which in the case of health data could for example include disease or disability status [START_REF] Fung | Privacy-preserving data publishing: A survey of recent developments[END_REF]. The core idea behind anonymization operations is then to remove (in part or totality) the information contained in identifiers and/or sensitive variables [START_REF] Fung | Privacy-preserving data publishing: A survey of recent developments[END_REF]. Despite their intuitive appeal, such methods have been subject to heavy criticisms in the past decades, not only because they tend to distort relationships between variables [START_REF] Little | Statistical Analysis of Masked Data[END_REF], but also because of their intrinsic vulnerability to various attacks [START_REF] Ganta | Composition attacks and auxiliary information in data privacy[END_REF]. In brief, it can be shown that any adversary with enough background knowledge (possibly acquired from other independent databases) can re-identify subjects in data protected by such anonymization operations. That a potential adversary would care about collecting data from several databases to use them in combination is not a fictional idea, as illustrated by the 2008 Netflix Prize privacy breach (17). More recently, Roger et al. showed that 15 demographic variables were enough to identify 99.98% of Americans in any pseudonymized dataset [START_REF] Rocher | Estimating the success of re-identifications in incomplete datasets using generative models[END_REF]. Such results certainly blur the line between identifiers and non-identifiers. Because of these vulnerabilities and their resulting inability to ensure high levels of privacy, these models have been called syntactic privacy models, as opposed to semantic models which aim at providing formal privacy guarantees independently from any attacker's background knowledge [START_REF] Lee | Differentially private release of medical microdata: an efficient and practical approach for preserving informative attribute values[END_REF]. Semantic privacy models have been developed more recently than their syntactic counterparts, and essentially consist in variations around the concept of differential privacy developed by Dwork et al. in 2006 (19-21). In short, given a set of possible datasets 𝐸 and any set 𝐹, a randomized function 𝑓: 𝐸 → 𝐹 is said to be differentially private at an 𝜖 ∈ ℝ * + level if, and only if [START_REF] Dwork | Differential Privacy[END_REF]:

∀(𝑆, 𝐷 1 , 𝐷 2 ) ∈ ℘(𝐾) × 𝐸², 𝐷 1 ∩ 𝐷 2 ̅̅̅̅̅̅̅̅̅̅ = 𝐷 1 ̅̅̅ -1 = 𝐷 2 ̅̅̅ -1 , P(𝑓(𝐷 1 ) ∈ 𝑆) ≤ exp (𝜖) × P(𝑓(𝐷 2 ) ∈ 𝑆)

Intuitively, this means that a randomized function is differentially private at an 𝜖 level if modifying its input dataset by one element does not alter significantly its result. The desired level of significance is obtained by adjusting the value of 𝜖. Differential privacy and its variant are often considered to offer the highest standards for data privacy [START_REF] Lee | Differentially private release of medical microdata: an efficient and practical approach for preserving informative attribute values[END_REF][START_REF] Shlomo | Statistical Disclosure Limitation: New Directions and Challenges[END_REF], but are not flawless. Among others, differential privacy does not allow for direct publication of microdata (the randomized function in the formal description typically represents a mechanism generating aggregated data), is not directly compatible with standard statistical tools (attaining differential privacy requires noise addition that needs to be accounted for by statisticians) and requires users to choose a specific value for 𝜖, which is always arbitrary to some extent [START_REF] Garfinkel | Issues Encountered Deploying Differential Privacy[END_REF][START_REF] Charest | How Can We Analyze Differentially-Private Synthetic Datasets[END_REF][START_REF] Mivule | Utilizing Noise Addition for Data Privacy, an Overview[END_REF][START_REF] Bowen | Comparative Study of Differentially Private Synthetic Data Algorithms from the NIST PSCR Differential Privacy Synthetic Data Challenge[END_REF][START_REF] Clifton | On syntactic anonymity and differential privacy[END_REF][START_REF] Domingo-Ferrer | The limits of differential privacy (and its misuse in data release and machine learning)[END_REF][START_REF] Muralidhar | ϵ-Differential Privacy for Microdata Releases Does Not Guarantee Confidentiality (Let Alone Utility)[END_REF].

The lack of formal guarantees presented by classical privacy models and the impracticability of differential privacy for microdata has long suggested that a paradigmatic shift may be necessary to generate publicly releasable microdata [START_REF] Albright | Privacy Protection in Social Science Research: Possibilities and Impossibilities[END_REF]. Synthetic data generation, which has gained attention in recent years, arguably represents such a paradigmatic shift. Synthetic data can be defined as fictive data created from an actual dataset by a statistical process and designed for public consumption [START_REF] Raghunathan | Synthetic Data[END_REF]. Typically, a synthetized dataset resembles a real one, but contains no unit of the original data (cf. Figure 1). Alternatively, the synthesis process can be applied only to parts of the original dataset (e.g. some cells only). Such cases correspond to partially synthetic data, while the typical implementation described above is called fully synthetic data [START_REF] Drechsler | 30 Years of Synthetic Data[END_REF]. In the following, we will use the terms "synthetic data" without explicit precision to refer to fully synthetic data only.

Original Data Synthetic Data

Gender Height

Donald Rubin and Roderick

Little are generally credited for the first suggestion of using synthetic data as a SDC method [START_REF] Drechsler | 30 Years of Synthetic Data[END_REF]. In their 1993 seminal papers [START_REF] Little | Statistical Analysis of Masked Data[END_REF][START_REF] Rubin | Statistical disclosure limitation[END_REF], they proposed using the multiple imputation framework that they developed to handle missing data as a way of generating fictive microdata for general public use. Their idea was to preserve both the confidentiality of individuals from which the data originate (no synthetized unit being an actual unit) and the utility of the data (when properly configured, multiply imputed data can lead to valid statistical inferences). The nature of the data produced makes their confidentiality properties less reliant on syntactic privacy models [START_REF] Drechsler | 30 Years of Synthetic Data[END_REF] and may reduce the need for formal privacy guarantees such as those provided by differential privacy. Thirty years later, these core principle still hold, but their application in the healthcare field is subject to several challenges. Many of these challenges are related to the determination of the best tradeoff between utility and disclosure risks of such data [START_REF] Murtaza | Synthetic data generation: State of the art in health care domain[END_REF]. When processing a dataset with SDC methods, there is indeed an inverse relationship between the confidentiality and the utility (practical value for general or specific purposes) of the resulting data [START_REF] Murtaza | Synthetic data generation: State of the art in health care domain[END_REF][START_REF] Duncan | Disclosure Risk vs. Data Utility: The RU Confidentiality Map[END_REF]. Synthetic data make no exception, with original data (highest utility but lowest confidentiality) and completely random data (highest confidentiality but null utility) lying at each extremity of the risk-utility (RU) curve.

In recent years, several metrics have been developed to help statisticians and computer scientists quantify the utility and disclosure risks of their synthetic data [START_REF] Murtaza | Synthetic data generation: State of the art in health care domain[END_REF]. They provide valuable information in the process of choosing the best RU profile for a synthetic data generation method, which still remains a NP-hard task [START_REF] Mivule | Utilizing Noise Addition for Data Privacy, an Overview[END_REF]. Other challenges related to the use of synthetic data include the determination of maximum acceptable levels of disclosure, which depends not only on statistical but also on methodological and social considerations [START_REF] Bonnéry | The Promise and Limitations of Synthetic Data as a Strategy to Expand Access to State-Level Multi-Agency Longitudinal Data[END_REF][START_REF] El Emam | Validating a membership disclosure metric for synthetic health data[END_REF][START_REF] Hotz | Balancing data privacy and usability in the federal statistical system[END_REF].

Thirty years after Rubin's proposal, the maturation of this field has already allowed the publication of several synthetic datasets, such as synthetic versions of the French National Health Data System (SNDS) [START_REF]SNDS synthétiques[END_REF], the NIH National COVID Cohort Collaborative [START_REF] Haendel | The National COVID Cohort Collaborative (N3C): Rationale, design, infrastructure, and deployment[END_REF], and cancer data provided by the National Disease Registration Service (41). However, there currently seems to be no large-scale or institutional initiative to publish synthetic datasets generated from research data. In 2022, the French Centre de recherche en Epidémiologie et Santé des Populations (CESP) began to fill this gap by launching the Open-CESP project, with the aim of providing public access to synthetic datasets derived from research works led by the CESP. Four datasets have already been published as proofs of concept using a novel full synthesis framework based on Classification And Regression Trees (CART) and an original distance-based filtering.

In this context, the goal of our work was to develop a refined version of this framework, to discuss the content of the corresponding synthesizer and to assess its privacy and utility properties using various empirical and formal tools, including novel ones that we developed for the sake of this evaluation.

Materials and Methods

Synthetic data generation methods primarily aim at preserving the utility of original data and the privacy of subjects from which they originate [START_REF] Reiter | Using CART to Generate Partially Synthetic, Public Use Microdata[END_REF]. To show how our framework perform on these two aspects, we computed privacy and utility metrics on the real and several synthetic versions of a rich dataset. We completed our assessment by performing standard utility evaluations on real-world analyses and using validated third-party libraries to quantify privacy risks. In the following subsections, we successively present our data synthesis framework, the original dataset that we used for its evaluation and the privacy and utility assessments conducted on synthetic versions of this dataset.

Synthetic data generation framework

The main steps of our Synthetic Data Generation Framework (SDGF) are depicted in Figure 2. Input data to our framework consist in microdata, with no particular restriction on the number of variables and observations besides those related to synthesis using CART (cf. infra). Input variables can be of any type, namely categorical or quantitative, and can be linked by any logical relationship. Longitudinal data are also supported. Successive steps of the framework are detailed in the following subsections. These steps comply with common guidelines on synthetic data generation [START_REF] Raab | Guidelines for Producing Useful Synthetic Data[END_REF], and even extend them on decisive points such as protection against some forms of data disclosure.

Manual SDC

Every input data treated by the Open-CESP team undergo manual SDC. In this first phase, classical anonymization operations may be applied, the nature and order of which depends on the exact type of data. After standard data management operations, data scientists and researchers typically sort variables into direct identifiers (linked to exactly one individual, for example social security numbers), quasi-identifiers (linked to a small number of individuals, for example town of residence) and sensitive outcomes (highly disclosive information, such as religious beliefs, that needs to be protected from potential intruders). Any variable which seems to have no scientific interest (which was not necessarily known when data was collected) is removed. Identifiers are also typically removed, even when they do not fall into this category. Other variables may be subject to categorization, bottom-or top-coding (for quantitative variables) and coarsening (for categorical variables), among others. Disclosure risk may be higher for statistical outliers and those may dropped (or their data perturbed) if necessary. The entire process is guided by scenarios of attack, where plausible behaviors of attackers trying to access sensitive outcomes are examined. For a detailed review on classical anonymization operations and related semantics, see e.g. ( 44) and [START_REF] Benschop | Statistical disclosure control: A practice guide[END_REF]. When the addition of manual SDC and data synthesis seems insufficient to reach the desired level of privacy, no data are published. On the opposite, some input data may not need any manual SDC before being submitted to our synthesizer. Already published data, for example in peer-reviewed journals, are always taken into account in this manual SDC process.

Data synthesis

The core of every synthetic data generation method is the generative model used to produce data, also called the synthesizer. Multiple models have been reported in the literature, broadly classified into knowledge-driven and data-driven models [START_REF]Practical Synthetic Data Generation[END_REF]. In a knowledge-driven approach, a model is manually created based on what is known of a particular population in terms of distributional and relational properties of target variables. This knowledge takes the form of generative rules, which can for example be implemented as multiple regression models and serve as a basis for the resulting synthesizer to generate data. Because of the fine tune needed to ensure the validity of these rules, creating a knowledge-driven model is a tedious work, generally implying preliminary literature reviews as well as the assistance of field researchers working on the subject involved. The main reward of this work is the ability of the resulting model to produce synthetic data without relying on real input data. This entails a minimal risk of information disclosure. However, this level of privacy comes at a substantial cost that we see as prohibitive: exclusively data-driven models are prone to miss a large part of the relationship between variables, simply because they have not been explicitly included in them [START_REF] Murtaza | Synthetic data generation: State of the art in health care domain[END_REF]. By choosing a knowledge-driven model, we would therefore deprive ourselves of one of the main benefits of synthetic data generation, that is their potential use to formulate new research hypotheses [START_REF] Gonzales | Synthetic data in health care: A narrative review[END_REF]. Moreover, these methods can hardly be automated and therefore tend to be laborious and prone to human errors, which make them ill-suited to the publication of large amounts of data. For all these reasons, we chose a data-driven synthesizer as part of our data generation method. This choice only slightly narrows the number of candidate models for our framework, as many different data-driven methods have been proposed in recent years [START_REF] Drechsler | 30 Years of Synthetic Data[END_REF]. Unfortunately, there are currently no consensual guidelines on how to choose a data-driven generative model, nor formal ways of assessing the superiority of a given model against another one. In this context, we think that the a priori choice of a model for a framework should mainly depend on the technical constraints entailed by its intended usage. In the case of the Open-CESP project, aiming at publishing various datasets for general use of scientists (not necessarily familiar with synthetic data), the selected model should arguably:

1. Be probabilistic rather than deterministic, so that the synthesis algorithm can be published along datasets without raising privacy concerns. 2. Be suited to longitudinal as well as cross-sectional microdata, possibly including large numbers of variables. 3. Support logical constraints between variables to avoid anomalous values from being produced. 4. Be non-parametric in the classical sense of the term, which means that it must not be manually shaped to individual joint distributions in the original dataset. 5. Allow for coarse tuning so that for every input dataset, the best trade-off between utility of generated data and privacy of original units can be selected. 6. Be as easy to configure and computationally inexpensive as possible.

We think that these criteria make generative models based on CART the most a priori wellsuited to our project. Most authors suggest that the appropriateness to use a particular generative model should also be assessed using specific metrics of utility and confidentiality [START_REF] Murtaza | Synthetic data generation: State of the art in health care domain[END_REF][START_REF] El Emam | Utility Metrics for Evaluating Synthetic Health Data Generation Methods: Validation Study[END_REF][START_REF] Emam | Seven Ways to Evaluate the Utility of Synthetic Data[END_REF]. Models based on CART have been shown to perform well in this regard [START_REF] Bonnéry | The Promise and Limitations of Synthetic Data as a Strategy to Expand Access to State-Level Multi-Agency Longitudinal Data[END_REF][START_REF] Pathare | Comparison of tabular synthetic data generation techniques using propensity and cluster log metric[END_REF][START_REF] Nowok | Utility of synthetic microdata generated using tree-based methods[END_REF][START_REF] Drechsler | An empirical evaluation of easily implemented, nonparametric methods for generating synthetic datasets[END_REF][START_REF] Rankin | Reliability of Supervised Machine Learning Using Synthetic Data in Health Care: Model to Preserve Privacy for Data Sharing[END_REF], and we confirmed these findings in previous analyses where we compared these models with other candidates on four testing datasets. These results strengthened our decision to use a synthesizer based on CART in our framework. CART have been formally introduced by Leo Breiman in 1984 [START_REF] Breiman | Classification and Regression Trees[END_REF] as a tool to address decision problems. By essence, CART are binary trees in which every node contains observations of an original dataset meeting specific criteria related to some variables called predictors [START_REF] Chipman | Bayesian CART Model Search[END_REF]. These criteria are chosen such that the leaves of the tree are relatively homogeneous with respect to a given outcome variable, where the homogeneity is canonically understood in terms of a low Gini's index. This is done by machine learning implementations sometimes offering parameters to control for the number and location of the nodes. Resulting CART can then be used to determine the distribution of outcome variables conditionally on predictors, with a precision depending on these parameters. Figure 3 shows the example of a CART generated from the dataset displayed in Figure 1. In 2005, Jerome Reiter was the first to propose using CART to generate synthetic data [START_REF] Reiter | Using CART to Generate Partially Synthetic, Public Use Microdata[END_REF]. Although his initial work dealt with partial synthesis, it has then been extended to full synthesis [START_REF] Taub | Synthetic Data: An Exploration of Data Utility and Disclosure Risk[END_REF][START_REF] Nowok | synthpop: Bespoke creation of synthetic data in R[END_REF]. The core idea is to generate CART (which we refer to as T 1 , T 2 , … , T 𝑛 ) for each of the 𝑛 variables in the original dataset to capture their conditional distributions. Each original observation then undergoes the following synthesis process. First, a synthetic value for the variable X 1 is sampled among the values belonging to the same leaf of T 1 . The location of the observation in T 2 , T 3 , … , T 𝑛 ) is then updated according to this new value, and the whole process is repeated for every variable in the dataset. In the end, it is very unlikely that a synthetic observation be identical to a real one. The probability of such a phenomenon is reduced as the number of observations in each leaf increases ; but doing so also decrease the precision of the conditional distribution estimates by CART and can lead to lower data utility. Different implementations of the algorithm can use other ways of reducing the resemblance between original and synthetic data, by example by setting a threshold on the intra-leaves variance. Several solutions can also be proposed to generate any number of synthetic units from an original dataset of limited length, such as preliminary samplings from the original data. General considerations on these points can be found in [START_REF] Reiter | Using CART to Generate Partially Synthetic, Public Use Microdata[END_REF] and [START_REF] Nowok | synthpop: Bespoke creation of synthetic data in R[END_REF]. In [START_REF] Reiter | Using CART to Generate Partially Synthetic, Public Use Microdata[END_REF], Reiter also discusses the best choice for the order of variables in the synthesis process, as well as the sampling technique to be used within each leaf. To generate synthetic data using CART, we use the synthpop R package [START_REF] Nowok | synthpop: Bespoke creation of synthetic data in R[END_REF], which is arguably one the most popular packages in this field. The empirical validity of datasets synthesized using synthpop for various use cases has been established by numerous studies [START_REF] Nowok | Utility of synthetic microdata generated using tree-based methods[END_REF][START_REF] Endres | Synthetic Data Generation: A Comparative Study[END_REF][START_REF] Raab | Practical Data Synthesis for Large Samples[END_REF][START_REF] Nowok | Providing bespoke synthetic data for the UK Longitudinal Studies and other sensitive data with the synthpop package for R 1[END_REF][START_REF] Hittmeir | Utility and Privacy Assessments of Synthetic Data for Regression Tasks[END_REF][START_REF] Quintana | A synthetic dataset primer for the biobehavioural sciences to promote reproducibility and hypothesis generation[END_REF], and its feasibility successfully assessed for longitudinal data [START_REF] Bonnéry | The Promise and Limitations of Synthetic Data as a Strategy to Expand Access to State-Level Multi-Agency Longitudinal Data[END_REF]. The package offers several parameters to tune the synthesis process, including the desired minimum number of units in any leaf of the CART, logical relationships between and desired number of synthetic units to be produced. Missing values are supported by considering them as a distinct modality of qualitative variables, and by the adjunction of an auxiliary variable for quantitative ones. Under the hood, synthpop can use distinct packages to generate CART, namely rpart [START_REF] Therneau | Package 'rpart.' Available Online Cran Ma Ic Ac Ukwebpackagesrpartrpart[END_REF] and party [START_REF] Hothorn | Package 'party.' Package Ref Man Party Version 09-998[END_REF]. Our preference goes to rpart because of its close alignment with Breiman's original ideas, conferring it a higher face validity in our views. Generally, we generate synthetic datasets of same length than original ones, namely to prevent statistical conditions from being falsely met when performing parametric tests. This also helps controlling disclosure risk and artificial statistical power inflation. As for the number of observations in each leaf of generated CART, we see it as a major way of mitigating disclosure risk in our framework, as larger numbers of observations are associated with decreased resemblance between original and synthetic data. Consequently, the choice we make for this parameter highly depends on the results of previous and next steps of our framework, as well as the sensitivity of the input data. Some authors recommend releasing multiple synthetic datasets for every original one [START_REF] Drechsler | Synthetic Datasets for Statistical Disclosure Control: Theory and Implementation[END_REF]. This idea mainly stems from the original proposal of Rubin for synthetic data generation [START_REF] Rubin | Statistical disclosure limitation[END_REF], deeply rooted in its multiple imputation framework. The underlying principle is that no valid inference can be made from synthetic datasets if one does not take into account the additional variance produced by the synthesis process [START_REF] Drechsler | Comparing Fully and Partially Synthetic Datasets for Statistical Disclosure Control in the German IAB Establishment Panel[END_REF]. Although the statistical reasoning seems solid, we think that this does not apply to the Open-CESP initiative, and consequently release only one synthetic version of each original dataset that we process. Our approach is indeed not meant to allow researchers to draw valid inferences from released datasets. Instead, we expect them to run analyses on synthetic data in an exploratory phase, and to confirm promising results on real data (available on demand). In our view, this last step is mandatory for the obtained results to be considered valid, and we strongly discourage presenting results obtained from synthetic datasets alone as conclusive. By doing so, we align with the policy of other data providers, such as the United States Census Bureau ® which provides access to the SynLBD synthetic database but recommends running final analyses on original data [START_REF] Jarmin | Expanding the Role of Synthetic Data at the U.S. Census Bureau[END_REF]. This policy prevents the inflation of disclosure risk that can arise if several datasets synthetized from the same original data are released incautiously. It also has the advantage of not requiring data users to use complicated statistical procedures to handle multiple datasets.

Distance-based filtering

Although terminologies vary between authors, attacks against anonymized microdata are generally categorized into membership disclosure attacks, identity disclosure attacks and attribute disclosure attacks [START_REF] Templ | Introduction to statistical disclosure control (sdc)[END_REF][START_REF] Olatunji | A Review of Anonymization for Healthcare Data[END_REF]. Table 1 outlines the main principles underlying each of these types of attacks.

Type of attacks Principle

Membership disclosure attack Given the anonymized dataset and a sufficient amount of background knowledge, the attacker tries to establish that a given individual was part of the original dataset.

Identity disclosure attack

Given the anonymized dataset and a sufficient amount of background knowledge (often including membership knowledge), the attacker tries to identify a record in the dataset matching a given individual.

Attribute disclosure attack

Given the anonymized dataset and a sufficient amount of background knowledge (often including linkage knowledge), the attacker tries to infer unknown values of attributes about a given individual. Some authors reserve this term to inferences with a total certainty, and call "inferential disclosures" the inferences associated with a high, but less than 1, confidence [START_REF] Vilhuber | 5 Balancing Privacy and Data Usability: An Overview of Disclosure Avoidance Methods | Handbook on Using Administrative Data for Research and Evidence-based Policy[END_REF].

Table 1. Characteristics of the main type of attacks against anonymized microdata.

In our framework, formal protection against membership disclosure attacks is provided by noise addition performed in its last step and described in a subsequent section. On the other hand, manual SDC and the synthesis itself provide a significant level of protection against identification and attribute disclosure risks. In particular, fully synthetic microdata are often said to be immune from identification disclosure risk because there exists no meaningful link between rows of the original dataset and rows of the synthetic one [START_REF]Synthetic data for official statistics: a starter guide[END_REF]. Although this point is valid at a theoretical level, CART-based synthesizers (like many other synthesizers) may generate rows closely resembling those of the original dataset [START_REF] Manrique-Vallier | Bayesian Non-Parametric Generation Of Fully Synthetic Multivariate Categorical Data in the Presence of Structural Zeros[END_REF]. This phenomenon would arguably be of little interest to a potential attacker, for whom every synthetized row is the result of the same probabilistic mechanism and has the same negligible probability to belong to the original dataset. However, it is acknowledged that the presence of such rows in synthetic datasets can impair the trust of participants into the synthesis process [START_REF] Nowok | Recognising real people in synthetic microdata: Risk mitigation and impact on utility[END_REF]. This is why we developed an algorithm capable of filtering out these rows based on their distance with other statistical units of the original and synthetic data. By doing so, we also aim at mitigating the risk of attribute disclosure, thereby addressing one of the main limitations of CART synthesizers which have been shown to provide high data utility, but also higher disclosure risks than alternative methods when used in isolation [START_REF] Taub | Creating the Best Risk-Utility Profile: The Synthetic Data Challenge[END_REF].

Our filtering method is based on four successive steps which are depicted in Figure 4. Input data to the algorithm correspond to synthetic statistical units generated by CART as well as original units. As a first step, respective distances between all pairs of units are computed. To do so, we use the Mahalanobis distance on a subset of quantitative, ordinal and/or binary variables that can be conjointly considered as quasi-identifiers. Candidate nominal variables can be included after dichotomization. By using the Mahalanobis distance rather than other distance measures, we prevent highly dispersed and/or correlated groups of variables from exerting a preponderant effect on the distance, disregarding their significance in terms of identification disclosure risk. Moreover, the properties of the Mahalanobis distance are especially well understood with variables following normal distributions [START_REF] Ekström | Distance Beyond Normal Distributions[END_REF], which is generally the case with health data [START_REF] Bono | Non-normal Distributions Commonly Used in Health, Education, and Social Sciences: A Systematic Review[END_REF]. However, atypical situations may arise where other distances would make unquestionably better choices. In such cases, we may use distance measures other than the Mahalanobis distance. This would for example be the case with data exclusively composed of binary variables, where we would tend to use the Jaccard index rather than the Mahalanobis distance. If the input data contain missing values and the distance measure selected does not support them, we advocate (and use) a conservative approach where:

-Distances between original units are computed after replacing missing values with values maximizing those distances (for example, if two units have a missing value for the same variable, we would assign the maximum value of the variable to the first unit, and the minimum value to the second). -Distances between synthetic and original units are computed after replacing missing values with values minimizing those distances (using the same example as above, we would assign the exact same value of the variable to both units). Following this approach can be seen as implementing a "worst-case scenario", because it causes overestimation of the distances between original units, and underestimation of the distances between original and synthetic units. When using this solution, it is thus hard for a synthetic unit to be retained, giving the guarantee that the resulting data preserve the confidentiality of original units at least as much as when no values are missing. The second and third steps of the algorithm are the respective determination of the nearest original neighbor of each original and synthetic unit using the aforementioned distance. Finally, synthetic units which are too close to their nearest original neighbor are deleted, where "too close" means closer than the distance separating this original unit and its nearest original neighbor. New units are then synthetized using CART and undergo the same filtering process, until the desired number of retained units has been reached. Naive pseudocode for the whole process is given in Algorithm 1.

Algorithm 1. Naive implementation of the distance-based filtering.

This method has an intuitive appeal because it ensures that for every synthetic unit, the remark that it is close to an original one remains inconclusive: one can hardly expect synthetic units to be more different from the original units than the original units are from each other. If a participant to a study worries than a synthetic row resembles himself, he could always be reassured by hearing that at least one real person in the same dataset is even more resemblant to him. Said differently, he could have made the same remark if he had seen the original dataset with his data specifically removed, in which case this remark would be absurd. Therefore, if resemblance there is, it cannot be a legitimate cause for concern. On a more statistical point of view, this method also has the advantage of not preventing synthetic units from being close to one another. Neither does it prevent them from being close to original units if original units themselves are densely regrouped. The practical gains of using this method in terms of privacy enhancement will be assessed throughout this work using methods developed below.

Noise addition

Fully synthetic data are often said to be immune from identity disclosure and are supposed to limit risks of attribute disclosure [START_REF]Synthetic data for official statistics: a starter guide[END_REF]. In our framework, these risks are further mitigated by the manual SDC and filtering process described in previous sections. Still, synthetic data may be vulnerable to Membership Disclosure Attacks (MDA), where an attacker tries to determine whether an individual belongs to a dataset or not [START_REF] El Emam | Validating a membership disclosure metric for synthetic health data[END_REF]. This is especially the case with synthesis methods that sample synthetic values from original ones. For example, suppose that a row of a synthetic dataset generated using such a method contains the value "15" for the variable "number of children". Also suppose that all data originate from women (this may be known to any attacker, for example if the data was collected as part of a study on endometrial cancers). There are presumably very few women in any source population with this parity, generally no more than one. In such a scenario, the mere presence of the value "15" in the synthetic dataset indicates that this particular woman was part of the original dataset. This can have harmful consequences, for example if the data was collected as part of an oncology study and the attacker works for an insurance company. Synthesis methods using CART are prone to such risks because they perform synthesis by sampling from actual variables values (cf. supra). Manual SDC described in the previous section is a first step to control membership disclosure risk, and by our standards must ensure enough granularity for qualitative variables. However, we regard it as insufficient for quantitative variables, especially because not all subjects exposed to this risk are outliers. Imagine, for example, a study on chronic hepatitis B (CHB) among farmers in French Guiana, where the prevalence of this condition was close to 5% in the 2010s [START_REF] Epelboin | Panorama des pathologies infectieuses et non infectieuses de Guyane en 2022[END_REF]. Considering a farmer population of around 1,500 individuals (78), this gives a prevalence of CHB among Guyanese farmers of around 75 individuals. Because of the imbrication of CHB outcomes with those of obesity [START_REF] Pais | The Impact of Obesity and Metabolic Syndrome on Chronic Hepatitis B and Drug-Induced Liver Disease[END_REF], it is plausible that biometric variables such as weight and height will be collected in such a study. But due to the small number of individuals involved, it is also plausible that most heights in this population will be unique up to the nearest centimeter. If the data collected in the study contain height and is synthesized as is with CART, simply knowing the height of an individual (even a non-outlier) can therefore lead to membership disclosure. Of course, this would be an extreme case, as the source population for this study would be especially small. But the argument can also hold for larger populations, especially when considering less obvious variables or combinations of variables. In the statistical community, the information that an individual belongs to a particular dataset has been acknowledged as especially sensitive as early as 1989 [START_REF] Sullivan | The use of measurement error to avoid disclosure[END_REF]. Rather than a specific target for attacks, it was mainly treated as a preliminary information that any attacker must possess to perform fruitful identity or attribute disclosure attacks [START_REF] Bethlehem | Disclosure control of microdata[END_REF][START_REF] Fuller | Masking procedures for microdata disclosure[END_REF]. This concern is still relevant today [START_REF] Olatunji | A Review of Anonymization for Healthcare Data[END_REF] and, together with their intrinsic sensitivity, makes membership information crucial to protect. Unfortunately, there seems to be little guidance in the literature on how to perform this protection [START_REF] Carvalho | Survey on Privacy-Preserving Techniques for Microdata Publication[END_REF]. This can be due to the fact that microdata publication has historically been proposed for census data, in which membership disclosure risks are maximal by definition [START_REF] Skinner | A Measure of Disclosure Risk for Microdata[END_REF]. Traditional syntactic privacy models, such as k-anonymity may contribute to protect synthetic data against membership disclosure [START_REF] Abdelhameed | Enhanced additive noise approach for privacy-preserving tabular data publishing[END_REF], but are poorly suited to quantitative variables [START_REF] Torra | Attribute disclosure risk for k-anonymity: the case of numerical data[END_REF]. One of the only specific metrics to assess membership disclosure risk, 𝛿-presence, presents the same limitations (87). More recently have been proposed metrics derived from machine learning techniques, such as the F1 score [START_REF] El Emam | Validating a membership disclosure metric for synthetic health data[END_REF][START_REF] Azizi | A comparison of synthetic data generation and federated analysis for enabling international evaluations of cardiovascular health[END_REF], but their formal grounding seems fragile, and their application involves arbitrary configuration decisions (such as the proportion of records used to train the model). Perturbative methods are an intuitive choice for protecting quantitative variables against membership disclosure. In his seminal paper on CART for synthetic data generation (42), Reiter suggested using Kernel Density Estimation (KDE) rather than direct sampling from leaves to prevent real values from being disclosed. The synthpop package implements this mechanism (to be activated via an optional parameter). However, the choice of the range for the KDE is left to the discretion of the user, without any formal hint on the resulting membership disclosure risk. Authors suggesting the use of additive noise for SDC are not much more informative, merely advising that the variance of the noise should be proportional to the variance of the original variable to preserve covariances [START_REF] Mivule | Utilizing Noise Addition for Data Privacy, an Overview[END_REF][START_REF] Hundepool | Handbook on statistical disclosure control[END_REF][START_REF] Templ | Statistical Disclosure Control for Micro-Data Using the R Package sdcMicro[END_REF]. For these reasons, we chose to develop our own formal model to ensure enough protection against MDA. In its current version, this model is based on the addition of uncorrelated noise to each quantitative variable of the synthetic dataset (synthesized without using KDE). Its mechanism and formal justification are presented in the following paragraphs. Suppose that we want to protect a sample of size 𝑛 drawn from an underlying population of size 𝑁 against MDA, where only one quantitative variable is collected for each sampled unit. Let (s 𝑘 ) 𝑘∈⟦1;𝑛⟧ be these collected values, and (x 𝑘 ) 𝑘∈⟦1;𝑁⟧ be the values of this quantitative variable in the underlying population, sorted in ascending order. Finally, let 𝑀 be a probabilistic noise-addition mechanism independent on the values of input variables and preserving their means, and let define the sequence (r 𝑘 ) 𝑘∈⟦1;𝑛⟧ by: r 𝑘 = 𝑀(s 𝑘 ) for all 𝑘 ∈ ⟦1; 𝑛⟧. Our goal is to shape 𝑀 so that the risk of membership disclosure is lower than some user-defined threshold when the user releases (r 𝑘 ) 𝑘∈⟦1;𝑛⟧ . For this, we model a typical scenario for a membership disclosure attack as follows. Suppose that an attacker knows the public version (r 𝑘 ) 𝑘∈⟦1;𝑛⟧ of our sample, a particular value x 𝑎 of (x 𝑘 ) 𝑘∈⟦1;𝑁⟧ , a plausible continuous probability distribution 𝐷 for (x 𝑘 ) 𝑘∈⟦1;𝑁⟧ , the detailed behavior of the mechanism 𝑀 and the value of 𝑁 and 𝑛. With these information on hand, the attacker would presumably be interested in the probability that x 𝑎 belongs to (s 𝑘 ) 𝑘∈⟦1;𝑛⟧ given (r 𝑘 ) 𝑘∈⟦1;𝑛⟧ . To estimate this probability, the most natural choice would be to use some variation of the following formal model:

let (S 𝑘 ) 𝑘∈⟦1;𝑛⟧ be independent random variables identically distributed according to a mixture distribution such that for every 𝑘 in ⟦1; 𝑛⟧, S 𝑘 = x 𝑎 with probability 1 𝑁 and S 𝑘 ~𝐷 otherwise; -let (B 𝑘 ) 𝑘∈⟦1;𝑛⟧ be independent and identically distributed random variables representing the noise added to (s 𝑘 ) 𝑘∈⟦1;𝑛⟧ by 𝑀; -then the probability of interest is given by: P(⋃

S 𝑘 = x 𝑎 𝑛 𝑘=1 | ⋂ S 𝑘 + B 𝑘 = 𝑛 𝑘=1
r 𝑘 ). However, this value alone would generally be of little use to a potential attacker. Let indeed

𝑓: { ℝ → [0; 1] x ⟼ P(⋃ S 𝑘 = x 𝑛 𝑘=1 | ⋂ S 𝑘 + B 𝑘 = 𝑛 𝑘=1
r 𝑘 ) be the application giving such a probability for any potential value of the variable considered. One shows easily that the elements of Im((r 𝑘 ) 𝑘∈⟦1;𝑛⟧ ) are the arguments of the local maxima of 𝑓. Consequently, unless x 𝑎 is such a value, there will always be an infinite number of alternative real numbers associated with higher values of 𝑓 than x 𝑎 . Therefore, any claim of the form "x 𝑎 is certainly in the dataset because 𝑓(x 𝑎 ) is high" could be countered by remarking that numerous other values would make better candidates, much more than there are in Im((s 𝑘 ) 𝑘∈⟦1;𝑛⟧ ).

To remain convincing, the attacker must at least show that the value of 𝑓 at x 𝑎 is higher than at its neighboring values (that is x 𝑎-1 and x 𝑎+1 , which by hypothesis the attacker has no way to prove that they do not exist). This implies that there exists a number 𝑘 ∈ ⟦1; 𝑛⟧ such that x 𝑎-1 < r 𝑘 < x 𝑎+1 , which for 𝑁 large enough is true if

x 𝑎 +x 𝑎-1 2 < r 𝑘 < x 𝑎 +x 𝑎+1 2
in virtue of Taylor's theorem. To show that, the attacker would presumably use his knowledge of x 𝑎 , 𝑁 and 𝐷 to get a plausible value for x 𝑎-1 and x 𝑎+1 . But even if he succeeds, the question remains whether the high value of 𝑓(x 𝑎 ) (that is, the proximity of x 𝑎 to a value of (r 𝑘 ) 𝑘∈⟦1;𝑛⟧ ) is significant compared to the potentially high values of 𝑓(x 𝑎-1 ), 𝑓(x 𝑎+1 ), 𝑓(x 𝑎-2 ), etc. A necessary condition to show this is arguably to prove that the presence of a value of (r 𝑘 ) 𝑘∈⟦1;𝑛⟧ between

x 𝑎 +x 𝑎-1 2 and

x 𝑎 +x 𝑎+1 2

is most probably due to x 𝑎 rather than other values of (x 𝑘 ) 𝑘∈⟦1;𝑁⟧ . Said differently, the point is to prove that the probability that x 𝑎 has been sampled is high if there exists such a value of (r 𝑘 ) 𝑘∈⟦1;𝑛⟧ . We call this probability the Elemental Correct Attribution Probability (ECAP) for x 𝑎 . If the attacker determines a high value for the ECAP, he can confidently affirm that x 𝑎 has probably been sampled because other plausible values of (x 𝑘 ) 𝑘∈⟦1;𝑁⟧ cannot explain this particular value of (r 𝑘 ) 𝑘∈⟦1;𝑛⟧ alone.

On the contrary, if he fails to do so, he exposes himself to the arguments mentioned above and the attack cannot be considered successful. Let 𝐷′ be a probability distribution resulting from the restriction of 𝐷 to ℝ\[x 𝑎-1 ; x 𝑎+1 ]. Let (S′ 𝑘 ) 𝑘∈⟦1;𝑛⟧ be independent random variables identically distributed according to a mixture distribution such that for every 𝑘 in ⟦1; 𝑛⟧, S′ 𝑘 = x 𝑎 with probability 1 𝑁 and S′ 𝑘 ~𝐷′ otherwise.

Once the attacker has estimated a value for x 𝑎-1 and x 𝑎+1 , (S′ 𝑘 ) 𝑘∈⟦1;𝑛⟧ is a more legitimate choice than (S 𝑘 ) 𝑘∈⟦1;𝑛⟧ to model the situation. Finally, let 𝐼 1 = [

x 𝑎 +x 𝑎-1 2

;

x 𝑎 +x 𝑎+1 2

] and 𝐼 2 = [

x 𝑎-1 -x 𝑎 2 ;

x 𝑎+1 -x 𝑎 2

]. The ECAP for x 𝑎 is then given by:

ECAP(x a ) = P (⋃ S 𝑘 ′ 𝑛 𝑘=1 = x 𝑎 | ⋃ S 𝑘 ′ + B 𝑘 𝑛 𝑘=1 ∈ 𝐼 1 )
Using elementary probability calculus operations, it is easy to show that:

ECAP(x a ) = 1 - ( 𝑁 -1 𝑁 ) 𝑛 -(P(S 1 ′ + B 1 ∉ 𝐼 1 ) - P(B 1 ∉ 𝐼 2 ) 𝑁 ) 𝑛 1 -P(S 1 ′ + B 1 ∉ 𝐼 1 ) 𝑛
(Equation 1)

This formulation makes it apparent that the ECAP for a given value only depends on the distribution of (B 𝑘 ) 𝑘∈⟦1;𝑛⟧ once the problem has been modeled by a correct choice of 𝑁, 𝐷, x 𝑎 , x 𝑎-1 and x 𝑎+1 . This property of the ECAP is what makes it useful to choose such a distribution, hence the determination of plausible values for x 𝑎-1 and x 𝑎+1 is especially critical. The choice of 𝑁 and 𝐷 is no less important, but relates more to the current state of scientific knowledge than to statistical considerations.

To determine plausible values for x 𝑎-1 and x 𝑎+1 , one intuitive possibility would be to estimate the Mean Successive Differences (MSD) in the source population of the sample. Keeping previous notations, the MSD for variable x can be defined as:

MSD = 1 𝑁 -1 ∑ x 𝑘+1 -x 𝑘 𝑁-1 𝑘=1
When x 1 and x 𝑁 are known, this obviously simplifies to MSD =

x 𝑁 -x 1 𝑁-1 . However, this approximation of x 𝑎-1 and x 𝑎+1 is far from being optimal, especially with tight distributions where it tends to underestimate x 𝑎-1 and x 𝑎+1 for values close to the tail and to overestimate them otherwise. A better alternative is to use the distribution of (x 𝑘 ) 𝑘∈⟦1;𝑁⟧ , which is known by hypothesis (or at least its continuous approximation) to estimate x 𝑎-1 and x 𝑎+1 . With the knowledge attributed by hypothesis to the attacker, the following estimates are arguably the best to hold:

x 𝑎-1 ≈ 1 ∑ P(S (𝑘) = x 𝑎 ) 𝑁 𝑘=2 ∑ P(S (𝑘) = x 𝑎 )E(S (𝑘-1) | S (𝑘) = x 𝑎 ) 𝑁 𝑘=2 x 𝑎+1 ≈ 1 ∑ P(S (𝑘) = x 𝑎 ) 𝑁-1 𝑘=1 ∑ P(S (𝑘) = x 𝑎 )E(S (𝑘+1) | S (𝑘) = x 𝑎 ) 𝑁-1 𝑘=1
Where S (𝑘) represents the kth order statistic of a sample of 𝑁 values originating from the same distribution than (S 𝑘 ) 𝑘∈⟦1;𝑛⟧ . This is the estimate we use to determine ECAP. Rather than computing conditional expectations, we approximate these values using a Monte-Carlo approach where we sample 𝑁 -1 values multiple times from distribution 𝐷 and calculate the distances of x 𝑎 with the values to which it is closest. We found this approach to be computationally inexpensive while generating precise estimates after a few iterations only. Using these estimates, calculating the ECAP for a particular value of (x 𝑘 ) 𝑘∈⟦1;𝑁⟧ is straightforward. Depending on 𝐷 and on the desired type of distribution for (B 𝑘 ) 𝑘∈⟦1;𝑛⟧ , this calculation may require classical Monte-Carlo techniques. Figure 5 shows the resulting ECAP for x 𝑎 = 178, 𝐷 = 𝑁(170, 12 2 ), 𝑁 = 1500, 𝑛 = 25 and B 1 = 𝑁(0, 𝜎 2 ) with various values of 𝜎 2 and where 𝑁(𝑎, 𝑏 2 ) denotes the normal distribution of parameters 𝑎 and 𝑏 2 . This would arguably correspond to the ECAP for the height of a 178 centimeters tall individual sampled from the population of Guyanese farmers. For populations large enough, Figure 6 shows that calculated ECAP with the same values of x 𝑎 , 𝑛 and 𝜎 2 are quite insensitive to the exact value of 𝑁. As illustrated by Figure 7, the same holds with the variance of 𝐷 in the case of normal distributions. For populations large enough, the exact choice of 𝑁 and 𝐷 should therefore not be a major cause for concern. Because of its high face validity, its robustness to changes in the underlying parameters, and its acceptable computational complexity, we think that the ECAP is a relevant metric for SDC against MDA. After correctly modelling the situation (which in most cases should not be a major challenge), data holders should be able to calculate ECAP for each observation of quantitative variables in their dataset. They can then choose a noise distribution making these ECAP low enough so that an attacker would not be able to demonstrate membership, even with an extensive knowledge of the variables involved and the type of noise used. In this process, a decision has to be made on the maximum ECAP to be tolerated, which is always arbitrary to some extent. Intuitively, ECAP values below 0.2 are suggestive of high protection against MDA, and determining the minimal noise needed to attain such values is straightforward using standard optimization algorithms. However, we suggest having a more flexible approach by looking at ECAP plots like the one in Figure 5 and selecting values based on the successive difference quotients. This may help minimizing the risk of membership disclosure without significantly impairing the utility of resulting data. For example, in Figure 5, an ECAP of value 0.2 would approximately be attained with 𝜎 = 0.075, but taking 𝜎 = 0.1 instead would ensure an ECAP of around 0.1. Said differently, a difference of only 0.025 in the noise variance would lead to a 50% reduction in the ECAP. In this case, we would recommend retaining the value 0.1, which is what we typically do in our synthesis framework. Finally, the question remains as to which value to choose for x 𝑎 . To ensure a sufficient protection of all original units, we suggest computing the ECAP for all available values and choosing a noise distribution minimizing the highest ECAP. The corresponding original value will generally be close to the tails of the distribution, as these values typically exhibit the highest distances with neighboring values in the population. Depending on the parameters used, this framework can allow for effective protection against MDA without significantly compromising data utility. For example, in a random sample of 15 heights drawn from the population of Guyanese farmers (see above for the model specifications), obtaining ECAP below 0.1 for all subjects only requires adding a normal noise with a variance of 0.09. Figures 8 and9 illustrate the resulting perturbation, which is arguably minimal. Consequently, we perform these operations for every quantitative variable of our synthetic datasets that need to be protected against MDA. Because needed variances are often small, they rarely result in aberrant values (such as negative heights), even though we use probability distributions defined on the whole real line. Of course, only synthesized values are protected this way, as values that have not been sampled by CART present by definition no risk of disclosure. Finally, we recommend publishing the type and amount of noise added to these variables so that end-users of the data can take this information into account for their fine-grained analyses. This presents no risk of disclosure, as this information is by hypothesis part of the knowledge of a potential attacker (cf. supra). However, we strongly discourage against publishing obtained ECAP values, as this could lead to privacy breaches if an attacker uses a reversed version of Equation 1.

Assessment framework

To assess the performance of our SDGF in terms of privacy and utility of the data generated, we computed various metrics on the original and synthetic version of a rich dataset. We also performed similar evaluations on datasets generated using truncated versions of our framework to validate the individual steps involved. In the following sections, we successively describe the original dataset used in this process, the synthetic versions we generated from it and the privacy and utility assessment framework we used for their evaluation.

Original dataset

The dataset we used to assess the performance of our SDGF originates from the "Mental Health In Prison" study conducted by Falissard et al. between 2003 and[START_REF] De Ladministration Penitentiaire | Les chiffres clés de ladministration pénitentiaire[END_REF] to determine the prevalence and risk factors of mental disorders in French prisons [START_REF] Falissard | Prevalence of mental disorders in French prisons for men[END_REF]. This epidemiological study used a two-stage stratified random sampling strategy. At first, 20 prisons were selected at random from the list of all French metropolitan prisons for men with stratification on the type of prison. Prisoners were then chosen at random in each of these 20 prisons until 799 prisoners were enrolled. Each prisoner was interviewed for approximately 2 hours by a group of 2 clinicians, one of whom was called a "senior" clinician and the other a "junior". These clinicians independently established their positive and severity diagnoses which they then pooled together. This resulted in a dataset of 799 observations of several hundreds of variables, of which we selected 26 based on their theoretical and empirical importance. Table 2 summarizes the nature of these variables after classical data management operations and manual SDC. In the following, we will refer to this original dataset as 𝐷 𝐼 .

Variable name

Generated datasets

Because some components of our privacy and utility assessment frameworks require a control dataset that has not been used in the synthesis processed, we did not use all rows of 𝐷 𝐼 as input to our SDGF. Instead, we randomly selected 199 rows of 𝐷 𝐼 , which we stored in a separated dataset called 𝐶 intended to be used as a control dataset when needed. The remaining 600 rows of 𝐷 𝐼 (which we shall call 𝐷 𝑂 in what follows) were used to generate 3 synthetic datasets of same length, which we respectively refer to as 𝐷 1 , 𝐷 2 and 𝐷 3 . Each of them corresponds to a further step of our SDGF. As such, 𝐷 1 was generated using CART implemented in the R 4.3.0 synthpop package and running with rpart. The CART were configured so that each leaf contained at least 33 observations, and that splits were only attempted in parent nodes containing at least 100 observations. We anticipated that these parameters would provide a satisfactory level of disclosure control given the nature of the original data. 𝐷 2 was generated from 𝐷 1 by running our distance-filtering algorithm described above.

Because most of the variables involved were quantitative, binary or ordinal, we chose the Mahalanobis distance as the measure for filtering rows. We intended to use all variables as identifiers, except job which was the only nominal variable. Missing data were handled using our custom conservative method based on worst-case scenarios (see above). Finally, we generated 𝐷 3 by adding noise to 𝐷 2 's quantitative variables that needed formal protection against MDA. Based on official reports, we estimated that the total number of males held in French prisons was about 60,000 in 2003 and 2004, at the time the data were collected [START_REF] Guérin | La population carcérale[END_REF](93)[START_REF] De Ladministration Penitentiaire | Les chiffres clés de ladministration pénitentiaire[END_REF]. These reports and some other publications allowed us to gain direct or indirect information on the distribution of these quantitative variables in the source population of the study [START_REF] Falissard | Prevalence of mental disorders in French prisons for men[END_REF][START_REF]Statistique mensuelle de la population écrouée et détenue en France -data[END_REF](96)(97)[START_REF] Masson | Avez-vous eu des enfants? Si oui[END_REF][START_REF] Toulemon | Combien d'enfants, combien de frères et soeurs depuis cent ans?[END_REF](100). More specifically, we considered that the following distributions hold in this source population: AGE~𝑁(34, 8²), N. CHILDREN~𝑁(2, 2.5²) and N. SIBLINGS~𝑁(4, 2.5²). The only other quantitative variable in the dataset, DUR.INTERV, did not undergone noise addition as per definition it cannot be collected secondarily and thus cannot be subject to MDA. In the end, 𝐷 3 is the synthetic dataset we would typically want to release as part of the Open-CESP initiative.

Privacy-related assessment

The ability of synthetic data generation methods to ensure the privacy of individuals from which their input data originate is considered to be one of their most essential qualities. It is typically assessed using privacy metrics measuring different aspects of the protection they provide against various attacks [START_REF] Murtaza | Synthetic data generation: State of the art in health care domain[END_REF]. Many metrics have been proposed, mainly targeting partially synthetic data which can be exposed to the same attacks than non-synthetic data (101). On the other hand, fully synthetic data generation methods such as ours are virtually unexposed to most of these attacks, including identity disclosure attacks (made ineffective by the synthesis process and the subsequent filtering) and MDA (formally prevented by the noise addition). They can, however, be subject to attribute disclosure attacks, where an attacker tries to infer the value of target variables for an individual based on his knowledge of other "key" variables [START_REF]Synthetic data for official statistics: a starter guide[END_REF].

Quantifying the information that an attacker can gain conditionally on his knowledge of key variables is a challenging task for which no formal model currently exists. In 2014, Mark Elliot made a valuable contribution to this field by introducing a new metric initially named the "Empirical differential privacy" (102) and developed in subsequent works under the name of Differential Correct Attribution Probability (DCAP) (103). Given a set 𝐾 of key values and a set 𝑇 of target values, the idea is to compare the probability P(𝑇 | 𝐾) in the original and synthetic datasets. This is typically implemented by counting the number of occurrences of these values in each dataset. A synthetic dataset giving a conditional probability close to the one calculated in the original data would be considered as particularly disclosive. On the contrary, if the probability obtained from the synthetic data is close to the univariate distribution of the target variables, then the risk of attribute disclosure can be considered as minimal.

The DCAP has several qualities, including its high face validity upon initial approach and the possibility to compute it using specifically chosen key and target variables, thus making it easier to interpret. However, it faced a serious criticism in 2019, when Chen et al. showed that in its original state, the DCAP was no more than a utility metric (104). Indeed, let us imagine a key variable consisting of individuals' smoking status and a target variable defined as whether or not they have lung cancer. If a synthetic dataset allowed a precise prediction of the oncological status of individuals conditionally on their smoking habits, would this count as disclosure or rather as a sign of quality of the synthetic data? Arguably, preventing synthetic datasets from drawing such inferences would defeat their whole purpose, even with other choices of key and target variables. The correction suggested by Chen et al. was already outlined in the seminal works on the DCAP, and consisted in restricting the calculation of conditional probabilities on statistical uniques. The resulting metric has been called the Targeted Correct Attribution Probability (TCAP). Because it intuitively resolves the main flaws of the DCAP, this new metric has enjoyed some popularity since then, and has been used in several other works (105-107). Still, it has the disadvantage of being only defined for categorical variables, and thus unsuitable to rich datasets like those processed by the Open-CESP team. In 2019, Hittmeir et al. suggested a way of extending the DCAP to numerical variables, which could theoretically be adapted to the TCAP (61). However, their approach suffers from several flaws that we consider to be prohibitive, namely their choice of an infinite radius to compare the value of numerical variables, which raises interpretation issues. They also seem to recode categorical variables into numerical, which in our view would make their approach as unsuitable to the Open-CESP as the original TCAP. Even though the TCAP and its variants are not suited to our privacy assessment framework in their current state, we think that their general approach was the most promising to quantify attribute disclosure risks. Consequently, we chose to design a new metric following the same core idea, but suited both to numerical and categorical variables, which we call the Generalized Targeted Correct Attribution Probability (GTCAP). Our approach is based on the specification of radiuses for all quantitative variables involved. These radiuses define the maximum distance between two values of these variables so that they can be considered equal or approximately equal. More specifically, they allow for the computation of proximities between each value of these variables, linearized such that they equal 0 for an absolute difference greater than the radius, and 1 for a null difference. These proximities are used both to define statistical uniques and to weight the conditional probabilities computed from them.

When no numerical variables are involved, or when every computed proximities are either 0 or 1, these conditional probabilities are the same that would be obtained by computing a TCAP on the same dataset with categorized variables. When the calculation of a conditional probability involves a null denominator, we follow one of the option proposed by Taub et al. and count the resulting correct attribution probability as 0 (103). Finally, we normalize resulting GTCAP between the univariate probability and the GTCAP obtained with the original data. Normalized GTCAP obtained from all statistical uniques are then averaged, resulting in what we call the mean GTCAP for a synthetic dataset. Algorithm 2 contains the key elements of our implementation.

Algorithm 2. Main functions needed to compute the mean GTCAP of a synthetic dataset.

To assess the performance of our SDGF in terms of protection against attribute disclosure attacks, we computed the mean GTCAP for 𝑆 1 , 𝑆 2 and 𝑆 3 using AGE, JOB, N.CHILDREN, N.SIBLINGS and EDUCATION as key variables, and SEVERITY as target variable. The decision to include only one target variable was made to prevent computed probabilities from being zero too frequently. The number of key variables was also limited so that only an acceptable proportion of units would become statistical uniques. The following radiuses were used: 5 for AGE, 1 for N.CHILDREN and 2 for N.SIBLINGS. Additionally to the mean GTCAP, we also used histograms to display the normalized GTCAP of all statistical uniques and assess their dispersion for each synthetic dataset.

Although their historical usage was mainly related to the assessment of the privacy of synthetic datasets used by computer scientists to train artificial intelligence models [START_REF] Drechsler | 30 Years of Synthetic Data[END_REF], metrics derived from machine learning techniques are expanding in the field of synthetic health data generation (108). Among them, those provided by the Anonymeter framework have a particular appeal because of their apparent regulatory validity. Running on Python 3.8 to 3.10, Anonymeter provides three main classes, each assessing a different type of disclosure risks, respectively singling out risks, linkability risks and inference risks (109). This typology of risks is based on the semantics used by the former European Union Data Protection Working Party (110). The assessment framework itself is based on simulated attacks exploiting each of these risks. According to its authors, this framework has been positively reviewed by the French Commission Nationale de l'Informatique et des Libertés (CNIL), which has "not identified any reason suggesting that the proposed set of methods could not allow to effectively evaluate the extent to which the aforementioned three criteria are fulfilled or not in the context of production and use of synthetic datasets" (111). Because of this apparent legal compliance and its complementarity with more standard metrics, we also included Anonymeter in our privacy assessment framework. We ran it on Python 3.10 to simulate 150 univariate and multivariate singling-out attacks as well as 150 linkage attacks against the following groups of variables: AGE, JOB, EDUCATION, N.CHILDREN and N.SIBLINGS versus DURATION, DISCIPLINARY, CHILDREN.JUDGE and PLACEMENT. Finally, we used it to simulate 26×150 inference attacks successively targeting each variable of our synthetic datasets, with all other variables being used as keys. In all these simulations, 𝐶 was used as the learning dataset and 𝑆 1 , 𝑆 2 and 𝑆 3 were the successive targets.

Utility-related assessment

Along with privacy, utility of synthetic data is one of their main sought qualities. Although some authors may use this term with a more specific meaning, it can be defined as the ability of the synthetic data to replace the original ones in their intended use [START_REF] Murtaza | Synthetic data generation: State of the art in health care domain[END_REF]. In the context of the Open-CESP initiative, one of the main component of the utility of synthetic data should therefore be their ability to replicate the statistical content of the original data. This arguably implies a high distributional similarity between the synthetic and original data. The first step of our utility assessment framework was therefore to compare the univariate distribution of all variables in 𝐷 𝑂 and (respectively) 𝑆 1 , 𝑆 2 and 𝑆 3 . To compare bivariate distributions between each of these datasets, we also plotted scatter plots of every pair of their quantitative variables. The intended use of research data can be considered from two perspectives. On the one hand, the specific context of the research can suggest specific processing and analyses of the data. On the other hand, the research dataset may virtually be processed in a infinite number of manners, each of them having an equal a priori validity. In the synthetic data literature, both these perspectives have been taken to justify two different types of utility metrics: narrow metrics and broad ones [START_REF] El Emam | Utility Metrics for Evaluating Synthetic Health Data Generation Methods: Validation Study[END_REF]. Narrow metrics are by definition specific to a particular analysis to be performed on the data; often, they simply consist in the replication of such an analysis.

In contrast, utility metrics are said to be broad when they aim at quantifying the overall utility of a synthetic dataset, irrespective of the analyses to be performed on it. In the absence of formal ways to prove the optimality of a SDGF in terms of utility of the generated data, the use of metrics of one type or the other is considered to be a critical part of any utility assessment framework. In this context, narrow and broad metrics are not incompatible and some authors even suggest that they should be used together when possible [START_REF] Emam | Seven Ways to Evaluate the Utility of Synthetic Data[END_REF]. The large number of reported metrics in the literature could make the choice of a specific metric difficult. However, when validating a novel SDGF, we believe that already proven metrics are the most suitable, as it would be otherwise difficult to validate separately the SDGF and the metric. For this reason, we chose to use the so-called Purdam and Elliot methodology (112) for the narrow utility assessment of our synthetic data, and the propensity score Mean Squared (pMSE) as a broad utility metric. The Purdam and Elliot methodology has been first described by Taub et al. in 2017 (113), referring to a previous work by Purdam et al. (112). Given an original dataset collected as part of a study, the core of this method is to identify the essential findings of the original study and to try to replicate them with the synthetic data. Depending on the statistical nature of these findings, specific metrics can be calculated such as interval overlaps or ratios of counts (113). In our case, the main findings associated with the original data have been published by Falissard et al. in 2006 (90). In this article, the most crucial data are arguably shown in the first table, which contains the prevalence estimates of several DSM-IV diagnoses. Using 𝐷 𝑂 , 𝑆 1 , 𝑆 2 and 𝑆 3 , we would be able to calculate similar estimates for major depressive disorders, agoraphobia, substance-related disorders and schizophrenia, which is the way we chose to implement the Purdam and Elliot methodology in our assessment framework. As for the pMSE, it has been extensively studied in recent works (114) and has even been advocated as the best and most popular population-level utility metric (115). As its name suggests, it is based on the so-called propensity scores used in causal inference studies. The idea is to use all available variables to build a model predicting the synthetic nature of a given row (original or synthetic). For each row, this predicted probability is subtracted from the real proportion of synthetic rows in the whole dataset combining original and synthetic units. Each differences are squared and their mean gives the pMSE. Intuitively, a low pMSE indicates that the model was not able to distinguish correctly between original and synthetic units, thus suggesting a high utility of synthetic data (116). In our utility assessment framework, we used the functions provided by the synthpop package to calculate the pMSE for 𝑆 1 , 𝑆 2 and 𝑆 3 based on a propensity model fitted using CART (117). For each synthetic dataset, we also plotted the standardized pMSE ratios obtained from each pair of variables. Standardized pMSE ratios can be interpreted as classical pMSE, but allow meaningful comparisons between several models. Their calculation method is detailed in (116).

Results

All of the following results were obtained in a single pass, using a random seed unknown to the authors.

Synthesis

The synthesis of 𝑆 2 from 𝑆 1 was first attempted using all non-ordinal variables to calculate distances, as described in the "Methods" section. By doing so, however, the resulting covariance matrix was found to be near-singular, having a determinant of about 1.8 × 10 -7 which resulted in numerical stability issues when computing Mahalanobis distances. We therefore decided to remove the variables most likely involved in this near-singularity from the distance calculations. Figure 10 shows the initial correlation matrix between all nonordinal variables of 𝐷 𝑂 . From the inspection of this matrix, it appeared that SUICIDE.HR, SUICIDE.SCORE, CHILDREN.JUDGE and PERSONALITY were responsible for diffuse correlation patterns. Accordingly, we exclude them from the calculation of Mahalanobis distances. The determinant of the covariance matrix without these variables had a satisfactory value of around 0.0002, allowing the synthesis of 𝑆 2 from 𝑆 1 without further issues. Figure 11 shows the correlation matrix of 𝐷 𝑂 without these variables. Based on the model specified above and the value of the synthesized units for numerical variables, we determined that a normal noise with a standard deviation of 0.1 was needed to protect both AGE and N.CHILDREN against MDA, while a standard deviation of 0.2 was needed to protect N.SIBLINGS. 𝑆 3 was obtained from 𝑆 2 by applying these additive noises.

Privacy-related assessment

The mean GTCAP for 𝑆 1 , 𝑆 2 and 𝑆 3 were respectively 0.183, 0.164 and 0.166, suggesting an excellent level of protection against attribute disclosure attacks. Histograms of normalized GTCAP for statistical uniques can be seen in Figure 14. The results of attacks simulated using Anonymeter are displayed in Prevalence data for seven diagnoses of the DSM-IV were reconstituted following the Purdam and Elliot methodology. They are shown in Table 4 As planned in our assessment protocol, pMSE were determined for each synthetic dataset, resulting without surprise in 𝑆 2 (pMSE=0.123) and 𝑆 3 (pMSE=0.124) demonstrating a bit less utility than 𝑆 1 (pMSE=0.109). This finding is confirmed and illustrated by standardized pMSE ratios plotted in Figure 23, 24 and 25. More surprisingly, these ratios were especially high in 𝑆 1 for the pair AGORAPHOBIA × DEPRESSION, which may be related to the underestimate of the prevalence rate of agoraphobia when using this dataset.

Discussion

Throughout this work, we showed how a multi-step SDGF can produce high fidelity data while preserving the confidentiality of individuals from which they originate. Both these qualities have been assessed on a rich dataset featuring complex joint distributions. We used both proven and innovative assessment methods which gave unequivocal results. In particular, the calculated pMSE as well as the GTCAP were found to be persuasively low in all synthetic datasets generated. Dataset 𝑆 2 was close to 𝑆 1 for all metrics computed, and performed better on most privacy metrics, which demonstrates the relevance of our distancebased filtering method (aiming, among other, at preventing identification disclosure and related attacks). 𝑆 3 and 𝑆 2 had a nearly identical content, which shows that individuals of 𝐷 𝑂 could be protected against MDA at a low utility cost. These results are encouraging and show that the Open-CESP project is technically feasible, at least for some datasets. This, in our view, is a great step toward compliance with the core Open Science principles. However, research is still needed to determine what are the conditions of this technical feasibility. For most types of disclosure risks, our assessment method has indeed a weak formal grounding. Consequently, there is always an open possibility that another dataset could not have resulted in such neat outcomes. While waiting for the establishment of formal foundations to assess the intrinsic qualities of SDGF, replicating this work with other original datasets could give us precious insights on these validity conditions. In parallel, the properties of the novel metrics that we introduced, such as the GTCAP, should be established more thoroughly. This hopefully could help determining the best risk-utility tradeoff for upcoming synthetic datasets, which at the time being is still a major research challenge [START_REF] Carvalho | Survey on Privacy-Preserving Techniques for Microdata Publication[END_REF].

Another major contribution of this work is the introduction of a formal protection framework against MDA. This in our knowledge had never been reported before. By showing that high levels of protection against these attacks can be provided by a minimal noise addition, we sketched out a solution to what should be a legitimate concern of every data provider. The solution is not complete however, because this framework in its current state still has substantial limitations. First and foremost, its validity conditions need to be studied in more details, at least to answer the following questions: how to deal with values at the extreme periphery of the distribution? How to deal with small samples and/or small populations? How to deal with non-standard distributions? An important development would also be to treat the multivariate case, as a typical attacker would arguably use more than one variable to conduct a MDA. Other open questions include the feasibility of a noise addition framework preserving more of the variance of the original data, and the specification of an optimal algorithm to estimate ECAP and related values. In the meantime, comparing the current framework against existing membership disclosure metrics such as the F1 score [START_REF] El Emam | Validating a membership disclosure metric for synthetic health data[END_REF] seems to be a necessary step to validate it further. Given these results, and even if further developments are undoubtedly to come in the following years, we think that the Open-CESP initiative can be launched at a full-scale as of now. In this respect, legitimate concerns are to be anticipated. Despite their intuitive appeal, the probabilistic nature of the data synthesis and most of the additional steps of our SDGF may generate the fear that a privacy attack could be successful, even by chance. These concerns are theoretically well-founded [START_REF] Drechsler | 30 Years of Synthetic Data[END_REF]. However, they need to be replaced in the larger context of medical research and data protection. When researchers communicate on their results, they release data, which can always lead to disclosure with a nonzero probability. Similarly, physical data storage locations can be prone to privacy breaches. However, research data are still communicated and stored worldwide. Thus there is always a trade-off made between the risk of disclosure and the expected benefits of using this type of data. Synthetic data make no exception, and as the conditions of this trade-off are more and more understood, we think that their large scale public release has nothing unrealistic.

Conclusion

By successfully assessing the quality of data produced using a novel multi-step synthetic data generation framework, we showed the technical soundness of the Open-CESP project. In doing so, we also made several more general contributions including a novel formal protection framework against membership disclosure attacks as well as a generalized privacy metric compatible with various data types. This work opens the door to further investigation related to the determination of the best risk-utility tradeoff for synthetic data. Despite these persisting challenges, the Open-CESP initiative seems ripe for full-scale implementation, thus aligning with the broad Open Science objectives. Further work will refine the methods we used, but the path forward for public release of synthetic data appears promising.

Figure 2 .

 2 Figure 2. Illustrated steps of our SDGF.

Figure 3 .

 3 Figure 3. Credible CART generated from data shown in Figure 1.

Figure 4 .

 4 Figure 4. Successive steps of the distance-based filtering algorithm. Empty circles represent original units, while solid circles represent synthetic ones. In step (4), green synthetic units are retained, while red ones are removed.

Figure 5 .

 5 Figure 5. ECAP values after the addition of normal noise of increasing variance.

Figure 6 .

 6 Figure 6. ECAP values after the addition of normal noise of increasing variance for various population sizes.

Figure 7 .

 7 Figure 7. ECAP values after the addition of normal noise of increasing variance for N=1500 and various population variances.

Figure 8 .

 8 Figure 8. Deviation from initial position after the addition of a normal noise of 0.09 variance to a random sample of heights.

Figure 9 .

 9 Figure 9. Distribution of the sample displayed in Figure 8 before (left) and after (right) noise addition.

  Figures 12 shows a projection performed using NIPALS (118) of the units synthesized and filtered after the first iteration. Figures 13 uses the same projection to display retained synthetic units.

Figure 10 .

 10 Figure 10. Correlation matrix for all non-ordinal variables of Do.

Figure 11 .

 11 Figure 11. Correlation matrix for all non-ordinal variables of Do, excluding SUICIDE.HR, SUICIDE.SCORE, CHILDREN.JUDGE and PERSONALITY.

Figure 12 .

 12 Figure 12. Projection of Do and S1 on their first (PC1) and second (PC2) principal component. Points of S1 are displayed red if they were filtered out, and purple otherwise.

Figure 13 .

 13 Figure 13. Projection of Do and S2 on the same components as in Figure 12. Points of S2 do not appear to be further from Do than those of S1.

Figure 14 .

 14 Figure 14. Normalized GTCAP values for statistical uniques in S1, S2 and S3.

Figure 15 .

 15 Figure 15. Scores obtained by S1 after simulated inference attacks with each variable being successively selected as a target.

Figure 16 .

 16 Figure 16. Scores obtained by S2 after simulated inference attacks with each variable being successively selected as a target.

Figure 17 .Figure 18 .

 1718 Figure 17. Scores obtained by S3 after simulated inference attacks with each variable being successively selected as a target.

Figure 23 .

 23 Figure 23. Matrix of standardized pMSE ratios for each pair of variables in S1.

Figure 24 .

 24 Figure 24. Matrix of standardized pMSE ratios for each pair of variables in S2.

Figure 25 .

 25 Figure 25. Matrix of standardized pMSE ratios for each pair of variables in S3.

Table 2 .

 2 Characteristics of variables in the original dataset.

	Meaning	Type and values

Table 3

 3 This was especially apparent when comparing the scores obtained by 𝑆 2 and 𝑆 3 , which were significantly different despite these datasets being constituted from almost the same rows. The precision could anyways not have been a lot better because of the necessarily limited size of the control dataset.

	Attack type	S 1	S 2	S 3
	Singling out / univariate	0.200	0.226	0.206
	Singling out / multivariate	0.242	0.210	0.084
	Linkability	0.006	0.000	0.000

and Figures 15 to

17

. 𝑆 2 and 𝑆 3 seemed to perform better than 𝑆 1 for all attack types, which was expected given the additional processing that these two datasets underwent. Quantifying the relative performance of the three datasets was, however, tedious because of the imprecision of the score estimates.

Table 3 .

 3 Scores of each synthetic dataset after simulated attacks by Anonymeter. Lower scores are indicative of a better protection against these type of attacks.

Table 4 .

 4 and Figure22. All synthetic datasets performed equally well in this respect, providing estimates close to those of 𝐷 𝑂 , with the notable exception of agoraphobia and schizophrenia, for which every synthetic estimates were close to the half of the 𝐷 𝑂 estimate. Interestingly, this was precisely for these diagnoses that sampling fluctuations caused 𝐷 𝑂 to overestimate original prevalence rates. Prevalence

	D I	D o	S 1	S 2	S 3

data reconstituted using the Purdam and Elliot methodology. These prevalence rates were calculated in inmates having a SEVERITY score of at least 5. DI refers to the complete data of 799 observations used by the authors of the original study. Figure 22. Same data as in Table 4 plotted for Do, S1, S2 and S3.

Figure 19. Univariate distributions of S1 plotted against Do.

Figure 20. Univariate distributions of S2 plotted against Do.