Sequential CART Synthesis

Description

Sequential CART synthesis creates an artificial copy of a confidential microdata set (records about individual people or organisations) that can be released in place of the real data, in the form used by the synthpop package for R. Variables are synthesised one at a time in a chosen order: the first is generated by sampling with replacement from its observed values, and for each later variable a classification or regression tree (CART) is fitted on the real data to predict it from the variables earlier in the order. Each synthetic record is passed down that tree using its already-synthesised values, and the new value is copied from a randomly chosen real record in the leaf it reaches, so the joint distribution of the data is rebuilt as a chain of conditional distributions. Disclosure risk is limited by setting a minimum leaf size, smoothing synthesised continuous values and removing synthetic records that reproduce unique real ones, and several synthetic copies can be released so that analysts can allow for the extra uncertainty that synthesis adds.

Example Use Cases

Privacy

A national longitudinal study that links census returns to administrative records such as births, deaths and cancer registrations for a sample of the population cannot let approved researchers take the data off site. Its support team runs CART synthesis to produce a bespoke synthetic extract for each project, so researchers can explore the data and write and test their analysis code at their own institution before the final model is run on the real data in the secure setting.

A hospital trust wants a university team to develop a readmission model without receiving patient records. It releases a CART-synthesised copy of the admissions table with a minimum leaf size of ten and kernel smoothing of continuous values, removes any synthetic record that matches a unique real patient on age, sex and postcode district, and runs a disclosure-risk assessment before release.

A national statistics office publishes a synthetic teaching file of its labour force survey for university courses, generated by sequential CART synthesis with the variable order and minimum leaf sizes chosen with subject experts, and labels every record as synthetic so that no reader mistakes a row for a real respondent.

Limitations

It gives no formal privacy guarantee. No synthetic record is a real person, but trees can reproduce rare combinations and extreme values, and an intruder who knows that a real record holds the largest value of a variable can bound it from the synthetic maximum. Risk must be measured for each release and reduced with larger leaves, smoothing and removal of unique matches, each of which costs analytical value.
Relationships the trees miss disappear from the synthetic data. A tree grown from few records may never split on a variable that matters, so the synthetic data show no association where the real data have one; in the method's original evaluation a regression coefficient for sex was attenuated to zero in this way. Small subgroups and weak effects are the most exposed.
Results depend on the order in which variables are synthesised and on which earlier variables predict each later one. A careless order can produce impossible combinations, such as a detailed category that contradicts the summary variable derived from it, so detailed variables should be synthesised before derived ones and the output checked for inconsistencies.
Synthetic data cannot reproduce every analysis of the real data. Analyses the synthesiser did not plan for may give different answers, so a release should state which analyses it supports, and users should confirm key findings on the real data, for example through a verification service or secure access.

Resources

Research Papers

synthpop: Bespoke Creation of Synthetic Data in R

Beata Nowok, Gillian M. Raab, and Chris Dibben•Oct 28, 2016

In many contexts, confidentiality constraints severely restrict access to unique and valuable microdata. Synthetic data which mimic the original observed data and preserve the relationships between variables but do not contain any disclosive records are one possible solution to this problem. The synthpop package for R, introduced in this paper, provides routines to generate synthetic versions of original data sets. We describe the methodology and its consequences for the data characteristics. We illustrate the package features using a survey data example.

Using CART to Generate Partially Synthetic Public Use Microdata

J. P. Reiter•Jan 1, 2005

To limit disclosure risks, one approach is to release partially synthetic public use microdata sets. These comprise the units originally surveyed, but some collected values, for example sensitive values at high risk of disclosure or values of key identifiers, are replaced with multiple imputations. This article presents and evaluates the use of classification and regression trees to generate partially synthetic data. Two potential applications of CART are studied via simulation: (i) generate synthetic data for sensitive variables; and, (ii) generate synthetic data for variables that are key identifiers.

Software Packages

synthpop: Generating Synthetic Versions of Sensitive Microdata for Statistical Disclosure Control

Jul 12, 2025

A tool for producing synthetic versions of microdata containing confidential information so that they are safe to be released to users for exploratory analysis. The key objective of generating synthetic data is to replace sensitive original values with synthetic ones causing minimal distortion of the statistical information contained in the data set. Variables, which can be categorical or continuous, are synthesised one-by-one using sequential modelling. Replacements are generated by drawing from conditional distributions fitted to the original data using parametric or classification and regression trees models. Data are synthesised via the function syn() which can be largely automated, if default settings are used, or with methods defined by the user. Optional parameters can be used to influence the disclosure risk and the analytical quality of the synthesised data. For a description of the implemented method see Nowok, Raab and Dibben (2016) <doi:10.18637/jss.v074.i11>. Functions to assess identity and attribute disclosure for the original and for the synthetic data are included in the package, and their use is illustrated in a vignette on disclosure (Practical Privacy Metrics for Synthetic Data).

Tutorials

Get started — synthpop

Get started with synthpop, run your first synthesis or explore synthpop with Shinny app.

Documentations

synthpop: Generating synthetic versions of sensitive microdata for statistical disclosure control

What is synthpop? An R package for generating synthetic versions of sensitive microdata. A tool to create synthetic data and evaluate their utility.

Related Techniques

Name	Description	Assurance Goals
GAN-Based Tabular Synthetic Data	GAN-based tabular synthetic data generation trains a generative model on a real table, then samples new rows from it to produce a synthetic table that can be shared or used in place of the original. In CTGAN (Conditional Tabular GAN), a generator network learns to produce rows and a discriminator network learns to tell them from real ones. CTGAN suits tables through mode-specific normalisation, which treats each numeric column as a mixture of clusters, and through training-by-sampling, which shows rare categories to the model often enough for it to learn them. TVAE is a related model built on a variational autoencoder, another kind of generative network, rather than a GAN. The synthetic table aims to preserve the original's column distributions and correlations, and its rows are generated rather than copied, but this is not a privacy guarantee, because a generator can memorise and reproduce training rows.	Privacy
k-Anonymity	k-Anonymity is a property that a table of real records about people can be made to satisfy before it is released or shared, in which every record shares its values on the quasi-identifiers with at least k-1 other records, so anyone linking the table to another source on those columns always matches a group of at least k records, which is k people only when each person has one record. Quasi-identifiers are columns that are not names or ID numbers but could be found elsewhere and combined to single a person out, such as date of birth, sex and postcode, and because the data holder chooses them, the protection covers only those columns. To reach a chosen k, each quasi-identifier is coarsened along a hierarchy set in advance (exact age to five-year band, full postcode to district), and the values or records that would still sit in a group smaller than k are suppressed, with a search choosing the coarsening that loses least information. The output is the transformed table of real records made less specific, not artificial ones, together with the k it achieves and a measure of the detail lost. Unlike differential privacy, it gives no bound on what an observer can learn, because it blocks linking on the listed columns but does not stop someone learning a sensitive value that everyone in a group shares.	Privacy
PII Detection and Redaction in Training Text	PII detection and redaction finds personally identifiable information (PII), such as names, email addresses, phone numbers and account or ID numbers, in a body of text and removes or replaces it before the text is used to train or fine-tune a model, so that the model has fewer personal details to memorise and later reproduce. Presidio, a widely used open-source tool first released by Microsoft and now run as an independent community project, is the reference implementation: each document passes through a set of recognisers, in which a named-entity recognition model (by default an English spaCy model) tags names, places and dates, patterns with checksum or format checks catch structured identifiers such as card and NHS numbers, and nearby words such as 'account' raise a candidate's confidence score. Every detection above a chosen score is then replaced with a placeholder for its type (for example <PERSON>), masked, hashed, encrypted or deleted, and the cleaned corpus goes to training. Because detection is never complete, the procedure ends by measuring recall, the share of identifiers actually caught, for each type on a hand-labelled sample of the same corpus. The evidence it produces is that measured miss rate and the cleaned corpus; unlike differential privacy or synthetic data, it removes real personal details from real text and gives no bound on what remains.	Privacy