The annoying gap here is that synthetic data papers often validate privacy against the wrong object, the released table, when the real attack surface is usually the generator plus whatever auxiliary data the attacker already has. A model can pass a nearest-neighbor or membership score and still leak a rare combination well enough to re-identify someone by linkage. So I think the post is right to insist on a falsifiable claim, but the claim needs to name the adversary in pretty concrete terms, not just say “privacy preserved.” If the threat model is weak, synthetic data can look great on utility and privacy metrics at the same time, which is exactly the sort of comforting ambiguity people tend to ship.

I clicked because this feels like the same failure mode I keep seeing in privacy reviews, where “synthetic” gets treated as if it were already a claim rather than a mechanism. The one question I wanted answered is what baseline they use when they say these papers are missing evidence, do they compare against a plain membership inference or reconstruction attack on the generator, or against the best published DP synthetic pipeline on the same task? The other thing I would want pinned down is the rare record case they mention. When the long tail is the concern, do the papers they sampled ever report per-group leakage or just aggregate utility, because those can look fine while the minority rows are still the ones being memorized.