Gen-LRA: Generative Likelihood Ratio Attack

• Gen-LRA is a membership inference attack that detects if a record was used in generating synthetic tabular data by evaluating local likelihood shifts.
• It employs Gaussian Kernel Density Estimation and k-nearest neighbor techniques to compute a log-likelihood ratio that identifies local overfitting.
• Empirical results across various models show that Gen-LRA is computationally efficient and achieves higher AUC in detecting privacy leakage.

Searching arXiv for the specified papers to ground the article. Generative Likelihood Ratio Attack (Gen-LRA) is a membership inference attack for synthetic tabular data release that operates in a no-box setting: the auditor has no knowledge of, nor query access to, the target generator’s internal architecture, parameters, or sampling mechanism, and instead relies on the released synthetic dataset $S$ and an independently collected reference dataset $R \sim P$ from the same ambient population (Ward et al., 28 Aug 2025). Its central idea is to evaluate how the inclusion of a candidate real record $x^\star$ in a surrogate estimator for the ambient population changes a local likelihood ratio over synthetic samples near $x^\star$. In the formulation of the method, a high score indicates that adding $x^\star$ to the reference set substantially increases the local likelihood of nearby synthetic samples, which is consistent with local overfitting by the target generator and therefore with membership in the training set (Ward et al., 28 Aug 2025).

1. Threat model, objective, and attack game

Gen-LRA is defined for the privacy auditing of synthetic tabular data release. An auditor receives a candidate real record $x^\star$ and must decide whether $x^\star$ was in the training set $T$ of a tabular generative model $G$ that produced a released synthetic dataset $S$ (Ward et al., 28 Aug 2025). The attack is framed as a standard membership inference game. A challenger samples $R \sim P$0 from a population distribution, trains a generator, and releases synthetic samples. A bit $R \sim P$1 is then drawn uniformly; if $R \sim P$2, $R \sim P$3 is drawn from $R \sim P$4 and is therefore a member, otherwise $R \sim P$5 and is a non-member. The adversary outputs a guess based on a score and threshold,

$R \sim P$6

The method assumes a no-box threat model. The only inputs available are the released synthetic dataset $R \sim P$7 and an independently collected reference dataset $R \sim P$8 from the same ambient population (Ward et al., 28 Aug 2025). The reference-data assumption is described as realistic because it can be satisfied by public or open-source data, paid datasets, or preexisting domain knowledge.

The motivation for the attack is the observation that tabular generative models tend to significantly overfit to certain regions of the training distribution (Ward et al., 28 Aug 2025). In those regions, synthetic density often exhibits local concentration around subpopulations present in $R \sim P$9, such as minorities or demographic pockets. If $x^\star$0 and lies near such a region, its presence shifts local likelihoods over $x^\star$1 more than an out-of-training $x^\star$2. This suggests that membership evidence is concentrated in local neighborhoods rather than in global density behavior.

2. Local likelihood ratio and influence formulation

The core quantity in Gen-LRA is a local likelihood ratio. Given a candidate point $x^\star$3, the method first defines a local neighborhood in the synthetic dataset by the $x^\star$4 nearest synthetic samples,

$x^\star$5

The paper specifies that $x^\star$6 is a small integer, with $x^\star$7 by default, and that locality is measured in the encoded numeric space using Euclidean distance with an efficient $x^\star$8-NN index such as a ball-tree (Ward et al., 28 Aug 2025).

The local conditional likelihood ratio is then defined as

$x^\star$9

Its attack score is the log-likelihood ratio,

$x^\star$0

A high score means that including $x^\star$1 as a reference sample significantly increases the local likelihood of nearby synthetic samples (Ward et al., 28 Aug 2025).

The same quantity is interpreted as an empirical influence measure. The paper introduces the population influence functional

$x^\star$2

and its finite-sample analogue

$x^\star$3

For Gen-LRA, the relevant functional is the local log likelihood of $x^\star$4 under a surrogate trained on $x^\star$5 versus $x^\star$6, so that

$x^\star$7

This formulation is used to justify Gen-LRA as a local influence attack rather than a direct density estimator of the candidate point itself (Ward et al., 28 Aug 2025).

3. Surrogate density estimation and attack pipeline

Gen-LRA uses Gaussian Kernel Density Estimation (KDE) as a surrogate density estimator for the ambient population. With isotropic bandwidth $x^\star$8, the surrogate density trained on $x^\star$9 is

$x^\star$0

where

$x^\star$1

and $x^\star$2 is the dimensionality after encoding (Ward et al., 28 Aug 2025). For the augmented reference set $x^\star$3, the corresponding estimator is

$x^\star$4

Bandwidth selection follows Silverman’s rule of thumb,

$x^\star$5

using either a per-dimension rule or a global isotropic bandwidth (Ward et al., 28 Aug 2025).

Using a product rule for independent synthetic points as a local approximation, the estimated local likelihood ratio is

$x^\star$6

and the score becomes

$x^\star$7

The attack pipeline has four stages (Ward et al., 28 Aug 2025). First, mixed-type tabular data are encoded into numeric space; in the reported experiments, ordinal encoding worked best for KDE-based attacks, while one-hot plus PCA and VAE latent encodings were viable alternatives. Second, a ball-tree is built on the synthetic dataset $x^\star$8 for fast neighbor queries. Third, a KDE is fit on $x^\star$9 once, and for each candidate $x^\star$0 a KDE is instantiated on $x^\star$1. Fourth, the method queries the $x^\star$2 nearest neighbors of $x^\star$3 in $x^\star$4, evaluates both surrogates on those points, computes $x^\star$5, and applies the threshold rule $x^\star$6.

The complexity profile is one of the method’s practical advantages. Building the ball-tree on $x^\star$7 takes $x^\star$8 time and $x^\star$9 memory; for each candidate $x^\star$0, the $x^\star$1-NN query costs $x^\star$2 and naïve KDE evaluation on $x^\star$3 points costs $x^\star$4 multiplications (Ward et al., 28 Aug 2025). The paper contrasts this with query-based MIAs that require training many surrogate generators per candidate point. This suggests that Gen-LRA is designed to be computationally inexpensive relative to generator-retraining attacks while still exploiting a likelihood-ratio principle.

4. Theoretical basis and operating characteristics

The theoretical grounding of Gen-LRA is explicitly tied to the likelihood ratio principle: the paper invokes the Neyman–Pearson lemma to motivate the use of likelihood ratios as the most powerful tests between simple hypotheses (Ward et al., 28 Aug 2025). In this construction, the ratio is local and conditional rather than global, because the observable leakage surface in the no-box setting is the released synthetic dataset itself.

A central claim is that overfitting yields detectable local signals. If the generator memorizes or replicates patterns around training points, augmenting the ambient surrogate with a member increases the local synthetic likelihood more than adding a non-member (Ward et al., 28 Aug 2025). The method therefore depends on local concentration around training regions, not on globally elevated density everywhere in feature space.

The paper also proves an invariance property: if

$x^\star$5

then for any invertible transformation $x^\star$6 of the feature space,

$x^\star$7

This is presented as stability of the log-likelihood ratio under invertible re-encodings (Ward et al., 28 Aug 2025). A plausible implication is that the score is tied to likelihood structure rather than to any single coordinate system, although the empirical success of the method still depends on practical encoding choices for KDE and nearest-neighbor search.

Hyperparameter behavior is also theoretically informative. Smaller $x^\star$8 improves performance, whereas as $x^\star$9 and the score approaches a global likelihood comparison, the signal vanishes and $T$0 (Ward et al., 28 Aug 2025). This is reported as direct evidence that the relevant overfitting is local. Likewise, Gaussian KDE with Silverman bandwidth outperformed deep-learning density estimators such as BNAF in identifying local privacy leakage, especially for models with egregious leakage. The paper attributes this to the subtlety of local ratio differences and the computational simplicity of KDE.

5. Empirical results and comparison to other membership inference attacks

The empirical study spans 15 tabular datasets, 9 generative models, and 7 MIAs, with experiments repeated over 10 seeds and dataset sizes $T$1 (Ward et al., 28 Aug 2025). The generative models are Bayesian Network, PATEGAN, Ads-GAN, CTGAN, TVAE, Normalizing Flows, Tab-DDPM, ARF, and TabSyn. The MIAs are LOGAN, MC, DCR, DCR difference, DOMIAS, DPI, and Gen-LRA. The experimental protocol uses equal-sized random splits for $T$2, $T$3, and $T$4, trains the generator on $T$5, produces $T$6, and audits candidate points using consistent encodings.

Gen-LRA is reported to achieve the best average rank, 1.0, across architectures in AUC-ROC (Ward et al., 28 Aug 2025). Representative mean AUCs are:

Generative model	Mean AUC for Gen-LRA
Bayesian Network	0.679 (0.07)
Tab-DDPM	0.603 (0.08)
TabSyn	0.583 (0.04)
ARF	0.562 (0.03)
TVAE	0.541 (0.02)
Ads-GAN	0.534 (0.02)
CTGAN	0.533 (0.02)
Normalizing Flows	0.524 (0.02)
PATEGAN	0.520 (0.02)

At low false-positive operating points, the method is also reported to dominate competing attacks. The reported values are $T$7 of $T$8, $T$9 of $G$0, and $G$1 of $G$2 (Ward et al., 28 Aug 2025). The paper states that Gen-LRA nearly doubles the next-best attack at $G$3 and dominates across FPRs, which it interprets as stronger identification of egregiously leaked members.

The comparative discussion emphasizes why Gen-LRA differs from alternative MIAs. DOMIAS scores $G$4 by a density ratio at the point itself, $G$5, whereas Gen-LRA measures the influence of $G$6 on the local likelihood of $G$7 and aggregates multiple local synthetic points (Ward et al., 28 Aug 2025). Distance-based attacks such as DCR and DCR-Diff, and Monte Carlo neighborhood counting, rely on nearest-neighbor distances or counts without a reference-conditioned local likelihood ratio and underperform especially at low FPR. LOGAN and other shadow-model-style attacks require training discriminators or shadow generators and are described as unrealistic or expensive in the release setting. Query-based attacks such as Groundhog and TAPAS require access to the generator implementation and retraining many versions with and without $G$8; Gen-LRA is presented as avoiding these assumptions by remaining no-box.

The paper also reports a privacy–utility tension: generators with stronger fidelity, measured by lower Wasserstein or MMD distances, often exhibit higher Gen-LRA AUC, with Bayesian Network and Tab-DDPM given as examples of high utility but greater leakage (Ward et al., 28 Aug 2025). This suggests that privacy auditing for synthetic release cannot be reduced to fidelity assessment alone.

6. Scope, naming ambiguity, limitations, and mitigations

A notable point in the recent literature is terminological ambiguity. In (Galichin et al., 2024), the narrative describes GLiRA, or Guided Likelihood Ratio Attack, for black-box membership inference on image classifiers and states that it is also referred to there as Gen-LRA. That method improves estimation of the non-member distribution by distilling the target model into shadow students and then applying an offline one-sided likelihood-ratio test on a Gaussian fit to transformed ground-truth confidence statistics (Galichin et al., 2024). By contrast, the Gen-LRA of (Ward et al., 28 Aug 2025) is a no-box attack for synthetic tabular data release that constructs a local likelihood ratio over released synthetic samples using KDE surrogates fit on a reference dataset. The two methods share a likelihood-ratio framing but differ in observable data, surrogate construction, and threat model. This suggests that the abbreviation “Gen-LRA” should be resolved from context rather than assumed to denote a single canonical algorithm.

The limitations of the synthetic-data Gen-LRA are stated directly. Strong differential privacy noise or well-regularized generators can reduce leakage and drive AUC toward $G$9 (Ward et al., 28 Aug 2025). Severe domain shift between $S$0 and $S$1 degrades calibration, so the reference-data assumption must be plausible. Extremely high-dimensional mixed-type data can challenge KDE, making encoding and normalization consequential. The neighborhood size $S$2 is a sensitivity knob: if it is too large, locality is diluted and the signal disappears.

The paper’s practical guidance for auditing is correspondingly specific. It recommends starting with $S$3, Gaussian KDE with Silverman bandwidth, Euclidean distance in normalized or encoded space, and reporting ROC/AUC together with $S$4 at $S$5, $S$6, and $S$7 rather than relying on accuracy at a single threshold (Ward et al., 28 Aug 2025). Runtime is described as fast per candidate point when ball-tree nearest-neighbor search and KDE evaluation are used.

The mitigation recommendations follow the attack’s local-overfitting perspective. Differential privacy methods such as DP-SGD, PATE-style training, or marginal-based DP mechanisms reduce memorization; regularization and early stopping temper local concentration; de-duplication and data curation reduce memorization hotspots; and post-processing synthetic data by downsampling dense clusters, adding small noise, or smoothing local densities can lower local concentration (Ward et al., 28 Aug 2025). The paper also recommends disclosure policies that do not release generator implementations, which trivially hinders query-based MIAs even though Gen-LRA itself does not require model access.

Reproducibility details are concrete. Generators are taken from Synthcity with default hyperparameters; KDE is implemented with standard libraries; $S$8-NN uses a ball-tree; and datasets come from UCI, OpenML, and Kaggle as listed in the appendix (Ward et al., 28 Aug 2025). The main benchmark, including data generation and auditing, took approximately 72 hours on an AWS G5.2xlarge, with deep-learning density ablations taking approximately 80 additional hours. These details place Gen-LRA as a practical privacy-auditing procedure for released synthetic tabular datasets under no-box assumptions.