Auditing the Privacy of Synthetic Gene Expression Data: A Unified Weighted-Distance Framework for No-Box Membership Inference
The paper audits whether synthetic bulk RNA-seq data leaks training-set membership by framing several no-box membership inference attacks as weighted nearest-distance tests over gene expression profiles from TCGA synthetic data. Its main neat idea is that attack design reduces to how you weight genes, with spectral residualization—removing dominant PCA structure—substantially improving leakage detection, though the study is limited to this challenge setting/model family and shows that hand-curated pathway weights do not generalize well across targets.
Abstract
Synthetic gene expression data is increasingly proposed as a privacy-preserving substitute for controlled-access genomic repositories, but its safety depends on empirical auditing. Membership inference attacks (MIAs) provide that audit by testing whether a patient's gene expression profile was used to train a generative model. We report a red-team study on synthetic gene expression data derived from bulk RNA-seq profiles in The Cancer Genome Atlas, released by the ELSA Health 2026 Challenge. We unify five no-box attacks under a single weighted-distance framework in which each variant differs only in how it weights genes: uniformly (baseline), by variance, by synthetic-versus-reference KL divergence, by spectral residualization removing dominant principal components, and by curated pathway membership. Against a conditional variational autoencoder, spectral residualization raises AUC from 0.8251 to 0.8951 and TPR at 1% FPR from 0.3842 to 0.5970 on pan-cancer TCGA. Biological pathway priors did not transfer across targets.