Addition of IRRS – Synthetic Data Reidentification Risk Score heuristic tool

[marshallowitz]

This contribution introduces the Synthetic Data Reidentification Risk Score (IRRS), an openly available heuristic tool intended to support privacy risk assessment in the context of synthetic data generation and use.

Although synthetic data are frequently adopted as a privacy-enhancing strategy, residual reidentification risk can persist. The IRRS is designed to help organizations identify, assess, and communicate these remaining privacy risks in a structured and explainable manner.

The IRRS estimates three core privacy risk dimensions:

risk of membership inference

risk of attribute inference

risk of singling-out or isolation of individuals

The tool combines those dimensions into a 0–100 risk score and assigns qualitative categories (Low / Moderate / High). It operates using process-level information only, without accessing original datasets, and therefore supports privacy-by-design principles.

The metric incorporates variables such as:

sensitivity of the underlying data

presence of quasi-identifiers

proportion of rare or unique records

data synthesis approach and model type

privacy-enhancing techniques implemented

The primary purpose of IRRS is to:

assist privacy professionals in evaluating synthetic data releases

support risk communication to governance bodies and stakeholders

complement privacy risk management activities aligned with the NIST Privacy Framework and AI RMF

encourage structured discussion of residual privacy risk in AI and data analytics initiatives

The IRRS is not a substitute for formal privacy guarantees (e.g., differential privacy), deidentification certification, or legal compliance determinations. Rather, it serves as a decision-support tool that aids prioritization, comparison of scenarios, and documentation of privacy considerations associated with synthetic data.

The submission includes:

a Python notebook implementing the scoring methodology

Markdown documentation explaining the approach, assumptions, and limitations

references to the privacy literature addressing inference and reidentification risk

We respectfully submit this resource for consideration and community feedback as an additional tool to support privacy risk assessment practices involving synthetic data.