RAPID and the new riskutility R package at useR! 2026 in Warsaw
On 7 July 2026, Oscar Thees presented our work at useR! 2026, the international R user conference, hosted this year in Warsaw. His talk, Evaluating Disclosure Risk in Synthetic Data with the R Package riskutility, introduced RAPID and the new R package that now contains it.
The talk opened with a cartoon by Ted Rall: two people are denied insurance for the same reason. In one panel their de-identified data was found in a study (“privacy violated”); in the other, they simply match a general finding (“privacy not violated”). Same harm, opposite verdict. Whether such inferences count as a privacy violation is a debate the talk deliberately left open. The practical point holds either way: data holders need to measure how much a release lets an attacker infer. Synthetic data breaks the link to real records, but it does not remove that inference risk.
RAPID (Risk of Attribute Prediction-Induced Disclosure) measures exactly this. It simulates a realistic attacker as a machine-learning model that is trained on the released synthetic data and then used to predict the sensitive values of real individuals. A baseline correction ensures that only inference beyond what anyone could already guess counts as risk.
Risk is only half the story, though: every release is a risk-utility trade-off, and both sides are multivariate. That is why RAPID now lives inside riskutility, our new R package on CRAN, which provides around 100 risk and utility measures for synthetic and anonymised tabular data.
- Slides: useR! 2026 programme
- RAPID paper: arXiv:2602.09235
- riskutility on CRAN: cran.r-project.org/package=riskutility
The work is joint with Matthias Templ and Roman Müller.
Cover: cartoon by Ted Rall (2024), from S. L. Garfinkel, Differential Privacy (MIT Press).