CoRTeC: Cohort-Conditioned Differentially Private Synthetic Tabular Data from a Frozen Language Model

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

Differentially private (DP) synthetic tabular data lets an institution train on, and share, records it cannot release. Its value depends on how much accuracy a model loses when it is trained on the synthetic data instead of the real data. The deployed mechanisms, MST and AIM, are selected on marginal fidelity and do not report it. On UCI Adult at ε = 2 their output trains models 0.14 to 0.17 AUC below a same-size real sample, and real data with its target permuted passes a 90% marginal-similarity bar. CoRTeC spends the privacy budget once, on a release built for a downstream model, and trains nothing. Within public cohorts it publishes one DP histogram per attribute and outcome class, and a DP table of target rates over disjoint cells. Disjoint cells cost one query per level, so the release carries 6.7× more budget per statistic than a natural implementation. A frozen language model then decodes the release: each batch is told the exact counts it must produce, a threefold pool is filtered to the rows matching the release, and sub-bin values are redrawn. The generator never sees a private record, so generation is post-processing: unlimited datasets at no further privacy cost. A third stage releases a DP bound on the gap between private and synthetic conditional rates. At ε = 2 and n = 300 on Adult, credit and NHANES, CoRTeC's 1-way error is within 0.005 of MST's or below it, and below a real sample's. Tree models trained on its output do not separate from those trained on a same-size real sample on any of the three datasets; the linear model matches on Adult and is within 0.021 elsewhere; AIM's and MST's output trains models 0.05 to 0.18 AUC lower. Whether a forced private relationship survives synthesis differs between the two mechanism families we tested at the same guarantee. Enabling reasoning in the generator changes conditional error 3.8× while AUC cannot detect it. Four membership-inference attacks reach an advantage of 0.048 against a permitted 0.762. Contents of this record. The arXiv paper (CoRTeC_arxiv.pdf), the technical report with the full experimental record (CoRTeC.pdf), a three-page summary (CoRTeC_summary.pdf), and source archives of the two public repositories at the released commits: cortec-framework 1.0.0 (the reference implementations, two pip-installable Python packages) and cortec 1.0.0 (the papers, figures and experiment harness). The papers are released under CC BY 4.0; the software in the two archives is released under the Apache License 2.0, whose text is included in each archive.