Portable Causal Fairness Across Synthetic Data Generator Families

# Portable Causal Fairness Across Synthetic Data Generator Families
Source: [https://arxiv.org/html/2609.03180](https://arxiv.org/html/2609.03180)
Steven Golob††thanks:Corresponding author\.Sikha PentyalaAffiliation:University of Washington TacomaMartine De CockAffiliation:University of Washington Tacoma

###### Abstract

When a statistical agency or regulator releases synthetic data in place of sensitive records, it chooses the generator that produces the table, and can shape that generator so unfair pathways are absent\. DECAF made this concrete on one non\-private GAN: three fairness definitions become three sets of edge cuts on the generator’s causal graph\. Whether the mechanism belongs to DECAF, or to causal factorisation itself, was untested\. We port all three definitions to nine generators from three unrelated families \(marginals\-based, GAN, and diffusion, each with differentially private variants\), across three levels of formal privacy guarantee, over 2,520 matched\-pair runs on Adult and COMPAS datasets\. The mechanism transfers everywhere, and our new causal diffusion backbone yields the fairest release of any family we tested, at fidelity close to the marginals tier\. Applying the cut barely moves fidelity, only costs a downstream classifier about0\.070\.07to0\.150\.15AUC on average, and adding privacy guarantees don’t make the data less fair\.

## 1Introduction

Institutions holding sensitive records increasingly publish a synthetic substitute rather than the records themselves: a hospital, a lending regulator or a statistical agency fits a generative model and releases a table drawn from it\. The practice is real and growing: the 2020 US Census was released under a differential\-privacy guarantee\[[2](https://arxiv.org/html/2609.03180#bib.bib22)\], and public challenges run by NIST, the FDA and the US–UK privacy\-technology programme have made private tabular release a working technology rather than a proposal\[[17](https://arxiv.org/html/2609.03180#bib.bib23),[8](https://arxiv.org/html/2609.03180#bib.bib24),[21](https://arxiv.org/html/2609.03180#bib.bib25)\]\. That substitution is usually justified on privacy grounds, but it carries a second, less\-exploited consequence\. Whoever generates the data chooses the generating process, and a process can be edited\. A disparity that exists in the world because of a pathway running from a protected attribute, such as national origin, to an outcome, such as whether a loan is approved, need not exist in the released table\.

The cleanest existing realisation of that lever is DECAF\[[20](https://arxiv.org/html/2609.03180#bib.bib1)\], which factors a generator along a causal graph so that severing an edge at sampling time makes the generator structurally unable to use the pathway it named\. But DECAF is a single non\-private WGAN\-GP\[[9](https://arxiv.org/html/2609.03180#bib.bib16)\], whose released tables trail modern differentially private marginals\-based synthesizers and modern diffusion models on the fidelity and utility benchmarks that decide what institutions actually deploy \(Sec\.[4](https://arxiv.org/html/2609.03180#S4)\)\. Whether the fairness mechanism is confined to that one architecture, or is a property of causal factorisation itself, is therefore a practical question and not merely an academic one: it decides whether an institution deploying synthetic data has the intervention available at all\.

We ask two questions of that mechanism\. Is edge surgery a property of DECAF, or of the causal factorisation any such generator uses? And can it be attached to a generator whose graph is not a supplied causal DAG but the undirected marginal\-dependency graph a differentially private synthesizer builds from noisy counts? The stakes are practical: if the mechanism that would make a released table fair is confined to a generator no institution would actually deploy, it might as well not exist\.

## 2Background and related work

Figure 1:Three fairness definitions as three sets of severed edges, acting on the graph the data is*generated*from, not on the model trained afterwards for a downstream task\.SSis the protected attribute,YYthe outcome,AAan admissible attribute whose influence is deemed legitimate, andZZan intermediate proxy\. Dashed red edges are cut\. DemPar removes every directedS↝YS\\rightsquigarrow Ypath; CF removes only those that avoidAA, so the routeS→A→YS\\rightarrow A\\rightarrow Ysurvives\.#### DECAF: fairness as graph surgery\.

DECAF\[[20](https://arxiv.org/html/2609.03180#bib.bib1)\]generates fair synthetic tables from a GAN whose generator is*factored*along a causal DAG \(directed acyclic graph\): the joint distribution over columns is written as a product of conditionals,P⁡\(X\)=∏iP⁡\(Xi∣pa⁡\(Xi\)\)P\(X\)=\\prod\_\{i\}P\(X\_\{i\}\\mid\\mathrm\{pa\}\(X\_\{i\}\)\), withpa⁡\(Xi\)\\mathrm\{pa\}\(X\_\{i\}\)the columns the graph draws as parents of columnXiX\_\{i\}\. This is the same decomposition a marginals\-based synthesizer such as MST\[[15](https://arxiv.org/html/2609.03180#bib.bib12)\]fits, differing chiefly in that MST’s dependency graph is undirected\. DECAF gives each column its own sub\-network reading onlypa⁡\(Xi\)\\mathrm\{pa\}\(X\_\{i\}\), so a parent can be severed at generation time by substituting a surrogate value drawn independently of the rest of the row\.

SeveringXj→XiX\_\{j\}\\rightarrow X\_\{i\}re\-fits nothing: the trained conditional is instead*evaluated*at a surrogate parent value resampled fromXjX\_\{j\}’s own marginal, a*do*\-style intervention applied at sampling time\. That is why the cut is cheap, and also why it can cost fidelity: the sub\-network is asked about parent combinations it never saw in training\.

Which edges to sever turns a fairness*definition*into an*algorithm*, and DECAF supplies three \(Figure[1](https://arxiv.org/html/2609.03180#S2.F1)\)\.FTU\(fairness through unawareness\) cuts only the direct edgeS→YS\\rightarrow Y;DemPar111DECAF calls this mechanism DP; we write DemPar throughout and reserve DP for differential privacy, discussed alongside it in every result below\.\(demographic parity\) cuts every directed pathS↝YS\\rightsquigarrow Y;CF\(conditional fairness\) spares paths that pass through an attribute the modeller has nominated*admissible*, so disparity routed through a legitimate factor survives\. DECAF’s own illustration is the clearest:Education→Resume→Job\\textit\{Education\}\\rightarrow\\textit\{Resume\}\\rightarrow\\textit\{Job\}is worth keeping becauseResumeis admissible, whileRace→Postcode→Loan\\textit\{Race\}\\rightarrow\\textit\{Postcode\}\\rightarrow\\textit\{Loan\}is redlining and is not\. The machinery is clean, and its authors argue it should port to other generators\.

#### Differential privacy\.

Institutions releasing sensitive tables increasingly attach a differential privacy \(DP\) guarantee\[[7](https://arxiv.org/html/2609.03180#bib.bib19)\]: the 2020 US Census was released under one\[[2](https://arxiv.org/html/2609.03180#bib.bib22)\], and the synthesizers we study here are the winners and entrants of the public challenges that made private tabular release practical\[[17](https://arxiv.org/html/2609.03180#bib.bib23),[15](https://arxiv.org/html/2609.03180#bib.bib12),[21](https://arxiv.org/html/2609.03180#bib.bib25)\]\. DP caps the influence any single individual can have on the released table by a budgetε\\varepsilon: smallerε\\varepsilonmeans stronger privacy and noisier releases\.ε=1\\varepsilon\{=\}1is the tight budget an institution might publish under;ε=1000\\varepsilon\{=\}1000is a permissive comparison point that approximates no privacy at all\. Every mention of “private” or “DP\-” below refers to such a synthesizer\.

#### Related approaches, and the gap\.

Only PreFair\[[18](https://arxiv.org/html/2609.03180#bib.bib2)\]attaches an in\-generator fairness cut to a private synthesizer, adapting CF to MST alone by excluding offending marginals from candidacy before the private structure search runs\. Everything else combining privacy with fairness in generation acts outside the graph: enforcing independence on a learned embedding\[[10](https://arxiv.org/html/2609.03180#bib.bib7),[19](https://arxiv.org/html/2609.03180#bib.bib8)\], prompting an LLM backbone\[[16](https://arxiv.org/html/2609.03180#bib.bib10)\], learning a private structure without a fairness objective\[[12](https://arxiv.org/html/2609.03180#bib.bib11)\], or mitigating downstream\[[3](https://arxiv.org/html/2609.03180#bib.bib3)\]\. Causal\-DAG diffusion targets fidelity only\[[23](https://arxiv.org/html/2609.03180#bib.bib4),[11](https://arxiv.org/html/2609.03180#bib.bib5)\], and private tabular diffusion without a causal graph exposes no per\-column edge to cut\[[27](https://arxiv.org/html/2609.03180#bib.bib9)\]\. We benchmark against[Angelozzi and Arcolezi \[3\]](https://arxiv.org/html/2609.03180#bib.bib3)in §[4\.3](https://arxiv.org/html/2609.03180#S4.SS3), the one prior system on the same units \(parity gap on a held\-out real population\); the embedding\- and LLM\-based generators are outside our scope, which is whether in\-generator edge surgery transfers across families rather than a head\-to\-head between fair\-SDG algorithms\.

That leaves the question nobody has asked: is DECAF’s edge surgery a property of the complete*DECAF*architecture, or of*causal factorisation*? DECAF conjectures the latter, calling the method “simple and extendable to other generative methods”, but never tests it\. The stakes are practical: if the mechanism is confined to DECAF, a publisher who wants a fair release must accept a non\-private GAN that, on our own measurements \(Figure[2](https://arxiv.org/html/2609.03180#S4.F2)\), no institution would deploy; if it is a property of the factorisation, the publisher keeps the fairness lever while picking a synthesizer for its privacy and quality, spanning the marginals\-based synthesizers that dominate private tabular data\[[15](https://arxiv.org/html/2609.03180#bib.bib12),[24](https://arxiv.org/html/2609.03180#bib.bib13),[26](https://arxiv.org/html/2609.03180#bib.bib14)\]and diffusion, which leads several tabular\-quality benchmarks\[[13](https://arxiv.org/html/2609.03180#bib.bib6)\]\.

## 3Porting the mechanisms

We implement FTU, CF and DemPar once, against a single interface,222Anonymized code, with instructions to reproduce every run and table:[https://anonymous\.4open\.science/r/CausalFairnessInSDG\-55EC/](https://anonymous.4open.science/r/CausalFairnessInSDG-55EC/)\.and port that interface to nine generators from three unrelated families\. The fairness definitions do not change\. What changes is the graph the cut acts on, and whether that graph is directed or undirected\. Each definition reduces to a graph\-separation constraint on the release’s dependency structure \(no unadmissibleS↝YS\\rightsquigarrow Ypath\); DECAF’s directed\-edge severance and our undirected\-pair exclusion are two implementations of the same constraint, so the DAG in DECAF’s presentation is a design choice\.

Marginals\-basedsynthesizers \(MST\[[15](https://arxiv.org/html/2609.03180#bib.bib12)\], PrivBayes\[[24](https://arxiv.org/html/2609.03180#bib.bib13)\]and PrivSyn\[[26](https://arxiv.org/html/2609.03180#bib.bib14)\]\) form a graphical model whose edges are the pairs of columns whose noisy joint counts the synthesizer chooses to measure under the privacy budget; the release is drawn from a distribution reproducing those counts\. Their graph is undirected, so we enforce the cut on*paths*rather than on ordered parent→\\rightarrowchild edges\. Whether adding a candidate pair would create a forbiddenSS\-to\-YYpath depends on what the model already contains, so we check the constraint incrementally at each selection step\. A pair the cut excludes is never measured, which makes the constraint free in the privacy accounting rather than merely cheap \(following PreFair\[[18](https://arxiv.org/html/2609.03180#bib.bib2)\]for CF on MST, extended here to PrivBayes, PrivSyn, and to DemPar and FTU\)\.

Causal GANs\(DECAF, plus variants we build on a CTGAN representation\[[22](https://arxiv.org/html/2609.03180#bib.bib15)\]and on DP\-SGD\[[1](https://arxiv.org/html/2609.03180#bib.bib20)\]\) take DECAF’s surrogate substitution unchanged, on the DAG\. Forcausal diffusionwe keep the same factorisation and replace each sub\-network with a small denoiser trained by supervised noise prediction\. The cut is then the same code path, because what exposes an edge is thatXiX\_\{i\}has its own network reading onlypa⁡\(Xi\)\\mathrm\{pa\}\(X\_\{i\}\), true whether that network was trained adversarially, as in the GAN families, or by denoising\.

#### Experimental setup\.

Two datasets, Adult\[[6](https://arxiv.org/html/2609.03180#bib.bib26)\]and COMPAS\[[4](https://arxiv.org/html/2609.03180#bib.bib27)\]; nine generators; four mechanisms \(none/FTU/CF/DemPar\); three protected/admissible role splits per dataset \(Appendix[A](https://arxiv.org/html/2609.03180#A1)\); five seeds;2,5202\{,\}520completed runs\. Six of the nine generators carry a differential\-privacy guarantee\[[7](https://arxiv.org/html/2609.03180#bib.bib19)\]and are marked†\\daggerthroughout: the three marginals\-based synthesizers, which are private by construction, and the three backbones to which we attach DP\-SGD \(DP\-GAN, DP\-CTGAN, DP\-Diffusion\)\. Those six run atε∈\{1,10,1000\}\\varepsilon\\in\\\{1,10,1000\\\}withδ=10−9\\delta=10^\{\-9\}; DECAF,\+\+CTGAN and\+\+Diffusion have no privacy mechanism and run once\. For the causal GAN and diffusion families we specify each dataset’s DAG by hand from domain knowledge, as is standard in this literature \(following[Kusner et al\. \[14\]](https://arxiv.org/html/2609.03180#bib.bib17)and[Zhang et al\. \[25\]](https://arxiv.org/html/2609.03180#bib.bib18)\), and hold it fixed across generators so that any effect is attributable to the mechanism\. The marginals\-based generators choose their own undirected graph under the privacy budget, and we enforce the cut on that graph\.

#### The fairness metric\.

Every fairness number in this paper is ademographic\-parity gap\. Train a classifier on the released synthetic table, use it to predict the outcome for a held\-out sample of*real*people, and compare how often it says yes to each protected group:

gap=\|Pr⁡\(Y^=1∣S=1\)−Pr⁡\(Y^=1∣S=0\)\|,\\mathrm\{gap\}\\;=\\;\\bigl\|\\;\\Pr\(\\hat\{Y\}\{=\}1\\mid S\{=\}1\)\\;\-\\;\\Pr\(\\hat\{Y\}\{=\}1\\mid S\{=\}0\)\\;\\bigr\|,reported as the worst case over the protected attributes of the split\. For example, if a classifier trained on a synthetic Adult table predicts above\-$50k income for50%50\\%of the men and17%17\\%of the women in the real held\-out sample, the gap is0\.330\.33; a mechanism that brings it to0\.050\.05has removed85%85\\%of the gap\. Note what the gap does and does not say: it asks only whether the two groups receive the positive prediction equally often, not whether either prediction is correct\. It is the right target here because it is the disparity DemPar is defined to remove, and because it is measured on real people rather than on the synthetic table, so a generator cannot score well by inventing a fairer population than the one it was given\. We also record conditional parity and positive\- and negative\-rate balance for every run; every claim below holds on all four, and we report the parity gap because it is the one the three mechanisms are defined against\.

#### Fidelity, utility, and matched pairs\.

For*fidelity*we report total\-variation distance \(TVD\) between synthetic and real marginals \(00= agree exactly,11= share no mass\), averaged over single columns \(11\-way\) and column pairs \(22\-way\), plus the mean absolute difference in Cramér’sVVacross column pairs \(which asks whether the release preserves the*strength*of each pairwise association\)\. For*utility*we train a classifier on the synthetic table and score it on the real held\-out30%30\\%, reporting AUC \(floor0\.50\.5\) and macro\-F1 \(floor0\.410\.41\) against a train\-on\-real reference\. Because seed noise rivals the fairness effects themselves, every fairness number below is amatched\-pairsdifference: each mechanism run is differenced against the run identical in dataset, generator,ε\\varepsilon, role split*and*seed, but with no mechanism\.

## 4Results

Figure 2:\(a, b\)every generator with no fairness mechanism, averaged over role splits and seeds; \(a\)22\-way TVD to the real table \(lower is better\), \(b\) downstream AUC on real held\-out people \(higher is better\), with chance \(0\.50\.5\) and train\-on\-real references marked; a cell where the release collapsed to a single outcome class carries no AUC and is marked as such\.\(c\)the parity gap remaining after CF at each privacy budget, for the two families with a matched cell at everyε\\varepsilon\(marginals\-based and causal diffusion; the causal GAN family has DP\-GAN and DP\-CTGAN collapses that leave some cells empty\)\. Each line is one family–dataset pairing \(Adult solid, COMPAS dashed\)\.†\\daggermarks a generator carrying a differential\-privacy guarantee\.### 4\.1Fidelity and utility

Fidelity separates the nine generators cleanly on22\-way TVD \(Figure[2](https://arxiv.org/html/2609.03180#S4.F2)a\)\. The marginals\-based synthesizers dominate, as expected since they optimise almost exactly this metric: MST reaches0\.0470\.047on Adult and0\.0280\.028on COMPAS\. Among the causal backbones on the same metric, our diffusion backbone is next and holds it at every privacy level: it reaches0\.1030\.103on Adult against DECAF’s own0\.5970\.597, and with DP\-SGD attached, DP\-diffusion at0\.2180\.218still leads DP\-CTGAN at0\.3130\.313and DP\-GAN at0\.8950\.895\.

Utility separates the same way \(Figure[2](https://arxiv.org/html/2609.03180#S4.F2)b\)\. Most generators clear the AUC floor of0\.50\.5comfortably on both datasets; on Adult, PrivBayes reaches0\.8390\.839, causal diffusion0\.8190\.819, DP\-diffusion0\.7910\.791atε=10\\varepsilon\{=\}10, MST0\.7420\.742\.Only DP\-GAN collapses: AUC0\.4270\.427on Adult \(below chance\) and a constant predictor on COMPAS, an artefact of DP\-SGD on a WGAN\-GP discriminator that we diagnose in §[4\.4](https://arxiv.org/html/2609.03180#S4.SS4)\. A collapsed generator has no disparity for a fairness mechanism to remove; since every fairness number below is a matched\-pair difference, this only affects DP\-GAN’s own row\.

### 4\.2Fairness findings

Table 1:Matched\-pairs effect of each mechanism on the worst\-case demographic\-parity gap, pooled within generator family, restricted to trials where the no\-mechanism release lets a downstream random forest reachAUC\>0\.6\\mathrm\{AUC\}\>0\.6\(so that “fairness” is not a trivial artefact of collapsed learning\)\.*gap*and*AUC*are what remains after the mechanism, both measured on real held\-out people; the parenthesised value beside each is the mean*paired*change against the identical run with no mechanism \(negative==the gap shrank\), with a95%95\\%CI on the gap\. Each family header gives its no\-mechanism gap and AUC on Adult / COMPAS\.†\\daggermarks a generator carrying a differential\-privacy guarantee; those run atε=10\\varepsilon\{=\}10\.The definitions transfer\.Cutting edges reduces the downstream parity gap in every family, on both datasets, at every privacy level \(Table[1](https://arxiv.org/html/2609.03180#S4.T1)\); the predicted ordering \(DemPar\>\>CF\>\>FTU by amount removed\) holds in five of six family×\\timesdataset cells, a sanity check on the definitions themselves\. Nothing about the three definitions requires a GAN, and nothing requires a supplied DAG\.

Causal diffusion produces the fairest release under both mechanisms, averaged across datasets\.The mean parity gap remaining on real held\-out data after CF is0\.0990\.099for diffusion,0\.1280\.128for causal GAN, and0\.1520\.152for marginals; under DemPar,0\.0810\.081,0\.0890\.089,0\.1360\.136\(Table[1](https://arxiv.org/html/2609.03180#S4.T1)\)\. On Adult, diffusion cuts an initial gap of0\.1590\.159to0\.0390\.039under CF and0\.0250\.025under DemPar: a release whose downstream classifier predicts the positive outcome at almost equal rates for the two protected groups\. CF removes76%76\\%of the baseline gap on diffusion \(Adult\),78%78\\%on causal GAN, and41%41\\%on marginals; the mechanism transfers everywhere, and its impact is largest through the causal factorisation that the diffusion backbone we introduce carries\.

The two graph types differ in cost, not in what they cut\.How manyS↝YS\\rightsquigarrow Yedges each graph contains varies by dataset \(Table[2](https://arxiv.org/html/2609.03180#S4.T2)\); more consistently, per edge severed a DAG cut costs about2\.5×2\.5\\timesas much downstream utility as a marginals cut, because a marginals cut excludes a pair before training while a DAG cut asks a trained sub\-network to extrapolate \(Appendix[B](https://arxiv.org/html/2609.03180#A2)\)\.

Table 2:Mean number of edges the mechanism must sever, per run, per generator family\. Causal GAN/diffusion counts are deterministic \(DAG edges DECAF’s surrogate substitution would replace under each dataset’s role split\); marginals counts are the minimum edge cut on the baseline learned graph needed to break every forbiddenSS\-to\-YYpath\.The cut hardly moves fidelity\.Pooled across all nine generators and both datasets, CF shifts the released table’s22\-way TVD to the real distribution by0\.0010\.001and DemPar by0\.0040\.004, against a no\-fairness\-mechanism TVD that ranges from0\.030\.03to0\.320\.32across generators; the release is essentially as faithful after the cut as before\. The utility cost is modest under CF \(about0\.070\.07downstream AUC on average\) and larger under DemPar \(about0\.150\.15; Table[1](https://arxiv.org/html/2609.03180#S4.T1)\)\.

### 4\.3How this compares to intervening downstream

Table 3:Where to intervene, on identical data\.Absolute parity gap on MST synthetic training data at differential\-privacy budgetε\\varepsilon, real held\-out test set, XGBoost, 5 seeds, all inside the benchmark harness of[Angelozzi and Arcolezi \[3\]](https://arxiv.org/html/2609.03180#bib.bib3)\. The eight upper mitigators act on the released table or the classifier trained from it; our three \(in\-gen \(ours\)\) act inside the generator\. The harness reports accuracy but not AUC or macro\-F1, and every method scores within a point of the majority baseline \(0\.760\.76Adult,0\.530\.53COMPAS\), so accuracy does not discriminate methods and we omit it\.‡\\ddaggermarks a row where the classifier collapsed further, below majority\.Everything above measures the cut against itself\. To place it against the alternatives an institution already has, we run the benchmark of[Angelozzi and Arcolezi \[3\]](https://arxiv.org/html/2609.03180#bib.bib3), which asks where in a synthesis pipeline a fairness intervention should go and supplies eight standard answers, all acting on the released synthetic table or the classifier trained from it \(pre\-processing the table, constraining the trained classifier, or post\-processing its predictions\)\. We add a fourth stage \(in\-generator\) by running MST\-FTU, MST\-CF and MST\-DemPar as extra rows in the same benchmark, otherwise unmodified: its preprocessed data, splits, MST synthesizer, XGBoost classifier, aif360 metrics, and its default role split \(matching PreFair; Appendix[A](https://arxiv.org/html/2609.03180#A1)\)\.

On Adult, our in\-generator DemPar reaches a parity gap of0\.0060\.006atε=10\\varepsilon\{=\}10, tied with the strongest downstream mitigator \(equalised\-odds post\-processing at0\.0150\.015\) and lower than every pre\- and in\-processing entry\. On COMPAS, equalised\-odds post\-processing wins \(0\.0230\.023vs\. our0\.1480\.148\); our cut still improves fairness over no mitigation\.

Neither of these comparisons is the point: a downstream mitigator can be dropped, altered or replaced by whoever trains on the release, while an in\-generator cut ships with the table itself\. We develop this in §[5](https://arxiv.org/html/2609.03180#S5)\.

### 4\.4Privacy and fairness are nearly independent

A tighter DP budget might be expected to blunt fairness cuts, since DP suppression falls hardest on the smallest groups\[[5](https://arxiv.org/html/2609.03180#bib.bib21)\], but we do not observe that\. Pooled across the six DP generators, the parity gap after CF sits at0\.090\.09–0\.130\.13at everyε∈\{1,10,1000\}\\varepsilon\\in\\\{1,10,1000\\\}we tested \(Figure[2](https://arxiv.org/html/2609.03180#S4.F2)c\), and after DemPar at0\.080\.08–0\.120\.12; the mechanism removes whatever disparity the budget produced\.

One private generator fails outright\.DECAF’s post\-processing argument invites swapping in a DP\-SGD\[[1](https://arxiv.org/html/2609.03180#bib.bib20)\]discriminator; doing so collapses the synthetic outcome to a single class in168/360168/360runs \(47%47\\%; Table[1](https://arxiv.org/html/2609.03180#S4.T1), DP\-GAN row\)\. Two substitutions each remove the failure \(CTGAN representation,1/3601/360; diffusion in place of the WGAN\-GP discriminator,0/3600/360\), locating the cause in DP\-SGD on a weight\-clipped discriminator, not in private causal generation as such\.

## 5Discussion

Figure 3:The three generator families on seven axes, atε=10\\varepsilon\{=\}10for the differentially private generators and averaged over both datasets, role splits and seeds\. Higher is better on every axis\. The four baseline axes \(fidelity, association preservation, utility\) are scaled between the weakest and strongest family; the three fairness axes are anchored at00so absolute magnitude is visible\. True ranges are printed beside each label\.*Fairness gain*is the matched\-pair share of the baseline parity gap CF removes, over runs where there was a gap to remove;*fairness after CF*and*fairness after DemPar*are the complements of the mean final parity gap under those cuts\. Marginals\-based shows a lower*gain*because its graph carries fewerS↝YS\\rightsquigarrow Yedges to sever \(Table[2](https://arxiv.org/html/2609.03180#S4.T2)\), yet still lands within a few points of the other families on*fairness after*\.Edge surgery belongs to causal factorisation, not to DECAF\.DECAF conjectured that its mechanism would extend beyond its own GAN but tested no other generator, and PreFair implements one such definition \(CF\) on a single marginals synthesizer \(MST\)\. We show the definitions compile identically across nine generators, three per family, on both datasets and at every privacy budget; an institution can now pick a synthesizer for its fidelity, privacy or maturity and keep the fairness lever, instead of being pushed onto a non\-private GAN or a single marginals implementation to get it\.

Causal diffusion produces the fairest release we tested\.Averaged over both datasets, our diffusion backbone leaves the smallest downstream parity gap under both CF \(0\.0990\.099\) and DemPar \(0\.0810\.081\), ahead of causal GAN \(0\.1280\.128,0\.0890\.089\) and marginals \(0\.1520\.152,0\.1360\.136; Table[1](https://arxiv.org/html/2609.03180#S4.T1)\)\. This is the finding we want to highlight, since the diffusion backbone is new work: DECAF gave us one GAN and PreFair one marginals\-based synthesizer, and neither offered a diffusion route, through which the mechanism turns out to reduce disparity most\.

Which generator should a publisher use?*Marginals\-based synthesizers*remain the default when fidelity and privacy come first: they are truest to the real table on every fidelity measure, and are differentially private by construction\.*Causal diffusion*is the choice when the fairness lever has to bite, removing the largest fraction of the parity gap while holding fidelity close to the marginals tier\.*The causal GAN family*trails on fidelity and utility, and DP\-GAN fails outright\. On Adult, CF pays66AUC points to remove41%41\\%of the baseline gap on marginals,1616\(78%78\\%\) on causal GAN, and1818\(76%76\\%\) on causal diffusion; the cost is smaller on COMPAS, where every family starts closer to chance, and DemPar costs roughly double CF on both COMPAS families\.

Only the in\-generator cut ships with the table\.On datasets where the private structure encodes little to sever, a downstream mitigator can reach a lower parity gap on the release \(Table[1](https://arxiv.org/html/2609.03180#S4.T1)\)\. But a public table is used by consumers its publisher will never meet, and of the four places to intervene, the in\-generator cut is the only one that travels with the release and cannot be dropped\.

Conclusion\.The point is not any generator we ported to, but that all three families share the same abstraction \(a causal factorisation whose edges can be severed\), and this abstraction, not any one architecture, is where the fairness lever lives\. An institution can now pick a synthesizer for its privacy or data\-quality needs, and keep a portable causal\-fairness intervention as part of that choice\.

## References

- \[1\]M\. Abadi, A\. Chu, I\. Goodfellow, H\. B\. McMahan, I\. Mironov, K\. Talwar, and L\. Zhang\(2016\)Deep learning with differential privacy\.InProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security,pp\. 308–318\.Cited by:[§3](https://arxiv.org/html/2609.03180#S3.p3.1),[§4\.4](https://arxiv.org/html/2609.03180#S4.SS4.p2.1)\.
- \[2\]J\. M\. Abowd, R\. Ashmead, R\. Cumings\-Menon, S\. Garfinkel, M\. Heineck, C\. Heiss, R\. Johns, D\. Kifer, P\. Leclerc, A\. Machanavajjhala, B\. Moran, W\. Sexton, M\. Spence, and P\. Zhuravlev\(2022\)The 2020 census disclosure avoidance system TopDown algorithm\.Harvard Data Science Review\.External Links:[Document](https://dx.doi.org/10.1162/99608f92.529e3cb9)Cited by:[§1](https://arxiv.org/html/2609.03180#S1.p1.1),[§2](https://arxiv.org/html/2609.03180#S2.SS0.SSS0.Px2.p1.1)\.
- \[3\]V\. G\. Angelozzi and H\. H\. Arcolezi\(2026\)Where to intervene? Benchmarking fairness\-aware learning on differentially private synthetic tabular data\.Proceedings on Privacy Enhancing Technologies\.Cited by:[§2](https://arxiv.org/html/2609.03180#S2.SS0.SSS0.Px3.p1.1),[§4\.3](https://arxiv.org/html/2609.03180#S4.SS3.p1.1),[Table 3](https://arxiv.org/html/2609.03180#S4.T3)\.
- \[4\]J\. Angwin, J\. Larson, S\. Mattu, and L\. Kirchner\(2016\)Machine bias\.Note:ProPublicaCited by:[§3](https://arxiv.org/html/2609.03180#S3.SS0.SSS0.Px1.p1.1)\.
- \[5\]E\. Bagdasaryan, O\. Poursaeed, and V\. Shmatikov\(2019\)Differential privacy has disparate impact on model accuracy\.InAdvances in Neural Information Processing Systems,Vol\.32,pp\. 15479–15488\.Cited by:[§4\.4](https://arxiv.org/html/2609.03180#S4.SS4.p1.1)\.
- \[6\]B\. Becker and R\. Kohavi\(1996\)Adult\.Note:UCI Machine Learning RepositoryExternal Links:[Document](https://dx.doi.org/10.24432/C5XW20)Cited by:[§3](https://arxiv.org/html/2609.03180#S3.SS0.SSS0.Px1.p1.1)\.
- \[7\]C\. Dwork, F\. McSherry, K\. Nissim, and A\. Smith\(2006\)Calibrating noise to sensitivity in private data analysis\.InTheory of Cryptography Conference \(TCC\),pp\. 265–284\.Cited by:[§2](https://arxiv.org/html/2609.03180#S2.SS0.SSS0.Px2.p1.1),[§3](https://arxiv.org/html/2609.03180#S3.SS0.SSS0.Px1.p1.1)\.
- \[8\]FDA Office of Digital Transformation\(2023\)The Veterans cardiac health and AI model predictions \(V\-CHAMPS\) challenge\.Note:[https://precision\.fda\.gov/challenges/31/results](https://precision.fda.gov/challenges/31/results)Cited by:[§1](https://arxiv.org/html/2609.03180#S1.p1.1)\.
- \[9\]I\. Gulrajani, F\. Ahmed, M\. Arjovsky, V\. Dumoulin, and A\. Courville\(2017\)Improved training of Wasserstein GANs\.InAdvances in Neural Information Processing Systems,Vol\.30,pp\. 5767–5777\.Cited by:[§1](https://arxiv.org/html/2609.03180#S1.p2.1)\.
- \[10\]T\. Hyrup, E\. Panagiotou, A\. Roy, A\. Zimek, E\. Ntoutsi, and P\. Schneider\-Kamp\(2025\)Achieving Hilbert–Schmidt independence under Rényi differential privacy for fair and private data generation\.arXiv preprint arXiv:2508\.21815\.Cited by:[§2](https://arxiv.org/html/2609.03180#S2.SS0.SSS0.Px3.p1.1)\.
- \[11\]S\. Jacob, B\. Prenkaj, W\. Shao, and G\. Kasneci\(2026\)TabSCM: a practical framework for generating realistic tabular data\.arXiv preprint arXiv:2604\.22337\.Cited by:[§2](https://arxiv.org/html/2609.03180#S2.SS0.SSS0.Px3.p1.1)\.
- \[12\]K\. Jia, Y\. Ma, Y\. Li, and F\. Wang\(2025\)PrAda\-GAN: a private adaptive generative adversarial network with Bayes network structure\.arXiv preprint arXiv:2511\.07997\.Cited by:[§2](https://arxiv.org/html/2609.03180#S2.SS0.SSS0.Px3.p1.1)\.
- \[13\]A\. Kotelnikov, D\. Baranchuk, I\. Rubachev, and A\. Babenko\(2023\)TabDDPM: modelling tabular data with diffusion models\.InProceedings of the 40th International Conference on Machine Learning,pp\. 17564–17579\.Cited by:[§2](https://arxiv.org/html/2609.03180#S2.SS0.SSS0.Px3.p2.1)\.
- \[14\]M\. J\. Kusner, J\. Loftus, C\. Russell, and R\. Silva\(2017\)Counterfactual fairness\.InAdvances in Neural Information Processing Systems,Vol\.30,pp\. 4066–4076\.Cited by:[§3](https://arxiv.org/html/2609.03180#S3.SS0.SSS0.Px1.p1.1)\.
- \[15\]R\. McKenna, G\. Miklau, and D\. Sheldon\(2021\)Winning the NIST contest: a scalable and general approach to differentially private synthetic data\.Journal of Privacy and Confidentiality11\(3\)\.External Links:[Document](https://dx.doi.org/10.29012/jpc.778)Cited by:[§2](https://arxiv.org/html/2609.03180#S2.SS0.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2609.03180#S2.SS0.SSS0.Px2.p1.1),[§2](https://arxiv.org/html/2609.03180#S2.SS0.SSS0.Px3.p2.1),[§3](https://arxiv.org/html/2609.03180#S3.p2.1)\.
- \[16\]N\. Nagesh, Z\. Wang, and A\. M\. Rahmani\(2025\)FairCauseSyn: towards causally fair LLM\-augmented synthetic data generation\.In47th Annual International Conference of the IEEE Engineering in Medicine and Biology Society \(EMBC\),Cited by:[§2](https://arxiv.org/html/2609.03180#S2.SS0.SSS0.Px3.p1.1)\.
- \[17\]National Institute of Standards and Technology\(2019\)2018 differential privacy synthetic data challenge\.Note:[https://www\.nist\.gov/ctl/pscr/open\-innovation\-prize\-challenges/past\-prize\-challenges/2018\-differential\-privacy\-synthetic](https://www.nist.gov/ctl/pscr/open-innovation-prize-challenges/past-prize-challenges/2018-differential-privacy-synthetic)Cited by:[§1](https://arxiv.org/html/2609.03180#S1.p1.1),[§2](https://arxiv.org/html/2609.03180#S2.SS0.SSS0.Px2.p1.1)\.
- \[18\]D\. Pujol, A\. Gilad, and A\. Machanavajjhala\(2023\)PreFair: privately generating justifiably fair synthetic data\.Proceedings of the VLDB Endowment16\(6\),pp\. 1573–1586\.Cited by:[§2](https://arxiv.org/html/2609.03180#S2.SS0.SSS0.Px3.p1.1),[§3](https://arxiv.org/html/2609.03180#S3.p2.1)\.
- \[19\]F\. J\. Sarmin, A\. R\. Rahman, C\. J\. Henry, and N\. Mohammed\(2025\)Privacy\-preserving fair synthetic tabular data\.arXiv preprint arXiv:2503\.02968\.Cited by:[§2](https://arxiv.org/html/2609.03180#S2.SS0.SSS0.Px3.p1.1)\.
- \[20\]B\. van Breugel, T\. Kyono, J\. Berrevoets, and M\. van der Schaar\(2021\)DECAF: generating fair synthetic data using causally\-aware generative networks\.InAdvances in Neural Information Processing Systems,Vol\.34,pp\. 22221–22233\.Cited by:[§1](https://arxiv.org/html/2609.03180#S1.p2.1),[§2](https://arxiv.org/html/2609.03180#S2.SS0.SSS0.Px1.p1.1)\.
- \[21\]J\. Vos, S\. Pentyala, S\. Golob, R\. Maia, D\. Kelley, Z\. Erkin, M\. De Cock, and A\. Nascimento\(2024\)Privacy\-preserving membership queries for federated anomaly detection\.Proceedings on Privacy Enhancing Technologies2024\(3\),pp\. 186–201\.Cited by:[§1](https://arxiv.org/html/2609.03180#S1.p1.1),[§2](https://arxiv.org/html/2609.03180#S2.SS0.SSS0.Px2.p1.1)\.
- \[22\]L\. Xu, M\. Skoularidou, A\. Cuesta\-Infante, and K\. Veeramachaneni\(2019\)Modeling tabular data using conditional GAN\.InAdvances in Neural Information Processing Systems,Vol\.32,pp\. 7335–7345\.Cited by:[§3](https://arxiv.org/html/2609.03180#S3.p3.1)\.
- \[23\]J\. Zhang, Z\. Zhou, Y\. Xiong, C\. Xia, and F\. Dai\(2025\)CausalDiffTab: mixed\-type causal\-aware diffusion for tabular data generation\.arXiv preprint arXiv:2506\.14206\.Cited by:[§2](https://arxiv.org/html/2609.03180#S2.SS0.SSS0.Px3.p1.1)\.
- \[24\]J\. Zhang, G\. Cormode, C\. M\. Procopiuc, D\. Srivastava, and X\. Xiao\(2014\)PrivBayes: private data release via Bayesian networks\.InProceedings of the 2014 ACM SIGMOD International Conference on Management of Data,pp\. 1423–1434\.Cited by:[§2](https://arxiv.org/html/2609.03180#S2.SS0.SSS0.Px3.p2.1),[§3](https://arxiv.org/html/2609.03180#S3.p2.1)\.
- \[25\]L\. Zhang, Y\. Wu, and X\. Wu\(2017\)A causal framework for discovering and removing direct and indirect discrimination\.InProceedings of the 26th International Joint Conference on Artificial Intelligence \(IJCAI\),pp\. 3929–3935\.External Links:[Document](https://dx.doi.org/10.24963/ijcai.2017/549)Cited by:[§3](https://arxiv.org/html/2609.03180#S3.SS0.SSS0.Px1.p1.1)\.
- \[26\]Z\. Zhang, T\. Wang, N\. Li, J\. Honorio, M\. Backes, S\. He, J\. Chen, and Y\. Zhang\(2021\)PrivSyn: differentially private data synthesis\.In30th USENIX Security Symposium,pp\. 929–946\.Cited by:[§2](https://arxiv.org/html/2609.03180#S2.SS0.SSS0.Px3.p2.1),[§3](https://arxiv.org/html/2609.03180#S3.p2.1)\.
- \[27\]C\. Zhu, J\. Tang, J\. F\. Pérez, M\. van Dijk, and L\. Y\. Chen\(2024\)DP\-TLDM: differentially private tabular latent diffusion model\.arXiv preprint arXiv:2403\.07842\.Cited by:[§2](https://arxiv.org/html/2609.03180#S2.SS0.SSS0.Px3.p1.1)\.

## Appendix ARole splits

Table 4:The three role splits per dataset used throughout the paper\.*Protected*isSS,*admissible*isAA\(the attributes CF is allowed to route disparity through\), and the outcomeYYisincomeon Adult andtwo\_year\_recidon COMPAS\. The first split of each dataset follows PreFair’s Table 1; the others widen and narrow the admissible set, since a narrow admissible set should make CF behave more like DemPar\.
## Appendix BPer\-edge cost of the cut

Table[2](https://arxiv.org/html/2609.03180#S4.T2)in §[4\.2](https://arxiv.org/html/2609.03180#S4.SS2)shows the two graph types sever different numbers of edges to enforce the same fairness definition\. Here we normalise both fairness gain and utility cost by that count, and find that the two graph types deliver essentially the same fairness per severed edge but differ substantially in the utility they pay per edge\.

Table 5:Fairness gain and utility cost under CF, normalised by the number of edges CF severs \(Table[2](https://arxiv.org/html/2609.03180#S4.T2)\)\. Values are matched\-pair means across seeds, role splits and privacy budgets, restricted to trials with baselineAUC\>0\.6\\mathrm\{AUC\}\>0\.6\.Under CF, the gap\-per\-edge is essentially the same across graph types \(≈0\.03\\approx 0\.03\), so per severed edge the two mechanisms are equally effective at removing disparity\. The utility cost per edge, in contrast, is about2\.5×2\.5\\timeslarger on the DAG \(mean0\.0330\.033AUC per edge across datasets\) than on the marginals graph \(mean0\.0140\.014\)\. Under DemPar the direction on utility cost agrees on three of four cells but is diluted on Adult, where the DAG severs≈9\\approx 9edges and the per\-edge denominator grows\.

A mechanism\-level reading follows from §[3](https://arxiv.org/html/2609.03180#S3)\. Severing an edge on the DAG evaluates a trained sub\-network on parent combinations it never saw at training time, so the fidelity hit propagates into every column downstream of that sub\-network\. Severing an edge on the marginals graph merely excludes a candidate pair from the graphical model’s structure search before training begins, so the model is fit on the remaining constraints without ever being asked to extrapolate\. This is the concrete face of the “cheap but not free” tension for DAG\-based cuts we set up in §[2](https://arxiv.org/html/2609.03180#S2)\.

A related observation from the same data is worth recording\. On Adult, the private marginals graph carries the direct protected\-to\-outcome edge in none of the1515matched pairs across seeds and generators, so the FTU cut is a literal no\-op in every one: the definition is satisfied by the graph the private structure search selected under the budget, before any fairness constraint is imposed\. This is not evidence that private marginals graphs are always fair, but it is a specific case in which the choice of graph did the fairness work on its own\.