ML data engineering
Data Augmentation, Synthetic Data, and Weak Supervision
Evaluate transformations, simulation, synthetic records, pseudo-labels, and weak labeling under evidence-based gates.
By the end you can
- Compare augmentation, simulation, synthesis, pseudo-labeling, and weak supervision
- Test whether transformations preserve the correct target
- Track lineage and mixture proportions for generated evidence
- Evaluate privacy, conflict, dependency, and realism limits
Visual
Generated evidence needs its own lineage
A downstream user should be able to trace every derived example back to its origin and method. The lineage record is what makes every later check possible. Store the source ID, the generator version, the parameter set and the seed, or no one can say afterwards whether a row was observed or manufactured. The rest of this lesson is a list of what that costs: recursive collapse of the distribution's tails, memorized patient records emitted as synthetic samples, resampling that silently destroys calibration. Every one of those failures is invisible once observed and generated evidence sit in the same pile.
1. Source
Identify observed examples, simulator state, prompts, rules, or seed distributions.
2. Generate
Record transformation, model, parameters, random seed, and software version.
3. Validate
Check label preservation, realism, coverage, privacy, and artifacts by slice.
4. Assign split and weight
Keep derivatives with their source and control their influence during training.
5. Track outcomes
Compare observed-only and mixed-data performance on independent real evaluation sets.
Synthetic rows should carry provenance and should never enter the independent real-world test set as substitutes for observation.
Generated examples encode assumptions about invariance and reality
Augmentation creates modified views of observed examples. Synthetic data creates new records through rules, simulators, or generative models. Weak supervision creates labels from heuristics, distant signals, or multiple noisy sources. All three can expand useful training signal. All three can also repeat existing bias, invent impossible combinations, leak private examples, or teach invariances the real task does not possess. A horizontal image flip may preserve a generic object label. It can also reverse text, handedness, traffic direction, or medical laterality. A simulated failure may omit the messy precursors that appear in actual machines.
Feed generated output back into training without marking it as generated, and what happens is no longer a matter of opinion. In July 2024 Nature published the measurement. The abstract states the result plainly: “We find that indiscriminate use of model-generated content in training causes irreversible defects in the resulting models, in which tails of the original content distribution disappear.” The six authors named the effect model collapse. Then they measured it. They fine-tuned OPT-125m recursively on its own wikitext2 output and tracked perplexity. With real data, “The original model fine-tuned with real wikitext2 data obtains 34 mean perplexity, from the zero-shot baseline of 115”. With no original training data retained, “training with generated data allows us to adapt to the underlying task, losing some performance, from 20 to 28 perplexity points”.
The finding is not confined to text, or to one laboratory. An independent group at Rice University found the same thing in state-of-the-art generative image models, in a 2024 paper called Self-Consuming Generative Models Go MAD. They named the condition Model Autophagy Disorder and reported that “appreciable MADness arises in just a few generations”. Two research communities, two media, one mechanism: the rare cases go first.
The pipeline should therefore record source example, generator, parameters, label rule, and version. Synthetic evidence must stay distinguishable from independently observed evidence during evaluation and incident analysis. As the collapse work shows, it has to stay distinguishable during the next training run too.
Feed a model its own output without marking it as generated and the tails of the distribution disappear: measured, generation by generation, in Nature.
Example
Transformations that can change the correct target
Whether the label survives is task-specific, not visually obvious. Three Google researchers built an entire dataset out of this one failure. PAWS — Paraphrase Adversaries from Word Scrambling, 2019 — contains 108,463 human-labeled paraphrase and non-paraphrase pairs with high lexical overlap, produced by controlled word swapping and back translation. The canonical pair is “flights from New York to Florida” against “flights from Florida to New York”. Every token is preserved. The meaning is reversed. Systems that had learned paraphrase from ordinary corpora fell apart on it: “State-of-the-art models trained on existing datasets have dismal performance on PAWS (<40% accuracy); however, including PAWS training data for these models improves their accuracy to 85% while maintaining performance on existing tasks.” Google's own release of the data gives the composition. PAWS-Wiki holds 49,401 labeled training pairs, 44.2% of them paraphrases, alongside 656k noisily labeled pairs. PAWS-QQP holds 11,988 training pairs, 31.3% paraphrases. A paraphrase generator used as an augmenter runs that same transformation — without the labels that would tell you when it went wrong.
- Medical image flip: reversing left and right can change anatomical laterality and treatment meaning.
- Speech speed change: moderate variation may preserve words, while extreme stretching can alter phonemes and intelligibility.
- Text paraphrase: a generator may preserve topic but change stance, negation, named entities, or factual claims. PAWS pairs such as “flights from New York to Florida” and “flights from Florida to New York” keep almost every token and flip the label, and models trained on existing paraphrase datasets score under 40% accuracy on them.
- Transaction interpolation: averaging two customers can create an impossible combination of age, account state, and product ownership.
- Time-series warping: shifting a waveform can detach sensor response from the known maintenance or event timestamp.
Comparison
Five ways to manufacture additional training signal
Methods differ in whether they change inputs, create new examples, or infer labels. The last of the five, resampling and interpolation, has the longest published record and the sharpest warning attached to it. SMOTE dates from 2002. Its own description: a “method of over-sampling the minority class involves creating synthetic minority class examples”. Twenty years later, a study in JAMIA measured what that does to a clinical risk model. Monte Carlo simulation, plus an ovarian-cancer case study, and the result was blunt: “The use of random undersampling, random oversampling, or SMOTE yielded poorly calibrated models: the probability to belong to the minority class was strongly overestimated.” There was no compensating gain in AUC. Their conclusion is the sentence to remember before reaching for the technique: “Outcome imbalance is not a problem in itself, imbalance correction may even worsen model performance.” A later simulation extended the same finding to machine-learning algorithms and to MIMIC-III. Interpolating between observed feature vectors changes the optimization problem. It does not add independent real-world coverage. And it can cost the calibration the model was supposed to deliver.
Label-preserving augmentation
Transform an observed example while keeping its target.
- Encodes desired invariance
- Should inherit the source split
- Can create unrealistic artifacts
- Example: mild image crop or audio noise
Simulation
Generate records from a mechanistic or environment model.
- Can target rare scenarios deliberately
- Quality depends on simulator fidelity
- Supports exact latent labels in some domains
- Example: synthetic sensor failure trajectory
Generative synthesis
Sample new examples from a learned generator.
- Can increase apparent diversity
- May memorize or smooth rare modes
- Requires privacy and realism checks
- Example: generated product images
Programmatic weak labels
Apply rules or external signals to assign noisy targets.
- Scales domain knowledge across unlabeled data
- Rules can correlate and conflict
- Needs a higher-quality validation sample
- Example: labeling text with multiple heuristics
Resampling or interpolation
Change the frequency or combine observed feature vectors.
- Addresses optimization imbalance
- Does not create independent real-world coverage
- Can produce invalid mixed records
- Example: minority oversampling in tabular space
Key idea
Synthetic does not automatically mean anonymous
A generative model can memorize rare training records or reproduce recognizable combinations. Membership and attribute inference risks can remain even when outputs are not exact copies. The belief that synthesis is anonymisation has been tested directly. A 2022 paper at USENIX Security offered “the first quantitative evaluation of the privacy gain of synthetic data publishing”. Their result: “Our evaluation of a wide range of state-of-the-art generative models demonstrates that synthetic data either does not prevent inference attacks or does not retain data utility.” Synthetic data, they conclude, “does not provide a better tradeoff between privacy and utility than traditional anonymisation techniques”.
A regulator has written down the same position. The UK Information Commissioner's Office does not treat synthetic data as automatically non-personal. Its draft anonymisation, pseudonymisation and privacy enhancing technologies guidance of September 2022 instructs controllers that “You should consider whether the synthetic data you generate is personal data”, and warns that “Some synthetic data generation methods have been shown to be vulnerable to model inversion attacks.”
Similarity searches, nearest-neighbor review, canary records, disclosure testing, and privacy-preserving training methods can provide evidence. No single distance threshold proves safety. Preserve the legal and consent basis of source data. Generating derivatives does not remove restrictions on purpose, retention, or sharing.
Synthetic data changes representation; it does not erase provenance, consent, or privacy risk by definition.
Case
A thousand training images, and 37.2% of the patients, pulled back out
Diffusion models can hand back their own training pictures. Carlini and colleagues tested the memorization worry directly in 2023 and showed that “diffusion models memorize individual images from their training data and emit them at generation time”. A generate-and-filter pipeline extracted “over a thousand training examples” from state-of-the-art models, ranging from photographs of individual people to trademarked company logos. Their conclusion is that diffusion models are much less private than GANs.
Patient data behaves no better, and the rate has since been measured. Unconditional latent diffusion models memorize patient imaging data: that is the title of a 2025 paper in Nature Biomedical Engineering, and a self-supervised copy-detection method applied to the outputs is where the title comes from. “We show a high degree of patient data memorization across all datasets, with approximately 37.2% of patient data detected as memorized and 68.7% of synthetic samples identified as patient data copies.” The synthetic set was, for the most part, the training set wearing a new file name.
An independent group at Linköping University reached the same conclusion in 2025, working on BRATS20/21 brain MRI and a chest x-ray pneumonia dataset. They found diffusion models more prone to memorization than StyleGAN. They called the paper Beware of diffusion models for synthesizing medical images. A synthetic medical dataset released on the assumption that generation launders identity is releasing patients.
Steps
Approve a generated-data method through evidence
Begin from the failure or coverage gap the method is supposed to address. Each step below exists because a published result showed what its absence costs. Provenance, because model output fed back unmarked erodes the tails of the distribution. Semantic review, because word-order swaps that preserve every token reverse the label. Independent real-data validation, because risk models rebalanced with SMOTE keep their discrimination and lose their calibration. Approve a generator the way a measurement instrument is approved — against observations it did not produce.
1. State the desired invariance or scenario
Define what should change, what must remain, and which slices need support.
2. Preserve provenance
Store source IDs, generator versions, parameters, seeds, and label origin.
3. Run semantic review
Use domain experts, validators, and targeted checks for label preservation and realism.
4. Control mixture and weight
Limit synthetic dominance and separate source-derived families during splitting.
5. Validate on independent real data
Measure overall, slice, calibration, robustness, and privacy outcomes against observed-only baselines.
Generated evidence earns trust only by improving performance on independent real examples without unacceptable new failures.
Analogy
Synthetic data buys simulator time, not flight hours
Pilots log hours in a simulator before they meet the failure in the air. Simulation safely exposes them to rare failures and repeated scenarios. Performance still depends on how faithfully the simulator represents aircraft and human behavior. Augmentation resembles varying weather or camera viewpoint around a known flight. Weak supervision resembles automated instructors that flag likely mistakes using imperfect rules.
A pilot can feel when the simulator is lying. A learner may instead exploit simulator artifacts invisible to people. Excellent synthetic-set performance can therefore coexist with poor transfer to real operations. And when the simulator is itself trained on the last simulator's output, it can coexist with a world that has quietly lost its rare weather.
Synthetic training is valuable when independent real-world evaluation confirms transfer beyond generator artifacts.
Weak labels need conflict and dependency analysis
Multiple labeling rules may make the same mistake because they share a source, keyword list, or upstream model. Majority vote then overstates independent evidence.
Measure rule coverage, overlap, conflict, class tendency, and performance on a manually reviewed sample. Preserve each rule's output rather than only the combined label. Rules can be useful as features, candidate generators, or training targets under different protocols, and a rule that performs poorly alone may still contribute complementary information. Version the rules and recompute weak labels when logic changes. Mix rule generations without provenance and you cannot tell whether things got better or worse.
Run that discipline properly and the payoff is measurable in production, not only on benchmarks. In 2019 Google deployed programmatic labelling functions on three production classification tasks, in a system called Snorkel DryBell. The paper reports: “On three classification tasks at Google, we find that Snorkel DryBell creates classifiers of comparable quality to ones trained with tens of thousands of hand-labeled examples, converts non-servable organizational resources to servable models for an average 52% performance improvement, and executes over millions of data points in tens of minutes.” Google's own account of the deployment puts the equivalence in counts: “we achieved the same predictive accuracy training a model with Snorkel DryBell's labels as we did when training that same model with 12,000 and 80,000 hand-labeled training data points”, and reports that cross-feature transfer “boosted our performance by an average 52% on the benchmark datasets we created”. Those numbers are the reward for treating the rules as an instrument to be characterized, not as an oracle to be averaged.
Weak supervision is a noisy measurement system whose sources, dependencies, conflicts, and versions must remain observable.
Case
Snorkel against seven hours of hand labeling
Snorkel put numbers on what labeling functions are worth. Ratner and colleagues published them in 2017. In the user study, subject matter experts “build models 2.8x faster and increase predictive performance an average 45.5% versus seven hours of hand labeling”. None of that training data was hand labeled. Across “four open-source text and image data sets” and two US federal collaborations, Snorkel gave “132% average improvements to predictive performance over prior heuristic approaches”. It came within “an average 3.60%” of large hand-curated training sets.
Key takeaways
- Augmentation, simulation, generative synthesis, resampling, and weak supervision create different kinds of additional training signal, and each encodes a different assumption about reality.
- Label preservation is task-specific: PAWS pairs such as “flights from New York to Florida” and “flights from Florida to New York” share almost every token and reverse the label, and models trained on existing paraphrase datasets score under 40% accuracy on them.
- Derived examples should retain source lineage, generator parameters, label origin, version, and split inheritance — a 2024 Nature paper measured what recursive training on unmarked model output does to the tails of the distribution.
- Synthetic quality includes coverage, realism, downstream utility, robustness, privacy, and performance on independent real data; SMOTE and its relatives yielded poorly calibrated models with no gain in AUC in the JAMIA simulation and ovarian-cancer case study.
- Weak-label sources can conflict or correlate, so preserve individual rule outputs and evaluate them against reviewed examples; Snorkel DryBell's three Google tasks matched models trained on 12,000 and 80,000 hand-labeled points.
- Generated data can supplement scarce evidence but cannot replace independent real-world evaluation or erase governance obligations: a USENIX Security evaluation found no better privacy–utility tradeoff than traditional anonymisation, the ICO tells controllers to consider whether synthetic data is personal data, and a latent diffusion model memorized approximately 37.2% of patient records.