A new empirical auditing framework detects and classifies synthetic data disclosures as either true or phantom. It distinguishes direct reproductions of user data from incidental generation without model access or training, using only synthetic output and a held-out control set. The method provides tighter privacy leakage bounds than prior approaches and requires significantly fewer computational resources.