A layered perturbation method for the protection of tabular outputs
Section 4. Empirical investigation

• Previous
• Next

We applied the LPM and EZS methods to personal data from a taxation file. Two variables were used: $x=$ income $\left(\text{if}>0\right)$ and $y=x^2$ (to increase skewness). Cells of between 15 and 148 units were generated by combining age groups within postal code, sex and marital status. Different levels of noise $\left({\epsilon }_i\right)$ from a split triangular distribution were tried. Results presented are those with ${\sigma }_{\epsilon }^2=\mathrm{0.006.}$ Following the Risk-Utility Framework (Duncan, Keller-McNulty and Stokes 2001) the impacts of the methods on data accuracy and on risk were examined.

Table 4.1 shows the impact of the LPM on the quality of cell totals by cell size range. The LPM was applied 500 times in each cell. For each cell size range the table gives the number of cells, their average coefficient of variation (CV) after perturbation, and the percentage of times that the perturbed total was within 2%, 5%, 8% and 12% of the original cell total. For this study we assumed that cells that failed a $P-$ percent sensitivity rule with $P=15$ would be suppressed $–$ so they were not included in the results. There were more such cells with variable $y$ (which may resemble business data more). As expected, the impact of the perturbation was higher for smaller cells, and for variable $y.$ All cells perturbed by more than 8% were near-sensitive and would have been suppressed with $P=20.$

Table 4.2 gives the impact of the EZS multiplicative noise, for the same ${\sigma }_{\epsilon }^2,$ on the cell totals. Results for income $\left(x\right)$ are fairly similar, while results for $y$ are noticeably better. Similar results were obtained when a value for ${\sigma }_{\epsilon }^2$ near 0.014 was used (LPM was slightly better with $x,$ EZS slightly better with $y).$

We next examined the amount of protection offered to the largest units in each cell. For each cell, an estimate ${\widehat{x}}_i$ for unit $x_i$ was obtained by differencing perturbed cell totals with and without the unit. Relative differences $d_i=100\left|{\widehat{x}}_i-x_i\right|/x_i$ were calculated and incorporated in a score equal to ${\displaystyle {\sum }_{cells}{r}_i},$ where $r_i=1$ if $d_i<10,r_i=0$ if $d_i>15$ and $0<r_i<1$ otherwise. Table 4.3 shows the quartiles of $d_i$ and the scores for variables $x$ and $y$ for the largest twelve units in each cell with LPM, and for the largest unit with EZS (EZS offers the same level of protection to all units).

With the LPM the largest three units tend to be protected the most, as expected. Patterns for variables $x$ and $y$ are different. If one looks at the quartiles of $d_i$ for variable $x,$ the level of protection gradually declines until unit 10 and increases afterwards. Since the $\text{V}\left({\widehat{x}}_i\right)$ are the same for $i>9$ results should keep improving after the 10^th largest unit. The scores give a similar story. For variable $y$ the descent is not as regular, with unit 5 being protected the least (unit 10 if one looks at Q1 only). The weaker protection around units 5 and 10 is predicted by the formulas for $\text{V}\left({\widehat{x}}_i\right),$ whose basic form changes around those two units. Unit 10 is vulnerable to repeated targeted attacks the most, where an attack consists of obtaining an estimate ${\widehat{x}}_{10}$ from totals for units 1 to 10, and for units 1 to 9, with some set of smaller units (e.g., obtain ${\widehat{x}}_{10\left(i\right)}$ from totals excluding unit $i$ and excluding units $i$ and 10, for $i=11,12,13\dots ).$ Averaging the ${\widehat{x}}_{10\left(i\right)},$ if there are enough of them, may give good estimates of $x_{10}.$ Such attacks require carefully set up tabulation requests, which a semi-controlled custom tabulation environment could discourage.

In contrast, results for EZS show that the level of protection offered to unit 1 (or for any unit for that matter) is fairly constant, and it is generally much poorer than that with the LPM. The score for EZS is almost 100%, a very poor outcome. But EZS was designed to offer protection for totals, not to protect from differencing. If protection from differencing is required then the level of noise would have to be set much higher to protect values at levels comparable to the LPM. But with EZS units around unit 10 would not be more vulnerable to repeated targeted attacks.

To investigate the roles of $K,L$ and $M$ we generated random values from a uniform distribution, but created an outlier in each cell by setting the value of $x_1$ as the highest value that would not make the cell sensitive, i.e., for $P=15,$ set $x_1=\frac{100}{15}{\displaystyle {\sum }_{i\ge 3}{x}_i}.$ The LPM was used with $M$ set to 1, and $K$ and $L$ either calculated as suggested above or set to 1. For our generated data the calculated value of $L$ never left 1. Table 4.4 shows that factor $K$ is useful because when it is set to 1 the level of protection for the outlier is not high enough when ${\sigma }_{\epsilon }^2=\text{0}\text{.006}.$

• Previous
• Article main page
• Next