A layered perturbation method for the protection of tabular outputs
Section 5. Discussion and challenges

• Previous
• Next

We presented a perturbative method for protecting tables of magnitude in a custom tabulation environment. The method is not resource intensive $–$ it is only necessary to keep track of the largest units in each cell and their permanent random number. We have shown that the method is able to protect the largest units from a differencing attack.

Since perturbation is applied to the largest values, and sensitive cells are suppressed, there is less need to use variable-specific noise to protect ratios. Ratios can be calculated using perturbed values $\left(Z\right).$ Likewise, means can be calculated using the $Z$ values and perturbed (e.g., rounded) frequencies. Alternatively, if users prefer, means can be calculated by dividing $Z$ by the true frequencies, and totals obtained by multiplying the perturbed means by perturbed frequencies.

Zeroes are not treated, but $X$ (and $Z)$ are suppressed for sensitive and small cells. If a non sensitive cell has less than 5 nonzero values then the addition of another zero-valued unit will not affect $Z.$ So, in that particular situation, users may be able to tell if a unit added to the cell was zero-valued. If unit values $x_i$ can be negative the largest absolute values $\left|x_i\right|$ in each cell could be treated (perturbed). Dominance rules would need to be adapted for negative values (e.g., see Tambay and Fillion 2013).

Residual disclosure issues with related outputs such as unperturbed totals and tables of distributions remain. If the Agency released some unperturbed totals, a hacker could try differencing attacks with the unperturbed total as the starting point. It would be preferable to keep unperturbed results to a minimum, e.g., only for official releases. Tables of distribution (e.g., total income by income range) may also present problems of residual disclosure because of the information conveyed by the ranges. One approach would be to severely restrict the ranges that can be used in such tables.

Table additivity is not maintained, and suppressed cells complicate the use of raking to restore additivity. One solution would consist of imputing those cells, raking, then suppressing the imputed cells. We could start by imputing lone suppressions in a row or column based on other cell values (bottom code at 0 if needed) and repeat this if it generated new lone suppressions in a row or column. Other methods can be used to impute values for remaining suppressed cells.

References

Cox, L.H., and Dandekar, R.A. (2004). A new disclosure limitation method for tabular data that preserves data accuracy and ease of use. Proceedings of the 2002 FCSM Statistical Policy Seminar, Statistical Policy Working Paper 35, Federal Committee on Statistical Methodology, Washington, DC.

Cox, L.H., and Sande, G. (1979). Techniques for preserving statistical confidentiality. Proceedings of the 42^nd Session of the International Statistical Institute, Manila, Philippines.

Duncan, G., Keller-McNulty, S. and Stokes, S. (2001). Disclosure Risk vs. Data Utility: The r-u Confidentiality Map. Technical Report LA-UR-01-6428, Los Alamos National Laboratory, Statistical Sciences group, Los Alamos, New Mexico.

Evans, T., Zayatz, L. and Slanta, J. (1998). Using noise for disclosure limitation of establishment tabular data. Journal of Official Statistics, 14, 537-551.

Giessing, S. (2011). Post-tabular stochastic noise to protect skewed business data. Joint UNECE/Eurostat Work Session on Statistical Data Confidentiality, Tarragona, Spain, October 26-28, 2011.

Massell, P., and Funk, J. (2007). Recent developments in the use of noise for protecting magnitude data tables: Balancing to improve data quality and rounding that preserves protection. Proceedings of the Research Conference of the Federal Committee on Statistical Methodology, Arlington, Virginia.

Tambay, J.-L., and Fillion, J.-M. (2013). Strategies for processing tabular data using the G-Confid cell suppression software. Proceedings of the Survey Research Methods Section, American Statistical Association Joint Statistical Meetings, Montreal, August 3-8, 2013.

Thompson, G., Broadfoot, S. and Elazar, D. (2013). Methodology for the automatic confidentialisation of statistical outputs from remote servers at the Australian Bureau of Statistics. Joint UNECE/Eurostat Work Session on Statistical Data Confidentiality, Ottawa, October 28-30, 2013.

• Previous
• Article main page
• Next