Statistical Disclosure Control Research Articles

Finding ε and δ of Traditional Disclosure Control Systems

This paper analyzes the privacy of traditional Statistical Disclosure Control (SDC) systems under a differential privacy interpretation. SDCs, such as cell suppression and swapping, promise to safeguard the confidentiality of data and are routinely adopted in data analyses with profound societal and economic impacts. Through a formal analysis and empirical evaluation of demographic data from real households in the U.S., the paper shows that widely adopted SDC systems not only induce vastly larger privacy losses than classical differential privacy mechanisms, but, they may also come at a cost of larger accuracy and fairness.

Social Statistics Transformation: Understanding the population through the production of income by ethnicity statistics from administrative data

ObjectivesThe lack of an income question on the Census has meant the production of multivariate income by ethnicity statistics has not been possible in census outputs to date. Our ambition is to provide individual-level records for every member of the usually resident population of England and Wales using admin data.
 MethodExciting progress has been made in the development of admin-based characteristics measures, including the ongoing feasibility research to produce admin-based datasets on ethnic group and income. Demonstrated improved results include the coverage of the population steadily increasing and methods to create these datasets gradually improving.
 Access to these record-level administrative datasets has allowed us to combine admin-based income and ethnicity measures developed in previous research, linking individuals between the two. We review the coverage of the combined dataset and the feasibility of producing multivariate statistics at subnational levels in England and Wales for the first time.
 ResultsThis presentation will showcase our innovative progress so far. By combining admin-based income and admin-based ethnicity datasets, we established an income and a stated ethnicity for 77.1% of people in England and 82.1% of people in Wales aged 16 years and over in the admin-based Statistical Population Dataset (our population base).
 For the first time, we have produced income percentiles for ethnic groups at different levels of geography in England and Wales including national figures, regional figures and figures for local authorities and lower layer super output areas; although statistical disclosure control means that some of the figures have been suppressed.
 We will highlight some of the challenges in using administrative data sources to produce these statistics and in assessing their statistical quality.
 ConclusionOur research developing these statistics is truly novel and shows much promise. Future work will include research to improve the univariate admin-based measures that are used, to continue to explore the limitations of the combined dataset, to explore the data by occupied address, and explore methods to adjust for missingness.

Database Reconstruction Is Not So Easy and Is Different from Reidentification

Abstract In recent years, it has been claimed that releasing accurate statistical information on a database is likely to allow its complete reconstruction. Differential privacy has been suggested as the appropriate methodology to prevent these attacks. These claims have recently been taken very seriously by the U.S. Census Bureau and led them to adopt differential privacy for releasing U.S. Census data. This in turn has caused consternation among users of the Census data due to the lack of accuracy of the protected outputs. It has also brought legal action against the U.S. Department of Commerce. In this article, we trace the origins of the claim that releasing information on a database automatically makes it vulnerable to being exposed by reconstruction attacks and we show that this claim is, in fact, incorrect. We also show that reconstruction can be averted by properly using traditional statistical disclosure control (SDC) techniques. We further show that the geographic level at which exact counts are released is even more relevant to protection than the actual SDC method employed. Finally, we caution against confusing reconstruction and reidentification: using the quality of reconstruction as a metric of reidentification results in exaggerated reidentification risk figures.

A Rejoinder to Garfinkel (2023) – Legacy Statistical Disclosure Limitation Techniques for Protecting 2020 Decennial US Census: Still a Viable Option

Abstract In our article “Database Reconstruction Is Not So Easy and Is Different from Reidentification”, we show that reconstruction can be averted by properly using traditional statistical disclosure control (SDC) techniques, also sometimes called legacy statistical disclosure limitation (SDL) techniques. Furthermore, we also point out that, even if reconstruction can be performed, it does not imply reidentification. Hence, the risk of reconstruction does not seem to warrant replacing traditional SDC techniques with differential privacy (DP) based protection. In “Legacy Statistical Disclosure Limitation Techniques Were Not an Option for the 2020 US Census of Population and Housing”, by Simson Garfinkel, the author insists that the 2020 Census move to DP was justified. In our view, this latter article contains some misconceptions that we identify and discuss in some detail below. Consequently, we stand by the arguments given in “Database Reconstruction Is Not So Easy:: :”.

Towards Demand-Driven On-The-Fly Statistics

Abstract A prototype of a question answering (QA) system, called Farseer, for the real-time calculation and dissemination of aggregate statistics is introduced. Using techniques from natural language processing (NLP), machine learning (ML), artificial intelligence (AI) and formal semantics, this framework is capable of correctly interpreting a written request for (aggregate) statistics and subsequently generating appropriate results. It is shown that the framework operates in a way that is independent of a specific statistical domain under consideration, by capturing domain specific information in a knowledge graph that is input to the framework. However, it is also shown that the prototype still has its limitations, lacking statistical disclosure control. Also, searching the knowledge graph is still time-consuming.

Survey on Privacy-Preserving Techniques for Microdata Publication

The exponential growth of collected, processed, and shared microdata has given rise to concerns about individuals’ privacy. As a result, laws and regulations have emerged to control what organisations do with microdata and how they protect it. Statistical Disclosure Control seeks to reduce the risk of confidential information disclosure by de-identifying them. Such de-identification is guaranteed through privacy-preserving techniques (PPTs). However, de-identified data usually results in loss of information, with a possible impact on data analysis precision and model predictive performance. The main goal is to protect the individual’s privacy while maintaining the interpretability of the data (i.e., its usefulness). Statistical Disclosure Control is an area that is expanding and needs to be explored since there is still no solution that guarantees optimal privacy and utility. This survey focuses on all steps of the de-identification process. We present existing PPTs used in microdata de-identification, privacy measures suitable for several disclosure types, and information loss and predictive performance measures. In this survey, we discuss the main challenges raised by privacy constraints, describe the main approaches to handle these obstacles, review the taxonomies of PPTs, provide a theoretical analysis of existing comparative studies, and raise multiple open issues.

The Parameterized Complexity of Network Microaggregation

Microaggregation is a classical statistical disclosure control technique which requires the input data to be partitioned into clusters while adhering to specified size constraints. We provide novel exact algorithms and lower bounds for the task of microaggregating a given network while considering both unrestricted and connected clusterings, and analyze these from the perspective of the parameterized complexity paradigm. Altogether, our results assemble a complete complexity-theoretic picture for the network microaggregation problem with respect to the most natural parameterizations of the problem, including input-specified parameters capturing the size and homogeneity of the clusters as well as the treewidth and vertex cover number of the network.

Population aggregates from administrative data samples–how good are they?

Researchers regularly use administrative micro-data samples to approximate subgroup aggregates from the full population. In this paper, I argue that the most commonly used method to do this is often not optimal. I outline some alternatives and compare their relative performance in selected cases. I also discuss the effect of statistical disclosure control on the aggregated data and how researchers can reduce bias resulting from censoring.

A Critical Review on the Use (and Misuse) of Differential Privacy in Machine Learning

We review the use of differential privacy (DP) for privacy protection in machine learning (ML). We show that, driven by the aim of preserving the accuracy of the learned models, DP-based ML implementations are so loose that they do not offer the ex ante privacy guarantees of DP. Instead, what they deliver is basically noise addition similar to the traditional (and often criticized) statistical disclosure control approach. Due to the lack of formal privacy guarantees, the actual level of privacy offered must be experimentally assessed ex post , which is done very seldom. In this respect, we present empirical results showing that standard anti-overfitting techniques in ML can achieve a better utility/privacy/efficiency tradeoff than DP.

The trade-off between the risk of disclosure and data utility in SDC: A case of data from a survey of accidents at work1

One of the key problems associated with Statistical Disclosure Control is ensuring an optimal trade-off between minimizing the risk of unit identification and maximizing the utility of data to be disseminated (which means minimizing information loss due to the application of SDC methods). In practice, it is usually achieved by defining how much risk can be accepted for any given unit, and then doing the best to modify the data set so that the risk is below the preset threshold while maximising the utility. Moreover, variables from statistical surveys vary not only in terms of their measurement scale but also as regards the role they play in the SDC process. All these aspects should therefore be taken into account when one tries to find this trade-off. In the paper we present a way of assessing whether an optimal trade-off has been achieved. Two main aspects of measuring the risk of disclosure are discussed. The first one is internal risk, i.e. the risk of disclosing confidential information only on the basis on disseminated microdata after the application of SDC (i.e. no attempt of combining data with external information is made); the second one is external risk, when the user has access to an alternative data set containing information that can be linked with statistical data in order to identify a unit. We show that it is possible to measure external risk and information loss while accounting for the measurement scale of variables. In our empirical study we used data from an annual survey of accidents at work for 2017. We compared complex information loss and the risk of disclosure in the original data files and those subjected to SDC using methods implemented in the new working version of the sdcMicro R package. We present the underlying assumptions and results of the SDC process, highlighting the benefits and drawbacks of the tools used in the study, which was conducted in 2020 and 2021 in the Centre for Small Area Estimation at the Statistical Office in Poznań.

Statistical Data Privacy: A Song of Privacy and Utility

To quantify trade-offs between increasing demand for open data sharing and concerns about sensitive information disclosure, statistical data privacy (SDP) methodology analyzes data release mechanisms that sanitize outputs based on confidential data. Two dominant frameworks exist: statistical disclosure control (SDC) and the more recent differential privacy (DP). Despite framing differences, both SDC and DP share the same statistical problems at their core. For inference problems, either we may design optimal release mechanisms and associated estimators that satisfy bounds on disclosure risk measures, or we may adjust existing sanitized output to create new statistically valid and optimal estimators. Regardless of design or adjustment, in evaluating risk and utility, valid statistical inferences from mechanism outputs require uncertainty quantification that accounts for the effect of the sanitization mechanism that introduces bias and/or variance. In this review, we discuss the statistical foundations common to both SDC and DP, highlight major developments in SDP, and present exciting open research problems in private inference.

Measuring Risk of Re-Identification in Microdata: State-of-the Art and New Directions

AbstractWe review the influential research carried out by Chris Skinner in the area of statistical disclosure control, and in particular quantifying the risk of re-identification in sample microdata from a random survey drawn from a finite population. We use the sample microdata to infer population parameters when the population is unknown, and estimate the risk of re-identification based on the notion of population uniqueness using probabilistic modelling. We also introduce a new approach to measure the risk of re-identification for a subpopulation in a register that is not representative of the general population, for example a register of cancer patients. In addition, we can use the additional information from the register to measure the risk of re-identification for the sample microdata. This new approach was developed by the two authors and is published here for the first time. We demonstrate this approach in an application study based on UK census data where we can compare the estimated risk measures to the known truth.

Scottish Medical Imaging Service - Technical and Governance controls.

ObjectivesThe Scottish Medical Imaging (SMI) service provides linkable, population based, “research-ready” real-world medical images for researchers to develop or validate AI algorithms within the Scottish National Safe Haven. The PICTURES research programme is developing novel methods to enhance the SMI service offering through research in cybersecurity and software/data/infrastructure engineering.
 ApproachAdditional technical and governance controls were required to enable safe access to medical images.
 The researcher is isolated from the rest of the trusted research environment (TRE) using a Project Private Zone (PPZ). This enables researchers to build and install their own software stack, and protects the TRE from malicious code.
 Guidelines are under development for researchers on the safe development of algorithms and the expected relationship between the size of the model and the training dataset. There is associated work on the statistical disclosure control of models to enable safe release of trained models from the TRE.
 ResultsA policy enabling the use of “Non-standard software” based on prior research, domain knowledge and experience gained from two contrasting research studies was developed.  Additional clauses have been added to the legal control – the eDRIS User Agreement – signed by each researcher and their Head of Department.  Penalties for attempting to import or use malware, remove data within models or any attempt to deceive or circumvent such controls are severe, and apply to both the individual and their institution. The process of building and deploying a PPZ has been developed allowing researchers to install their own software.
 No attempt has yet been made to add additional ethical controls; however, a future service development could be validating the performance of researchers’ algorithms on our training dataset.
 ConclusionThe availability to conduct research using images poses new challenges and risks for those commissioning and operating TREs. The Private Project Zone and our associated governance controls are a huge step towards supporting the needs of researchers in the 21st century.

Using Saturated Count Models for User-Friendly Synthesis of Large Confidential Administrative Databases

AbstractOver the past three decades, synthetic data methods for statistical disclosure control have continually evolved, but mainly within the domain of survey data sets. There are certain characteristics of administrative databases, such as their size, which present challenges from a synthesis perspective and require special attention. This paper, through the fitting of saturated count models, presents a synthesis method that is suitable for administrative databases. It is tuned by two parameters, σ and α. The method allows large categorical data sets to be synthesized quickly and allows risk and utility metrics to be satisfied a priori, that is, prior to synthetic data generation. The paper explores how the flexibility afforded by two-parameter count models (the negative binomial and Poisson-inverse Gaussian) can be utilised to protect respondents'—especially uniques'—privacy in synthetic data. Finally, an empirical example is carried out through the synthesis of a database which can be viewed as a good substitute to the English School Census.

Vine copula statistical disclosure control for mixed-type data

In this paper, we develop a new statistical disclosure control (SDC) method for mixed-type data based on vine copulas. The use of Gaussian and skew-t copulas has been demonstrated to be capable of incorporating information from the marginal distributions of mixed-type variables, whether they are discrete or continuous. In particular, our proposed SDC method using vine copulas generalizes a data perturbation method using an extended skew-t copula. Our vine-SDC method improves the SDC method using the extended skew-t copula by allowing the bivariate copulas in the vine decomposition to take various forms, thus offering a better fit for the joint distribution of the data and more flexibility in data perturbation. An additional advantage of our vine-SDC method is the significant improvement in computational efficiency compared with that using the extended skew-t copula. We discuss some statistical properties of vine copulas and the methodology of vine-SDC. A simulation and a study of real healthcare survey data are provided to explore the performance and strength of vine-SDC and compare it with a common copula-based SDC method.

Evaluating adaptive differential privacy model

Differential privacy is a statistical disclosure control that is gaining popularity in recent years due to easy application for the data collection mechanisms. Many variants of differential privacy are being developed for specific use cases and environments. One of them is adaptive differential privacy that modulates the generated noise in such a way, that the retrieved result is affected according to the risk profile of the asked query and the risk-accuracy tradeoff required for the queried database. This paper intends to evaluate the adaptive differential privacy using VIOLAS Framework and through assessing how the security characteristics satisfied by the adaptive differential privacy mitigate the risk of selected inference attacks.

An algorithm for the microaggregation problem using column generation

The field of statistical disclosure control aims to reduce the risk of re-identifying an individual from disseminated data, a major concern among national statistical agencies. Operations Research (OR) techniques have been widely used in the past for protecting tabular data, but not microdata (i.e., files of individuals and attributes). Few papers apply OR techniques to the microaggregation problem, which is considered one of the best methods for microdata protection and is known to be NP-hard.The new heuristic approach is based on a column generation scheme and, unlike previous (primal) heuristics for microaggregation, it also provides a lower bound on the optimal microaggregation. Using real data that is typically used in the literature, our computational results show, first, that solutions with small gaps are often achieved and, second, that dramatic improvements are obtained relative to the literature’s most popular heuristics.

Multivariate Microaggregation of Set-Valued Data

Data controllers manage immense data, and occasionally, it is released publically to help the researchers toconduct their studies. However, this publically shared data may hold personally identifiable information (PII)that can be collected to re-identify a person. Therefore, an effective anonymization mechanism is required toanonymize such data before it is released publically. Microaggregation is one of the Statistical Disclosure Control (SDC) methods that are widely used by many researchers. This method adapts the k-anonymity principle togenerate k-indistinguishable records in the same clusters to preserve the privacy of the individuals. However,in these methods, the size of the clusters is fixed (i.e., k records), and the clusters generated through these methods may hold non-homogeneous records. By considering these issues, we propose an adaptive size clusteringtechnique that aggregates homogeneous records in similar clusters, and the size of the clusters is determinedafter the semantic analysis of the records. To achieve this, we extend the MDAV microaggregation algorithm tosemantically analyze the unstructured records by relying on the taxonomic databases (i.e., WordNet), and thenaggregating them in homogeneous clusters. Furthermore, we propose a distance measure that determines theextent to which the records differ from each other, and based on this, homogeneous adaptive clusters are constructed. In experiments, we measured the cohesiveness of the clusters in order to gauge the homogeneity ofrecords. In addition, a method is proposed to measure information loss caused by the redaction method. In experiments, the results show that the proposed mechanism outperforms the existing state-of-the-art solutions.

Secure Big Data Collection and Processing: Framework, Means and Opportunities

AbstractStatistical disclosure control is important for the dissemination of statistical outputs. There is an increasing need for greater confidentiality protection during data collection and processing by National Statistical Offices. In particular, various transactions and remote sensing signals are examples of useful but very detailed big data that can be highly sensitive. Moreover, possible conflicts of interest may arise for data suppliers who operate commercially. In this paper, we formulate statistical disclosure control for data collection and processing as an optimisation problem. Even when it is difficult to specify and solve the problem unequivocally, the formulation can still provide the basis for comparing different disclosure control methods. We develop a general compartmented system that adapts and implements non-perturbative methods in the related fields of linking sensitive data and secure computation. We illustrate how the system can be configured to yield variously required tables and microdata sets with sufficiently low disclosure risks.

Ensuring the ethical use of big data: lessons from secure data access

Big data holds great potential for research and for society, large volumes of varied data can be produced and made available to researchers much faster compared to ‘traditional’ data. Whilst this potential is recognized, there are ethical concerns which users of big data must consider. With the volume and variety of information in big data, comes a greater risk of disclosure. Researchers and data access services working with highly detailed and sensitive, secure data have grappled with this for many years. The sector has developed both ethical frameworks and statistical disclosure control techniques which could be utilized by those working with big data. We discuss the challenges, present some of the frameworks and techniques and conclude with recommendations for secure data access of big data.