PaperlayerView exact revision on arXiv

Source-linked AI summary

An Economic Analysis of Privacy Protection and Statistical Accuracy as Social Choices

John M. Abowd, Ian M. Schmutte

arXiv:1808.06303v1cs.CR

TL;DR

Statistical agencies must weigh privacy against accurate publication, while the value people place on privacy loss remains difficult to measure. The paper frames this choice using differentially private production possibilities and a social-choice rule, illustrated with U.S. statistical examples. It concludes that better evidence on preferences and time-varying costs and benefits is needed.

Abstract

from arXiv · show

Statistical agencies face a dual mandate to publish accurate statistics while protecting respondent privacy. Increasing privacy protection requires decreased accuracy. Recognizing this as a resource allocation problem, we propose an economic solution: operate where the marginal cost of increasing privacy equals the marginal benefit. Our model of production, from computer science, assumes data are published using an efficient differentially private algorithm. Optimal choice weighs the demand for accurate statistics against the demand for privacy. Examples from U.S.\ statistical programs show how our framework can guide decision-making. Further progress requires a better understanding of willingness-to-pay for privacy and statistical accuracy.

I Key Concepts: Privacy and Accuracy

The paper frames privacy protection as a response to risks from publishing statistics and explains how differential privacy limits what publication can reveal about individuals.

I.A Measuring Privacy

  • Differential privacy bounds how publication changes across similar databases; composition supports cumulative accounting, but ε is a worst-case bound, not an individual's realized privacy loss.The paper also describes semantic privacy as limiting how much an attacker can learn about a person from published statistics, and calls the guarantees public and future-proof.Source: I.A Measuring Privacy · pp. 7–8

I.B Data Security and Privacy

  • Publishing summary statistics can leak the same kind of private information as a security breach, motivating formal limits on those leakages.The paper situates these risks alongside database reconstruction and re-identification.Source: I.B Data Security and Privacy · p. 9

I.B.1 Motivating Examples

  • Netflix's released ratings remained re-identifiable after direct identifiers were removed and only a random sample was released.Probabilistic matching to IMDb revealed ratings users had not made public there.Source: I.B.1 Motivating Examples · p. 10

I.B.2 From Data Breaches to Differential Privacy

  • Reconstruction rebuilds record-level data from published statistics; re-identification links records to external identifying information, and reconstruction can facilitate that linkage.Publishing many linearly independent statistics can permit reconstruction with small error.Source: I.B.2 From Data Breaches to… · pp. 10–11

I.B.3 Reconstruction and Re-identification in Economic Data

  • More than 7.7 billion summaries were published from 309 million people in the 2010 Census—25 statistics per person—providing equations for possible record-level reconstruction.Census researchers acknowledged that tabular publications may be vulnerable to reconstruction.Source: I.B.3 Reconstruction and… · p. 12
  • QCEW suppression did not alter published totals, allowing suppressed cells—often covering one or two establishments—to be reconstructed and expose payroll and employment data.The CWHS example also shows how released sample-construction details enabled partial SSN reconstruction and subsequent re-identification.Source: I.B.3 Reconstruction and… · p. 12
  • GWAS marginal distributions can enable exact re-identification: an attacker can establish that a genome was included and link it to a medical case identifier.The paper notes that the association is unique except for identical twins.Source: I.B.3 Reconstruction and… · pp. 12–13

I.C The Choice of an Accuracy Measure

This section defines accuracy as expected squared error and sets up databases, queries, and publication mechanisms as the objects used to analyze privacy and statistical accuracy.

I.C The Choice of an Accuracy Measure

  • Expected squared-error loss defines the paper's accuracy measure, but universal agreement about accuracy across consumers is impossible except for a single counting query.The paper notes that this measure is not without loss of generality.Source: I.C The Choice of an Accuracy Measure · p. 13

II.A The Database

II.A.2 Population Statistics Are Database Queries

  • A database query maps the histogram to an output; its sensitivity is the maximum change in its exact answer when one record is added or removed.Adjacent histograms differ by one record, measured by an ℓ1 distance of one.Source: II.A.2 Population Statistics Are… · p. 14
  • A workload is a set of queries, represented as a matrix when its queries are linear; most official statistical publications can be expressed as linear queries.Counting queries are a special case, and marginal totals can be represented this way.Source: II.A.2 Population Statistics Are… · p. 15

II.B The Data Publication Mechanism

  • The publication mechanism is modeled as a random function of the database histogram and query workload, producing an output whose added distortion can improve privacy while reducing accuracy.Deterministic mechanisms are included as a special case, but only trivial deterministic mechanisms are differentially private.Source: II.B The Data Publication Mechanism · pp. 15–16

II.B.1 Differential Privacy

The paper defines privacy and accuracy measures, then treats the feasible privacy–accuracy relationship as a production technology; randomized response illustrates the trade-off.

II.B.1 Differential Privacy

  • ε-differential privacy bounds the probability of any output event across adjacent databases, limiting how much publication can reveal about one record.The definition takes probability over the mechanism's randomness.Source: II.B.1 Differential Privacy · p. 16

II.B.2 Accuracy and Empirical Loss

Technology

  • For a known differentially private mechanism, the production frontier can relate privacy loss to accuracy and, when closed, bounded, and convex, yield a marginal rate of transformation.This gives the agency a marginal cost of increasing privacy in units of foregone accuracy.Source: Technology · p. 17

III.A The Production of Privacy and Statistical Accuracy

  • The agency's feasible activities pair privacy loss ε with accuracy I; nontrivial accuracy requires privacy loss, while perfect accuracy requires infinite ε.The paper notes that no general solution for the production function G(ε, I) is currently available, so agencies must use the best available workload-specific technology.Source: III.A The Production of Privacy and… · p. 18

III.B Example: Randomized Response

  • Randomized response protects a sensitive binary answer by mixing it with an innocuous question, so interviewers cannot know with certainty which question was answered.The illustration assumes the innocuous response is independent of the sensitive trait and has probability 0.5 of being one.Source: III.B Example: Randomized Response · pp. 19–20
  • In randomized response, increasing the chance of the innocuous question increases privacy but also increases uncertainty about the population proportion; the privacy–accuracy relationship is increasing and concave.The paper also states that randomized response is ε-differentially private.Source: III.B Example: Randomized Response · pp. 19–21

III.C Example: Matrix Mechanism

The matrix mechanism is a workload-based differentially private method that uses a strategy matrix to add noise to query answers.

III.C Example: Matrix Mechanism

  • The matrix mechanism is a general class of data-independent mechanisms that adds workload-sensitivity-calibrated noise to exact query answers, and the analysis applies to mechanisms with convex privacy–accuracy relationships.The paper says the approach is under development for Census Bureau use.Source: III.C Example: Matrix Mechanism · p. 21

III.C.1 The Matrix Mechanism

  • A strategy matrix A lets the mechanism express each target query as a linear combination of strategy queries; choosing lower-sensitivity A can improve accuracy at a given privacy-loss level.The paper presents the matrix mechanism as an improvement over applying the Laplace mechanism directly to the target workload.Source: III.C.1 The Matrix Mechanism · p. 22
  • The Laplace-implemented matrix mechanism is ε-differentially private, and its accuracy depends on the noise variance, workload sensitivity of A, and the Frobenius norm of QA+.The published workload is Qx plus transformed Laplace noise; the noise scale is 1/ε.Source: III.C.1 The Matrix Mechanism · p. 22

III.D Efficiency in Production

The paper models privacy and accuracy as feasible outputs of differentially private publication, then combines that production frontier with social preferences to characterize an efficient choice. It relates mechanism-level privacy guarantees to bounds on what can be learned about individual secrets and models heterogeneous preferences over privacy and accuracy.

III.D Efficiency in Production

  • For general, large linear query workloads, computing a solution for the query strategy matrix remains unsolved, although feasibility has been demonstrated for large census-like workloads.The K-norm mechanism approximately achieves maximal accuracy, but its accuracy lacks a closed-form solution and it is computationally burdensome; the paper uses the Laplace mechanism for this reason.Source: III.D Efficiency in Production · pp. 23–24, IV.A Differential Privacy as a Bound… · p. 24

IV.A Differential Privacy as a Bound on Learning

  • Differential privacy implies a bound on the Bayes factor for any secret pair, but the semantic result depends on the data-generating process and its conditioning assumptions.The cited result states that the process in equation (D-13) is the only one for which mechanisms satisfying differential privacy generate semantics satisfying equation (6).Source: IV.A Differential Privacy as a Bound… · pp. 24–25
  • The semantic privacy bound connects mechanism guarantees to the feasible privacy-accuracy pairs and to individuals’ preferences over protection of their secrets.The mechanism bound constrains the technology set, while the semantic bound informs preferences over privacy and accuracy.Source: IV.A Differential Privacy as a Bound… · pp. 24–25

IV.B Modeling Preferences over Privacy and Accuracy

  • The model maximizes utilitarian social welfare along the production frontier and allows heterogeneous preferences for privacy loss and statistical accuracy.It permits some groups to care only about privacy and others only about accuracy.Source: IV.B Modeling Preferences over Privacy… · p. 26

IV.B.1 Information Utility

The preference model represents privacy loss through individuals’ information utility and statistical accuracy through data utility. Along the production frontier, welfare is maximized where the marginal cost of privacy loss equals the willingness to accept it in units of accuracy.

IV.B.1 Information Utility

  • The model represents privacy as protection against changes in what can be learned about a person’s secrets, with ε entering information utility linearly as a public bad.The information-utility model is motivated by Ghosh and Roth (2015); the passage notes that expected utility loss may be lower than its upper bound, and ε may also reflect a preference for a common privacy parameter.Source: IV.B.1 Information Utility · p. 27, IV.B.2 Data Utility · p. 27

IV.B.2 Data Utility

  • Data utility is specified as linear in accuracy, and the authors describe this simple model as a proof of concept given limited research on preferences for public statistics.The specification uses person-specific weights on accuracy; the passage says the planner’s relevant concern is these weights.Source: IV.B.2 Data Utility · pp. 27–28

IV.B.3 Equilibrium

  • At the welfare-maximizing choice, the production frontier’s marginal rate of transformation equals the marginal rate of substitution, or willingness to accept privacy loss in accuracy units.Choosing the point requires the marginal rate of transformation and average preferences for privacy and accuracy; the authors calibrate those quantities in an illustrative analysis.Source: IV.B.3 Equilibrium · p. 29

IV.C Accuracy and Privacy Protection Are Public Goods

The framework treats privacy protection and statistical accuracy as public goods, so agencies choose common levels despite heterogeneous individual preferences. A Title I funding example shows how privacy-protected counts can trade off confidentiality against funding misallocation.

IV.C Accuracy and Privacy Protection Are Public Goods

  • Privacy protection and accuracy are public goods in the model: everyone receives the same levels, while preferences may differ across individuals.Privacy protection is non-rival, and worst-case analysis under mechanisms closed under composition tracks cumulative exposure across published statistics.Source: IV.C Accuracy and Privacy Protection… · pp. 29–31

V Example: Title 1 School Funding Allocations

  • In the Title I example, privacy-protected counts of eligible students can misallocate district funding, while unprotected publication compromises privacy.The policy problem is to balance privacy loss among disadvantaged households against misallocation of Title I funds.Source: V Example: Title 1 School Funding… · p. 31, V.A Setting · p. 32

V.A Setting

  • The example assumes district funding depends on eligible-student counts and adjusted per-pupil expenditures, with the expenditure measure known and published counts potentially differing from true counts.The analysis abstracts from the Census Bureau’s actual data collection and disclosure practices and from other types of nonsurvey error.Source: V.A Setting · pp. 31–32, V.B The Social Choice Problem · p. 32

V.B The Social Choice Problem

  • The proposed mechanism publishes each district’s eligible-student count with Laplace noise and satisfies ε-differential privacy; welfare combines privacy loss with the social cost of funding misallocation.Because school districts do not overlap, parallel composition gives each district the same ε guarantee.Source: V.B The Social Choice Problem · pp. 32–33

V.C Solution and Calibration

The calibration and applications illustrate how the framework maps privacy preferences and statistical accuracy into publication choices. In the Title I example, greater allocative efficiency is associated with higher privacy loss and lower allocation error; the redistricting discussion describes how exact block counts constrain confidentiality protection.

V.C Solution and Calibration

  • The calibration sets average privacy preference at $1,400 using an identity-theft loss estimate and yields ε = 2.52 × η^-1.The authors describe the analysis as a simple, stylized illustration and assume the planner dislikes misallocation.Source: V.C Solution and Calibration · pp. 33–34, Setting · p. 34

Setting

  • At η = 1, ε∗ = 2.52 and allocation RMSE is approximately $2,509; at η ≈ 0.15, ε∗∗ = 4.74 and RMSE is approximately $1,334.The corresponding misallocation costs are about 70 cents and 38 cents per student, respectively.Source: Setting · p. 34
  • For ε0 = 0.1, allocation RMSE is approximately $63,000, or roughly $18 per student.The passage compares the per-student amount to the cost of lunch for seven days.Source: Setting · p. 34

VI Application to Current Statistical Programs

VI.A Legislative Redistricting

  • Publishing exact population counts at every geography exposes block-level geocodes and constrains the Census Bureau’s ability to protect confidentiality.The discussion says block geocodes cannot be protected, though some other secret pairs can be; exact counts also affect the ability to protect other variables.Source: VI.A Legislative Redistricting · p. 36

VI.B Economic Censuses and National Accounts

The examples apply the privacy–accuracy framework to agency publication choices, while later research sections identify modeling and preference gaps. The paper argues that production possibilities and preferences must be better measured and modeled.

VII.A Extensions of the Production Model

VI.B Economic Censuses and National Accounts

  • Applying privacy protection directly to BEA national-account summaries could improve accuracy and privacy, while authorized Census–BEA data sharing could capture some consolidated-agency efficiency gains.The alternative is contrasted with traditional disclosure-limitation methods used for the Census Bureau’s detailed public releases.Source: VI.B Economic Censuses and National… · pp. 36–37

VI.C Tax Data and Tax Simulations

  • Micro-aggregation can disrupt tax-record audit consistency and tax-schedule breakpoints; private tax simulations would require very large ε despite the sensitivity of returns.The proposed alternative runs simulations behind the IRS firewall on confidential returns, then releases differentially private outputs with user-specific privacy-loss parameters and global accounting.Source: VI.C Tax Data and Tax Simulations · pp. 37–38

VI.D General Purpose Public-use Micro-data

  • A dynamic, differentially private query system could support public-use microdata-like analyses when the agency can specify allowable queries in advance.More complicated analyses may require restricted-access environments, which still need privacy-loss budgets and formally private analysis systems.Source: VI.D General Purpose Public-use… · pp. 38–39

VII Directions for Research

  • Making the framework practical requires more sophisticated production models and better models and measures of demand for privacy and accuracy.The paper describes these as promising directions for extending its framework.Source: VII Directions for Research · p. 39

VII.A Extensions of the Production Model

  • The model focuses on contingency tables and population aggregates, not super-population parameters; a robust statistical-learning extension must allow ambiguity about the true data-generating process.The current accuracy criterion concerns learning the finite-population statistic.Source: VII.A Extensions of the Production Model · p. 39

VII.B Extensions of the Model of Preferences

  • Market models should account for statistics as public goods; differential privacy bounds worst-case participation harm, while the paper’s accuracy preferences use a reduced-form link to wealth.The authors identify privacy semantics and direct modeling of statistics’ effects on decision-making as possible extensions.Source: VII.B Extensions of the Model of… · p. 40
  • The static model omits time-varying privacy costs and accuracy benefits, and its data-collection model assumes truthful reporting despite declining survey participation.The paper points to the Census Bureau’s release of decennial responses after 72 years as an implicit acknowledgment that privacy preferences can change relative to the benefit of access.Source: VII.B Extensions of the Model of… · p. 41

VII.C The Need for Better Measurement

The paper calls for better evidence about how people value privacy loss and accurate public statistics. It concludes that privacy and statistical accuracy are public goods whose optimal levels are a social choice guided by marginal social costs and benefits.

VII.C The Need for Better Measurement

  • Reported privacy attitudes do not clearly reveal behavioral responses to changing privacy-loss risks, and evidence on the social value of public statistics or improved accuracy is scarce.The paper calls for more evidence on the price people attach to inferential privacy disclosures.Source: VII.C The Need for Better Measurement · p. 41

VII.D Conclusion

  • Because privacy protection and statistical accuracy are public goods, their optimal levels are a social choice guided by equating marginal social costs and benefits.Formal privacy models let privacy protection be treated as a commodity over which individuals have preferences.Source: VII.D Conclusion · p. 42
  • The framework combines insights from several disciplines but relies on simplifying assumptions, and the authors invite further work on publication systems that support accurate science without infinite privacy loss.They identify economics, demography, computer science, and statistics as relevant disciplines.Source: VII.D Conclusion · p. 42

Statistical Accuracy as Social Choices

The supplied passage names John M. Abowd and Ian M. Schmutte.

Statistical Accuracy as Social Choices

A Potential Database Reconstruction Attack against the 2010 Decennial Census

The section describes how published census tabulations may constrain database reconstruction, then develops randomized response as a way to trade privacy against statistical accuracy. Its analysis covers how the mechanism’s parameters affect privacy guarantees and estimation quality.

B Randomized Response Details

  • Randomized response mixes sensitive and innocuous binary questions; its estimator of π is unbiased, with variance Var[bπ] = Var[bβ]ρ^-2.The analyst observes reported responses, while the probability ρ of asking the sensitive question and the innocuous-response probability μ are known.Source: B Randomized Response Details · pp. 55–56

B1 Privacy under Randomized Response

  • For a given μ, the privacy guarantee is the larger of two Bayes-factor bounds; μ = 1/2 minimizes privacy loss, assuming equal sensitivity of affirmative and negative answers.The analysis notes that its results do not depend on the equal-sensitivity assumption.Source: B1 Privacy under Randomized Response · p. 56

B2 Statistical Accuracy under Randomized Response

  • The innocuous-response rate μ can shift privacy toward one inference; data quality measures sampling-variance deviation from the unprotected case (ρ = 1).For the tax-evasion example, μ = 1 maximizes privacy against inference of evasion but provides no privacy against inference of non-evasion.Source: B2 Statistical Accuracy under… · pp. 57–58

B3 The Accuracy Cost of Enhanced Privacy under Randomized Response

The section derives how privacy loss and accuracy change together under randomized response, then supplies technical details on query sensitivity, privacy semantics, and the data-utility model.

B3 The Accuracy Cost of Enhanced Privacy under Randomized Response

  • Both derivatives are positive, and each increment in accuracy requires increasingly large privacy losses under randomized response.The analysis describes the rate of privacy loss required for increased accuracy and reports a negative second derivative.Source: B3 The Accuracy Cost of Enhanced… · pp. 58–59

C Details of the Matrix Mechanism

  • The matrix mechanism’s workload sensitivity, ΔQ, is defined using the largest L1 change in query answers between neighboring integer databases.The section refers to a workload of linear queries and defines neighboring databases as differing by at most one in L1 distance.Source: C Details of the Matrix Mechanism · p. 59

D Details of Privacy Semantics

  • The protected paired hypotheses cover whether a person is included in the database and, if included, what record that person has.The section defines the database as a random sample from a latent population.Source: D Details of Privacy Semantics · pp. 59–60

E Derivation of the Data Utility Model

  • Expected utility is approximated by a second-order Taylor expansion in mechanism noise, and the resulting individual-specific data utility is linear in accuracy.The model assumes the mechanism and query details are known to the individual, with uncertainty over the database and noise.Source: E Derivation of the Data Utility Model · pp. 60–62

F Details of Legislative Redistricting Example

The section notes that the methods were upheld in Utah v. Evans.

F Details of Legislative Redistricting Example

Loading 1808.06303v1…