Confidentiality and Differential Privacy in the Dissemination of Frequency Tables
Confidentiality and Differential Privacy in the Dissemination of Frequency Tables
复制标题
频率表传播中的保密性和差分隐私
作者：
Y. Rinott;C. O'Keefe;N. Shlomo;C. Skinner
几十年来，国家统计机构和其他数据保管机构一直在发布基于人口普查、调查和行政数据的频率表。为了保护数据中所代表的个人的机密性，基于原始数据的表格在发布之前会被修改。最近，为了满足用户对更灵活和响应更快的表格发布服务的需求，频率表发布方案已经通过在线表格生成服务器（例如美国人口普查局FactFinder和澳大利亚统计局（ABS）TableBuilder）得到增强。这些系统允许用户构建自己的自定义表格，并利用自动扰动例程来保护机密性。受表生成服务器日益普及的推动，在本文中，我们研究了扰动频率表的机密性保护，包括与分析效用的权衡，重点关注 ABS TableBuilder 的一个版本作为数据发布机制的具体示例，并检查其属性。机密性保护是根据差分隐私标准进行评估的，本文可以作为差分隐私、与其应用相关的计算、机密性保护与效用之间的关系以及一般机密性的实用介绍。
For decades, national statistical agencies and other data custodians have been publishing frequency tables based on census, survey and administrative data. In order to protect the confidentiality of individuals represented in the data, tables based on original data are modified before release. Recently, in response to user demand for more flexible and responsive table publication services, frequency table publication schemes have been augmented with on-line table generating servers such as the US Census Bureau FactFinder and the Australian Bureau of Statistics (ABS) TableBuilder. These systems allow users to build their own custom tables, and make use of automated perturbation routines to protect confidentiality. Motivated by the growing popularity of table generating servers, in this paper we study confidentiality protection for perturbed frequency tables, including the trade-off with analytical utility, focusing on a version of the ABS TableBuilder as a concrete example of a data release mechanism, and examining its properties. Confidentiality protection is assessed in terms of the differential privacy standard, and this paper can be used as a practical introduction to differential privacy, to calculations related to its application, to the relationship between confidentiality protection and utility, and to confidentiality in general.