Protecting the Confidentiality of Tables by Adding Noise to the Underlying Microdata Paul Massell and Jeremy Funk Statistical Research Division U.S. Census Bureau Washington, DC

2 Talk Outline 1.Overview of EZS Noise 2.Measuring Effectiveness of Perturbative Protection 3.Noise Applied to Weighted Data 4.Noise Applied to Unweighted Data: Random vs. Balanced Noise 5.Conclusions and Future Research

3 The EZS Noise Method (Evans, Zayatz, Slanta) Developed by Tim Evans, Laura Zayatz, and John Slanta in the 1990s Multiplicative noise is added to the underlying microdata, before table creation A noise factor or multiplier is randomly generated for each record

4 The distribution of the multipliers should produce unbiased estimates, and ensure that no multipliers are too close to 1 Weights both known and unknown to users are combined with the noise factors to obtain noisy values for all records When tabulated, in general, sensitive cells are changed quite a bit and non-sensitive cells are changed only by a small amount The EZS Noise Method (Evans, Zayatz, Slanta)

5 Tables with noisy data are created in the same way as the original tables: simply: replace var X with var X-noisy Tables are automatically additive An approximate value could be released for every cell (depends on agency policy) No Complementary Suppressions Attractive Features of EZS

6 Linked tables and special tabs are automatically protected consistently EZS allows for protection at the company level (Census requirement) Ease of implementation compared to methods such as cell suppression Attractive Features of EZS

7 Measuring Effectiveness of the EZS Method Step 1: Determine which cells in a table are sensitive – e.g., using p% Sensitivity Rule Step 2: Measure level of protection to sensitive cells (using protection multipliers) Step 3: Measure amount of perturbation to non-sensitive cells (via % change graph)

8 The p% Sensitivity Rule Unweighted Data: Let T = cell total ; x1, x2 top 2 contributions Let rem denote remainder Set rem = T – (x1 + x2) Let prot denote suggested protection Set prot = (p/100) * x1 – rem if prot > 0, when Contributor 2 tries to estimate x1, rem does NOT provide enough uncertainty ; additional protection is needed; noise may provide this uncertainty

9 p% Sensitivity Rule Weighted Data: TA = Fully Weighted Cell Estimate X1 = Largest Cell Respondent Contribution X2 = 2 nd Largest Cell Contribution w kn = Known Weights w un = Unknown Weights

10 Extended p% rule w. weights & rounding rem = TA – (X1 * w kn1 + X2 * w kn2 ) prot = ( (p/100) * X1 * w kn1 ) – rem

11 Measuring the Effectiveness of a Perturbative Protection Method Protection of Sensitive Cells : Define Protection Multiplier (PM) PM = abs (perturbation) / prot Find how many (or %) have PM < 1 Data Quality: Important: % change for non-sensitive cells Less important: % over-pertubation for sensitive cells

12 EZS Noise Factors for Unweighted Data Let X = original microdata value Let Y = perturbed value Let M = noise multiplier; i.e. a draw from a specified noise distribution of EZS type Y = X * M

13 Noise Distribution used for all examples: (a=1.05, b=1.15) 5% to 15% noise

14 Noise Applied to Weighted Data Key idea: weights (e.g., sample weights) provide protection to microdata since users typically know weights only roughly (except when close to 1) Not necessary to apply full M factor to X unless w = 1

15 EZS Noise Factor for Weighted Data Weighted Data: For a simple weight w with associated uncertainty interval at least as wide as 2*b*w the noise factor S can be combined with w to form the Joint Noise-Weight Factor

16 Noise Formula for Known and Unknown Weights Calculation of Perturbed Values: w kn is the known weight w un is the unknown weight.

17 Noise for Weighted Data: Commodity Flow Survey (CFS) Measures flow of goods via transport system in U.S. Estimates volume and value of each commodity shipped: by origin, destination, modes of transport Used for transport modeling, planning,... Some users have objected to disclosure suppressions

18 Effect of Noise on High Level Aggregate Cells CFS Table: National 2-DigitCommodity Data Quality Measure: 43 cells; 0 are sensitive 41 cells change by [0 - 1] % 2 cells change by [1 - 2] %

19 CFS Test Table (Origin State by Destination State by 2 digit Commodity) 61,174 cells of which 230 are sensitive Data Quality and Protection Assessments (following slides)

20 CFS Noise Results Data Quality Assessment While some cells may receive large doses of noise, vast majority get less than 1% or 2%

21 CFS Random Noise Protection Assessment Most sensitive cells receive significant noise, i.e. 5% to 11% Only 2 out of 230 sensitive cells do not receive full protection from noise, as measured by Protection Multipliers (PM)

22 Noise for Unweighted Data Non-Employers Statistics Special Features of Microdata Unweighted adminstrative data Only 1 variable to protect: receipts Many small integers (after rounding to $1000) Special Features of Key Table Many cells have a small number of contributors; these include many safe cells Many sensitive cells with only 1 or 2 contributors

23 NE Noise Results Data Quality Assessment Lack of weights results in much more distortion to non-sensitive cells than occurs for CFS

24 NE Noise Results Protection Assessment Resembles noise factor distribution, due to prevalence of 1 respondent cells in NE test table and no weights

25 Noise Balancing Is there a way to improve data quality in this situation? Yes, if one can focus on one key table T Idea: balance noise at each cell in balancing sub-table B of T (defn: every micro value is in at most one cell of B) Choose noise directions to maximize noise cancellation for each cell of B

26 Noise Balancing Supportive NE Characteristics Balancing works especially well for NE because a high % of microdata is single unit After balancing interior cells, need to check noise effect on aggregate cells in same table Also need to check noise effect in higher and lower tables; these we call trickle up and trickle down effects For NE, there are few of these other tables; this makes balancing decision easier

27 NE – Balanced Noise Data Quality Assessment Vast improvement in data quality Resembles that of weighted data in CFS

28 NE – Balanced Noise Protection Assessment Very similar to Random Noise application 91.7% of sensitive cells fully protected

29 Random Noise vs. Balanced Noise Non Employer Test Data Data Quality is greatly improved Protection Level is not significantly reduced Thus Balanced Noise is a Good Choice Here Percent Fully Protected ( PM >= 1 ) Random92.14% Balanced91.70% PM density curves on [0,1] are nearly identical for 2 methods

30 Conclusions Conclusions: 1.EZS Noise is a useful method for protecting tables from a variety of economic programs 2.There are now several variations of the basic EZS method ; which is best for a survey depends on both microdata and table characteristics

31 Future Research 1. Should some sensitive cells be suppressed; high noise cells flagged ? 2. How to handle multiple variables ? 3. What is the most that users can be told about noise process without compromising data protection ? 4. How to handle company dynamics (births, deaths, mergers, ….) ? 5. How to coordinate survey protection ?

32