# Presentation: 859771

## Slide 1

## “Software for Tabular Data Protection”

- “Software for Tabular Data Protection”

*Joe Fred Gonzalez, Jr.*
*Lawrence H. Cox*
*National Center for Health Statistics*
*Office of Research and Methodology*
*January 28, 2003*

## NCHS Confidentiality Concerns

- A major responsibility of NCHS is the protection of identifiable data collected from survey respondents, persons or establishments.
- Prior to release of public use files, data that could be used to identify a respondent are perturbed or removed  from microdata files.
- The other mechanism for statistical disclosure is the possible identification of individuals or establishments via tabular data.

## Development of Software as a Demonstration Tool for Tabular Data Protection

- 	The National Center for Health Statistics has sponsored the development of disclosure limitation software for two-way tables by OptTek Systems, Inc.

## Software Functions 

- cell suppression
- controlled rounding
- unbiased controlled rounding
- controlled rounding subject to subtotal constraints
- synthetic substitution (controlled tabular adjustment)

## Cell Suppression

- 	A multiple-cell suppression technique by Cox (1995) is used as the cell suppression function in the Software for Tabular Data Protection (STDP).

## Cell Suppression (cont.)

-   	Hides from publication the values of all cells representing direct disclosure of confidential data on individual respondents (the *disclosure cells (**blue**)*), together with sufficiently many appropriately selected nondisclosure cells (the *complementary cells(**red**)*) to ensure that a third party cannot reconstruct or narrowly estimate confidential respondent data by manipulating linear relationships between released and suppressed table values.

## Cell Suppression (cont.)

- 	The challenge of this cell suppression problem is to select complementary suppressions that provide sufficient disclosure protection while minimizing the amount of information lost due to suppression.  That is, suppression pattern given is optimal with respect to total value suppressed.

## Cell Suppression (cont.)

- 	The cell suppression approach used is based on mathematical networks which offer theoretical and practical advantages.  A mathematical network is a specialized linear program defined over a mathematical graph.

## Slide 10

## Slide 11

## Controlled Rounding

- 	The *controlled rounding* function that is used in the STDP is based on the methodology described by Cox and Ernst (1982) and by Causey, Cox, and Ernst (1985).

## Controlled Rounding (cont.)

- 	The controlled rounding function is the problem of rounding all entries in a one or two-way tabular array A to integer multiples of a positive integer base B subject to the following requirements:
- (1) 	each entry in A is rounded to an *adjacent integer multiple of *B;		that is, an entry *a* is rounded to either B[*a/*B] or B([*a*/B] + 1),
- 	where [ ] is the greatest integer function, and
- (2) 	the sum of the rounded values for any row (or column) of A 	equals the rounded value of the corresponding row (or column) 	total entry.
- 	Requirements  (1) and (2) are referred to as *controlled rounding* of an array A.

## Controlled Rounding (cont.)

-  	Additionally, optimal controlled roundings were achieved by presenting this problem as a capacitated transportation problem whose objective function is minimized with respect to the* l**p*  norm, 1   *p *< , where the objective function is the pth  root of the sum of the pth powers of the absolute values of the differences between rounded and unrounded entries of A.

## Objective Function to Minimize with respect to lp norm 

- <footer>

- <date/time>

- Objective Function to Minimize with respect to *l*p norm* *

## Test Results for Controlled Rounding Function:

- Testing was done on a Pentium 4 processor with 261, 200 KB of Ram.

## Test Results (cont.) : The total time to solve the problem is dependent on:

- The number of cells in the table that are not multiples of the base.
- The number of rows and columns in the table.

## Test Results (cont.)

- A table with 50 rows and 50 columns was rounded in less than a minute.
-  A table with 100 rows and 100 columns was rounded in 24 minutes.
- A table with 1000 rows and 5 columns was rounded in 1 hour and 40 minutes.

## Slide 19

## Slide 20

## Unbiased Controlled Rounding

- 	The *unbiased controlled rounding* function that is used in the STDP is based on the methodology described by Cox (1987).

## Unbiased Controlled Rounding (cont.)

-    	First, we assume that we have a two-way table A  that is additive, that is, entries sum along rows and columns to all corresponding totals entries.

## Unbiased Controlled Rounding (cont.)

-  	The objective is to construct a second additive table R(A) whose internal and totals entries, denoted by R(*a*), are integer multiples of B that are adjacent to the corresponding entries of A, that is, R(*a*) = B[*a*/B] or B([*a*/B] + 1), where [*a/B*] denotes the integer part of *a/B.*

## Unbiased Controlled Rounding (cont.)

- 	In summary, the conditions for unbiased controlled rounding are that every entry *a *of A satisfies the following:
- 		         1.     R(*a*) = B[*a/B*] or B([*a/B*] + 1)
- 2.     R(A) is additive.
- 3.        | R(*a*) - *a**|* < B
- 4.            E(R(*a*)) = *a*

## Test Results for Unbiased Controlled Rounding 

- A table with 50 rows and 50 columns was rounded in a second.
-  A table with 100 rows and 100 columns was rounded in 4 seconds.
- A table with 400 rows and 25 columns was rounded in 5 seconds.
- A table with 2000 rows and 25 columns was rounded in 5 minutes and 45 seconds.

## Slide 26

## Slide 27

## Controlled Rounding Subject to Subtotal Constraints

- The *controlled rounding* *subject to subtotal constraints* function that is used in the STDP is based on the methodology described by Cox and George (1987).
- The methodology used in this function is similar to that used for *controlled rounding* as discussed earlier.
- Recall that controlled rounding  for a two-way table was presented as a capacitated transportation problem.  This function extends that methodology to tables with subtotals along one, but not both, dimensions.

## Slide 29

## Slide 30

## Synthetic Substitution (Controlled Tabular Adjustment)

- Developed by Dandekar and Cox (2002) as an alternative to complementary cell suppression.
- Uses a threshold rule(s) to determine how cells can be modified.
- All cells, *a*ij  “Base” (B) are set = 0 or (*a*ij + B ).
- All other cells can be adjusted such that:
-  (*a*ij - B ) < new value < (*a*ij + B ).

## Synthetic Substitution (cont.)

- In output file (table), the cells, *a*ij   B are highlighted in blue; other cells that were modified are highlighted in red.
- A “noise” factor is used to randomize the results of synthetic substitution.  Therefore, performing synthetic substitution more than once on the same input file will generate different results/outputs.  Currently, different thresholds are being tested.

## Slide 33

## Slide 34

## Future Research and Development

- As mentioned earlier, the software developed for this project is a tool which features some of the different mathematical functions for protecting potential disclosure cell values in two-way tables.
-  The ultimate goal of this project is to develop production level software that can be an embedded into NCHS data systems, for example, the NCHS Research Data Center (RDC), where data analysts and researchers submit their statistical programs, such as SAS (1999) and/or SAS Callable SUDAAN (1996).

## References

**1.** Cox, L.H. (1995). Network models for complementary cell suppression. *Journal of the*
*	**American Statistical Association ***90**, 1453-1462.
- 	Cox, L.H. (1996). Addendum. *Journal of the American Statistical Association ***91**, 1757.
**2. **Cox, L.H. and L.R. Ernst (1982). Controlled rounding. *INFOR ***20**, 423-432.

## References (cont.)

**3. **Causey, B.D, L.H. Cox, and L.R. Ernst (1985). Applications of transportation theory to
- 	statistical problems. *Journal of the American Statistical Association ***80**, 903-909.
**4. **Cox, L.H. (1987). A constructive procedure for unbiased controlled rounding. *Journal of the American Statistical Association ***82**, 520-524.
**5. **Cox, L.H. and J.A. George (1989). Controlled rounding for tables with subtotals. *Annals of Operations Research ***20**, 141-157.

## References (cont.)

**6**. SAS Institute Inc., SAS/STAT User’s Guide, Version 8, Cary, NC: SAS Institute Inc (1999).
**7**. Shah, B., Barnwell, B., Bieler, G., *SUDAAN Users’s Manual, Release 7.0*, Research Triangle Park, NC: Research Triangle Institute (1996).

## Slide 39