# Presentation: 096730

## Slide 1

## Software for Tabular Data Protection

*Joe Fred Gonzalez, Jr.*
*Lawrence H. Cox*
*National Center for Health Statistics*
*Office of Research and Methodology*
*April 16, 2004*

## NCHS Confidentiality Concerns

- A major responsibility of NCHS is the protection of identifiable data collected from survey respondents, persons or establishments.
- Prior to release of public use files, data that could be used to identify a respondent are perturbed or removed  from microdata files.
- The other mechanism for statistical disclosure is the possible identification of individuals or establishments via tabular data.

## What is statistical disclosure?  

- 	**Statistical disclosure** occurs when the release of a statistical data product enables a third party to learn more about a respondent than the third party had already known (Dalenius)

## “Respondent”

- 	“Respondent” refers both to direct providers of data (person, organization, business) and to “units of analysis” they represent (families, corporations, groups)-(Cox, 1998)

## Must confidentiality preservation be absolute? What is its relative importance? (Cox, 1998)

- The balance issue: right to privacy vs. need to know
- Absolute confidentiality preservation is impossible (unless you don’t release data!)- the release of any data divulges something about each respondent

## Confidentiality Preservation (cont.)

- Technology limits what can be done
- 		-technology to limit disclosure
- 		-technology to cause disclosure
- In principle:
- 		-minimum disclosure protection and 	data quality and completeness standards 	are not incompatible
- 		-a joint optimum can be reached

## Confidentiality Preservation (cont.)

- In practice:
- 		-the balancing process is iterative
- 		-incompatibilities are resolved in favor 	of preserving confidentiality

## Possible Statistical Disclosure (Tabular Data Disclosure)

- respondents may be identified directly from small cell counts in categorical data
- magnitude data (number of events, such as hospital admissions or discharges where each respondent can contribute unequally to each cell), respondent contributions to  heavily concentrated cells may be closely approximated by the cell value.

## Possible Statistical Disclosure

- Problem: A table has small cell frequency counts (1,2, 3, or 4).  This could cause statistical disclosure.

## Disclosure Limitation

- Solution: Round all counts to base 5 (U.S. Census Bureau, New Zealand)

## Disclosure Limitation 

- Constraints:
- 		 * multiples of 5 remain fixed,
- 		 * nonmultiples of 5 round to one of the
- 		    two adjacent multiples of 5,
- 		 * rounded table is additive,
- 		 * rounding procedure is random 	 	 	    (unbiased).

## Disclosure Limitation 

- One Method: controlled random rounding using “stepping stones” algorithm

## Indirect tabular Statistical Disclosure

- 	Possible in tables through manipulation of additive tabular relationships between cell values and totals, e.g., manipulating rows and column totals in a two-dimensional table.

## Two-dimensional Tables 

- are a staple of official statistics
- enjoy mathematical properties absent from higher dimensions Cox (8).
- Most importantly, can be modeled as a *mathematical network *which can result in considerable reduction in computational time when optimizing certain functions.* *

## Two-dimensional Tables (cont.)

- Complex optimization functions involving integer variables, which could require exponential computing time, can be performed instead by using computationally efficient continuous linear methods, which require only polynomial (quadratic) computing time.

## Development of Software as a Demonstration Tool for Tabular Data Protection

- 	The National Center for Health Statistics has sponsored the development of disclosure limitation software for two-way tables by OptTek Systems, Inc.

## Software Functions 

- cell suppression
- controlled rounding (minimum-distance controlled rounding)
- unbiased controlled rounding
- controlled rounding subject to subtotal constraints
- synthetic substitution (controlled tabular adjustment)

## Cell Suppression

- 	A multiple-cell suppression technique by Cox (1995) is used as the cell suppression function in the Software for Tabular Data Protection (STDP).

## Cell Suppression (cont.)

-   	Hides from publication the values of all cells representing direct disclosure of confidential data on individual respondents (the *disclosure cells (**blue**)*), together with sufficiently many appropriately selected nondisclosure cells (the *complementary cells(**red**)*) to ensure that a third party cannot reconstruct or narrowly estimate confidential respondent data by manipulating linear relationships between released and suppressed table values.

## Cell Suppression (cont.)

- 	The challenge of this cell suppression problem is to select complementary suppressions that provide sufficient disclosure protection while minimizing the amount of information lost due to suppression.

## Cell Suppression (cont.)

- Information loss is typically measured as:
- number of cells suppressed,
- total value suppressed, and
- total percent of value suppressed or other functions such as the total of logarithm of one plus value suppressed.

## Cell Suppression (cont.)

- Typically, an objective function (or cost function) is formed which includes terms related to one of the types of information losses described in the previous slide.  Then, the optimization (cell suppression) is carried out by minimizing the objective function subject to certain constraints, such as row or column marginals.

## Cell Suppression (cont.)

- The choice of objective function is an important one for the data provider: the mathematical methods and software will produce an optimal solution with equal ease for different objective functions, but the resulting solutions can be quite different.  It is important that the provider, through prior experimentation or established policy, understand the qualitative difference likely to result from the specification of a particular objective.

## Cell Suppression (cont.)

- The determination of which cells are the disclosure cells is made by applying a quantitative *disclosure rule* to the cell data.  For count data, typically a nonzero cell is a disclosure cell if its value is below a specified *threshold*, e.g., n = 5(applied to examples that follow.).  Zero cells can be, but most frequently are not, regarded as disclosure cells.

## Cell Suppression (cont.)

- For magnitude data, many disclosure rules are possible, but notable is the *p-percent rule* that declares disclosure whenever the cell value minus the contribution of the second largest contributor is less than (100 + p)-percent of the contribution of the largest contributor.  This rule protects each contributor from having its contribution divulged to a competitor (for example, a competing hospital in the same geographic area) any closer than p-percent of its value.

## Cell Suppression (cont.)

- 	The cell suppression approach used is based on mathematical networks which offer theoretical and practical advantages.  A mathematical network is a specialized linear program defined over a mathematical graph.

## Slide 28

## Cell Suppression (cont.)

- The following table displays the results of applying the *complementary cell suppression *to the* *previous (original) table.
- The optimization criterion is total value suppressed.

## Slide 30

## Disadvantage of Cell Suppression

- Limits utility of tabular data
- Difficult or impossible to perform a statistical analysis of table which includes “D” or “C” for cell values

## Controlled Rounding

- 	The *controlled rounding* function that is used in the STDP is based on the methodology described by Cox and Ernst (1982) and by Causey, Cox, and Ernst (1985).

## Controlled Rounding (cont.)

- 	The controlled rounding function is the problem of rounding all entries in a one or two-way tabular array A to integer multiples of a positive integer base B subject to the following requirements:
- (1) 	each entry in A is rounded to an *adjacent integer multiple of *B;		that is, an entry *a* is rounded to either B[*a/*B] or B([*a*/B] + 1),
- 	where [ ] is the greatest integer function, and
- (2) 	the sum of the rounded values for any row (or column) of A 	equals the rounded value of the corresponding row (or column) 	total entry. Similarly, rounded values of the row and column      totals both sum to the rounded grand total.
- 	Requirements  (1) and (2) are referred to as *controlled rounding* of an array A.

## Controlled Rounding (cont.)

-  	Additionally, optimal controlled roundings were achieved by presenting this problem as a capacitated transportation problem whose objective function is minimized with respect to the* l**p*  norm, 1   *p *< , where the objective function is the pth  root of the sum of the pth powers of the absolute values of the differences between rounded and unrounded entries of A.

## Objective Function to Minimize with respect to lp norm 

- <footer>

- <date/time>

- Objective Function to Minimize with respect to *l*p norm* *

## Controlled Rounding (cont.)

- Cox and Ernst (2) showed that this objective function can be expressed as a linear function of appropriate variables, thus defining a linear program.
- In general, this function has a geometrical and not statistical, interpretation (namely, minimum of a corresponding Euclidean distance).

## Controlled Rounding (cont.)

- However, other linear functions can be employed to optimize statistical properties, e.g., sum of differences between rounded and unrounded entries minimizes change to the table mean resulting from rounding.

## Controlled Rounding (cont.)

- Unfortunately, controlled rounding cannot be extended to three- or higher-dimensional tables in all cases (Ernst [8]).  Often, exact methods for two-dimensional tables as described here are applied iteratively to the vertical planes of a three-dimensional table to produce approximate results.

## Test Results for Controlled Rounding Function:

- Testing was done on a Pentium 4 processor with 261, 200 KB of Ram.

## Test Results (cont.) : The total time to solve the problem is dependent on:

- The number of cells in the table that are not multiples of the base.
- The number of rows and columns in the table.

## Test Results (cont.)

- A table with 50 rows and 50 columns was rounded in less than a minute.
-  A table with 100 rows and 100 columns was rounded in 24 minutes.
- A table with 1000 rows and 5 columns was rounded in 1 hour and 40 minutes.

## Slide 42

## Slide 43

## Unbiased Controlled Rounding

- 	The *unbiased controlled rounding* function that is used in the STDP is based on the methodology described by Cox (1987).

## Unbiased Controlled Rounding (cont.)

-    	First, we assume that we have a two-way table A  that is additive, that is, entries sum along rows and columns to all corresponding totals entries.

## Unbiased Controlled Rounding (cont.)

-  	The objective is to construct a second additive table R(A) whose internal and totals entries, denoted by R(*a*), are integer multiples of B that are adjacent to the corresponding entries of A, that is, R(*a*) = B[*a*/B] or B([*a*/B] + 1), where [*a/B*] denotes the integer part of *a/B.*

## Unbiased Controlled Rounding (cont.)

- 	In summary, the conditions for unbiased controlled rounding are that every entry *a *of A satisfies the following:
- 		         1.     R(*a*) = B[*a/B*] or B([*a/B*] + 1)
- 2.     R(A) is additive.
- 3.        | R(*a*) - *a**|* < B
- 4.            E(R(*a*)) = *a*

## Unbiased Controlled Rounding (cont.)

- In other words, in lieu of optimizing with respect to a Euclidean measure of distance, the desired solution preserves original values with respect to the statistical criterion *expectation*.
- This method relies on a probability measure on rounding down or up for each table entry, as follows.  Let r denote the remainder of the cell value after division by the rounding base B; 0 _<_ r < B.  Round the cell down with probability (b - r)/B; round the cell up with probability r/B.  The implementation does not rely on linear programming per se but on a specialized algorithm from mathematical programming known as the *stepping stones algorithm*.  See Cox ([4]) for details.

## Test Results for Unbiased Controlled Rounding 

- A table with 50 rows and 50 columns was rounded in a second.
-  A table with 100 rows and 100 columns was rounded in 4 seconds.
- A table with 400 rows and 25 columns was rounded in 5 seconds.
- A table with 2000 rows and 25 columns was rounded in 5 minutes and 45 seconds.

## Slide 50

## Slide 51

## Controlled Rounding Subject to Subtotal Constraints

- The *controlled rounding* *subject to subtotal constraints* function that is used in the STDP is based on the methodology described by Cox and George (1987).
- The methodology used in this function is similar to that used for *controlled rounding* as discussed earlier, but seeks as well to preserve additivity to subtotals along rows or columns of the table, at least to within “base” units of the original subtotal.
- Recall that controlled rounding  for a two-way table was presented as a capacitated transportation problem.  This function extends that methodology to tables with subtotals along one, but not both, dimensions.

## Slide 53

## Slide 54

## Synthetic Substitution (Controlled Tabular Adjustment)

- Developed by Dandekar and Cox (2002) as an alternative to complementary cell suppression.
- Uses a threshold rule(s) to determine how cells can be modified.
- Replaces the value of each disclosure cell by either of its closest *safe values*, viz., cell value plus or minus the protection limit, and uses linear programming to make small adjustments to other cells to restore the additive tabular structure.

## Synthetic Substitution (Controlled Tabular Adjustment)

- For count data, the safe value is either zero or the threshold n.
- Adjustments to other values are controlled by capacitating changes to be small.

## Synthetic Substitution (cont.) (Controlled Tabular Adjustment)

- In the current software implementation, a    factor is used to randomize the results of tabular adjustment. Therefore, performing the procedure more than once on the same input file will generate different results/outputs.

## Slide 58

## Slide 59

## Future Research and Development

- The software developed for this project is a tool which features some of the different mathematical functions for protecting potential disclosure cell values in two-way tables.

## Future Research and Development (cont.)

- The ultimate goal of this project is to develop production level software that can be embedded into NCHS data analysis activities, for example, the NCHS Research Data Center (RDC).  Disclosure limitation research, controlled tabular adjustment in particular, is ongoing, and is addressing both data quality and data confidentiality concerns, e.g., Cox and Kelly ([10]).  We expect to incorporate new and improved methods into the software as they become available. The software developed for this project is a tool which features some of the different mathematical functions for protecting potential disclosure cell values in two-way tables.

## References

**1.** Cox, L.H. (1995). Network models for complementary cell suppression. *Journal of the*
*	**American Statistical Association ***90**, 1453-1462.
- 	Cox, L.H. (1996). Addendum. *Journal of the American Statistical Association ***91**, 1757.
**2. **Cox, L.H. and L.R. Ernst (1982). Controlled rounding. *INFOR ***20**, 423-432.

## References (cont.)

**3. **Causey, B.D, L.H. Cox, and L.R. Ernst (1985). Applications of transportation theory to
- 	statistical problems. *Journal of the American Statistical Association ***80**, 903-909.
**4. **Cox, L.H. (1987). A constructive procedure for unbiased controlled rounding. *Journal of the American Statistical Association ***82**, 520-524.
**5. **Cox, L.H. and J.A. George (1989). Controlled rounding for tables with subtotals. *Annals of Operations Research ***20**, 141-157.

## References (cont.)

**6**. SAS Institute Inc., SAS/STAT User’s Guide, Version 8, Cary, NC: SAS Institute Inc (1999).
**7**. Shah, B., Barnwell, B., Bieler, G., *SUDAAN Users’s Manual, Release 7.0*, Research Triangle Park, NC: Research Triangle Institute (1996).
- 8.) Cox, LH, On Properties of Multi-dimensional Statistical Tables. *Journal of Statistical Planning and Reference* 2003; in press.
- 9.) Ernst, LR. Further applications of linear programming to sampling problems.  Technical Report –Census/SRD/RR-89-05. 1989;Washington , DC, US Census Bureau

## References (cont.)

-   10.)  Cox LH.,  Kelly JP.  Ensuring data quality and confidentiality for tabular data. *Proceedings of the UNECE/Eurostat Work Session on Statistical Data Confideniality* (Invited Paper), April 2003, Luxembourg; to appear. Available: _http://www.unece.org/stats/documents/2003.04.confidentiality.htm_

## Slide 66