Differential Privacy and the 2020
Census in the United States
John M. Abowd
Chief Scientist and Associate Director for Research and Methodology
U.S. Census Bureau
Association for the Advancement of Artificial Intelligence
Privacy Preserving AI Workshop, February 8, 2021, 9:00am EST USA
The views expressed in this talk are my own and not those ofthe U.S. Census Bureau.

Going from suppression to differential
privacy is much easier than going frompublishing all the microdata to differential
privacy.

2

3

4

Major data products from the 2020 Census:• Apportion the House of Representatives(expected release between April 16 and April 30, 2021)• Supply data to all state redistricting offices(TBD)• Demographic and housing characteristics(TBD)• Detailed race and ethnicity data(TBD)• American Indian, Alaska Native, Native Hawaiian data(TBD)

For the 2010 Census, this was more than 150 billion
statistics from 15GB total data.
5

Reconstructing the 2010 Census• The 2010 Census collected information on the age, sex, race, ethnicity, andrelationship (to householder) status for ~309 Million individuals. (1.9 Billion
confidential data points)• The 2010 Census data products released over 150 billion statistics• Internal Census Bureau research confirms that the confidential 2010 Census
microdata can be accurately reconstructed from the publicly released tabulations

6

Reconstructing the 2010 Census:
What did we find?
• On the 309 million reconstructed records, census block and voting age (18+) werecorrectly reconstructed for all records and for all 6,207,027 inhabited blocks.
• Block, sex, age (in years), race (OMB 63 categories), and ethnicity werereconstructed:• Exactly for 46% of the population (142 million individuals)• Within +/- one year for 71% of the population (219 million individuals)• Block, sex, and age were then linked to commercial data, which provided putative
re-identification of 45% of the population (138 million individuals).
• Name, block, sex, age, race, ethnicity were then compared to the confidential
data, which yielded confirmed re-identifications for 38% of the putative reidentifications (52 million individuals).
• For the confirmed re-identifications, race and ethnicity are learned correctly,
though the attacker may still have uncertainty.
DRB Release CBDRB-FY20-103
7The Census Bureau’s Decision• Advances in computing power and the availability of external data
sources make database reconstruction and re-identification
increasingly likely.
• The Census Bureau recognized that its traditional disclosure
avoidance methods are increasingly insufficient to counter theserisks.
• To meet its continuing obligations to safeguard respondent
information, the Census Bureau has committed to modernizing its
approach to privacy protections.
8

The incredibly diverse user community is
now engaged in the debate about accuracy v.
privacy loss that publication of census results
at this scale demands.

9Title 13 U.S.Code delegates to the Census
Bureau arbitrating these diverse use cases.
Short of publishing the micro-data again,
many users, maybe even the majority, will be
uncomfortable with any choice. How does astatistical agency balance these interests?
10All 2020 Census Publications• Will all be processed by a collection of differentially private algorithms• Using a total privacy-loss budget set as policy, not hard-wired,
determined by the Data Stewardship Executive Policy Committee• Preliminary code base, technical documents, and extensive
demonstration products based on the 2010 Census confidential data
have all been released to the public• More information:
https://www.census.gov/newsroom/blogs/researchmatters/2019/10/balancing_privacyan.html
11Naïve Method: BottomUp or Block-by-Block• Apply differential privacy algorithms to the most detailed level ofgeography• Build all geographic aggregates from those components as a postprocessing• This is similar to the local differential privacy implementations in theChrome browser, iOS, and Windows 10.

12The Census TopDown Algorithm (TDA)• Take differentially private measurements at every level of the Census
geographic hierarchy• Moving from the United States to the census block post-process:• Solve a non-negative least squares optimization to get non-negative tables at
each level of the geographic hierarchy, always consistent with the levels
above• Solve a mixed integer linear program to get non-negative, integer tables at
each level of the geographic hierarchy, always consistent with the levels
above• Generate micro-data from these post-processed tables from theblock-level detailed tables (an exact image of a unique Microdata
Detail File)
13

14

15

If you feed TDA 11 billion differentiallyprivate measurements, it will do a good jobthat satisfies no one.

16

Accurate, but to whom?
• DAS operates under interpretable formal privacy guarantees, given
privacy-loss budgets• Accuracy properties depend upon the output metric (use case)• Distinct groups of data users will have a particular analyses they wish
to be accurate• Tuning accuracy for a given analysis can reduce accuracy for otheranalyses• Policy makers must consider reasonable overall accuracy metrics forprivacy tradeoffs
17Deep Dive: Redistricting Data
• Legislative districts for politically defined entities of arbitrary size
• Must be (approximately) equal populations in each district• Districts must be consistent with Section 2 scrutiny under the 1965
Voting Rights Act• Large minority populations cannot be clustered into a few districts• Majority-minority districts (approximately 50%+ minority population) must bedrawn when feasible• Focus statistics: total population, ratio largest race/ethnic population
to total population
18

19

20

21

22

Basic Demographic Accuracy Profile
Table 1.a: Total Population for county size categories - MAE, RMSE, MAPE, CV, MALPE, and outliers
Universe: Total population
Geography: Summary Level 050 - State-County
Count of Units(N)
All counties
3,143
Counties with total population less than 1,000
35Counties with total population 1,000 to 4,999
268
Counties with total population 5,000 to 9,999
395
Counties with total population 10,000 to 49,999
1,469
Counties with total population 50,000 to 99,999398
Counties with total population of 100,000 or more
578

MAE
6.57
11.40
6.08
6.59
6.20
6.16
7.71

RMSE
8.91
28.61
7.54
8.50
7.85
7.80
10.37

MAPE (%)
0.12
6.38
0.23
0.09
0.03
0.01
-

CV
0.01
4.16
0.25
0.11
0.03
0.01
-

Source: https://www.census.gov/programs-surveys/decennial-census/2020-census/planning-management/2020census-data-products/2020-das-metrics.html
Workbook: https://www2.census.gov/programs-surveys/decennial/2020/program-management/data-productplanning/2010-demonstration-data-products/ppmf20201116/2020-11-16-data-metrics-tables.xlsx
23

Table 1.b: Total Population for incorporated place size categories - MAE, RMSE, MAPE, CV, MALPE, and outliers
Universe: Total population
Geography: Summary Level 160 - State-Place - Incorporated Places Only

All incorporated places
Incorporated places with total population less than 500
Incorporated places with total population 500 to 999
Incorporated places with total population 1,000 to 4,999
Incorporated places with total population 5,000 to 9,999
Incorporated places with total population 10,000 to 49,999
Incorporated places with total population 50,000 to 99,999
Incorporated places with total population of 100,000 or moreCount of Units(N)
19,540
6,168
3,066
5,672
1,664
2,265
432
273

MAE
24.54
19.66
23.34
23.53
25.52
33.13
43.70
61.94

RMSE
34.44
25.73
31.16
32.23
35.29
45.73
58.77
84.01

MAPE (%)
4.98
12.80
3.38
1.23
0.37
0.18
0.07
0.03

CV
0.35
10.96
4.32
1.38
0.50
0.21
0.08
0.03

Source: https://www.census.gov/programs-surveys/decennial-census/2020-census/planning-management/2020census-data-products/2020-das-metrics.html
Workbook: https://www2.census.gov/programs-surveys/decennial/2020/program-management/data-productplanning/2010-demonstration-data-products/ppmf20201116/2020-11-16-data-metrics-tables.xlsx
24

Table 5.b: Hispanic or Latino Origin for county size categories - MAE, RMSE, MAPE, CV, MALPE, and outliers
Universe: Total population
Geography: Summary Level 050 - State-County

All counties
Hispanic or Latino
Not Hispanic or Latino
Counties with population 0 to 9
Hispanic or Latino
Not Hispanic or Latino
Counties with population 10 to 99
Hispanic or Latino
Not Hispanic or Latino
Counties with population of 100 or more
Hispanic or Latino
Not Hispanic or Latino

Count of Units
(N)

MAE

RMSE

MAPE (%)

CV

3,143
3,143

32.76
33.13

51.39
51.68

10.72
0.27

0.32
0.06

17-

12.76
-

18.67
-

503.45-356.54
-

322
3

17.59
41.00

23.77
61.59

40.10
47.14

40.94
73.91

2,804
3,140

34.62
33.12

53.78
51.67

4.36
0.22

0.30
0.06

Source: https://www.census.gov/programs-surveys/decennial-census/2020-census/planning-management/2020census-data-products/2020-das-metrics.html
Workbook: https://www2.census.gov/programs-surveys/decennial/2020/program-management/data-productplanning/2010-demonstration-data-products/ppmf20201116/2020-11-16-data-metrics-tables.xlsx
25

Table 5.c: Hispanic or Latino Origin for incorporated place size categories - MAE, RMSE, MAPE, CV, MALPE, and outliers
Universe: Total population
Geography: Summary Level 160 - State-Place - Incorporated Places Only

All incorporated places
Hispanic or Latino
Not Hispanic or Latino
Incorporated places with population 0 to 9
Hispanic or Latino
Not Hispanic or Latino
Incorporated places with population 10 to 99
Hispanic or Latino
Not Hispanic or Latino
Incorporated places with population of 100 or more
Hispanic or Latino
Not Hispanic or Latino

Count of Units
(N)

MAE

RMSE

MAPE (%)

CV

19,54019,540

22.48
32.16

43.96
49.75

65.67
5.58

2.24
0.63

6,241
44

4.47
5.50

7.37
7.26

142.15
123.58236.31155.85

6,609
1,217

14.46
14.85

18.94
19.42

51.69
28.69

52.39
31.60

6,690
18,279

47.20
33.37

72.38
51.19

8.12
3.76

1.27
0.61

Source: https://www.census.gov/programs-surveys/decennial-census/2020-census/planning-management/2020census-data-products/2020-das-metrics.html
Workbook: https://www2.census.gov/programs-surveys/decennial/2020/program-management/data-productplanning/2010-demonstration-data-products/ppmf20201116/2020-11-16-data-metrics-tables.xlsx
26

Table 6.a: Race Alone for states - MAE, RMSE, MAPE, CV, MALPE, and outliers
Universe: Total population
Geography: Summary Level - 040 StateWhite alone
Black alone
AIAN alone
Asian alone
NHPI alone
SOR alone
Two or more races

Count ofUnits (N)
51
51
51
51
51
51
51

MAE
162.1694.27
199.92103.55171.24
95.49
20.71

RMSE
190.41109.73233.78123.79222.61
123.2227.09

MAPE (%)
0.01
0.37
1.55
0.36
21.75
0.33
0.04

CV
0.01
0.41
0.04
2.10
0.03
0.02

Source: https://www.census.gov/programs-surveys/decennial-census/2020-census/planning-management/2020census-data-products/2020-das-metrics.html
Workbook: https://www2.census.gov/programs-surveys/decennial/2020/program-management/data-productplanning/2010-demonstration-data-products/ppmf20201116/2020-11-16-data-metrics-tables.xlsx
27

How to reconcile these statistics• Construct error metrics of the form
𝑃𝑟 𝑇𝐷𝐴 − 𝐶𝐸𝐹 ≤ 𝛼 ≥ 1 − 𝛽• Less than a error with probability at least 1-b for a target minimum population• Statistical interpretation: absolute differences (=RMSE differences) greater thana are outside the 1-b confidence interval• A single statistic can be used to tune the redistricting application
𝑃𝑜𝑝𝑢𝑙𝑎𝑡𝑖𝑜𝑛 𝑜𝑓 𝐿𝑎𝑟𝑔𝑒𝑠𝑡 𝑅𝑎𝑐𝑒 𝑜𝑟 𝐸𝑡ℎ𝑛𝑖𝑐 𝐺𝑟𝑜𝑢𝑝
𝑇𝑜𝑡𝑎𝑙 𝑃𝑜𝑝𝑢𝑙𝑎𝑡𝑖𝑜𝑛• Calculated for the TopDown Algorithm (TDA) output and the 2020 Census (CEF)28

Privacy protection out of the shadows• Certain privacy practices for previous censuses depended uponobfuscation• 2020 DAS demonstration data are the most transparent view into
Census Bureau privacy practices ever
• We appreciate and are excited to assess feedback from our external
partners

29

Selected Resources• Technical: https://github.com/uscensusbureau/census2020-dase2e/blob/master/doc/20190711_0945_Consistency_for_Large_Scale_Differentially_Private_Histograms.pdf• Basics:
https://www.census.gov/about/policies/privacy/statistical_safeguards/disclosure-avoidance-2020-census.html• Updates: https://www.census.gov/programs-surveys/decennialcensus/2020-census/planning-management/2020-census-dataproducts/2020-das-updates.html
30

Thank you.
John.Maron.Abowd@census.gov