Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SafeTab-P: Disclosure Avoidance for the 2020 Census Detailed Demographic and Housing Characteristics File A (Detailed DHC-A)

Sam Haney, Skye Berghel, Bayard Carlson, Ryan Cumings-Menon, Luke Hartman, Michael Hay, Ashwin Machanavajjhala, Gerome Miklau, Amritha Pai, Simran Rajpal, David Pujol, William Sexton, Ruchit Shrestha, Daniel Simmons-Marengo

TL;DR

SafeTab-P addresses the challenge of releasing granular census statistics while protecting individual privacy by employing adaptive granularity and a discrete Gaussian mechanism within the zero-concentrated differential privacy framework. The algorithm assigns per-level privacy budgets, uses a two-stage adaptive release for non-TotalOnly population groups, and provides formal zCDP guarantees alongside practical Postprocessing steps for demographic reasonableness. It is implemented atop Tumult Analytics, enabling automatic privacy accounting, adaptive grouping, and coordination across coterminous geographies, with SafeTEx guiding parameter tuning to meet specified MOE targets. The work demonstrates the viability of end-to-end privacy-preserving publication for the Detailed DHC-A, offering a blueprint for similar 2020 Census data products and outlining future work on related data releases.

Abstract

This article describes the disclosure avoidance algorithm that the U.S. Census Bureau used to protect the Detailed Demographic and Housing Characteristics File A (Detailed DHC-A) of the 2020 Census. The tabulations contain statistics (counts) of demographic characteristics of the entire population of the United States, crossed with detailed races and ethnicities at varying levels of geography. The article describes the SafeTab-P algorithm, which is based on adding noise drawn to statistics of interest from a discrete Gaussian distribution. A key innovation in SafeTab-P is the ability to adaptively choose how many statistics and at what granularity to release them, depending on the size of a population group. We prove that the algorithm satisfies a well-studied variant of differential privacy, called zero-concentrated differential privacy (zCDP). We then describe how the algorithm was implemented on Tumult Analytics and briefly outline the parameterization and tuning of the algorithm.

SafeTab-P: Disclosure Avoidance for the 2020 Census Detailed Demographic and Housing Characteristics File A (Detailed DHC-A)

TL;DR

SafeTab-P addresses the challenge of releasing granular census statistics while protecting individual privacy by employing adaptive granularity and a discrete Gaussian mechanism within the zero-concentrated differential privacy framework. The algorithm assigns per-level privacy budgets, uses a two-stage adaptive release for non-TotalOnly population groups, and provides formal zCDP guarantees alongside practical Postprocessing steps for demographic reasonableness. It is implemented atop Tumult Analytics, enabling automatic privacy accounting, adaptive grouping, and coordination across coterminous geographies, with SafeTEx guiding parameter tuning to meet specified MOE targets. The work demonstrates the viability of end-to-end privacy-preserving publication for the Detailed DHC-A, offering a blueprint for similar 2020 Census data products and outlining future work on related data releases.

Abstract

This article describes the disclosure avoidance algorithm that the U.S. Census Bureau used to protect the Detailed Demographic and Housing Characteristics File A (Detailed DHC-A) of the 2020 Census. The tabulations contain statistics (counts) of demographic characteristics of the entire population of the United States, crossed with detailed races and ethnicities at varying levels of geography. The article describes the SafeTab-P algorithm, which is based on adding noise drawn to statistics of interest from a discrete Gaussian distribution. A key innovation in SafeTab-P is the ability to adaptively choose how many statistics and at what granularity to release them, depending on the size of a population group. We prove that the algorithm satisfies a well-studied variant of differential privacy, called zero-concentrated differential privacy (zCDP). We then describe how the algorithm was implemented on Tumult Analytics and briefly outline the parameterization and tuning of the algorithm.
Paper Structure (38 sections, 11 theorems, 10 equations, 2 figures, 7 tables, 4 algorithms)

This paper contains 38 sections, 11 theorems, 10 equations, 2 figures, 7 tables, 4 algorithms.

Table of Contents

  1. Introduction
  2. Problem & Desiderata
  3. Geography
  4. Race and Ethnicity
  5. Population Groups
  6. Detailed Demographic and Housing Characteristics File A
  7. Private Release Problem
  8. SafeTab-P Algorithm
  9. Input Data Description
  10. The Algorithm Description
  11. SafeTab-P Privacy Analysis
  12. Privacy Preliminaries
  13. Privacy definitions
  14. Composition Theorems
  15. Postprocessing
  16. ...and 23 more sections

Key Result

Lemma 1

(Adaptive sequential composition of zCDP BunS16) Let $M_1: \mathcal{X} \rightarrow \mathcal{Y}$ and $M_2: \mathcal{X} \times \mathcal{Y} \rightarrow \mathcal{Z}$ be mechanisms satisfying $\rho_1$-zCDP and $\rho_2$-zCDP respectively. Let $M_3(x) = M_2(x, M_1(x))$. Then $M_3$ satisfies $(\rho_1 + \rho

Figures (2)

  • Figure 1: The probability of suppression as a function of the true size of the population group, when true zeros are suppressed with probability 99.99%. The true size of the population group is expressed as a fraction of the suppression threshold. For example, the "0.5" indicates a population group with true size $T/2$, where $T$ is the suppression threshold.
  • Figure 2: The bias in reported population group size compared to the true size of the population group, when true zeros are suppressed with probability 99.99%. Both the size of the population group and the bias are expressed as fractions of the suppression threshold. For example, the "0.5" on the x-axis indicates a population group with size $T/2$, where $T$ is the suppression threshold and "0.5" on the y-axis indicates a bias of $T/2$.

Theorems & Definitions (22)

  • Definition 1: Neighboring Databases
  • Definition 2
  • Definition 3
  • Definition 4: Bounded Neighboring Databases
  • Definition 5: Bounded zCDP
  • Lemma 1
  • Lemma 2
  • Lemma 3
  • proof : Proof of Lemma \ref{['lem:generalized-parallel-composition-zcdp']}
  • Lemma 4
  • ...and 12 more