Cell Suppression

The core mechanism involves two distinct operations:

• Primary Suppression: Hides cells that directly violate a threshold rule, such as a frequency count below a minimum or a dominance rule where one or two entities contribute too large a share of a total.
• Complementary Suppression: A mandatory secondary step that hides additional, non-sensitive cells. This is necessary to prevent an attacker from using published marginal totals to algebraically back-calculate the value of the primary suppressed cell.

Cells are flagged for suppression based on predefined sensitivity rules:

• Minimum Frequency Rule (n/k Rule): A cell is suppressed if it represents a count of fewer than a specified number of unique contributors.
• (n,k) Dominance Rule: A cell is sensitive if the sum of the largest n contributors exceeds k percent of the total cell value.
• p% Rule: A more precise dominance measure where a cell is sensitive if an attacker can estimate any contributor's value within a p percent margin using the published total.

A successful suppression pattern must pass a rigorous audit:

• Protection Interval: For each suppressed cell, an upper and lower bound is calculated. The true value must be protected within an interval wide enough to prevent precise estimation.
• Feasibility Check: The system must verify that no exact value can be derived for any suppressed cell by solving the system of linear equations formed by the published totals and unsuppressed cells.
• Optimal Pattern: Finding the minimal set of complementary suppressions that guarantees full protection is a computationally complex (NP-hard) optimization problem.

The technique is applied differently based on the table structure:

• Magnitude Tables: Display sums or averages (e.g., total revenue). Suppression protects against the disclosure of a dominant entity's contribution.
• Frequency Tables: Display counts (e.g., number of individuals). Suppression protects against revealing the existence of small, identifiable groups.
• Linked Tables: When multiple tables share common margins, suppression patterns must be coordinated across all releases to prevent the

The primary trade-off is between disclosure risk and analytical utility:

• Information Loss Metrics: The quality of a suppression pattern is measured by the total value or number of cells suppressed. Excessive complementary suppression degrades the dataset's usefulness for economic and policy analysis.
• Alternative Presentation: To mitigate utility loss, suppressed cells are often replaced with a secondary, less precise value (e.g., a range or an interval) rather than being completely blanked, a technique known as controlled rounding or interval publication.

Finding the optimal suppression pattern is a significant computational challenge:

• Network Flow Models: The problem is often modeled as a network or hypergraph, where cells are nodes and equations are arcs. Suppression is equivalent to finding a cut that protects sensitive nodes.
• Heuristic Solvers: Due to the NP-hard nature of finding the absolute minimum information loss, statistical agencies use heuristic algorithms and linear programming solvers (like the Simplex method) to find a "good enough" pattern that guarantees protection within reasonable compute time.