Statistical Disclosure Control (SDC)

Intentional alteration of original data values to obscure individual records while preserving aggregate statistical patterns. This is a primary method for creating safe microdata files.

• Noise Addition: Adding random noise drawn from a known distribution (e.g., Gaussian, Laplace) to continuous variables.
• Data Swapping: Exchanging values of sensitive variables between similar records to break the link between individuals and their true attributes.
• PRAM (Post-Randomization Method): A probabilistic technique applied to categorical variables where values are changed according to a prescribed transition matrix.
• Rounding: Reducing the precision of numerical values to create ambiguity about the exact original figure.

Techniques that reduce the level of detail in a dataset to prevent the isolation of unique or rare records. This is often a first-line defense against re-identification.

• Global Recoding: Applying a consistent transformation to an entire variable, such as converting exact birth dates to age bands or specific job titles to broad occupational categories.
• Local Suppression: Selectively deleting the values of specific cells or records that pose a high disclosure risk, such as outliers or unique combinations of attributes.
• Sampling: Releasing a random subset of the original data rather than the full population, introducing uncertainty about whether a specific individual is included.
• Top/Bottom Coding: Capping the extreme values of a continuous variable (e.g., all incomes above $500k are recorded as '$500k+') to prevent the identification of outliers.

Specialized methods for protecting aggregate tables where cell values represent sums, means, or counts. The primary risk is inferential disclosure, where a sensitive cell value can be derived from published marginal totals.

• Cell Suppression: Hiding the values of sensitive cells (primary suppression) and often additional non-sensitive cells (complementary suppression) to prevent recalculation.
• Controlled Rounding: Rounding all cell values to a fixed base (e.g., multiples of 5) in a way that maintains the additivity of the table.
• Table Redesign: Collapsing rows or columns with small counts to eliminate sparse cells that are most vulnerable to disclosure.

Creating an entirely artificial dataset from a statistical model fitted to the original confidential data. The goal is to replicate the analytical properties of the real data without containing any actual records.

• Fully Synthetic: All records are generated from the model. This offers the strongest privacy protection but may not preserve all complex relationships.
• Partially Synthetic: Only the most sensitive variables or records are synthesized and replaced, while the rest of the original data is retained.
• Sequential Synthesis: Variables are synthesized one after another using a chain of conditional models, which is effective for preserving multivariate relationships.

Quantifying the probability that an adversary can successfully re-identify records or learn sensitive attributes from the released data. This is a mandatory step before publication.

• k-Anonymity: Evaluates whether each record is indistinguishable from at least k-1 other records based on quasi-identifiers.
• l-Diversity: Checks if sensitive attributes within each k-anonymous group have sufficient variability.
• Record Linkage: Simulating an attack by matching the de-identified file against external identified datasets to measure the true match rate.
• Differential Privacy: A formal mathematical framework that provides a provable guarantee by measuring the maximum information leakage (epsilon) from any query.

Measuring the degradation in data utility caused by applying SDC techniques. The goal is to find the optimal point on the risk-utility curve where privacy is maximized for an acceptable loss of analytical validity.

• Propensity Score: Measures the similarity between the original and masked data by training a classifier to distinguish between them. A score near 0.5 indicates high utility.
• Benchmarking: Running a standard set of analyses (e.g., regression coefficients, means, correlations) on both the original and protected data and comparing the results.
• General Information Loss: Quantifies the degree of cell suppression, recoding granularity, and variance introduced by perturbation.

A foundational privacy model ensuring each record is indistinguishable from at least k-1 other records based on quasi-identifiers (QIDs) like age, zip code, and gender. This prevents singling out individuals.

• Generalization: Replaces specific values with broader ranges (e.g., age 34 → 30-40)
• Suppression: Removes outlier records that cannot form sufficiently large equivalence classes
• Limitation: Vulnerable to homogeneity attacks if sensitive attributes lack diversity within a group

An extension of k-anonymity that defends against homogeneity attacks by requiring at least l distinct, well-represented values for sensitive attributes within each equivalence class.

• Distinct l-diversity: Ensures l different sensitive values exist in each block
• Entropy l-diversity: Requires the entropy of sensitive value distribution to exceed a threshold
• Recursive (c,l)-diversity: Ensures the most frequent value does not dominate the class

A privacy model that refines l-diversity by requiring the distribution of a sensitive attribute in any equivalence class to be within a threshold t of its distribution in the overall dataset.

• Prevents skewness attacks where an attacker infers probabilistic membership
• Uses Earth Mover's Distance (EMD) to measure distributional divergence
• Balances privacy with analytical utility more effectively than rigid diversity constraints

A mathematical framework providing provable privacy guarantees by injecting calibrated noise into query outputs. The epsilon (ε) budget quantifies the privacy loss—lower values mean stronger protection.

• Laplace Mechanism: Adds noise scaled to query sensitivity for numeric outputs
• Gaussian Mechanism: Used for approximate (ε, δ)-differential privacy
• Composition Theorems: Track cumulative privacy loss across multiple queries

The intentional alteration of original data values to obscure individual records while preserving aggregate statistical patterns. Unlike suppression, perturbation modifies rather than removes data.

• Noise Addition: Injecting random values drawn from a defined distribution
• Data Swapping: Exchanging sensitive values between similar records
• Rounding: Reducing precision to create ambiguity at the individual level
• PRAM (Post-Randomization Method): Probabilistically flipping categorical values based on a transition matrix

The systematic evaluation of the probability that an adversary can successfully link de-identified records back to specific individuals using auxiliary information.

• Prosecutor Risk: Likelihood of re-identifying a specific known target
• Journalist Risk: Probability of re-identifying any individual in the dataset
• Marketer Risk: Expected number of correct re-identifications across the entire dataset
• Uniqueness Analysis: Measuring the proportion of records that are unique on QIDs