Releasing Private Contingency Tables

Abstract

Statistical agencies routinely publish aggregate data in the form of contingency tables. In this paper, we consider the problem of releasing private contingency tables so that the privacy of individual respondents in the table is preserved. We first uncover funda- mental problems with existing cell suppression algorithms that are used for this purpose. We then present a rigorous definition of privacy and a generic algorithmic framework for cell suppression given this definition. Using this framework we build a complete cell suppression solution for the special case of boolean private attributes. We study both theoretically and experimentally the utility of our approach. Along the way, we demonstrate a connection to the query auditing problem in statistical databases and make a foundational contribution to this problem as well. In particular, we analyze an unexamined assumption from the literature regarding the prior knowledge of attackers.