ASSESSING STATISTICAL DISCLOSURE RISK FOR

DIFFERENTIALLY PRIVATE, HIERARCHICAL

COUNT DATA, WITH APPLICATION TO THE

2020 U.S. DECENNIAL CENSUS

Zeki Kazan and Jerome P. Reiter

Duke University

> Abstract: We propose Bayesian methods to assess statistical disclosure risks
> for count data released under zero-concentrated differential privacy,
> focusing on settings with a hierarchical structure. We discuss applications
> of these risk assessment methods to differentially private data releases
> from the 2020 U. S. decennial census and perform empirical studies using
> public, individual-level data from the 1940 U. S. decennial census. In these
> studies, we examine how the data holder’s choice of privacy parameters
> affects disclosure risks and quantify increases in risk when an adversary
> incorporates substantial amounts of hierarchical information.
>
> Key words and phrases: confidentiality, privacy, re-identification

##  1 Introduction

To protect individual respondents’ privacy in the 2020 decennial census public
release data products, the U.S. Census Bureau applies a method satisfying a
variant of differential privacy (Abowd et al. (2022)). The Census Bureau
decided to use a differentially private method, which they call the TopDown
algorithm (TDA), because they determined that the risks of re-identifications
when using methods employed in previous censuses, namely data swapping, are
too great (Abowd (2018)). However, some stakeholders have questioned whether
or not differential privacy is necessary, for example, Ruggles et al. (2019)
and Kenny et al. (2021). This has led to calls from outside groups, such as
JASON (2022), for the Census Bureau to evaluate the disclosure risks of the
TDA. Such risk evaluations are particularly prudent since the Census Bureau
quotes an $\varepsilon=17.91$ to generate the perturbed counts. This exceeds
the recommendations of Dwork (2008), who suggests
$\varepsilon\leq\ln(3)\approx 1.10$ for typical applications, and is also
likely outside the range of reasonable $\varepsilon$ suggested by Lee and
Clifton (2011).

In this article, we present and illustrate methods for evaluating statistical
disclosure risks for differentially private count data nested in hierarchies.
The core idea is to compute Bayesian posterior probabilities of disclosure
given the released counts and assumptions about adversaries’ knowledge. We do
so for counts generated with the differentially private mechanisms employed in
the 2020 decennial census products with the exception that, unlike in the TDA,
we do not require released counts to be non-negative or to sum consistently
across geographical hierarchies; we provide rationales for this choice in
Section 2.3. Using data from the 1940 U. S. census, we use these methods to
shed light on the potential for disclosure risks.

The remainder of this article is organized as follows. In Section 2, we
present relevant background on differential privacy, statistical disclosure
risks, and the 2020 decennial census application. In Section 3, we describe
the Bayesian methods for assessing disclosure risks, distinguishing between
settings with and without hierarchical information. In Section 4, we apply
these methods to data from the 1940 decennial census using a mechanism that
satisfies zero-concentrated differential privacy (Bun and Steinke (2016)). We
illustrate how the disclosure risks vary as a function of the privacy
parameters and released counts. Finally, in Section 5, we conclude with future
research directions.

##  2 Background

In this section, we review background material relevant to our methods,
beginning with the privacy definitions that we reference throughout.

###  2.1 Differential Privacy

A mechanism ${\mathcal{M}}(\cdot)$ for releasing statistics satisfies
differential privacy (henceforth, DP) if for any two data sets $D$ and
$D^{\prime}$ that differ in only one row, ${\mathcal{M}}(D)$ and
${\mathcal{M}}(D^{\prime})$ are “similar.” How similar ${\mathcal{M}}(D)$ and
${\mathcal{M}}(D^{\prime})$ must be is determined by two privacy parameters,
$\varepsilon\in(0,\infty)$ and $\delta\in[0,1)$. This idea is formalized as
follows, drawing from Dwork et al. (2006).

######  Definition 1 (Differential Privacy).

A mechanism ${\mathcal{M}}$ satisfies ($\varepsilon$, $\delta$)-DP if for
input data sets $D,D^{\prime}$ that differ in only one row and $S\subseteq
Range({\mathcal{M}})$, ${\mathbf{P}}[{\mathcal{M}}(D)\in S]\leq
e^{\varepsilon}{\mathbf{P}}[{\mathcal{M}}(D^{\prime})\in S]+\delta$.

When $\delta=0$, the guarantee is referred to as pure DP, and when $\delta>0$,
the guarantee is referred to as approximate DP. For approximate DP, typical
values of $\delta$ in practice are extremely small; for example, the Census
Bureau uses $\delta=10^{-10}$ in their application.

With small $\epsilon$ (and $\delta$), DP provides a formal guarantee that any
one person’s participation in $D$ does not affect results sufficiently that an
adversary could detect that person participated. In effect, this protects
against an adversary who possesses information about all but one individual in
$D$.

Mechanisms that satisfy DP can have undesirably long tails. Because of this
drawback, the Census Bureau uses a variant of DP called zero-concentrated
differential privacy (henceforth, zCDP). The following definition draws from
Bun and Steinke (2016).

######  Definition 2 (Zero-Concentrated Differential Privacy).

A mechanism ${\mathcal{M}}$ satisfies $\rho$-zCDP if for inputs $D,D^{\prime}$
that differ in only one row and all $\alpha\in(1,\infty)$,
$D_{\alpha}({\mathcal{M}}(D)~{}\|~{}{\mathcal{M}}(D^{\prime}))\leq\rho\alpha$,
where $D_{\alpha}({\mathcal{M}}(D)~{}\|~{}{\mathcal{M}}(D^{\prime}))$ is the
$\alpha$-Rényi divergence between the distributions of ${\mathcal{M}}(D)$ and
${\mathcal{M}}(D^{\prime})$.

zCDP allows for mechanisms where randomness is added via a Gaussian
distribution, which is not possible under pure DP and has undesirable
properties under approximate DP (Bun and Steinke (2016)).

Since DP is a stronger criterion than zCDP, any mechanism that satisfies pure
DP also satisfies zCDP (see Proposition 1.4 in Bun and Steinke (2016)).
Converting from zCDP to DP is less straightforward; there is no guarantee that
a mechanism satisfying zCDP will satisfy pure DP. Instead, for any $\delta>0$,
one can convert from zCDP to approximate DP via the following theorem
(Proposition 1.3 in Bun and Steinke (2016)).

######  Theorem 1.

If ${\mathcal{M}}$ satisfies $\rho$-zCDP, then for any $\delta>0$,
${\mathcal{M}}$ satisfies $(\varepsilon,\delta)$-DP for
$\varepsilon=\rho+2\sqrt{\rho\log(1/\delta)}$.

The Census Bureau uses Theorem 1 to report the guarantees of their mechanisms
in terms of approximate DP.

Finally, we define a mechanism for releasing integer-valued statistics under
zCDP. Since the mechanism involves adding noise from a discrete Gaussian
distribution (see Canonne et al. (2020)), we refer to it as the discrete
Gaussian mechanism.

######  Definition 3 (Discrete Gaussian Mechanism).

Let $x\in{\mathbb{Z}}_{\geq 0}$ be a count statistic and suppose we wish to
release a noisy count $X^{*}\in{\mathbb{Z}}$ satisfying $\rho$-zero
concentrated differential privacy. The discrete Gaussian mechanism
accomplishes this by producing a count centered at $x$ with noise from a
discrete Gaussian distribution with parameter $1/(2\rho)$. That is,

${\mathbf{P}}[X^{*}=x^{*}]=\frac{e^{-\rho(x^{*}-x)^{2}}}{\sum_{\tilde{x}=-\infty}^{\infty}e^{-\rho(x^{*}-\tilde{x})^{2}}},\qquad
x^{*}\in{\mathbb{Z}}.$ (2.1)

Notationally, $X^{*}\sim\textsf{DG}(x,1/(2\rho))$. Canonne et al. (2020)
present an efficient algorithm for sampling from a discrete Gaussian
distribution.

###  2.2 Statistical Disclosure Risk

For a given data set, the statistical disclosure risk (henceforth used
interchangeably with disclosure risk and risk) is a measure of the risk to
respondent confidentiality the data holder would experience as a consequence
of releasing the data set to the public (Domingo-Ferrer and Torra (2004);
Duncan and Keller-McNulty (2000)). Duncan and Lambert (1986) propose measuring
disclosure risk by directly modeling the behavior of a Bayesian adversary with
a certain target in a released data set. Fienberg and Sanil (1997) present a
similar approach, focusing on how the results change when bias or noise is
present in the data. Reiter (2005) extends these methods to account for the
technique used to perturb the data using legacy disclosure control methods
such as topcoding variables and data swapping.

A few authors have studied statistical disclosure risks specifically under
differential privacy. Lee and Clifton (2011) use a hypothetical adversary’s
posterior beliefs to provide a method for selecting $\varepsilon$ for an
arbitrary data set. Abowd and Vilhuber (2008) and McClure and Reiter (2012)
focus on the setting of generating synthetic data with binary variables. In
particular, Abowd and Vilhuber (2008) demonstrate that by measuring the
disclosure risk via the posterior odds ratio between two data sets that differ
in only one row, $\varepsilon$-DP provides a bound on the disclosure risk for
that row. McClure and Reiter (2012) hypothesize a Bayesian adversary, make
assumptions about what information the adversary has available a priori, and
compare the adversary’s posterior probability of determining the true values
for a particular target to the corresponding prior probability.

We expand on the methodology from these works, adapting the framework of
McClure and Reiter (2012) and applying it to more general settings, including
categorical variables with more than two levels and data sets with a
hierarchical structure, such as the 2020 U. S. decennial census data.

###  2.3 DP in the 2020 Census Data Products

To describe the DP methods the Census Bureau is using for the 2020 decennial
census, we draw from Abowd et al. (2022). We focus on the release of the PL
94-171 file, which comprises 2020 census data used for redistricting. The file
includes the six summary tables listed in Table 1. Summary tables are produced
across six levels of geographic hierarchy: blocks within optimized block
groups, within tracts, within counties, within states, within the nation. We
focus on the persons tables P1 through P5 in Table 1.

Table 1: PL 94-171 tables for 2020 decennial census data. P1 | Race
---|---
P2 | Hispanic or Latino, and not Hispanic or Latino by Race
P3 | Race for the Population 18 Years and Over
P4 | Hispanic or Latino, and not Hispanic or Latino by Race for
| the Population 18 Years and Over
P5 | Group Quarters Population by Major Group Quarters Type
H1 | Occupancy Status (Housing)

To create these tables, the Census Bureau begins with a detailed histogram of
the Group quarters, Voting age, Hispanic, and Race variables—comprising a
total of 2,016 cells—at each location at each level of the hierarchy. We refer
to this histogram as the GVHR query. The Census Bureau first generates
differentially private counts (satisfying zCDP) for this histogram using the
discrete Gaussian mechanism. Then, they apply a post-processing algorithm to
force counts at each level of the hierarchy to sum to the counts in the level
above and to ensure that no counts are negative. This post-processing starts
at the national level and works down the hierarchy. Finally, the Census Bureau
aggregates the histograms to produce the summary tables listed in Table 1 and
releases them to the public.

Table 2: Allocations of $\rho$ in the 2020 decennial census. The second column displays the total proportion of $\rho$ allocated to each geographic level, and the third column displays the proportion of the $\rho$ at that level allocated to the GVHR query. Values taken from Section 8.2 of Abowd et al. (2022). Geographic Level | Total Prop. $\rho$ | GVHR Prop. $\rho$ | GVHR $\approx\rho$
---|---|---|---
United States | 104/4,099 | 189/241 | 0.0509
State | 1,440/4,099 | 230/4,097 | 0.0505
County | 447/4,099 | 754/4,097 | 0.0514
Tract | 687/4,099 | 241/2,051 | 0.0504
Optimized Block Group | 1,256/4,099 | 1,288/4,099 | 0.2465
Block | 165/4,099 | 3,945/4,097 | 0.0992

The Census Bureau assigned a global $\rho$ of 2.56 that was divided among the
levels of the geographic hierarchy, as displayed in the second column of Table
2. Each census block, for example, is allocated a $\rho$ of $2.56\times
165/4{,}099\approx 0.103$. Within each level of the hierarchy, the $\rho$
budget is further divided among 11 queries. The allocations for the GVHR query
are displayed in the third column of Table 2. The remainder of the allocations
can be found in Section 8.2 of Abowd et al. (2022). The GVHR query in each
census block, for example, is allocated a $\rho$ of $0.103\times
3{,}945/4{,}097\approx 0.099$. The approximate $\rho$ for each level is
presented in the final column of Table 2. The Census Bureau also reports the
DP guarantee as computed via Theorem 1: the global $\rho=2.56$ corresponds to
$\varepsilon=17.91$ for $\delta=10^{-10}$.

The Census Bureau does not release the noisy GVHR query; rather, they release
post-processed and aggregated counts. Several experts in DP have argued that
the Census Bureau should additionally release the noisy counts without any
post-processing (e.g., Dwork et al. (2021), Seeman et al. (2020)). Doing so
could allow researchers using the data to avoid biases resulting from post-
processing and estimate uncertainty properly. However, JASON, an advisory
group for the U. S. government on issues related to science and technology,
raises the concern that such a release could introduce disclosure risks. In
their report (JASON (2022)), they recommend that the Census Bureau should
“release all noisy measurements that are used to produce a published statistic
when doing so would not incur undue disclosure risk” (p. 64), and evaluate the
risks that “the released data allows an adversary to make inferences about an
individual’s characteristics with more accuracy and confidence than could be
done without the data released by the Census Bureau” (p. 114). The JASON
recommendations, coupled with the calls for releasing the noisy counts without
post-processing, motivate our methodological developments, which we now
describe.

##  3 Methods for Assessing Disclosure Risks

We begin with methods that do not utilize information from up the hierarchy,
and then discuss accounting for extra information from higher levels.

###  3.1 Setting Without Hierarchical Information

Under DP and zCDP, the random noise protects against an adversary who
possesses information about all but one individual in the data. For
applications with data nested in geographic hierarchies, such as the 2020
census, this adversary seems unlikely. The adversary would have to possess
information on all but one individual in the entire United States. To assess
disclosure risks, we instead consider an attack scenario where the adversary
possesses information on all but one individual in a census block (more
generally, in the lowest level of the hierarchy). For example, the adversary
could be a landlord who owns all property in a block or an administrator for a
group quarters institution that makes up an entire block. This set of
assumptions represents a type of “worst case” scenario; the adversary
possesses the most possible information about the individuals in the block
without possessing information about the target. We discuss and evaluate other
attack scenarios, e.g., where the adversary knows information at the block and
block-group levels, in Section S1 of the supplement.

To formalize, suppose the data comprise solely categorical variables and are
organized in a hierarchy with $h$ levels. We focus on a particular group,
$g_{1}$, at the lowest level of the hierarchy comprising $n_{1}$ individuals.
In the census application, $g_{1}$ is a census block with $n_{1}$ persons. The
adversary possesses complete data for $n_{1}-1$ of these individuals. We seek
to assess the disclosure risk for the remaining individual, henceforth
referred to as individual $t$ (the targeted individual). Let $c$ be the
characteristics of individual $t$, i.e., we label the combination of the
variables in individual $t$’s row as $c$. Let $X_{1}$ be the random variable
from the adversary’s perspective representing the count of individuals in
$g_{1}$ with characteristics $c$, and let $x_{1,-t}$ be the count of
individuals in $g_{1}$ with characteristics $c$ excluding individual $t$; the
adversary knows $x_{1,-t}$ a priori. The support of $X_{1}$ is
$\\{x_{1,-t},x_{1,-t}+1\\}$. Let $p\in(0,1)$ be the adversary’s prior
probability of assigning individual $t$ to the correct category. That is,
${\mathbf{P}}[X_{1}=x_{1,-t}+1]=p$ and ${\mathbf{P}}[X_{1}=x_{1,-t}]=1-p.$
Finally, let $x_{1}$ be the true count of individuals in $g_{1}$ with
characteristics $c$; here, we assume $x_{1}=x_{1,-t}+1$. The $x_{1}$ is
unknowable to the adversary but known by the data holder (e.g., the Census
Bureau).

As in the 2020 census application, we utilize zCDP and the discrete Gaussian
mechanism. Let $\eta_{1}$ be the added noise so that
$\eta_{1}\sim\textsf{DG}(0,1/(2\rho_{1}))$. Let $X_{1}^{*}=x_{1}+\eta_{1}$ be
the random variable representing the differentially private value of $x_{1}$
and $x_{1}^{*}$ be its realized outcome. The adversary’s posterior probability
of correctly concluding that $X_{1}=x_{1}=x_{1,-t}+1$ is,

$\displaystyle{\mathbf{P}}[X_{1}=x_{1}\mid X_{1}^{*}=x_{1}^{*}]$
$\displaystyle=\frac{pe^{-\rho_{1}(x_{1}^{*}-x_{1})^{2}}}{pe^{-\rho_{1}(x_{1}^{*}-x_{1})^{2}}+(1-p)e^{-\rho_{1}(x_{1}^{*}-x_{1,-t})^{2}}}.$
(3.1)

We define the ratio of the posterior and prior probabilities as

$\displaystyle R^{\prime}(x_{1}^{*})=\frac{{\mathbf{P}}[X_{1}=x_{1}\mid
X_{1}^{*}=x_{1}^{*}]}{{\mathbf{P}}[X_{1}=x_{1}]}.$ (3.2)

For the data holder, a particularly relevant measure of disclosure risk
averages (3.1) over possible realizations of $X_{1}^{*}$. We have

$\displaystyle{\mathbf{P}}[X_{1}=x_{1}\mid x_{1}=x_{1,-t}+1]$
$\displaystyle=\sum_{x_{1}^{*}=-\infty}^{\infty}{\mathbf{P}}[X_{1}=x_{1}\mid
X_{1}^{*}=x_{1}^{*}]$
$\displaystyle\qquad\qquad{\mathbf{P}}[X_{1}^{*}=x_{1}^{*}\mid
x_{1}=x_{1,-t}+1].$ (3.3)

We condition on $x_{1}$ in (3.1) to emphasize the dependence of this quantity
on the true value. Taking ratios of (3.1) over the prior risk, we define

$\displaystyle R$ $\displaystyle=\frac{{\mathbf{P}}[X_{1}=x_{1}\mid
x_{1}=x_{1,-t}+1]}{{\mathbf{P}}[X_{1}=x_{1}]}$
$\displaystyle=\sum_{x_{1}^{*}=-\infty}^{\infty}R^{\prime}(x_{1}^{*})\,{\mathbf{P}}[X_{1}^{*}=x_{1}^{*}\mid
x_{1}=x_{1,-t}+1].$ (3.4)

We also examine how the adversary can use the posterior probabilities to make
decisions. Let $\hat{X}_{1}$ be the adversary’s point estimate of $X_{1}$
(either $x_{1,-t}$ or $x_{1,-t}+1$). The $\hat{X}_{1}$ is a function of the
observed noisy counts, ${\mathcal{D}}=\\{x_{1}^{*}\\}$. We assume the
adversary decides the value of $\hat{X}_{1}$ by minimizing a loss function
${\mathcal{L}}(\hat{X}_{1},X_{1})$. We use the zero-one loss,
${\mathcal{L}}(\hat{X}_{1},X_{1})={\mathbf{1}}[X_{1}\neq\hat{X}_{1}]$, where
${\mathbf{1}}[\cdot]$ is an indicator function. The Bayes estimator is then

$\displaystyle\operatorname*{argmin}_{\hat{X}_{1}}{\mathsf{E}}[{\mathcal{L}}(\hat{X}_{1},X_{1})\mid{\mathcal{D}}]=\operatorname*{argmax}_{\hat{X}_{1}}{\mathbf{P}}[X_{1}=\hat{X}_{1}\mid{\mathcal{D}}].$
(3.5)

That is, the adversary’s point estimate for $X_{1}$ is whichever of $x_{1,-t}$
and $x_{1,-t}+1$ has higher posterior probability. Since $\hat{X}_{1}$ is a
deterministic function of $x_{1}^{*}$, the probability the adversary correctly
selects $\hat{X}_{1}=x_{1}$ is

$\displaystyle{\mathbf{P}}[\hat{X}_{1}=x_{1}]$
$\displaystyle=\sum_{x_{1}^{*}=-\infty}^{\infty}{\mathbf{P}}[X_{1}^{*}=x_{1}^{*}\mid
X_{1}=x_{1}]{\mathbf{1}}\left[{\mathbf{P}}[X_{1}=x_{1}\mid
X_{1}^{*}=x_{1}^{*}]>\frac{1}{2}\right]$
$\displaystyle={\mathbf{P}}[X_{1}^{*}\geq\tilde{x}_{1}^{*}\mid X_{1}=x_{1}],$
(3.6)

where $\tilde{x}_{1}^{*}$ is the smallest value of $x_{1}^{*}$ such that
${\mathbf{P}}[X_{1}=x_{1}\mid X_{1}^{*}=x_{1}^{*}]>\frac{1}{2}$.

###  3.2 Incorporating Hierarchical Information

It makes sense that, for example, if $x_{1,-t}=5$ and we observe that the
count of people with the characteristics $c$ at one level up (the block group
level) is $5$, then it should be more likely that $x_{1}=5$ than $x_{1}=6$.
Thus, using hierarchical information should improve the adversary’s inference.
But, if the noisy count one level up is $100$, then the hierarchical
information is probably not very useful in deciding between $x_{1}=5$ and
$x_{1}=6$. In this section, we formalize this intuition for the case where we
use two levels of the hierarchy; generalizing to more levels is
straightforward conceptually.

Let $g_{2}$ be the group at the second level of the hierarchy containing $t$,
and let $n_{2}$ be the number of individuals in $g_{2}$. In the census
application, $g_{2}$ is the block group—comprising $n_{2}$ individuals—that
contains census block $g_{1}$. Let $X_{2}$ be the random variable from the
adversary’s perspective representing the count of individuals in $g_{2}$ with
characteristics $c$, and let $x_{2}$ be the true count. Let
$\eta_{2}\sim\textsf{DG}(0,1/(2\rho_{2}))$ be noise added via the
differentially private mechanism. Let $X_{2}^{*}=x_{2}+\eta_{2}$ be the random
variable representing the differentially private version of $x_{2}$, and let
$x_{2}^{*}$ be the realization that is released. Let
$Y_{1}^{(1)},\ldots,Y_{1}^{(d)}$ be random variables representing the counts
of individuals with characteristics $c$ in the other $d$ groups at the lowest
level. That is, $X_{2}=X_{1}+\sum_{i=1}^{d}Y_{1}^{(i)}$. Let
$\eta_{1}^{(1)},\ldots,\eta_{d}^{(1)}\overset{iid}{\sim}\textsf{DG}(0,1/(2\rho_{1}))$
be the perturbations via the privacy mechanism. Set
$Y_{1}=\sum_{i=1}^{d}Y_{1}^{(i)}$ and
$Y_{1}^{*}=\sum_{i=1}^{d}(Y_{1}^{(i)}+\eta_{1}^{(i)})=Y_{1}+\sum_{i=1}^{d}\eta_{1}^{(i)}$.
The observed data is ${\mathcal{D}}=\\{x_{1}^{*},x_{2}^{*},y_{1}^{*}\\}$.

We first briefly describe an approximation the adversary (or data holder) can
make to simplify the computations. Since
$Y_{1}^{*}=Y_{1}+\sum_{i=1}^{d}\eta_{1}^{(i)}$, it follows that $Y_{1}^{*}$ is
an approximation of $Y_{1}$ with noise from a sum of discrete Gaussian
distributions. The noise term is difficult to handle when performing
inference, so we assume that the adversary makes the approximation

$\displaystyle\eta_{1}^{(i)}\overset{iid}{\sim}\textsf{DG}(0,1/(2\rho_{1}))\implies\sum_{i=1}^{d}\eta_{1}^{(i)}\approx\textsf{DG}(0,d/(2\rho_{1})).$
(3.7)

This approximation improves as $\rho\to 0$ and $d\to\infty$ and is very
accurate for the $\rho$ and $d$ used in Section 4. See Section S2 in the
supplement for details.

The adversary can use Bayesian inference to compute posterior probabilities
and disclosure risks akin to those in Section 3.1, using the information from
the second level of the hierarchy. Specifically, the adversary runs a Gibbs
sampler to sample from the posterior distribution of $(X_{1},X_{2})$ given
${\mathcal{D}}$ and uses the marginal posterior for $X_{1}$ to estimate the
posterior probability that $X_{1}=x_{1,-t}+1$. The risk computation and point
estimation techniques described in Section 3.1 then can be applied. For the
adversary, we assume the reasonable default choice for the prior for
$X_{2}\mid X_{1}=k_{1}$ of a uniform distribution on the set
$\\{k_{1},k_{1}+1,\ldots\\}$. Section S4 of the supplement discusses the
sensitivity of the posterior probabilities to the choice of the prior
distribution for $X_{2}$.

The full conditional for $X_{1}$ is, for $k_{1}\in\\{x_{1,-t},x_{1,-t}+1\\}$
and $k_{1}\leq k_{2}$,

$\displaystyle{\mathbf{P}}[X_{1}=$ $\displaystyle~{}k_{1}\mid
X_{2}=k_{2},X_{1}^{*}=x_{1}^{*},X_{2}^{*}=x_{2}^{*},Y_{1}^{*}=y_{1}^{*}]$
$\displaystyle\propto\exp\left\\{-\frac{d+1}{d}\rho_{1}\left[k_{1}-\frac{dx_{1}^{*}+(k_{2}-y_{1}^{*})}{d+1}\right]^{2}\right\\}\,{\mathbf{P}}[X_{1}=k_{1}].$
(3.8)

The full conditional for $X_{2}$ is, for $k_{2}\in\\{k_{1},k_{1}+1,\ldots\\}$,

$\displaystyle{\mathbf{P}}[X_{2}=$ $\displaystyle~{}k_{2}\mid
X_{1}=k_{1},X_{1}^{*}=x_{1}^{*},X_{2}^{*}=x_{2}^{*},Y_{1}^{*}=y_{1}^{*}]$
$\displaystyle\propto\exp\left\\{-\left(\rho_{2}+\frac{\rho_{1}}{d}\right)\left[k_{2}-\frac{\rho_{2}x_{2}^{*}+\frac{\rho_{1}}{d}(y_{1}^{*}+k_{1})}{\rho_{2}+\frac{\rho_{1}}{d}}\right]^{2}\right\\}.$
(3.9)

Thus, the full conditional for $X_{1}$ has a Bernoulli distribution, and the
full conditional for $X_{2}$ can be easily sampled over a grid. Section S3 of
the supplement includes details of the derivations.

##  4 Empirical Applications with 1940 Census Data

In this section, we illustrate the methodology from Section 3 on data from the
1940 U. S. decennial census, investigating whether the Census Bureau’s choice
of privacy parameters in 2020 would have led to unacceptably high disclosure
risks for the GVHR query. In Section 4.1, we describe the 1940 decennial
census data and how they differ from the 2020 decennial census data. In
Section 4.2, we consider the case where an adversary only uses the released
counts from lowest level of the hierarchy. In Section 4.3, we extend to the
case where the adversary leverages the released counts from a second level of
the hierarchy, examining how the hierarchical information affects risks and
how this effect depends on $x_{2}$ and $\rho_{2}$.

###  4.1 The 1940 Census

Every 72 years, the Census Bureau is permitted to release record-level data
collected in the decennial census, without any redaction for privacy
protection. Thus, the 1940 census data are an excellent testbed for our
methods.

The structure of the 1940 census data differs from that of the 2020 census
data. The 1940 census data have a smaller hierarchy; the 1940 census comprises
enumeration districts within counties, within states, within the country. Per
the national archives, enumeration districts could be “covered by a single
enumerator or census taker in one census period that lasted several weeks”
(National Archives and Records Administration, 2022) and so can vary
substantially in size. For illustrative purposes, we focus on a small set of
enumeration districts in North Carolina that are roughly the size of the
average modern-day census block.

Another important difference is the number of categories for the variables of
interest. In the 2020 census, the GVHR query produces a histogram with 2,016
possible levels—the product of 2 levels for each of the Hispanic and Voting
Age variables, 8 for the Group Quarters variable, and 63 for the Race
variable. In 1940, this query had only 864 possible levels—the product of 2
for Voting Age, 6 for Hispanic, 8 for Group Quarters, and 9 for Race. The 1940
census includes the exact age of each individual, which we transform to be
whether or not the person is of voting age to match the 2020 census data
releases for the PL 94-171 file.

###  4.2 Setting Without Hierarchical Information

We consider enumeration district 28-21 in Dare County, North Carolina, in
1940. Table 3 displays the counts for its GVHR query.

Table 3: Histogram for the GVHR query for enumeration district 28-21 from the 1940 decennial census. HHGQ | VOTINGAGE | HISPANIC | CENRACE | Count
---|---|---|---|---
Household | Of Voting Age | Not Hispanic | White | 34
Household | Not Of Voting Age | Not Hispanic | White | 10
Household | Of Voting Age | Not Hispanic | Black | 1

This enumeration district was similar in size to a modern day census block and
consisted of 45 non-Hispanic individuals residing in households. One
individual has unique characteristics and so is particularly vulnerable to an
attack.

We assume the adversary possesses complete information about all the non-
unique residents in enumeration district 28-21 ($g_{1}$) and wishes to target
the resident ($t$) who is uniquely a householder of voting age, non-Hispanic,
and black ($c$). The adversary’s known count is $x_{1,-t}=0$. We consider five
adversaries who differ only in the prior probability they assign to the event
that $X_{1}=1$; the first assigns probability $p=1/2$, the second $p=1/5$, the
third $p=1/10$, the fourth $p=1/50$, and the fifth $p=1/864$ (equal prior
probability on the $864$ possible levels of the GVHR query in 1940).

Figure 1: The left panel plots the posterior probability the adversary makes
the correct decision, ${\mathbf{P}}[X_{1}=1\mid X_{1}^{*}=x_{1}^{*}]$, as a
function of $x_{1}^{*}$. The right panel plots the implied disclosure risk,
$R^{\prime}(x_{1}^{*})$, as a function of $x_{1}^{*}$. The colors correspond
to different adversary prior beliefs. We set $\rho_{1}=0.099$.

We first examine the relationship between the posterior probability and the
noisy released count, $x_{1}^{*}$, when $\rho_{1}\approx 0.099$ as in the 2020
census application. Figure 1 displays a plot of the posterior probability the
adversary assigns to the correct conclusion that $x_{1}=1$ as a function of
$x_{1}^{*}$ and the implied risk $R^{\prime}(x_{1}^{*})$ for each of the five
adversaries. For each adversary, both the posterior probability and the risk
are monotonically increasing functions of the released $x_{1}^{*}$. Notably,
the posterior probability is greater than the prior probability $p$ (and thus,
the risk greater than one) if $x_{1}^{*}\geq 1$, while the posterior is less
than $p$ (and the risk less than one) when $x_{1}^{*}<1$. This makes intuitive
sense: if the released statistic is $1$ or more, this is evidence in favor of
the true count being $1$, and the posterior probability that $X_{1}=1$ will
increase relative to the prior probability. If the released statistic is $0$
or less, this is evidence in favor of the true count being $0$ and the
posterior probability that $X_{1}=1$ will decrease relative to the prior
probability.

In general terms, the risk is acceptable if it is near one, or equivalently if
the posterior probability the adversary makes the correct decision is near
$p$. Thus, we should be concerned if the probability of releasing a statistic
that produces a risk much greater than one is high. Table 4 presents the risks
and posterior probabilities implied by several values of $x_{1}^{*}$ along
with the probability of observing that value. For $x_{1}^{*}\geq 4$, the risk
substantially exceeds one, especially for adversaries with low $p$. A
statistic of $x_{1}^{*}=4$ will occur only 3.6% of the time, and a statistic
of $x_{1}^{*}=5$ only 1.5% of the time. While it is unlikely the released
statistic will produce a risk of this magnitude in any particular census
block, we will observe such risks in a sizable number of the millions of
census blocks in the U. S. Whether or not a risk of this magnitude is
unacceptable is a decision for policymakers.

Table 4: For several values of $x_{1}^{*}$, the values of probability mass ${\mathbf{P}}[X_{1}^{*}=x_{1}^{*}\mid X_{1}=1]$, the posterior probability the adversary makes the correct decision ${\mathbf{P}}[X_{1}=1\mid X_{1}^{*}=x_{1}^{*}]$, and the disclosure risk $R^{\prime}(x_{1}^{*})$. We set $\rho_{1}=0.099$. Posterior probabilities for $p=1/864$ are quite small and so are omitted. |  | Posterior Probability | Disclosure Risk
---|---|---|---
$x_{1}^{*}$ | Mass | $p=\frac{1}{2}$ | $\frac{1}{5}$ | $\frac{1}{10}$ | $\frac{1}{50}$ | $\frac{1}{2}$ | $\frac{1}{5}$ | $\frac{1}{10}$ | $\frac{1}{50}$ | $\frac{1}{864}$
1 | 0.161 | 0.525 | 0.216 | 0.109 | 0.022 | 1.05 | 1.08 | 1.09 | 1.10 | 1.10
2 | 0.119 | 0.574 | 0.252 | 0.130 | 0.027 | 1.15 | 1.26 | 1.30 | 1.34 | 1.35
3 | 0.073 | 0.622 | 0.291 | 0.154 | 0.032 | 1.24 | 1.46 | 1.54 | 1.62 | 1.64
4 | 0.036 | 0.667 | 0.334 | 0.182 | 0.039 | 1.33 | 1.67 | 1.82 | 1.96 | 2.00
5 | 0.015 | 0.710 | 0.379 | 0.213 | 0.047 | 1.42 | 1.90 | 2.13 | 2.37 | 2.44
Figure 2: The left panel plots the marginal posterior probability the
adversary makes the correct decision, ${\mathbf{P}}[X_{1}=1\mid x_{1}=1]$, as
a function of $\rho_{1}$. The right panel plots the implied disclosure risk,
$R$ (defined in Equation 3.4), as a function of $\rho_{1}$. The colors
correspond to different adversary prior beliefs and the dashed line
corresponds to $\rho_{1}=0.099$. Note the log-scales.

We next examine the expected value of the disclosure risks over realizations
of the released, differentially private counts, and how this quantity varies
with $\rho_{1}$. The first panel of Figure 2 plots the posterior probability
that the adversary correctly concludes $x_{1}=1$, marginalizing over
$X_{1}^{*}$, as a function of $\rho_{1}$. The second panel of Figure 2 plots
the implied risk, $R$. As we would expect, both quantities increase
monotonically with $\rho_{1}$, with the posterior probability increasing from
$p$ at $\rho_{1}$ near zero to one for $\rho_{1}$ very large, and the risk
increasing from 1 to $1/p$ along the same range. Across the various $p$, for
$\rho_{1}<0.25$, the posterior probability is approximately $p$ and the risk
is approximately one, indicating that the adversary gleans little from the
released statistic. For $0.25\leq\rho_{1}\leq 5$, the posterior probability
increases rapidly from $p$ to 1 and the risk from 1 to $1/p$, indicating that
the choice of $\rho_{1}$ is crucial in this range. Even small increases in
$\rho_{1}$ can cause large increases in a hypothetical adversary’s posterior
probability. For $\rho_{1}>5$, the posterior probability is approximately one
and the risk approximately $1/p$, indicating that parameters in this range are
too high for practical settings.

Table 5: The marginal posterior probability the adversary makes the correct decision and implied risk, $R$, for each prior probability $p$ when $\rho_{1}=0.099$. $p$ | Posterior Probability | Disclosure Risk
---|---|---
$1/2$ | 0.524 | 1.05
$1/5$ | 0.225 | 1.13
$1/10$ | 0.117 | 1.17
$1/50$ | 0.024 | 1.21
$1/864$ | $0.0014$ | 1.22

Figure 2 also demonstrates possible implications of the above discussion for
the 2020 decennial census. The Census Bureau’s chosen $\rho_{1}\approx 0.099$
is at the high end of the range where the posterior probability approximately
equals the prior probability and the implied risk is approximately one. As
shown in Table 5, the risks are between $1.05$ and $1.21$, indicating that the
Census Bureau’s choice of $\rho_{1}$ is at a reasonable level for release of
the query. If the Census Bureau were to increase $\rho_{1}$ by any substantial
amount, the risk would increase to levels likely deemed unacceptable. On the
other hand, if they were to decrease $\rho_{1}$ slightly, the decrease in risk
would be minimal.

We next examine the adversary’s behavior from a decision theoretic standpoint.
Figure 3 displays a plot of the probability that the adversary correctly
selects $\hat{X}_{1}=1$ as a function of $\rho_{1}$ for the five adversary
prior probabilities. For $p=1/2$, any $x_{1}^{*}\geq 1$ leads to a posterior
probability greater than $0.5$. Thus, the curve when $p=1/2$ is simply a plot
of ${\mathbf{P}}[X_{1}^{*}\geq 1\mid X_{1}=1]$ as a function of $\rho_{1}$.
For $p<1/2$ this need not be the case. For example, when $p=1/5$ and
$\rho_{1}=0.5$, ${\mathbf{P}}[X_{1}=1\mid X_{1}^{*}=x_{1}^{*}]>0.5$ if and
only if $x_{1}^{*}\geq 2$, giving
${\mathbf{P}}[\hat{X}_{1}=1]={\mathbf{P}}[X_{1}^{*}\geq 2\mid X_{1}=1]\approx
0.30$. If, however, we increase to $\rho_{1}=0.6$, still
${\mathbf{P}}[X_{1}=1\mid X_{1}^{*}=x_{1}^{*}]>0.5$ if and only if
$x_{1}^{*}\geq 2$, but now
${\mathbf{P}}[\hat{X}_{1}=1]={\mathbf{P}}[X_{1}^{*}\geq 2\mid X_{1}=1]\approx
0.28$. That is, since the probability of extreme values decreases as
$\rho_{1}$ increases, the probability of making the correct decision can
decrease as well. This leads to the jaggedness in the plot for $p\leq 1/5$
(and for other $p<1/2$) when $\rho_{1}$ is not high enough that observing
$x_{1}^{*}=1$ will give the correct decision.

Figure 3: The probability the adversary makes the correct decision under 0-1
loss as a function of $\rho_{1}$. Colors correspond to different adversary
prior beliefs, and the dashed line presents $\rho_{1}=0.099$. The x-axis is in
log-scale.

As evident in Figure 3 the implications for the 2020 census application are
very different for $p=1/2$ and for $p\leq 1/5$. For $p=1/2$, the probability
the adversary makes the correct decision is $0.59$, which is near $0.5$. For
$p\leq 1/5$, however, the probability that the adversary makes the correct
decision is a fraction of a percent. Apparently, the assumptions about the
adversary’s prior knowledge are extremely important for this metric. An
adversary who believes there is a 50-50 chance the target has characteristics
$c$ will make the correct decision a substantial proportion of the time, but
if that prior probability decreases even slightly, the probability the
adversary makes the correct decision under 0-1 loss can fall significantly.

###  4.3 Incorporating Hierarchical Information

In this section, we explore how the incorporation of hierarchical information
affects the disclosure risks. To do so, we consider enumeration district 39-14
in Granville County, North Carolina, one of 28 enumeration districts in the
county. This district includes a white, Hispanic individual who resided in an
institution for the elderly, handicapped, and poor and was not of voting age.
This person was unique at both the enumeration district level (which contained
209 people) and the county level (which contained 29,364 people). Thus, the
true data is $(x_{1},x_{2},y_{1})=(1,1,0)$, where we define $y_{1}$ as the
actual count of $Y_{1}$. Table 7 displays one realization of the discrete
Gaussian mechanism using the Census Bureau’s chosen $\rho_{1}\approx 0.099$
and $\rho_{2}\approx 0.246$. The noisy counts are
${\mathcal{D}}=(x_{1}^{*},x_{2}^{*},y_{1}^{*})=(2,1,-1)$

Table 6: One sample of possible ${\mathcal{D}}=\\{x_{1}^{*},x_{2}^{*},y_{1}^{*}\\}$ with $\rho_{1}$ and $\rho_{2}$ from Census application. $x_{1}$ | $x_{1}^{*}$ | $x_{2}$ | $x_{2}^{*}$ | $y_{1}$ | $y^{*}_{1}$
---|---|---|---|---|---
1 | 2 | 1 | 1 | 0 | -1

Table 7: Adversary’s posterior distribution for $X_{1}$ given ${\mathcal{D}}$ from Table 7, $p=1/2$, and $10^{4}$ MCMC draws. $k_{1}$ | 0 | 1
---|---|---
${\mathbf{P}}[X_{1}=k_{1}\mid{\mathcal{D}}]$ | 43.0% | 57.0%

Table 8: Adversary’s empirical posterior distribution for $X_{2}$ given the data in Table 7, $p=1/2$, and $10^{4}$ MCMC draws. $k_{2}$ | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7
---|---|---|---|---|---|---|---|---
${\mathbf{P}}[X_{2}=k_{2}\mid{\mathcal{D}}]$ | 11% | 40% | 30% | 14% | 4.6% | 0.7% | 0.08% | 0.01%

Given a ${\mathcal{D}}$, the adversary would sample from the posterior
distribution of $(X_{1},X_{2})$. We draw 10,000 posterior samples from the
MCMC sampler described in Section 3.2, assuming that the adversary places
prior probability $p=1/2$ on $X_{1}=1$. Table 7 summarizes the adversary’s
marginal posterior distribution for $X_{1}$. Since $x_{1}^{*}=2$, the
posterior distribution places more weight on $X_{1}=1$ than $X_{1}=0$, but the
difference is only slight because of the low $\rho$ values. If the adversary
does not use hierarchical information, the posterior probability that
$X_{1}=1$ is 57.4%, indicating minimal change from using the hierarchical
information in this case (in fact, the hierarchical information slightly
decreases the adversary’s posterior probability of the correct choice). The
adversary also can examine the posterior distribution of $X_{2}$, although
this is of less practical interest; Table 8 presents posterior summaries. This
posterior distribution places 40% of the mass on $X_{2}=1$, and the
probabilities for the right tail decline to zero relatively quickly.

For the remainder of this section, we consider the disclosure risks at
different values of ${\mathcal{D}}$. We assume throughout that the adversary
sets $p=1/2$. We focus on the case where the targeted individual is unique at
the lowest level of the hierarchy; see Section S1.1 of the supplement for
discussion of extending to non-unique individuals.

Figure 4: Adversary’s decision under 0-1 loss for each combination of
$x_{1}^{*}$, $x_{2}^{*}$, and $y_{1}^{*}$. Privacy parameters are set as in
the census application, $p=1/2$, and $d=27$. $10^{3}$ MCMC draws are taken for
each combination in most cases. When the posterior probability $x_{1}=1$ is
close to 0.5, the number of MCMC draws is increased to $2.5\times 10^{5}$.

We begin by examining when the hierarchical information affects the
adversary’s decision for $\rho_{1}\approx 0.099$ and $\rho_{2}\approx 0.247$,
as in the 2020 decennial census. To do so, we enumerate all reasonable
combinations of $x_{2}^{*}$ and $y_{1}^{*}$, which we choose as $-3\leq
x_{2}^{*}\leq 5$ and $-30\leq y_{1}^{*}\leq 30$; this region contains over 99%
of the probability mass. Figure 4 displays the decisions for these
combinations. Without hierarchical information, the adversary always decides
that $x_{1}=1$ when $x_{1}^{*}\geq 1$ and $x_{1}=0$ when $x_{1}^{*}\leq 0$.
Using the hierarchical information does not change the adversary’s decision
when $x_{1}^{*}\geq 2$ or $x_{1}^{*}\leq-1$. But when $x_{1}^{*}\in\\{0,1\\}$,
the hierarchical information can change the adversary’s decision. When
$x_{1}^{*}=1$ and $y_{1}^{*}$ is positive and large, the adversary decides
that $x_{1}=0$, whereas they choose $x_{1}=1$ without the hierarchical
information. Similarly, when $x_{1}^{*}=0$ and $y_{1}^{*}$ is negative and
large in absolute value, the adversary decides that $x_{1}=1$, whereas they
choose $x_{1}=0$ without the hierarchical information. Exactly how large
$y_{1}^{*}$ must be depends on the observed $x_{2}^{*}$. The tiles on Figure 4
where the hierarchical information causes the adversary to correctly change
their decision correspond to 2.48% of the probability mass, while the tiles
where the reverse occurs correspond to 1.83% of the probability mass. Thus,
the adversary has a slight net gain from the hierarchical information,
increasing the probability of a correct decision by 0.65%.

Figure 5: Proportion of times adversary correctly concludes that $x_{1}=1$ as
a function of $x_{2}$. Proportions are over $10^{6}$ random draws of
${\mathcal{D}}$. For each draw, $10^{3}$ MCMC samples are used to estimate the
posterior. The dashed black line is the corresponding probability when
ignoring hierarchical information, and the dashed red line is the average
proportion over $x_{2}\geq 4$. We set $\rho_{1}=0.099$, $\rho_{2}=0.247$,
$p=1/2$, and $d=27$.

We next examine how sensitive the disclosure risks are to the true count at
the second level, $x_{2}$. How would the results change if the target was
unique at the lowest level, but not at the second level? To examine this, we
alter the true counts, adding individuals to group $g_{2}$ with
characteristics $c$. Figure 5 displays the proportion of times the adversary
makes the correct decision as a function of $x_{2}$. Of note, the y-axis has a
small range; even with $10^{6}$ samples per point the Monte Carlo noise
obscures the relationship. Regardless, $x_{2}=1$ is a clear outlier; the
probability the adversary makes the correct decision is not only higher than
the corresponding probability when ignoring hierarchical information, but
higher than the analogous probabilities for $x_{2}>1$. For $x_{2}>3$, the
probabilities of making the correct decision are centered around 59.05% with a
small amount of Monte Carlo error.

Applying these findings to the 2020 census application, the main implication
is that the conclusions when $x_{2}=1$ generalize to $x_{2}>1$, although the
increase in the probability the adversary makes the correct decision is less
pronounced. This means that the discussion about the trade off between privacy
and accuracy in terms of the Census Bureau’s choice of $\rho_{2}$ applies no
matter the value of $x_{2}$. A remarkable feature of Figure 5 is how small a
difference is made by changes in $x_{2}$.

Figure 6: Plot of the proportion of the time the adversary correctly concludes
that $x_{1}=1$ as a function of $\rho_{2}$, colored for a few selected
$x_{2}$. The proportions are over $5\times 10^{5}$ MC draws for
${\mathcal{D}}$. For each draw, $10^{3}$ MCMC samples are used to estimate the
posterior. The dashed black line is the corresponding probability when
ignoring hierarchical information and the dashed purple line is
$\rho_{2}=0.247$. We set $\rho_{1}=0.099$, $p=1/2$, and $d=27$.

Finally, we examine the effect of changes in the second level privacy
parameter, $\rho_{2}$. Figure 6 displays the probability the adversary makes
the correct decision as a function of $\rho_{2}$ for $\rho_{1}\approx 0.099$
and a few values of $x_{2}$. The effect of $x_{2}=1$ observed
previously—increasing the adversary’s probability of making the correct
decision from when $x_{2}>1$—lessens as $\rho_{2}$ increases. For
$\rho_{2}>1$, the probabilities for $x_{2}\in\\{1,10,100\\}$ are quite
similar. The most striking feature of Figure 6 is that even for extremely
large values of $\rho_{2}$, the probability does not noticeably increase for
any of the selected $x_{2}$. When ignoring hierarchical information, the
corresponding probability is 58.89%. Even when $\rho_{2}=100$ the probability
only increases to 59.2%. This finding is a feature of the specific attack
scenario. Because the adversary knows only $x_{1,-t}$ and not the counts in
other blocks, knowing $x_{2}$ nearly exactly does not tell them which blocks
making up $g_{2}$ contain the individuals with characteristics $c$. Thus,
their probability of making the correct decision with respect to block $g_{1}$
improves as the uncertainty in $X_{2}$ decreases, but does not go to $1$.
Mathematically, in (3.9) as $\rho_{2}\to\infty$, ${\mathbf{P}}[X_{2}=x_{2}\mid
X_{1}=k_{1},{\mathcal{D}}]\to 1$, causing the full conditional for $X_{1}$ in
(3.8) to converge to a constant function of $x_{2}$ (but not to $1$ unless
$\rho_{1}\to\infty$). In the supplement, we show that hierarchical information
can increase risks more noticeably in other attack scenarios, e.g., when the
intruder knows $g_{2}$.

Overall, the results suggest that the adversary gains little from using the
hierarchical information in this attack scenario. This may provide evidence
that the Census Bureau’s choice of $\rho_{2}$ is reasonable from a disclosure
risk perspective. It also suggests that the Census Bureau could increase
$\rho_{2}$—and likely the $\rho$ values at higher levels of the
hierarchy—without significantly compromising the disclosure risk, at least
under this attack scenario. This would mean that more accurate statistics
could be released at the upper levels of the hierarchy. Essentially, if we
assume the adversary only has complete information about everyone except the
target at the lowest level of the hierarchy, then only the choice of
$\rho_{1}$ has a meaningful effect on the probability the adversary makes the
correct decision.

##  5 Conclusion

We provide methodology to compute statistical disclosure risks for categorical
data with many levels released under zCDP, while incorporating hierarchical
information. Following the suggestion in the JASON report, we demonstrate how
to conduct empirical analyses that could be used to evaluate the effect on
disclosure risks of releasing the GVHR query at the census block level prior
to post-processing. In our studies with 1940 census data, we find that, when
assuming the adversary possesses information about all but one individual at
the lowest level of the hierarchy, the main factor affecting the disclosure
risk is $\rho_{1}$, the privacy parameter at the lowest level. The
hierarchical information does not have an appreciable affect on the accuracy
of the adversary’s posterior inference under these assumptions.

The redistricting files are only one set of counts from the 2020 census
released by the Census Bureau; others are released over time. Thus, from the
lens of differential privacy, it is reasonable to ask about the value of
assessing disclosure risks for specific attack scenarios at a point in time.
We believe such assessments have a useful role to play. First, at the stage of
algorithm design, they can help the data holder, including decision makers who
may comprehend Bayesian probabilities more readily than bounds on Rényi
divergences, understand the risks inherent in different choices of privacy
parameters. Related, they can help the data holder explain the privacy
protection to the public, as posterior probabilities and posterior-to-prior
ratios can be more interpretable than guarantees expressed in terms of privacy
parameters (Hotz et al. (2022)). We also note that the risk measures have
desirable composition properties in settings where the same attack is applied
to sequential releases, with the total disclosure risk from $m$ releases being
equivalent to the product of the risk from each release (see Section S5 of the
supplement for details). We note, however, that settings where the output of
one release is used as side information for a different attack strategy are
less straightforward; analysis of the risk composition in such settings is an
area for future research.

Naturally, our findings are specific to a particular attack scenario—an
adversary with complete information about everyone in $g_{1}$ except the
target, about whom they know nothing. We can modify these assumptions in a
number of ways and still use the same approach; see Section S1.2 of the
supplement for a few examples. If we make large changes to the adversary’s
assumed knowledge, however, the results of the analysis may change. Section
S1.3 of the supplement includes an example of this, whereby we assume the
adversary knows the target is unique at multiple levels of the hierarchy.
Here, the effect of the hierarchical information can be stronger. An adversary
with this type of knowledge may or may not be realistic in some settings;
whether this is the case for the decennial census is a decision for the Census
Bureau.

As noted previously, we do not consider the TopDown algorithm’s post-
processing step or population invariants. The addition of a post-processing
step by itself, i.e., absent invariants derived directly from the confidential
data, does not affect the formal privacy guarantee and also should not
increase the statistical disclosure risks. Either the post-processing step is
invertible, in which case the risk analysis does not change, or it is not
invertible, in which case the computation of disclosure risks is far more
uncertain and computationally difficult (Gong and Meng, 2020). We illustrate
this in Section S6 of the supplement. The population invariants include the
total populations of each state, total number of housing units in each census
block, and number of occupied group quarters of each type in each census block
(Abowd et al. (2022)). It is unclear how possession of these quantities would
affect our disclosure risk measures, since they are not easily related to the
counts an adversary considers in our methods. Future work could provide a more
formal analysis of these points, examining in more detail how much extra
protection could be offered by the post-processing step (it is highly unlikely
to be invertible) and how adversaries could utilize population invariants in
their prior or data distributions.

This work also points to directions for future research. One direction
involves relaxing the assumption that the adversary possesses complete
information about all but one individual. For example, it may be possible to
adapt methods used in McClure and Reiter (2016) to examine inferences when the
adversary possesses information about all but two—or all but $n$—individuals.
Another direction involves using disclosure risk measures to approximate an
“empirical” DP bound for a data set released under DP or zCDP. For the 2020
decennial census, the Census Bureau quotes a total $\varepsilon=17.91$,
computed via composing the $\rho$ allocations at the six levels of the
hierarchy and using Theorem 1. Our results indicate that reporting the privacy
guarantee in this way may understate the degree of privacy. Other works, for
example the partial DP of Ghazi et al. (2022), examine how to produce a more
meaningful parameter for interpretation when the $\varepsilon$ from DP is
large. A method based on disclosure risks also may be possible and useful in
practice.

## Supplementary Materials

The online supplement contains a proposition on the sums of discrete
Gaussians, derivation of the full conditionals, and analysis of prior
sensitivity. It also contains discussion of extensions to the methods and
analysis that incorporate other attack scenarios, post-processing, and
sequential releases.

## Acknowledgements

This research was supported by NSF grant SES-2217456.

## References

  * Abowd (2018) Abowd, J. M. (2018).  The U.S. Census Bureau adopts differential privacy.  In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, KDD ’18, New York, NY, USA, pp. 2867. Association for Computing Machinery.
  * Abowd et al. (2022) Abowd, J. M., R. Ashmead, R. Cumings-Menon, S. Garfinkel, M. Heineck, C. Heiss, R. Johns, D. Kifer, P. Leclerc, A. Machanavajjhala, et al. (2022).  The 2020 census disclosure avoidance system TopDown algorithm.  arXiv preprint arXiv:2204.08986.
  * Abowd and Vilhuber (2008) Abowd, J. M. and L. Vilhuber (2008).  How protective are synthetic data?  In International Conference on Privacy in Statistical Databases, pp. 239–246. Springer.
  * Bun and Steinke (2016) Bun, M. and T. Steinke (2016).  Concentrated differential privacy: Simplifications, extensions, and lower bounds.  In Theory of Cryptography Conference, pp. 635–658. Springer.
  * Canonne et al. (2020) Canonne, C. L., G. Kamath, and T. Steinke (2020).  The discrete Gaussian for differential privacy.  arXiv preprint arXiv:2004.00010.
  * Domingo-Ferrer and Torra (2004) Domingo-Ferrer, J. and V. Torra (2004).  Disclosure risk assessment in statistical data protection.  Journal of Computational and Applied Mathematics 164, 285–293.
  * Duncan and Keller-McNulty (2000) Duncan, G. and S. Keller-McNulty (2000).  Bayesian insights on disclosure limitation: Mask or impute?  In Sixth World Meeting of the International Society for Bayesian Analysis.
  * Duncan and Lambert (1986) Duncan, G. T. and D. Lambert (1986).  Disclosure-limited data dissemination.  Journal of the American Statistical Association 81(393), 10–18.
  * Dwork (2008) Dwork, C. (2008).  Differential privacy: A survey of results.  In International Conference on Theory and Applications of Models of Computation, pp. 1–19. Springer.
  * Dwork et al. (2021) Dwork, C., R. Greenwood, and G. King (2021).  There’s a simple solution to the latest census fight.  Boston Globe.
  * Dwork et al. (2006) Dwork, C., F. McSherry, K. Nissim, and A. Smith (2006).  Calibrating noise to sensitivity in private data analysis.  In Theory of Cryptography Conference, pp. 265–284. Springer.
  * Fienberg and Sanil (1997) Fienberg, S. E. and A. P. Sanil (1997).  A Bayesian approach to data disclosure: Optimal intruder behavior for continuous data.  Journal of Official Statistics 13(1), 75.
  * Ghazi et al. (2022) Ghazi, B., R. Kumar, P. Manurangsi, and T. Steinke (2022).  Living with large $\varepsilon$ via partial differential privacy.  TPDP 2022.
  * Gong and Meng (2020) Gong, R. and X.-L. Meng (2020).  Congenial differential privacy under mandated disclosure.  In Proceedings of the 2020 ACM-IMS on Foundations of Data Science Conference, pp. 59–70.
  * Hotz et al. (2022) Hotz, V. J., C. R. Bollinger, T. Komarova, C. F. Manski, R. A. Moffitt, D. Nekipelov, A. Sojourner, and B. D. Spencer (2022).  Balancing data privacy and usability in the federal statistical system.  Proceedings of the National Academy of Sciences 119(31), e2104906119.
  * JASON (2022) JASON (2022).  Consistency of data products and formal privacy methods for the 2020 census.  Technical report, The MITRE Corporation.
  * Kenny et al. (2021) Kenny, C. T., S. Kuriwaki, C. McCartan, E. Rosenman, T. Simko, and K. Imai (2021).  The impact of the US census disclosure avoidance system on redistricting and voting rights analysis.  arXiv preprint arXiv:2105.14197.
  * Lee and Clifton (2011) Lee, J. and C. Clifton (2011).  How much is enough? choosing $\varepsilon$ for differential privacy.  In International Conference on Information Security, pp. 325–340. Springer.
  * McClure and Reiter (2012) McClure, D. and J. P. Reiter (2012).  Differential privacy and statistical disclosure risk measures: An investigation with binary synthetic data.  Transactions on Data Privacy 5(3), 535–552.
  * McClure and Reiter (2016) McClure, D. and J. P. Reiter (2016).  Assessing disclosure risks for synthetic data with arbitrary intruder knowledge.  Statistical Journal of the IAOS 32(1), 109–126.
  * National Archives and Records Administration (2022) National Archives and Records Administration (2022).  Enumeration district and related maps, 1880 - 1990.  https://catalog.archives.gov/id/821491.  Accessed: May 27, 2022.
  * Reiter (2005) Reiter, J. P. (2005).  Estimating risks of identification disclosure in microdata.  Journal of the American Statistical Association 100(472), 1103–1112.
  * Ruggles et al. (2019) Ruggles, S., C. Fitch, D. Magnuson, and J. Schroeder (2019).  Differential privacy and census data: Implications for social and economic research.  In AEA Papers and Proceedings, Volume 109, pp. 403–08.
  * Seeman et al. (2020) Seeman, J., A. Slavkovic, and M. Reimherr (2020).  Private posterior inference consistent with public information: A case study in small area estimation from synthetic census data.  In International Conference on Privacy in Statistical Databases, pp. 323–336. Springer.

Zeki Kazan, Duke University E-mail<EMAIL_ADDRESS>
Jerome Reiter, Duke University E-mail<EMAIL_ADDRESS>
Supplementary Material

This supplementary material contains a proposition on the sums of discrete
Gaussian random variables, derivations of the full conditionals for the Gibbs
sampler in the main text, and discussion of extensions of targeting non-unique
individuals and other types of disclosure attacks.

##  S1 Other Attacks

This section examines other attacks an adversary could perform in addition to
the attack focused on in the main text. One class of attacks considers the
same attack as in the main text, but with a target who is not unique in group
$g_{1}$. Another class considers different attacks that are mathematically
equivalent to the attack from the main text. A final class considers an attack
by an adversary with substantially more information than the adversaries
examined in the main text.

###  S1.1 Non-unique Individuals

The empirical analysis in Section 4 of the main text focuses on the case where
the targeted individual is unique at the lowest level of the hierarchy (the
block-level in the 2020 decennial census application). This assumption is not
necessary for the methodology. If rather than $x_{1,-t}=0$ and $x_{1}=1$, we
had $x_{1,-t}=m$ and $x_{1}=m+1$—i.e., the adversary knows there are $m$
individuals other than the target with characteristics $c$—the analysis would
be identical to what is presented in the main text. All the probabilities
plotted in Section 4 of the main text would stay the same, and all plots
involving $X_{1}^{*}$ and $X_{2}^{*}$ would be shifted by $m$.

###  S1.2 Equivalent Attacks

The methodology and empirical evaluations in the main text consider the
scenario where an adversary is interested in determining whether individual
$t$ has characteristics $c$. In this section we describe how several other
attacks map onto our notation with only the meaning of the prior probability,
$p$, changing. The results from the main text thus can be applied to these
other attacks directly.

An adversary may seek to determine whether the target filled out the census at
all. In this setting, we assume the adversary possesses the complete
information for all $n_{1}$ individuals in $g_{1}$, and believes a priori with
probability $p_{f}\in(0,1)$ that individual $t$ actually filled out the
census. The adversary assumes that the other $n_{1}-1$ individuals filled out
the census accurately. Thus, the data holder can simply replace $p$ with
$p_{f}$ in the main text and examine the risk from this attack.

Another adversary may seek to determine whether a census respondent lied or
made a mistake when completing the census. In this setting, we assume the
adversary possesses complete information for all $n_{1}$ individuals in
$g_{1}$, and believes a priori with probability $p_{\ell}\in(0,1)$ that
individual $t$ reported the correct information. The adversary assumes that
the other $n_{1}-1$ individuals filled out the census accurately. Thus, the
data holder can simply replace $p$ with $p_{\ell}$ in the main text and
examine the risk from this attack.

Finally, an adversary may seek to determine an unknown variable. In this
setting, we assume the adversary possesses the complete information for all
$n_{1}$ individuals in $g_{1}$, except that they do not know one of the
variables for individual $t$. For example, the adversary could know individual
$t$’s race, HHGQ status, and whether they are of voting age, but not their
ethnicity. Let $c_{e}$ be the true ethnicity of the individual as reported on
the decennial census, and let $p_{v}$ be the prior probability the adversary
assigns to individual $t$ having ethnicity $c_{e}$. The data holder can simply
replace $p$ with $p_{v}$ in the main text and examine the risk from this
attack.

###  S1.3 Adversaries with Additional Information

The settings in Sections S1.1 and S1.2 presume the adversary only has
information on individuals in $g_{1}$. Another class of attacks presumes the
adversary has information at higher levels of the hierarchy as well. For
example, and as suggested by a reviewer, consider an adversary who seeks to
determine an unknown variable for target $t$, say the individual’s ethnicity.
Let $c_{e}$ be the true ethnicity of the target (unknown to the adversary),
and let $c_{-e}$ be the true characteristics of the target for the other three
variables (known to the adversary). We now include the additional assumption
that the adversary knows a priori that the target’s value of $c_{-e}$ is
unique at $\ell$ levels of the hierarchy. For example, if $\ell=2$, the target
is the only individual in their block group with characteristics $c_{-e}$; if
$\ell=4$, the target is the only individual in their county with
characteristics $c_{-e}$. Because the target is so distinct, the released
noisy counts $X_{1}^{*},\ldots,X_{\ell}^{*}$ can be combined to improve the
adversary’s posterior, which now has the form

$\displaystyle{\mathbf{P}}[X_{1}=x_{1}$ $\displaystyle\mid
X_{1}^{*}=x_{1}^{*},\ldots,X_{\ell}^{*}=x_{\ell}^{*}]$
$\displaystyle=\frac{p\prod_{i=1}^{\ell}e^{-\rho_{i}(x_{i}^{*}-x_{1})^{2}}}{p\prod_{i=1}^{\ell}e^{-\rho_{i}(x_{i}^{*}-x_{1})^{2}}+(1-p)\prod_{i=1}^{\ell}e^{-\rho_{i}(x_{i}^{*}-x_{1,-t})^{2}}}.$
(S1.1)

We can marginalize over the $\ell$ noisy counts, as in the main text, to
compute the marginal posterior the adversary makes the correct conclusion and
the corresponding disclosure risk.

Figure 7 plots the marginal posterior and disclosure risk as a function of
$\ell$ for adversaries with different prior beliefs, where the prior
parameters are set as in the analysis in the main text (levels 3-6 all have
$\rho_{i}\approx 0.05$; see Table 2 in the main text for details). As
expected, the risk increases as a function of $\ell$ due to the increasing
amount of information available to the adversary. For all priors, the increase
is most substantial between $\ell=1$ and $\ell=2$, since $\rho_{2}$ is the
largest privacy parameter and thus provides the most accurate release. Overall
and in contrast to the findings from the main text, we conclude that, for this
type of attack, the hierarchical information can sharpen the adversary’s
estimates substantially.

To carry out this attack, this adversary requires detailed information across
geographical hierarchies. Whether this is a realistic adversary or not is a
matter for policymakers to determine in their particular scenarios.

Figure 7: The left panel plots the marginal posterior probability the
adversary makes the correct decision that $X_{1}=1$ as a function of the
number of levels of the hierarchy at which the target is known to be unique.
The right panel plots the corresponding implied disclosure risk. The colors
correspond to different adversary prior beliefs; the $\rho$ at each level is
the value used by the U. S. Census Bureau in 2020.

##  S2 Sums of Discrete Gaussian Random Variables

This section focuses on the following proposition.

######  Proposition 1.

Let $Z_{1},\ldots,Z_{n}\overset{iid}{\sim}\textsf{DG}(0,s=1/(2\rho))$. Then,
for $\rho<1$ and $n$ large, $\sum_{i=1}^{n}Z_{i}$ is well approximated by
$\textsf{DG}(0,s=n/(2\rho))$.

We present an informal proof of this fact, based on empirical results.

To begin, we denote the variance of each $Z_{i}$ as $\sigma^{2}$. Figure 8
plots $\sigma^{2}$ as a function of both the scale parameter, $s$, and
$\rho=1/(2s)$. We see that for $\rho<1$, which corresponds to $s>0.5$, the
approximation $\sigma^{2}\approx s=1/(2\rho)$ is quite accurate. Empirically,
$|\sigma^{2}-s|<0.002$ for all $s>0.5$ and $|\sigma^{2}-s|<10^{-6}$ for all
$s>1$. Thus, we are able to approximate the variance of the $Z_{i}$ in this
range of $\rho$ with $s$.

Figure 8: Plot of $\sigma^{2}$, the variance of $Z_{i}$ (computed to very high
precision), as a function of the scale parameter of the discrete Gaussian,
$s$. The dashed line is the line $\sigma^{2}=s$; the upper axis presents
$\rho=\frac{1}{2s}$ for comparison. Note the log scales.

For $n$ sufficiently large, we can apply the Central Limit Theorem, which
gives the approximation

$\sum_{i=1}^{n}Z_{i}\approx{\mathcal{N}}(0,n\sigma^{2}).$ (S2.1)

As this distribution is discrete and $n\sigma^{2}=n/(2\rho)\gg 1$, it makes
sense intuitively to instead use the approximation,

${\mathcal{N}}(0,n\sigma^{2})\approx\textsf{DG}(0,n\sigma^{2})=\textsf{DG}\left(0,\frac{n}{2\rho}\right).$
(S2.2)

Combining the two approximations gives

$\sum_{i=1}^{n}Z_{i}\approx\textsf{DG}\left(0,\frac{n}{2\rho}\right).$ (S2.3)

This approximation is quite accurate in practice. Figure 9 compares the
probability mass function of $\textsf{DG}(0,n/(2\rho))$ to
$\sum_{i=1}^{n}Z_{i}$ for $\rho\in\\{1,0.099\\}$ and for $n\in\\{5,27\\}$. We
note that 0.099 is the value of $\rho_{1}$ used in the 2020 census
application, and $n=27$ is used in Section 4.3 of the main text. The
approximation does extremely well for these values. Even when $n$ is small and
$\rho$ is large, the approximation remains quite accurate.

Figure 9: Histograms comparing the probability mass function of
$\textsf{DG}(0,n/(2\rho))$ (in red) to the probability mass function of
$\sum_{i=1}^{n}Z_{i}$ (in blue). Histograms are included for $\rho=0.099$ on
the top row, $\rho=1$ on the bottom row, $n=27$ on the left column, and $n=5$
on the right column.

##  S3 Full Conditionals for Gibbs Sampler

This section provides the derivations for and forms of the full conditionals
for the Gibbs Sampler described in Section 3.2 of the main text. We start with
the expression for the posterior distribution of $(X_{1},X_{2})$ given
${\mathcal{D}}=(X_{1}^{*}=x_{1}^{*},X_{2}^{*}=x_{2}^{*},Y_{1}^{*}=y_{1}^{*})$.
We have

$\displaystyle{\mathbf{P}}[$ $\displaystyle X_{1}=k_{1},X_{2}=k_{2}\mid
X_{1}^{*}=x_{1}^{*},X_{2}^{*}=x_{2}^{*},Y_{1}^{*}=y_{1}^{*}]$ (S3.1)
$\displaystyle\propto{\mathbf{P}}[X_{1}^{*}=x_{1}^{*},X_{2}^{*}=x_{2}^{*},Y_{1}^{*}=y_{1}^{*}\mid
X_{1}=k_{1},X_{2}=k_{2}]$ $\displaystyle\qquad{\mathbf{P}}[X_{2}=k_{2}\mid
X_{1}=k_{1}]\,{\mathbf{P}}[X_{1}=k_{1}]$ (S3.2)
$\displaystyle\propto{\mathbf{P}}[X_{1}^{*}=x_{1}^{*}\mid
X_{1}=k_{1}]\,{\mathbf{P}}[X_{2}^{*}=x_{2}^{*}\mid X_{2}=k_{2}]$
$\displaystyle\qquad{\mathbf{P}}[Y_{1}^{*}=y_{1}^{*}\mid
X_{1}=k_{1},X_{2}=k_{2}]\,{\mathbf{P}}[X_{2}=k_{2}\mid
X_{1}=k_{1}]\,{\mathbf{P}}[X_{1}=k_{1}]$ (S3.3)
$\displaystyle\propto\exp\left\\{-\rho_{1}(x_{1}^{*}-k_{1})^{2}\right\\}\exp\left\\{-\rho_{2}(x_{2}^{*}-k_{2})^{2}\right\\}$
$\displaystyle\qquad\cdot\exp\left\\{-\frac{\rho_{1}}{d}(y_{1}^{*}-(k_{2}-k_{1}))^{2}\right\\}\,{\mathbf{1}}[k_{2}\geq
k_{1}]\,{\mathbf{P}}[X_{1}=k_{1}].$ (S3.4)

The full conditional for $X_{1}$ is then, for
$k_{1}\in\\{x_{1,-t},x_{1,-t}+1\\}$ and $k_{1}\leq k_{2}$,

$\displaystyle{\mathbf{P}}[$ $\displaystyle X_{1}=k_{1}\mid
X_{2}=k_{2},X_{1}^{*}=x_{1}^{*},X_{2}^{*}=x_{2}^{*},Y_{1}^{*}=y_{1}^{*}]$
(S3.5)
$\displaystyle\propto\exp\left\\{-\rho_{1}(x_{1}^{*}-k_{1})^{2}\right\\}\exp\left\\{-\frac{\rho_{1}}{d}(y_{1}^{*}-k_{2}+k_{1})^{2}\right\\}\,{\mathbf{P}}[X_{1}=k_{1}]$
(S3.6)
$\displaystyle\propto\exp\left\\{-\rho_{1}(k_{1}^{2}-2k_{1}x_{1}^{*})-\frac{\rho_{1}}{d}(k_{1}^{2}-2k_{1}(k_{2}-y_{1}^{*}))\right\\}\,{\mathbf{P}}[X_{1}=k_{1}]$
(S3.7)
$\displaystyle\propto\exp\left\\{-\frac{d+1}{d}\rho_{1}k_{1}^{2}+2\rho_{1}(x_{1}^{*}+\frac{1}{d}(k_{2}-y_{1}^{*}))k_{1}\right\\}\,{\mathbf{P}}[X_{1}=k_{1}]$
(S3.8)
$\displaystyle\propto\exp\left\\{-\frac{d+1}{d}\rho_{1}\left[k_{1}-\frac{dx_{1}^{*}+(k_{2}-y_{1}^{*})}{d+1}\right]^{2}\right\\}\,{\mathbf{P}}[X_{1}=k_{1}].$
(S3.9)

This full conditional is straightforward to sample from.

The full conditional for $X_{2}$ is, for $k_{2}\in\\{k_{1},k_{1}+1,\ldots\\}$,

$\displaystyle{\mathbf{P}}[$ $\displaystyle X_{2}=k_{2}\mid
X_{1}=k_{1},X_{1}^{*}=x_{1}^{*},X_{2}^{*}=x_{2}^{*},Y_{1}^{*}=y_{1}^{*}]$
(S3.10)
$\displaystyle\propto\exp\left\\{-\rho_{2}(x_{2}^{*}-k_{2})^{2}\right\\}\exp\left\\{-\frac{\rho_{1}}{d}(y_{1}^{*}+k_{1}-k_{2})^{2}\right\\}$
(S3.11)
$\displaystyle\propto\exp\left\\{-\rho_{2}(k_{2}^{2}-2k_{2}x_{2}^{*})-\frac{\rho_{1}}{d}(k_{2}^{2}-2k_{2}(y_{1}^{*}+k_{1}))\right\\}$
(S3.12)
$\displaystyle\propto\exp\left\\{-\left(\rho_{2}+\frac{\rho_{1}}{d}\right)k_{2}^{2}+2\left(\rho_{2}x_{2}^{*}+\frac{\rho_{1}}{d}(y_{1}^{*}+k_{1})\right)k_{2}\right\\}$
(S3.13)
$\displaystyle\propto\exp\left\\{-\left(\rho_{2}+\frac{\rho_{1}}{d}\right)\left[k_{2}-\frac{\rho_{2}x_{2}^{*}+\frac{\rho_{1}}{d}(y_{1}^{*}+k_{1})}{\rho_{2}+\frac{\rho_{1}}{d}}\right]^{2}\right\\}.$
(S3.14)

This is a truncated discrete Gaussian distribution centered at
$\frac{\rho_{2}x_{2}^{*}+\frac{\rho_{1}}{d}(y_{1}^{*}+k_{1})}{\rho_{2}+\frac{\rho_{1}}{d}}$.
It can be easily sampled over a grid, since the tails of the distribution
decay rapidly. Using these full conditionals, the adversary can sample from
the posterior distribution and examine the marginal posterior distribution for
$X_{1}$.

##  S4 Prior Sensitivity

This section examines how sensitive the analysis producing Figure 4 in Section
4.3 of the main text is to the choice of the adversary’s prior on $X_{2}\mid
X_{1}$. In particular, since the prior

$(X_{2}\mid X_{1}=k_{1})\sim\textsf{Unif}(\\{k_{1},k_{1}+1,\ldots\\}),\qquad
k_{1}\in\\{0,1\\},$ (S4.1)

is an improper probability distribution with unbounded support, it may unduly
favor values that are practically implausible. To determine whether this is
the case, we re-do the analysis producing Figure 4 with a selection of other
priors and examine how the conclusions change. We assume throughout that the
prior probability for $X_{1}$ is $p=1/2$, the number of other blocks is
$d=27$, and the true counts are $x_{1}=x_{2}=1$. Figure 4 from the main text
is reproduced as the top panel of Figure 10, for ease of comparison.

Figure 10: Adversary’s decision under 0-1 loss for each combination of
$x_{1}^{*}$, $x_{2}^{*}$, and $y_{1}^{*}$. The top plot reproduces Figure 4
from the main text, while the bottom plot uses the prior $X_{2}\mid
X_{1}\sim\textsf{Unif}(\\{k_{1},\ldots,10\\})$. Privacy parameters are set as
in the census application, $p=1/2$, and $d=27$. $10^{3}$ MCMC draws are taken
for each combination in most cases. When the posterior probability $X_{1}=1$
is close to 0.5, the number of MCMC draws is increased to $2.5\times 10^{5}$.

We begin by examining a variation on the uniform prior used in the main text.
Suppose that an adversary, utilizing information from auxiliary data sources,
knows that the number of individuals in block group $g_{2}$ with
characteristics $c$ is at most $10$. A reasonable prior might then be

$(X_{2}\mid X_{1}=k_{1})\sim\textsf{Unif}(\\{k_{1},\ldots,10\\}),\qquad
k_{1}\in\\{0,1\\}.$ (S4.2)

This prior has bounded support and does not place any prior probability on
very extreme values for $X_{2}$. The results for this prior are presented on
the bottom panel of Figure 10. We do not observe a substantial change between
the truncated and non-truncated priors; for both, the adversary makes the
correct decision 59% of the time. The lack of change is likely due to the fact
that, as suggested by Table 8 in the main text, the unbounded uniform prior
allows the data to rule out implausible values away from $x_{2}$.

Another interesting comparison is to the case where the adversary knows a
priori that $x_{2}=1$. This corresponds to a prior with all the probability
mass on $X_{2}=1$. As a consequence, the adversary’s decision about $x_{1}$
does not depend on $x_{2}^{*}$. The results for this prior are presented in
the top panel of Figure 11. We do not observe a substantial change from the
previous two figures; the adversary still makes the correct decision 59% of
the time, even with perfect knowledge at the second level. The agreement
between this result and the uniform priors suggests that the uniform priors
are not biasing the results to any substantial degree.

Figure 11: Adversary’s decision under 0-1 loss for each combination of
$x_{1}^{*}$, $x_{2}^{*}$, and $y_{1}^{*}$. Priors are of the form
${\mathbf{P}}[X_{2}=k_{2}\mid X_{1}=k_{1}]=1$ for $k_{2}=1$ (top) and
$k_{2}=25$ (bottom). Privacy parameters are set as in the census application,
$p=1/2$, and $d=27$. $10^{3}$ MCMC draws are taken for each combination in
most cases. When the posterior probability $X_{1}=1$ is close to 0.5, the
number of MCMC draws is increased to $10^{6}$.

One might take the above as evidence that the choice of prior for $X_{2}\mid
X_{1}$ is of little importance. We demonstrate that this is not the case by
examining the results under a poorly specified prior. Suppose that the
adversary incorrectly believes that $x_{2}=25$ and places a prior with all the
probability mass on $X_{2}=25$. The results for this prior are presented in
the bottom panel of Figure 11. We observe a substantial change between this
plot and the previous three: the adversary now makes the correct decision 74%
of the time. But consider the counterfactual where in truth $x_{1}=0$ (and
$x_{2}=0$). Now the misspecified prior leads the adversary astray, and they
make the correct decision only 42% of the time (the distribution of
$X_{1}^{*}$ and $X_{2}^{*}$ change in the counterfactual, so the probability
is not simply $100\%-74\%$). Evidently, an inaccurate prior can impact the
results, possibly to the detriment or benefit of the adversary depending on
the value of $x_{1}$. Of course, in practical contexts the adversary does not
know whether they benefit or suffer from an informative prior. Given that the
uniform prior (with support that includes the true count) allows the
distributions of the noisy counts to fully determine the posterior probability
computations, it appears to be a sensible choice when evaluating statistical
disclosure risks.

##  S5 Composition of Risk

In this section, we briefly examine how the risk measures from the main text
behave under composition. That is, if the Census Bureau were to perform a
second data release, how would the risks from the two releases combine? Let
$X_{1i}^{*}$ be the released noisy count from the $i^{th}$ release and
$x_{1i}^{*}$ be the corresponding observed value. Recall that the disclosure
risk from the first release is

$\displaystyle R^{\prime}(x_{11}^{*})=\frac{{\mathbf{P}}[X_{1}=x_{1}\mid
X_{11}^{*}=x_{11}^{*}]}{{\mathbf{P}}[X_{1}=x_{1}]}.$ (S5.1)

We can similarly examine the disclosure risk from the second release. Assuming
the releases are sequential, the adversary will have already observed
$x_{11}^{*}$, so their prior probability for the second release corresponds
exactly to their posterior from the first release. That is,

$\displaystyle R^{\prime}(x_{12}^{*}\mid
x_{11}^{*})=\frac{{\mathbf{P}}[X_{1}=x_{1}\mid
X_{12}^{*}=x_{12}^{*},X_{11}^{*}=x_{11}^{*}]}{{\mathbf{P}}[X_{1}=x_{1}\mid
X_{11}^{*}=x_{11}^{*}]}.$ (S5.2)

This quantity is analogous to $R^{\prime}(x_{11}^{*})$ and, in practice, the
posterior in the numerator can be decomposed as follows via Bayes Theorem:

$\displaystyle{\mathbf{P}}[$ $\displaystyle X_{1}=x_{1}\mid
X_{12}^{*}=x_{12}^{*},X_{11}^{*}=x_{11}^{*}]$
$\displaystyle=\frac{{\mathbf{P}}[X_{12}^{*}=x_{12}^{*}\mid
X_{1}=x_{1},X_{11}^{*}=x_{11}^{*}]\,{\mathbf{P}}[X_{1}=x_{1}\mid
X_{11}^{*}=x_{11}^{*}]}{{\mathbf{P}}[X_{12}^{*}=x_{12}^{*}\mid
X_{11}^{*}=x_{11}^{*}]}$ (S5.3)
$\displaystyle=\frac{{\mathbf{P}}[X_{12}^{*}=x_{12}^{*}\mid
X_{1}=x_{1}]\,{\mathbf{P}}[X_{1}=x_{1}\mid
X_{11}^{*}=x_{11}^{*}]}{\sum_{k_{1}=x_{1,-t}}^{x_{1,-t}+1}{\mathbf{P}}[X_{12}^{*}=x_{12}^{*}\mid
X_{1}=k_{1}]\,{\mathbf{P}}[X_{1}=k_{1}\mid X_{11}^{*}=x_{11}^{*}]}.$ (S5.4)

The latter equality assumes that the mechanism for releasing $X_{12}^{*}$ does
not depend on the observed $x_{11}^{*}$. (S5.4) has a form identical to the
form of ${\mathbf{P}}[X_{1}=x_{1}\mid X_{1}^{*}=x_{1}^{*}]$ in the main text,
except that the prior is conditional on the observed $x_{11}^{*}$ from the
first release. This means that the analysis of the second release can proceed
exactly as the first with the only difference being an “updated” prior.

The total risk from the two releases is then

$\displaystyle R^{\prime}(x_{11}^{*},x_{12}^{*})$
$\displaystyle=\frac{{\mathbf{P}}[X_{1}=x_{1}\mid
X_{11}^{*}=x_{11}^{*},X_{12}^{*}=x_{12}^{*}]}{{\mathbf{P}}[X_{1}=x_{1}]}$
(S5.5) $\displaystyle=\frac{{\mathbf{P}}[X_{1}=x_{1}\mid
X_{12}^{*}=x_{12}^{*},X_{11}^{*}=x_{11}^{*}]}{{\mathbf{P}}[X_{1}=x_{1}\mid
X_{11}^{*}=x_{11}^{*}]}\cdot\frac{{\mathbf{P}}[X_{1}=x_{1}\mid
X_{11}^{*}=x_{11}^{*}]}{{\mathbf{P}}[X_{1}=x_{1}]}$ (S5.6)
$\displaystyle=R^{\prime}(x_{12}^{*}\mid x_{11}^{*})R^{\prime}(x_{11}^{*}).$
(S5.7)

This argument generalizes to an arbitrary number of releases. Letting $m$ be
the total number of releases, the total risk composes as

$\displaystyle
R^{\prime}(x_{11}^{*},\ldots,x_{1m}^{*})=R^{\prime}(x_{1m}^{*}\mid
x_{11}^{*},\ldots,x_{1,m-1}^{*})\cdots R^{\prime}(x_{11}^{*}).$ (S5.8)

Thus, the cumulative risk is simply the product of the risk from each release.
The generalized marginal risk and generalized probability the adversary makes
the correct decision are straightforward to compute from the generalized
$R^{\prime}$.

##  S6 The Effect of Post-Processing

In this section, we illustrate how a post-processing step could affect the
risk analysis in this article. Our intent is not to give a complete treatment
of this but rather to provide a rough intuition. Thus, in this analysis, we
make a substantial number of simplifying assumptions about the adversary and
the way the post-processing is performed compared to the TopDown algorithm
used for the 2020 decennial census data.

To begin, we outline our illustrative post-processing algorithm. Let
${\tilde{X}}_{1},{\tilde{X}}_{2}$ be the post-processed counts corresponding
to $X_{1},X_{2}$ and ${\tilde{x}}_{1},{\tilde{x}}_{2}$ be their observed
values. Similarly, let ${\tilde{Y}}_{1}^{(1)},\ldots,{\tilde{Y}}_{1}^{(d)}$ be
the post-processed counts corresponding to $Y_{1}^{(1)},\ldots,Y_{1}^{(d)}$
and ${\tilde{y}}_{1}^{(1)},\ldots,{\tilde{y}}_{1}^{(d)}$ be their observed
values. We define the post-processing algorithm at the block level as follows.
Taking ${\tilde{x}}_{2}$ as fixed, we enforce the aggregation constraint
${\tilde{x}}_{2}={\tilde{x}}_{1}+\sum_{i=1}^{d}{\tilde{y}}_{1}^{(i)}$, while
minimizing the sum of squared deviations from the noisy counts:

$\operatorname*{argmin}_{{\tilde{x}}_{1},{\tilde{y}}_{1}^{(1)},\ldots,{\tilde{y}}_{1}^{(d)}}\bigg{\\{}({\tilde{x}}_{1}-x_{1}^{*})^{2}+\sum_{i=1}^{d}({\tilde{y}}_{1}^{(i)}-y_{1}^{(i)*})^{2}\bigg{\\}}.$
(S6.1)

The post-processing algorithm used in the TopDown algorithm enforces several
aggregation constraints and minimizes a weighted sum of squared deviations
involving more quantities, so this is a substantial simplification, but one
that we expect to roughly approximate the effects of the true algorithm.
Letting $x_{1}^{*}$ and $y_{1}^{*}$ be the observed noisy counts corresponding
to $X_{1}$ and $Y_{1}$, this simplified problem has a closed form solution,
which we denote $\bar{x}_{1}$:

$\bar{x}_{1}=\frac{dx_{1}^{*}+({\tilde{x}}_{2}-y_{1}^{*})}{d+1}.$ (S6.2)

It is possible for $\bar{x}_{1}$ to be outside the range $[0,{\tilde{x}}_{2}]$
or to be non-integer valued. To correct for this, we truncate the solution to
be in the correct range and round to the nearest integer. The complete post-
processing algorithm includes a non-negativity constraint in the optimization
and performs a second controlled rounding step, although we expect this change
to have a limited effect for our illustration. We denote the final solution to
the optimization as $f(x_{1}^{*},y_{1}^{*},{\tilde{x}}_{2})$, which is given
by

$f(x_{1}^{*},y_{1}^{*},{\tilde{x}}_{2})=\begin{cases}0,&\textrm{if
}\bar{x}_{1}<0;\\\ {\tilde{x}}_{2},&\textrm{if
}\bar{x}_{1}>{\tilde{x}}_{2};\\\
[\bar{x}_{1}],&\textrm{otherwise.}\end{cases}$ (S6.3)

We now return to the perspective of the adversary. From the above, the
likelihood from the post-processing step is simply an indicator variable

$\displaystyle{\mathbf{P}}[{\tilde{X}}_{1}={\tilde{x}}_{1}\mid
X_{1}^{*}=x_{1}^{*},Y_{1}^{*}=y_{1}^{*},{\tilde{X}}_{2}={\tilde{x}}_{2}]={\mathbf{1}}[{\tilde{x}}_{1}=f(x_{1}^{*},y_{1}^{*},{\tilde{x}}_{2})].$
(S6.4)

The full likelihood is then, assuming that the adversary considers
${\tilde{x}}_{1},{\tilde{x}}_{2}$ and not
${\tilde{y}}_{1}^{(1)},\ldots,{\tilde{y}}_{1}^{(d)}$,

$\displaystyle{\mathbf{P}}$ $\displaystyle[{\tilde{X}}_{1}={\tilde{x}}_{1}\mid
X_{1}=k_{1},{\tilde{X}}_{2}={\tilde{x}}_{2}]$
$\displaystyle=\sum_{x_{1}^{*}=-\infty}^{\infty}\sum_{y_{1}^{*}=-\infty}^{\infty}{\mathbf{P}}[{\tilde{X}}_{1}={\tilde{x}}_{1}\mid
X_{1}^{*}=x_{1}^{*},Y_{1}^{*}=y_{1}^{*},{\tilde{X}}_{2}={\tilde{x}}_{2}]$
$\displaystyle\hskip 82.0pt{\mathbf{P}}[X_{1}^{*}=x_{1}^{*}\mid
X_{1}=k_{1}]\,{\mathbf{P}}[Y_{1}^{*}=y_{1}^{*}\mid X_{1}=k_{1}]$ (S6.5)
$\displaystyle=\sum_{x_{1}^{*}=-\infty}^{\infty}\sum_{y_{1}^{*}=-\infty}^{\infty}{\mathbf{1}}[{\tilde{x}}_{1}=f(x_{1}^{*},y_{1}^{*},{\tilde{x}}_{2})]\,{\mathbf{P}}[X_{1}^{*}=x_{1}^{*}\mid
X_{1}=k_{1}]$ $\displaystyle\hskip 82.0pt{\mathbf{P}}[Y_{1}^{*}=y_{1}^{*}\mid
X_{1}=k_{1}].$ (S6.6)

To simplify ${\mathbf{P}}[Y_{1}^{*}=y_{1}^{*}\mid X_{1}=k_{1}]$, we assume the
adversary knows $x_{2}$ exactly a priori, in addition to making the
approximation from Section S2. Assuming as in the main text that the true
$x_{1}=x_{2}=1$, the known count is $x_{1,-t}=0$, and the adversary’s prior on
$X_{1}$ is Bernoulli with parameter $p$, the posterior probability the
adversary makes the correct decision is

$\displaystyle{\mathbf{P}}[X_{1}=1\mid{\tilde{X}}_{1}={\tilde{x}}_{1},{\tilde{X}}_{2}={\tilde{X}}_{2}]$
$\displaystyle=\frac{{\mathbf{P}}[{\tilde{X}}_{1}={\tilde{x}}_{1}\mid
X_{1}=1,{\tilde{X}}_{2}={\tilde{x}}_{2}]\,p}{{\mathbf{P}}[{\tilde{X}}_{1}={\tilde{x}}_{1}\mid
X_{1}=1,{\tilde{X}}_{2}={\tilde{x}}_{2}]\,p+{\mathbf{P}}[{\tilde{X}}_{1}={\tilde{x}}_{1}\mid
X_{1}=0,{\tilde{X}}_{2}={\tilde{x}}_{2}](1-p)}.$ (S6.7)

Finally, for comparison to the results from the main text, we can marginalize
out ${\tilde{X}}_{1}$ from the posterior:

$\displaystyle{\mathbf{P}}[X_{1}=1\mid
x_{1}=1,{\tilde{X}}_{2}={\tilde{x}}_{2}]=\sum_{{\tilde{x}}_{1}=0}^{{\tilde{x}}_{2}}$
$\displaystyle{\mathbf{P}}[X_{1}=1\mid{\tilde{X}}_{1}={\tilde{x}}_{1},{\tilde{X}}_{2}={\tilde{x}}_{2}]$
$\displaystyle{\mathbf{P}}[{\tilde{X}}_{1}={\tilde{x}}_{1}\mid
x_{1}=1,{\tilde{X}}_{2}={\tilde{x}}_{2}].$ (S6.8)

Note that the result will vary with ${\tilde{x}}_{2}$.

Figure 12: The left panel plots the marginal disclosure risk from (S6) as a
function of ${\tilde{x}}_{2}$ when $\rho_{1}\approx 0.099$. The right panel
plots the marginal disclosure risk from (S6) as a function of $\rho_{1}$
colored by ${\tilde{x}}_{2}\in\\{1,10,100\\}$. The dashed line represents
$\rho_{1}\approx 0.099$. In both panels, the purple line represents the
marginal disclosure risk without post-processing. Both set $p=1/2$ and assume
the adversary knows that $x_{2}=1$.

We now examine whether, on average, releasing the counts with post-processing
will have lower disclosure risk than releasing the counts without post-
processing. The first panel of Figure 12 compares the marginal disclosure
risks in the case where $\rho_{1}\approx 0.099$ for various values of
${\tilde{x}}_{2}$. We find that the marginal risk with post-processing is
bounded above by the marginal risk without post-processing, as expected.
Larger values of ${\tilde{x}}_{2}$ give risks closer to the bound, which makes
sense intuitively; larger values of ${\tilde{x}}_{2}$ allow for a larger range
of possible observed ${\tilde{x}}_{1}$, which will make it easier for the
adversary to “work backward” to $x_{1}^{*}$. The second panel of Figure 12
compares the marginal disclosure risks as a function of $\rho_{1}$ for a
selection of ${\tilde{x}}_{2}$. We observe a similar effect, with the marginal
risk without post-processing providing an upper bound on the marginal risk
with post-processing. In general, we find that the bound is fairly tight; the
reduction in disclosure risk due to the post-processing is minor (given the
simplifications and assumptions we make).