📊 statistics

Statistics-Friendly Confidentiality Protection for Establishment Data, with Applications to the QCEW

This paper proposes a novel, policy-friendly confidentiality framework for business data that shifts focus from membership inference to attribute inference protection by defining uncertainty intervals around establishment values, and validates this approach using both confidential U.S. Bureau of Labor Statistics data and a publicly released substitute dataset.

Original authors: Kaitlyn Webb, Prottay Protivash, John Durrell, Daniell Toth, Aleksandra Slavković, Daniel Kifer

Published 2026-03-23

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Kaitlyn Webb, Prottay Protivash, John Durrell, Daniell Toth, Aleksandra Slavković, Daniel Kifer

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a statistician working for the government. Your job is to publish a giant report about how many people are working and how much money they are making across the country. This report is called the QCEW (Quarterly Census of Employment and Wages).

The problem? You can't just publish the raw numbers. If you say "The Walt Disney Company in California has 36,000 employees," that's fine. But if you say "Bob's Ice Cream Shop in a small town has 3 employees," and you publish that exact number, you might accidentally reveal private information about Bob's employees.

For decades, statisticians have used a method called "Cell Suppression" to protect this data. Think of this like a game of "Redact the Secret." If a number is too revealing, they simply black it out (suppress it) so no one can see it.

The Problem: This is like trying to solve a puzzle but throwing away 60% of the pieces. The resulting picture is blurry and useless for economists who need to see the big trends.

The New Idea: "The Foggy Window"

This paper proposes a smarter way to protect business data. Instead of blacking out numbers, they want to add a little bit of "statistical fog" (noise) to the answers. This way, the numbers are still visible, but they are slightly fuzzy, making it impossible to know the exact truth while still knowing the general truth.

However, there's a catch: Businesses are not all the same size.

Small Businesses: A tiny shop with 3 employees. If you add a little fog, it might look like they have 2 or 4 employees. That's a huge change! We need strong fog here to protect them.
Big Businesses: A giant company with 36,000 employees. If you add the same amount of fog, it might look like they have 36,002 employees. That's a tiny change. But if you make the fog too thick to protect them, the whole national economy looks wrong.

The Old Way vs. The New Way

The Old Way (Personalized Privacy):
Previous attempts tried to give every business its own "privacy setting."

The Logic: "Big companies are less private, so we give them weak protection. Small companies are very private, so we give them strong protection."
The Problem: This feels unfair to policymakers. It's like saying, "We will protect your neighbor's house with a steel door, but your house gets a screen door because you are richer." It creates a two-tier system of privacy that is hard to justify.

The New Way (Gaussian Establishment DP):
The authors propose a new framework called Gaussian Establishment DP (let's call it G-EDP). Instead of changing the strength of the protection based on size, they change the type of protection.

The Analogy: The "Fuzzy Target" vs. The "Ruler"

Imagine you are trying to guess the weight of a person.

For a small business (The "Ruler" approach): You need to be very careful about the percentage error. If a shop has 10 employees, guessing 11 is a 10% error. That's bad. We need to make sure the "fog" covers a wide range relative to their size.
For a big business (The "Fuzzy Target" approach): You don't care about the percentage as much; you care about the absolute number. If a giant company has 100,000 employees, guessing 100,100 is only a 0.1% error. That's fine! But guessing 100,000 exactly is bad.

The paper introduces a mathematical tool called a "Neighbor Function" (specifically, the Square Root function).

Think of this as a special lens. When you look at a small number through this lens, it gets magnified (making the "fog" cover a larger relative area). When you look at a huge number, the lens compresses it (making the "fog" cover a smaller relative area, but a larger absolute area).
The Result: Small businesses get a wide "uncertainty zone" (e.g., "We know they have between 2 and 5 employees"). Big businesses get a wide "uncertainty zone" too, but in absolute terms (e.g., "We know they have between 35,900 and 36,100 employees").
The Win: Everyone gets a fair "zone of plausible deniability." No one is strictly "less protected" than the other; they just have different kinds of protection that fit their size.

The Two Magic Machines

The paper builds two "machines" (algorithms) to generate these fuzzy answers:

The $\psi$ -Machine (The "Black Box"):
This machine adds the fog perfectly according to the rules. However, it has a quirk: it doesn't tell you exactly how much fog it added. It's like a chef who adds a secret spice but won't tell you the recipe. It's great for privacy, but statisticians hate it because they can't calculate the "margin of error" for their reports.
The PNC-Machine (The "Honest Chef"):
This is the paper's big innovation. It uses a clever trick called "Probably No Clipping."
- The Trick: Before adding the fog, the machine looks at the data and says, "I bet no single business is bigger than $X$ ." It sets a "cap" based on this guess.
- Because it knows the cap, it can calculate exactly how much fog to add and tell you the exact margin of error.
- Why it matters: Statisticians can now say, "This number is 10,000, give or take 500, and we are 99% sure that's accurate." This makes the data actually useful for making economic decisions.

Why This Matters

For the Government: They can release more data without fear of exposing secrets. No more blacking out 60% of the report!
For Economists: They get clearer pictures of the economy. They can see trends in small towns and big cities without the data being distorted by huge, random errors.
For Policy Makers: They get a system that treats all businesses fairly. A small bakery and a giant tech firm both get "plausible deniability"—a safe zone where the exact truth is hidden, but the general truth is clear.

In Summary:
The paper solves the problem of "How do we hide the exact number of employees in a business without making the whole economic report useless?" by inventing a new kind of "smart fog" that adjusts its thickness based on the size of the business, ensuring everyone gets a fair share of privacy while keeping the data useful for everyone else.

1. Problem Statement

The paper addresses the critical challenge of protecting business establishment data (e.g., employment counts and wages) while maintaining high statistical utility.

Limitations of Current Methods: The standard approach, cell suppression (used by the U.S. Bureau of Labor Statistics for the Quarterly Census of Employment and Wages, or QCEW), suffers from severe utility loss, suppressing approximately 60% of data cells. Furthermore, it is brittle against "composition attacks" (combining data from different sources) and lacks rigorous formal privacy guarantees against statistical inference.
Limitations of Standard DP: Traditional Differential Privacy (DP) designed for person-level data focuses on membership inference (hiding whether a specific record exists). This is ill-suited for business data because:
1. Large establishments (outliers) are often public knowledge (e.g., Disneyland's employee count), so hiding their existence is unnecessary and harmful to utility.
2. Standard DP treats all entities equally, requiring massive noise to hide large outliers, which renders regional economic statistics meaningless.
3. Personalized DP approaches that assign weaker privacy to large businesses create policy issues by explicitly offering weaker protections to some entities.
The Core Need: A privacy framework that protects against attribute inference (estimating the exact value of employment/wages) rather than membership, tailored to the skewed nature of business data where large entities require absolute error protection and small entities require relative error protection.

2. Methodology: Gaussian Establishment DP (gedp)

The authors propose a novel framework called Gaussian Establishment DP (gedp), which adapts the Metric DP and Gaussian DP (GDP) paradigms.

A. Core Concept: The Neighbor Function ( $\psi$ )

Instead of a fixed distance metric, the framework uses a neighbor function $\psi$ to define an "uncertainty interval" around an establishment's true value.

Definition: Two records are considered "neighbors" if their confidential attributes (e.g., wages) are close in the transformed space defined by $\psi$ . Specifically, $|\psi(x) - \psi(y)| \leq \gamma$ .
The Choice of $\psi$ : The paper argues against the traditional $\psi(x) = \log(x)$ $ψ (x) = lo g (x)$ (which enforces constant relative error). Instead, they advocate for $\psi(x) = \sqrt{x}$ .
- Rationale: This choice aligns with statistical sampling theory (Example 5.1), where the standard error of an estimate scales with $\sqrt{x}$ .
- Effect: It provides larger relative error for small establishments (protecting them from precise inference) and larger absolute error for large establishments (allowing them to be included in aggregates without distorting the total). This matches the realistic capabilities of attackers who can estimate small business sizes easily but only approximate large ones.

B. Privacy Definition

A mechanism satisfies $\mu$ -gedp if, for any two $\psi$ -neighboring datasets $D_1$ and $D_2$ , the output distributions satisfy the Gaussian DP condition:
$\Phi^{-1}(P(M(D_2) \in S)) \leq \Phi^{-1}(P(M(D_1) \in S)) + \mu$
This guarantees that distinguishing between two plausible values within an uncertainty interval is as hard as distinguishing between $N(0,1)$ and $N(\mu, 1)$ .

C. Query-Answering Mechanisms

The paper introduces two mechanisms for answering group-by sum queries:

The $\psi$ -Mechanism:
- Applies $\psi$ to the true sum, adds Gaussian noise, and releases the result.
- Limitation: The variance of the noise is data-dependent (depends on the true sum). While the noisy answer is released, the exact variance cannot be released without compromising privacy, making it difficult for statisticians to assess the reliability of the data or perform post-processing.
The pnc-Mechanism (Probably-No-Clipping):
- Workflow:
  1. Run the $\psi$ -mechanism on identity queries to generate noisy estimates of individual establishment values.
  2. Compute high-probability upper bounds ( $u_{j,i}$ ) for each establishment's attribute.
  3. Clip the true values of establishments in a group to these upper bounds.
  4. Calculate the sensitivity based on the maximum possible contribution in the group (the clipped bound).
  5. Add Gaussian noise with a variance derived from this sensitivity.
- Advantage: The variance of the noise is data-independent (determined by the public upper bounds) and can be safely released. This allows statisticians to calculate unbiased estimators and confidence intervals, facilitating the creation of high-quality privacy-preserving microdata.

3. Key Contributions

Gaussian Establishment DP (gedp): A new privacy definition that shifts focus from membership inference to attribute inference, using a metric tailored to the skewed nature of business data.
The $\sqrt{x}$ Neighbor Function: A theoretical and practical argument for using the square root transform over the logarithmic transform, ensuring that uncertainty intervals scale appropriately with establishment size (high relative error for small, high absolute error for large).
Two Novel Mechanisms:
- The $\psi$ -mechanism for direct query answering.
- The pnc-mechanism, which uniquely allows for the release of data-dependent variances, enabling the generation of unbiased microdata suitable for further statistical analysis.
Composability and Group Privacy: The framework supports adaptive composition (summing privacy budgets via the square root of the sum of squares) and provides group privacy guarantees for firms (groups of establishments) and individuals (employees within an establishment).

4. Results and Evaluation

The authors evaluated their methods on:

Real Data: A confidential historical QCEW dataset (via a cooperative agreement with the BLS).
Synthetic Data: A reconstructed dataset based on public Census Bureau data (County Business Patterns, QWI) for New Jersey and Rhode Island.

Key Findings:

Superior Utility: Both proposed mechanisms significantly outperform standard Gaussian DP (which treats all entities equally) and the traditional cell suppression method.
pnc vs. $\psi$ : The pnc-mechanism generally outperforms the $\psi$ $ψ$ -mechanism, particularly for high-level aggregations (e.g., state totals) and employment counts.
- Reason: In the $\psi$ -mechanism, noise scales with the total sum of a group. In the pnc-mechanism, noise scales with the largest single establishment in the group. For large groups where no single entity dominates, the pnc-mechanism injects significantly less noise.
Bias Reduction: The pnc-mechanism produces microdata with significantly less bias compared to the $\psi$ -mechanism because it allows for the release of exact variance estimates, enabling better post-processing (inverse-variance weighted least squares).
Skewness Handling: The methods successfully handle the heavy-tailed nature of business data, preserving the utility of large aggregates while protecting small entities.

5. Significance

Policy Impact: The framework offers a solution that is interpretable for policymakers. It avoids the ethical dilemma of "weaker privacy for the rich" by redefining privacy in terms of inference difficulty rather than existence.
Statistical Utility: By enabling the release of variance estimates and generating unbiased microdata, the pnc-mechanism allows statistical agencies to release detailed, customizable tabulations without the massive data loss associated with cell suppression.
Scalability: The approach is applicable to any skewed data, not just business data, offering a robust alternative to current disclosure limitation methods in government and private sectors.
Future Research: The paper opens avenues for optimizing privacy budget allocation adaptively and extending the framework to multi-attribute queries.

In summary, this paper presents a paradigm shift in business data privacy, moving away from "hiding existence" to "hiding precise values" via a mathematically rigorous, statistically sound, and policy-friendly framework.