It does what it says on the tin: safe synthetic data from coarsened margins

Technical Summary: Synthetic Data from Coarsened Margins

Problem Statement
The paper addresses the challenge of widening access to sensitive administrative data held by National Statistics Agencies (NSAs) while strictly maintaining individual privacy. Current methods for creating Fully Synthetic Data (FSD) often rely on complex machine learning models that lack transparency regarding which variable relationships are preserved. Furthermore, there is a growing consensus that synthetic data generated from real data may still pose disclosure risks, particularly if the generation process is not rigorously controlled. While Trusted Research Environments (TREs) offer a secure solution, they are often difficult to access, inhibit collaborative work, and slow down research planning and code development. Existing low-fidelity synthetic data approaches (preserving only univariate distributions) are insufficient for research planning or teaching, while high-fidelity methods often fail to provide a guaranteed assurance that the data is free of disclosure risk.

Methodology
The author proposes a method for generating synthetic data (SD) that ensures two primary advantages: transparency regarding preserved relationships and a guarantee that the data is derived from information already judged free of disclosure risk. The process involves the following steps:

1. Data Curation and Disclosure Control (SDC): The original Ground Truth (GT) data is processed to apply standard SDC measures (e.g., top-coding, bottom-coding, combining small categories).
2. Margin Definition: Specific marginal tables (cross-tabulations of variables) are selected to define the relationships to be maintained in the synthetic data. The paper suggests starting with all two-way margins.
3. Coarsening and Adjustment: To ensure the margins themselves are non-disclosive, counts in the tables are subjected to a "coarsening" process. All cell counts are adjusted to be multiples of a specific disclosure limit (e.g., 10). Counts below the limit are rounded up to the limit, and subsequent adjustments are made to ensure the total counts in the margins remain consistent with the original sample size (or are adjusted by a fixed subtraction to minimize deviation). This step ensures that even if the margins are published, no individual can be identified through differencing or subtraction.
4. Iterative Proportional Fitting (IPF): The adjusted, coarsened margins are used as constraints for the Iterative Proportional Fitting (IPF) algorithm. This algorithm generates a joint probability distribution that best fits the specified margins.
5. Synthesis: One or more synthetic datasets are generated by sampling from the multinomial distribution defined by the IPF-fitted proportions.

Key Contributions

• Transparency: Unlike "black box" machine learning synthesis methods, this approach explicitly defines which variable relationships (margins) are preserved. The user knows exactly which structures are maintained.
• Guaranteed Privacy: The method guarantees that the synthetic data is derived from margins that have already been processed to meet specific disclosure control standards. By coarsening the counts to multiples of the disclosure limit, the risk of re-identification via table differencing is mitigated.
• Practical Workflow: The paper provides a concrete, step-by-step workflow for creating such data, illustrated using 1901 Census data from Scotland. It demonstrates that the IPF algorithm can converge even when the adjusted margins are technically incompatible due to the rounding/coarsening process.

Results
The method was tested using 11 variables from the 1901 Census of Scotland (51,064 records). Three versions of synthetic data were generated and compared against the Ground Truth:

1. Disclosure Controlled: Small cells replaced with a fixed value (9).
2. Coarsened: Counts rounded to multiples of 10.
3. Coarsened and Adjusted: Coarsened counts further adjusted to align totals with the original sample size.

• Utility Metrics: The utility was measured using the Standardized Propensity Score Mean Square Error (SpMSE). All methods produced SpMSE values well below the threshold of 10 (where values >10 indicate major differences). The "Coarsened and Adjusted" method yielded the lowest SpMSE values, indicating the highest fidelity to the original data structure.
• Model Fitting: Logistic regression models predicting household employment of servants were fitted to both the GT and the synthetic data. The results, including coefficient signs and confidence interval overlaps (mean 68%), were consistent across both datasets.
• Convergence: The IPF algorithm successfully converged despite the incompatibility introduced by the coarsening and adjustment steps.

Significance and Claims
The paper positions this work as a "proof-of-concept" exercise rather than a definitive solution for all synthetic data needs. The author claims that this method offers a conservative, transparent, and computationally feasible approach to generating synthetic data that can be safely released outside of Trusted Research Environments.

The significance lies in its potential to facilitate:

• Research Planning: Allowing researchers to understand variable structures and formulate plans before accessing secure environments.
• Teaching: Creating datasets for training researchers on data structures without exposing them to real sensitive data.
• Code Development: Enabling the writing and debugging of analysis code prior to GT access.

The paper acknowledges limitations, such as the computational memory required for high-dimensional cross-tabulations (the example required ~50 million cells) and the theoretical risk that powerful algorithms might reverse-engineer the coarsened tables. However, it argues that the transparency of the method and the pre-validated safety of the source margins make it a viable alternative to current high-risk or low-utility synthetic data approaches. The author notes that the method shares similarities with work by the Manchester group but emphasizes its specific focus on the coarsening of margins as a disclosure control mechanism.