Differential Privacy for Protecting Multi-dimensional Contingency Table Data: Extensions and Applications

The methodology of dierential privacy has provided a strong deni- tion of privacy which in some settings, using a mechanism of doubly-exponential noise addition, also allows for extraction of informative statistics from databases. In a recent paper, Barak et al. (1) extend this approach to the release of a specied set of margins from a multi-way contingency table. Privacy protection in such settings implicitly focuses on small cell counts that might allow for the identica- tion of units that are unique in the database. We explore how well the mechanism works in the context of a series of examples, and the extent to which the proposed dierential-priva cy mechanism allows for sensible inferences from the released data. We conclude that the methodology, as it is currently formulated, is problematic in the context of the types of large sparse contingency tables encountered in statisti- cal practice. Keywords and phrases: Efron-Stein decomposition; Infeasible tables; Log- linear models; Privacy-protected marginals; Risk-Utility tradeo.