The Complexities of Differential Privacy for Survey Data

Jörg Drechsler; James Bailie

Home/Archive/arXiv

arXiv · 2408.07006

The Complexities of Differential Privacy for Survey Data

Jörg Drechsler·James Bailie

View original source ↗Read source document ↗Export metadata ↓

Abstract

The concept of differential privacy (DP) has gained substantial attention in recent years, most notably since the U.S. Census Bureau announced the adoption of the concept for its 2020 Decennial Census. However, despite its attractive theoretical properties, implementing DP in practice remains challenging, especially when it comes to survey data. In this chapter we present some results from an ongoing project funded by the U.S. Census Bureau that is exploring the possibilities and limitations of DP for survey data. Specifically, we identify five aspects that need to be considered when adopting DP in the survey context: the multi-staged nature of data production; the limited privacy amplification from complex sampling designs; the implications of survey-weighted estimates; the weighting adjustments for nonresponse and other data deficiencies, and the imputation of missing values. We summarize the project's key findings with respect to each of these aspects and also discuss some of the challenges that still need to be addressed before DP could become the new data protection standard at statistical agencies.

Explore related subjects

stat.ME cs.CR

Keep this discovery

BibTeX RIS

Jörg Drechsler, James Bailie. 2026-08-31. The Complexities of Differential Privacy for Survey Data. https://arxiv.org/abs/2408.07006

Cite the original work for its findings. Save a collection to share your selection of sources.

Discover connections

cs.CR subject stat.ME subject

Connections use source metadata and explicit phrase matches, not verified experimental comparisons.

KEEP EXPLORING

Related papers

arXiv2026

Optimal Adversarial Testing: Extracting Honest Test Results from Dishonest Test Takers

In applications, it is often required to test objects or people to determine their qualities in terms of certain metrics. However, besides being naturally noisy, the test results can be corrupted by adversarial behaviors of objects or people being tested (test takers). For example, dishonest test takers can cheat in the exams to distort the test results. With the development of AI technologies, such distortions driven by cheating using AI technologies are becoming more commonplace and severe. In this paper, we propose optimal testing strategies which can still recover needed test results even if there are cheaters polluting the results. The proposed testing strategies will optimally re-test selected group of test takers using different testing security measures. We determine the optimal testing strategies using a dynamic programming method.

cs.CR↗

arXiv2026

Balancing the privacy-utility trade-off: How to draw reliable conclusions from private data

Absolute anonymization, conceived as an irreversible transformation preventing re-identification and sensitive value disclosure, has proven to be a broken promise. Modern data protection must therefore shift toward a privacy-utility trade-off grounded in risk mitigation. Differential Privacy (DP) offers a rigorous mathematical framework for balancing quantified disclosure risk with analytical usefulness. Nevertheless, widespread adoption remains limited, largely because complex technical concepts, such as privacy-loss parameters, have yet to be translated into forms meaningful to non-technical stakeholders. This difficulty arises from randomization itself: both analysts and adversaries must draw conclusions from uncertain observations rather than deterministic values. In this work, we adopt an interpretation of the privacy-utility trade-off based on hypothesis testing to measure the uncertainty introduced by randomized mechanisms. In particular, we use the concept of relative disclosure risk to quantify the maximum reduction in uncertainty an adversary can obtain from a membership attack on protected outputs, and show this measure relates directly to standard privacy-loss parameters. We further analyze how DP affects analytical validity via its impact on hypothesis tests assessing statistical significance. Building on these results, we provide practical guidance, accessible to non-experts such as data protection authorities, for navigating the trade-off and selecting protection mechanisms and parameter values.

stat.ME↗

arXiv2026

A simple derivation of the Kalman filter

In this lecture note, we present a concise and self-contained derivation of the discrete-time Kalman filter equations that requires only a basic understanding of least squares estimation. The treatment is designed to minimize mathematical overhead while preserving both rigor and generality.

math.OC↗