The U.S. Census Bureau Adopts Differential Privacy

By John M. Abowd. 2018

462 citations recorded by the source corpus.

The U.S. Census Bureau announced, via its Scientific Advisory Committee, that it would protect the publications of the 2018 End-to-End Census Test (E2E) using differential privacy. The E2E test is a dress rehearsal for the 2020 Census, the constitutionally mandated enumeration of the population used to reapportion the House of Representatives and redraw every legislative district in the country. Systems that perform successfully in the E2E test are then used in the production of the 2020 Census. Motivation: The Census Bureau conducted internal research that confirmed that the statistical disclosure limitation systems used for the 2000 and 2010 Censuses had serious vulnerabilities that were exposed by the Dinur and Nissim (2003) database reconstruction theorem. We designed a differentially private publication system that directly addressed these vulnerabilities while preserving the fitness for use of the core statistical products. Problem statement: Designing and engineering production differential privacy systems requires two primary components: (1) inventing and constructing algorithms that deliver maximum accuracy for a given privacy-loss budget and (2) insuring that the privacy-loss budget can be directly controlled by the policy-makers who must choose an appropriate point on the accuracy-privacy-loss tradeoff. The first problem lies in the domain of computer science. The second lies in the domain of economics. Approach: The algorithms under development for the 2020 Census focus on the data used to draw legislative districts and to enforce the 1965 Voting Rights Act (VRA). These algorithms efficiently distribute the noise injected by differential privacy. The Data Stewardship Executive Policy Committee selects the privacy-loss parameter after reviewing accuracy-privacy-loss graphs.

Subfields: Artificial Intelligence, Sociology and Political Science, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Sociology and Political Science

In Privacy & Security

Citations in the corpus

Privacy-Preserving Generative Deep Neural Networks Support Clinical Data Sharing (2017, background): “The Census Bureau provides guidance on choosing an appropriate privacy loss [13,14].”
Private Counting from Anonymous Messages: Near-Optimal Accuracy with Vanishing Communication Overhead (2020, background): “…candidate, leading to several real-world deployments at companies such as Google (Erlingsson et al., 2014; Shankland, 2014), Apple (Greenberg, 2016; Apple Differential Privacy Team, 2017), and Microsoft (Ding et al., 2017), and in government agencies such as the U.S. Census Bureau (Abowd, 2018).”
Distributed Differential Privacy via Shuffling (2018, background): “Differential privacy is now widely studied, and algorithms satisfying the criterion are increasingly deployed [1, 24, 17].”
Locally Private k-Means in One Round (2021, background): “This has translated into several practical deployments within government agencies (Abowd, 2018) and the industry (Erlingsson et al.”
Deep Learning with Gaussian Differential Privacy (2019, methodology): “Today, this definition has developed into a firm foundation of private data analysis, with its applications deployed by Google (Erlingsson, Pihur, & Korolova, 2014), Apple (Apple, 2017), Microsoft (Ding, Kulkarni, & Yekhanin, 2017), and the US Census Bureau (Abowd, 2018).”
Hypothesis Testing Interpretations and Renyi Differential Privacy (2019, methodology): “We can extend this result to general measurable setting by using the continuity of ∆ ε (see also [Liese and Vajda, 2006]), which is obtained by f -divergence characterization of ∆ ε [Barthe and Olmedo, 2013].”
Proving differential privacy with shadow execution (2019, background): “Consider an injective function that adds noise as follows: for any query except for q[1], use the same noise as onD1 (i.”
Unlocking High-Accuracy Differentially Private Image Classification through Scale (2022, background): “…for mitigating privacy attacks aimed at leaking individual training examples, and it has already been adopted in practice by a range of public and private organizations (Abowd, 2018; Apple Diﬀerential Privacy Team, 2017; Bird, 2020; Erlingsson, 2014; McMahan and Thakurta, 2022; Nayak, 2020).”
Differentially Private Aggregation in the Shuffle Model: Almost Central Accuracy in Almost a Single Message (2021, background): “This has led to several practical deployments including by Google (Erlingsson et al., 2014; Shankland, 2014), Apple (Greenberg, 2016; Apple Differential Privacy Team, 2017), Microsoft (Ding et al., 2017), and the U.S. Census Bureau (Abowd, 2018).”
Distributed Differentially Private Averaging with Improved Utility and Robustness to Malicious Parties (2020, background): “A good example of such work is a recent study by the US Census to prepare their adoption of differential privacy [1].”