[Paper Review] Database Reconstruction Is Not So Easy and Is Different from Reidentification

Krishnamurty Muralidhar, Josep Domingo‐Ferrer|arXiv (Cornell University)|Jan 24, 2023

Privacy-Preserving Technologies in Data4 citations

TL;DR

This paper challenges the widely held belief that releasing statistical data inevitably enables database reconstruction, arguing that traditional statistical disclosure control (SDC) techniques—especially at the geographic level of release—can effectively prevent reconstruction without the severe utility loss seen in differential privacy. It further warns that using reconstruction accuracy as a proxy for reidentification risk leads to exaggerated privacy concerns.

ABSTRACT

In recent years, it has been claimed that releasing accurate statistical information on a database is likely to allow its complete reconstruction. Differential privacy has been suggested as the appropriate methodology to prevent these attacks. These claims have recently been taken very seriously by the U.S. Census Bureau and led them to adopt differential privacy for releasing U.S. Census data. This in turn has caused consternation among users of the Census data due to the lack of accuracy of the protected outputs. It has also brought legal action against the U.S. Department of Commerce. In this paper, we trace the origins of the claim that releasing information on a database automatically makes it vulnerable to being exposed by reconstruction attacks and we show that this claim is, in fact, incorrect. We also show that reconstruction can be averted by properly using traditional statistical disclosure control (SDC) techniques. We further show that the geographic level at which exact counts are released is even more relevant to protection than the actual SDC method employed. Finally, we caution against confusing reconstruction and reidentification: using the quality of reconstruction as a metric of reidentification results in exaggerated reidentification risk figures.

Motivation & Objective

• To challenge the assumption that releasing statistical data inevitably enables reconstruction of original databases.
• To demonstrate that traditional SDC techniques can effectively prevent reconstruction attacks.
• To highlight the critical role of geographic level in data release for privacy protection.
• To caution against conflating reconstruction with reidentification, showing that reconstruction metrics overstate reidentification risk.
• To call for independent, peer-reviewed evaluation of alternative privacy methods to differential privacy.

Proposed method

• Analyzes the theoretical and practical foundations of database reconstruction attacks, particularly the Dinur-Nissim theorem.
• Compares the effectiveness of traditional SDC methods (e.g., data masking, suppression, perturbation) in preventing reconstruction.
• Evaluates the impact of geographic granularity—specifically, the level at which exact counts are released—on reconstruction risk.
• Examines the use of differential privacy (DP) in the U.S. 2020 Census, including noise addition with Laplace and discrete Gaussian distributions.
• Analyzes the evolution of privacy parameters (ε) in the U.S. Census DAS system, from ε=4.5 to ε=39.907, and their implications for privacy loss.
• Assesses real-world data inconsistencies in the DAS-released 2021 and 2020 Census data, such as negative household counts and impossible population distributions.

Experimental results

Research questions

• RQ1 Is the claim that statistical data release inevitably enables database reconstruction accurate, or is it based on flawed assumptions?
• RQ2 Can traditional statistical disclosure control techniques effectively prevent database reconstruction without relying on differential privacy?
• RQ3 How does the geographic level of data release influence the risk of reconstruction?
• RQ4 To what extent does using reconstruction accuracy as a proxy for reidentification risk lead to overestimation of privacy threats?
• RQ5 Is differential privacy the optimal method for protecting U.S. Census data, given its severe utility and consistency issues?

Key findings

• The claim that releasing statistical data enables database reconstruction is incorrect and based on an incomplete and opaque comparison.
• Traditional SDC techniques, particularly when applied at the appropriate geographic level, are sufficient to prevent reconstruction attacks.
• The geographic level at which exact counts are released is more critical for privacy protection than the specific SDC method used.
• Using reconstruction accuracy as a proxy for reidentification risk leads to exaggerated privacy threat assessments, as reconstruction and reidentification are fundamentally different attacks.
• The U.S. Census Bureau’s use of differential privacy with ε=39.907 results in a privacy loss factor of over 2.38×10^15 compared to ε=4.5, rendering it ineffective for meaningful privacy protection.
• The DAS-released 2021 and 2020 Census data contain serious inconsistencies—such as negative household counts and impossible population distributions—indicating that differential privacy fails to ensure data consistency and utility.