Secondary Cell Suppression by Gaussian Elimination: An Algorithm Suitable for Handling Issues with Zeros and Singletons

Abstract

To protect tabular data through cell suppression, efficient algorithms are essential. Gaussian elimination can be used for secondary cell suppression to prevent exact disclosure. A beneficial feature of this method is that all tables created from the same microdata can be handled simultaneously. This paper presents a solution to the issue where suppressed zeros in frequency tables cannot protect each other. In magnitude tables, it outlines how the algorithm can be tailored to provide protection against singleton contributors using their own data for disclosure.

Appendix

Figures 5 and 6 illustrate steps from two alternative eliminations starting from the matrix in Fig. 4. These figures are referred to in Sect. 5.

Fig. 5.

Some Gaussian Elimination steps, including the last one, conducted with the matrix in Fig. 4 as a starting point. The treatment of singletons here leads to secondary suppression marked as $\circ$ in Table 3.

Fig. 6.

Some Gaussian Elimination steps, including the last one, conducted with the matrix in Fig. 4 as a starting point. Singletons are handled by two parallel eliminations, but the figure only shows the elimination sequence from one of these. The result is the secondary suppressed cells marked as $\#$ in Table 3. This figure also illustrates the singleton method which considers combinations. Then the process stops after step 5 and the secondary cells are those marked with $\triangle$ in Table 3.

Table 4. Synthetic data examples illustrating methods for handling ones, equivalent to methods for handling zeros. Each of the first three hypercube groups, according to the European Census 2021, is considered.

Table 5. Synthetic data examples illustrating methods for handling singletons. Each of the first three hypercube groups, according to the European Census 2021, is considered.

To illustrate the methods with realistic examples, we consider so-called hypercubes, according to the European Census 2021 [2]. We utilize data of 1,000,000 synthetic individuals based on Norwegian data, with a synthetic numeric variable and approximately 650,000 unique IDs added for use in magnitude tables [6]. Tables 4 and 5 provide examples of how the methods described in Sect. 4 and 5 affect the number of secondary suppressed cells. Each of the first three table groups, consisting of four, three, and three linked hierarchical tables, respectively, is analyzed using the GaussSuppression package [8]. These tables also indicate the total execution time, measured on a Linux server, from input microdata to final results.

In Table 4, illustrating the methods in Sect. 4, we chose to primary suppress ones, twos, and threes, while zeros remained unprotected and were considered structural. Thus, these methods address the suppression of ones, which, as described in Sect. 6, is analogous to handling zeros. This approach results in similar examples for frequency and magnitude tables.

The primary suppression of the magnitude tables in Table 5 is based on the $p\%$-rule [12], with $p=5$. Note that in the GaussSuppression package, virtual cells are created by examining the X-matrix. This may differ somewhat from the Tau-Argus method described in Sect. 5.1. The beginning of Sect. 5 mentioned that both rows and columns of the X-matrix can be labeled with singleton contributor IDs. Generally, there may be IDs on rows without a matching column. Extra primary cells representing these missing IDs may be added so that all singleton contributions are considered sensitive. This is included in the singleton methods used in Table 5.