A Refreshment Stirred, Not Shaken (III): Can Swapping Be Differentially Private?

2025-04-21

AI Summary

This paper investigates the theoretical compatibility of data swapping with differential privacy (DP), aiming to strengthen DP’s foundations, extend its applicability, and dispel common misconceptions. We propose a five-dimensional DP modeling framework—addressing *who*, *where*, *what*, *how*, and *how much*—to unify formal analyses of the 2010 U.S. Census swapping methodology and the 2020 TopDown algorithm under a rigorous DP lens. Through formal proofs and invariant analysis, we establish that swapping satisfies strict ε-DP under well-defined conditions. We further expose the “privacy theater” fallacy and quantify how aleatoric uncertainty implicitly depletes the privacy budget. By bridging statistical disclosure control (SDC) with modern DP practice, our work advances DP from a technical mechanism to an interpretable, auditable, and integrable privacy governance paradigm. The results provide theoretically sound and engineering-practical privacy-enhancing pathways for high-stakes applications such as official censuses.

Technology Category

• Machine Learning: Privacy
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Reasoning under Uncertainty: Other Foundations of Reasoning under Uncertainty

Application Category

• Security and Privacy: Data transparency and provenance
• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems
• Responsible Web: Data and user privacy-enhancing technologies for the Web

Abstract

The quest for a precise and contextually grounded answer to the question in the present paper's title resulted in this stirred-not-shaken triptych, a phrase that reflects our desire to deepen the theoretical basis, broaden the practical applicability, and reduce the misperception of differential privacy (DP)$unicode{x2014}$all without shaking its core foundations. Indeed, given the existence of more than 200 formulations of DP (and counting), before even attempting to answer the titular question one must first precisely specify what it actually means to be DP. Motivated by this observation, a theoretical investigation into DP's fundamental essence resulted in Part I of this trio, which introduces a five-building-block system explicating the who, where, what, how and how much aspects of DP. Instantiating this system in the context of the United States Decennial Census, Part II then demonstrates the broader applicability and relevance of DP by comparing a swapping strategy like that used in 2010 with the TopDown Algorithm$unicode{x2014}$a DP method adopted in the 2020 Census. This paper provides nontechnical summaries of the preceding two parts as well as new discussion$unicode{x2014}$for example, on how greater awareness of the five building blocks can thwart privacy theatrics; how our results bridging traditional SDC and DP allow a data custodian to reap the benefits of both these fields; how invariants impact disclosure risk; and how removing the implicit reliance on aleatoric uncertainty could lead to new generalizations of DP.

Problem

• Clarify differential privacy's core definitions and formulations
• Compare swapping strategies with DP methods in Census
• Bridge traditional SDC and DP for data custodians

Innovation

• Five-building-block system for DP
• Comparing swapping with TopDown Algorithm
• Bridging traditional SDC and DP benefits