An Examination of the Alleged Privacy Threats of Confidence-Ranked
  Reconstruction of Census Microdata
David Sánchez Najeeb Jebreel Josep Domingo-Ferrer Krishnamurty Muralidhar Alberto Blanco-Justicia
The alleged threat of reconstruction attacks has led the U.S. Census Bureau
(USCB) to replace in the Decennial Census 2020 the traditional statistical
disclosure limitation based on rank swapping with one based on differential
privacy (DP). This has resulted in substantial accuracy loss of the released
statistics. Worse yet, it has been shown that the reconstruction attacks used
as an argument to move to DP are very far from allowing unequivocal
reidentification of the respondents, because in general there are a lot of
reconstructions compatible with the released statistics. In a very recent
paper, a new reconstruction attack has been proposed, whose goal is to indicate
the confidence that a reconstructed record was in the original respondent data.
The alleged risk of serious disclosure entailed by such confidence-ranked
reconstruction has renewed the interest of the USCB to use DP-based solutions.
To forestall the potential accuracy loss in future data releases resulting from
adoption of these solutions, we show in this paper that the proposed
confidence-ranked reconstruction does not threaten privacy. Specifically, we
report empirical results showing that the proposed ranking cannot guide
reidentification or attribute disclosure attacks, and hence it fails to warrant
the USCB's move towards DP. Further, we also demonstrate that, due to the way
the Census data are compiled, processed and released, it is not possible to
reconstruct original and complete records through any methodology, and the
confidence-ranked reconstruction not only is completely ineffective at
accurately reconstructing Census records but is trivially outperformed by an
adequate interpretation of the released aggregate statistics.