arXiv subjects

Jörg Drechsler

Publications and source records attributed to Jörg Drechsler.

5 recordsLinked to original sources

arXiv2026

Differential Privacy Guarantees in Small Area Estimation

Statistical agencies increasingly rely on small area estimation to produce reliable estimates for subpopulations with limited sample sizes. These estimates are built from individual survey responses, so agencies must ensure that releasing them does not reveal information about any single respondent. We show that when a single draw from the posterior distribution of the Bayesian Fay-Herriot model is released, pure $\varepsilon$-differential privacy is unattainable, but the release satisfies formal privacy guarantees under Rényi differential privacy and zero-concentrated differential privacy without any noise being added, provided we treat the variance components as fixed. The key insight is that the posterior draw equals the posterior mean plus the Gaussian noise whose variance equals the posterior variance. The guarantee is thus governed by the sensitivity of the direct survey estimate and the posterior variance, and applies equally to a release of the posterior mean with that amount of noise added. For binary outcomes estimated with the Hájek estimator, the sensitivity equals the largest survey weight in the area divided by the sum of the weights. For the intercept-only model we derive exact coefficients describing how a change in one record propagates to every area's posterior mean, giving finite-sample per-area guarantees and a joint guarantee for releasing all areas at once that exceeds the largest per-area guarantee by at most a few percent in our applications. Two applications, poverty prevalence across 2,462 Public Use Microdata Areas in the American Community Survey and smoking prevalence across 52 substrata in the Washington state Behavioral Risk Factor Surveillance System, show that the guarantee is driven far more by the inequality of the survey weights than by the sample size, and that the shrinkage of the model tightens it substantially.

stat.ME↗

arXiv2026

The Complexities of Differential Privacy for Survey Data

The concept of differential privacy (DP) has gained substantial attention in recent years, most notably since the U.S. Census Bureau announced the adoption of the concept for its 2020 Decennial Census. However, despite its attractive theoretical properties, implementing DP in practice remains challenging, especially when it comes to survey data. In this chapter we present some results from an ongoing project funded by the U.S. Census Bureau that is exploring the possibilities and limitations of DP for survey data. Specifically, we identify five aspects that need to be considered when adopting DP in the survey context: the multi-staged nature of data production; the limited privacy amplification from complex sampling designs; the implications of survey-weighted estimates; the weighting adjustments for nonresponse and other data deficiencies, and the imputation of missing values. We summarize the project's key findings with respect to each of these aspects and also discuss some of the challenges that still need to be addressed before DP could become the new data protection standard at statistical agencies.

stat.ME↗

arXiv2025

Imputation Strategies for Rightcensored Wages in Longitudinal Datasets

Censoring from above is a common problem with wage information as the reported wages are typically top-coded for confidentiality reasons. In administrative databases the information is often collected only up to a pre-specified threshold, for example, the contribution limit for the social security system. While directly accounting for the censoring is possible for some analyses, the most flexible solution is to impute the values above the censoring point. This strategy offers the advantage that future users of the data no longer need to implement possibly complicated censoring estimators. However, standard cross-sectional imputation routines relying on the classical Tobit model to impute right-censored data have a high risk of introducing bias from uncongeniality (Meng, 1994) as future analyses to be conducted on the imputed data are unknown to the imputer. Furthermore, as we show using a large-scale administrative database from the German Federal Employment agency, the classical Tobit model offers a poor fit to the data. In this paper, we present some strategies to address these problems. Specifically, we use leave-one-out means as suggested by Card et al. (2013) to avoid biases from uncongeniality and rely on quantile regression or left censoring to improve the model fit. We illustrate the benefits of these modeling adjustments using the German Structure of Earnings Survey, which is (almost) unaffected by censoring and can thus serve as a testbed to evaluate the imputation procedures.

econ.EM↗

arXiv2023

Controlling Privacy Loss in Sampling Schemes: an Analysis of Stratified and Cluster Sampling

Sampling schemes are fundamental tools in statistics, survey design, and algorithm design. A fundamental result in differential privacy is that a differentially private mechanism run on a simple random sample of a population provides stronger privacy guarantees than the same algorithm run on the entire population. However, in practice, sampling designs are often more complex than the simple, data-independent sampling schemes that are addressed in prior work. In this work, we extend the study of privacy amplification results to more complex, data-dependent sampling schemes. We find that not only do these sampling schemes often fail to amplify privacy, they can actually result in privacy degradation. We analyze the privacy implications of the pervasive cluster sampling and stratified sampling paradigms, as well as provide some insight into the study of more general sampling designs.

stat.ME↗

arXiv2020

Applying Data Synthesis for Longitudinal Business Data across Three Countries

Data on businesses collected by statistical agencies are challenging to protect. Many businesses have unique characteristics, and distributions of employment, sales, and profits are highly skewed. Attackers wishing to conduct identification attacks often have access to much more information than for any individual. As a consequence, most disclosure avoidance mechanisms fail to strike an acceptable balance between usefulness and confidentiality protection. Detailed aggregate statistics by geography or detailed industry classes are rare, public-use microdata on businesses are virtually inexistant, and access to confidential microdata can be burdensome. Synthetic microdata have been proposed as a secure mechanism to publish microdata, as part of a broader discussion of how to provide broader access to such data sets to researchers. In this article, we document an experiment to create analytically valid synthetic data, using the exact same model and methods previously employed for the United States, for data from two different countries: Canada (LEAP) and Germany (BHP). We assess utility and protection, and provide an assessment of the feasibility of extending such an approach in a cost-effective way to other data.

econ.EM↗