arXiv subjects

Ruobin Gong

Publications and source records attributed to Ruobin Gong.

At least 19 recordsLinked to original sources

arXiv2026

Posterior Invariance of Multiplicative Contrasts under Margin Constraints in Contingency Tables

Measures of association in contingency tables, such as odds ratios and their generalizations, are often studied under different sampling schemes that either fix or leave random the margins of the table. While classical results show that certain odds ratios are unaffected by constraining the margins, it is less clear when this invariance holds more generally. This paper studies posterior inference for a broad class of multiplicative contrasts of multinomial cell probabilities, which we refer to as generalized odds ratios, and addresses exactly when fixing a margin alters inference about them. We consider Bayesian inference under multinomial sampling and under models in which partition sums of the table are fixed in advance, and assume that the marginal and conditional parameters are independent a priori. Under additional mild assumptions, we show that the posterior distribution of a generalized odds ratio is invariant to fixing a margin if and only if the coefficients defining the contrast sum to zero within the margin.

math.ST↗

arXiv2025

The Five Safes as a Privacy Context

The Five Safes is a framework used by national statistical offices (NSO) for assessing and managing the disclosure risk of data sharing. It can be understood as a specialization of a broader concept--contextual integrity--to the situation of statistical dissemination by an NSO. We demonstrate this by mapping the five parameters of contextual integrity onto the five dimensions of the Five Safes. We also discuss how each of these two theories can address weaknesses in the other, thereby strengthening them both.

cs.CR↗

arXiv2025

Differential Privacy Meets Invariant Statistics: Some Conundrums in Quantifying Trade-Offs

This work was inspired by the question of whether data swapping, a popular form of statistical disclosure control used to protect many data products including three recent US Decennial Censuses, can satisfy differential privacy (DP). Given the existence of more than 200 formulations of DP (and counting), as a precondition to answering this question one must precisely specify what it actually means to be DP. Motivated by this observation, we first conduct a theoretical investigation into DP's fundamental essence, resulting in a five-building-block system explicating the who, where, what, how and how much aspects of DP. Instantiating this system in the context of the US Decennial Census, we then demonstrate the broad applicability and relevance of DP by comparing a swapping strategy like that used in 2010 with the TopDown Algorithm--the main DP method adopted in the 2020 Census. This chapter provides nontechnical summaries of these two pieces of work (developed elsewhere), as well as extended discussions on a number of issues they unearth that complicate the formulation and the navigation of the so-called privacy-utility trade-off: How can greater awareness of the five building blocks thwart privacy theatrics? How can invariants (statistics that are released as is, without any privacy protection) align with DP's philosophy of relative privacy? How do our results bridging traditional statistical disclosure control and DP allow a data custodian to reap the benefits of both these fields? And how can removing the implicit reliance on aleatoric uncertainty lead to new generalizations of DP? Our ultimate goal with these discussions is to deepen the theoretical basis, broaden the practical applicability, and reduce the misperception of DP--all without shaking its core foundations.

cs.CR↗

arXiv2025

A Refreshment Stirred, Not Shaken: Invariant-Preserving Deployments of Differential Privacy for the U.S. Decennial Census

Protecting an individual's privacy when releasing their data is inherently an exercise in relativity, regardless of how privacy is qualified or quantified. This is because we can only limit the gain in information about an individual relative to what could be derived from other sources. This framing is the essence of differential privacy (DP), through which this article examines two statistical disclosure control (SDC) methods for the United States Decennial Census: the Permutation Swapping Algorithm (PSA), which resembles the 2010 Census's disclosure avoidance system (DAS), and the TopDown Algorithm (TDA), which was used in the 2020 DAS. To varying degrees, both methods leave unaltered certain statistics of the confidential data (their invariants) and hence neither can be readily reconciled with DP, at least as originally conceived. Nevertheless, we show how invariants can naturally be integrated into DP and use this to establish that the PSA satisfies pure DP subject to the invariants it necessarily induces, thereby proving that this traditional SDC method can, in fact, be understood from the perspective of DP. By a similar modification to zero-concentrated DP, we also provide a DP specification for the TDA. Finally, as a point of comparison, we consider a counterfactual scenario in which the PSA was adopted for the 2020 Census, resulting in a reduction in the nominal protection loss budget but at the cost of releasing many more invariants. This highlights the pervasive danger of comparing budgets without accounting for the other dimensions on which DP formulations vary (such as the invariants they permit). Therefore, while our results articulate the mathematical guarantees of SDC provided by the PSA, the TDA, and the 2020 DAS in general, care must be taken in translating these guarantees into actual privacy protection$\unicode{x2014}$just as is the case for any DP deployment.

cs.CR↗

arXiv2024

dapper: Data Augmentation for Private Posterior Estimation in R

This paper serves as a reference and introduction to using the R package dapper. dapper encodes a sampling framework which allows exact Markov chain Monte Carlo simulation of parameters and latent variables in a statistical model given privatized data. The goal of this package is to fill an urgent need by providing applied researchers with a flexible tool to perform valid Bayesian inference on data protected by differential privacy, allowing them to properly account for the noise introduced for privacy protection in their statistical analysis. dapper offers a significant step forward in providing general-purpose statistical inference tools for privatized data.

stat.CO↗

arXiv2024

Differentially Private Range Queries with Correlated Input Perturbation

This work proposes a class of differentially private mechanisms for linear queries, in particular range queries, that leverages correlated input perturbation to simultaneously achieve unbiasedness, consistency, statistical transparency, and control over utility requirements in terms of accuracy targets expressed either in certain query margins or as implied by the hierarchical database structure. The proposed Cascade Sampling algorithm instantiates the mechanism exactly and efficiently. Our theoretical and empirical analysis demonstrates that we achieve near-optimal utility, effectively compete with other methods, and retain all the favorable statistical properties discussed earlier.

cs.CR↗

arXiv2024

General Inferential Limits Under Differential and Pufferfish Privacy

Differential privacy (DP) is a class of mathematical standards for assessing the privacy provided by a data-release mechanism. This work concerns two important flavors of DP that are related yet conceptually distinct: pure $\varepsilon$-differential privacy ($\varepsilon$-DP) and Pufferfish privacy. We restate $\varepsilon$-DP and Pufferfish privacy as Lipschitz continuity conditions and provide their formulations in terms of an object from the imprecise probability literature: the interval of measures. We use these formulations to derive limits on key quantities in frequentist hypothesis testing and in Bayesian inference using data that are sanitised according to either of these two privacy standards. Under very mild conditions, the results in this work are valid for arbitrary parameters, priors and data generating models. These bounds are weaker than those attainable when analysing specific data generating models or data-release mechanisms. However, they provide generally applicable limits on the ability to learn from differentially private data - even when the analyst's knowledge of the model or mechanism is limited. They also shed light on the semantic interpretations of the two DP flavors under examination, a subject of contention in the current literature.

math.ST↗

arXiv2022

Integer Subspace Differential Privacy

We propose new differential privacy solutions for when external \emph{invariants} and \emph{integer} constraints are simultaneously enforced on the data product. These requirements arise in real world applications of private data curation, including the public release of the 2020 U.S. Decennial Census. They pose a great challenge to the production of provably private data products with adequate statistical usability. We propose \emph{integer subspace differential privacy} to rigorously articulate the privacy guarantee when data products maintain both the invariants and integer characteristics, and demonstrate the composition and post-processing properties of our proposal. To address the challenge of sampling from a potentially highly restricted discrete space, we devise a pair of unbiased additive mechanisms, the generalized Laplace and the generalized Gaussian mechanisms, by solving the Diophantine equations as defined by the constraints. The proposed mechanisms have good accuracy, with errors exhibiting sub-exponential and sub-Gaussian tail probabilities respectively. To implement our proposal, we design an MCMC algorithm and supply empirical convergence assessment using estimated upper bounds on the total variation distance via $L$-lag coupling. We demonstrate the efficacy of our proposal with applications to a synthetic problem with intersecting invariants, a sensitive contingency table with known margins, and the 2010 Census county-level demonstration data with mandated fixed state population totals.

cs.CR↗

arXiv2022

Data Augmentation MCMC for Bayesian Inference from Privatized Data

Differentially private mechanisms protect privacy by introducing additional randomness into the data. Restricting access to only the privatized data makes it challenging to perform valid statistical inference on parameters underlying the confidential data. Specifically, the likelihood function of the privatized data requires integrating over the large space of confidential databases and is typically intractable. For Bayesian analysis, this results in a posterior distribution that is doubly intractable, rendering traditional MCMC techniques inapplicable. We propose an MCMC framework to perform Bayesian inference from the privatized data, which is applicable to a wide range of statistical models and privacy mechanisms. Our MCMC algorithm augments the model parameters with the unobserved confidential data, and alternately updates each one conditional on the other. For the potentially challenging step of updating the confidential data, we propose a generic approach that exploits the privacy guarantee of the mechanism to ensure efficiency. We give results on the computational complexity, acceptance rate, and mixing properties of our MCMC. We illustrate the efficacy and applicability of our methods on a na\"ive-Bayes log-linear model as well as on a linear regression model.

stat.ME↗

arXiv2022

Six Statistical Senses

This article proposes a set of categories, each one representing a particular distillation of important statistical ideas. Each category is labeled a "sense" because we think of these as essential in helping every statistical mind connect in constructive and insightful ways with statistical theory, methodologies, and computation, toward the ultimate goal of building statistical phronesis. The illustration of each sense with statistical principles and methods provides a sensical tour of the conceptual landscape of statistics, as a leading discipline in the data science ecosystem.

stat.OT↗

arXiv2021

Dynamic Precise and Imprecise Probability Kinematics

We introduce dynamic probability kinematics (DPK), a method for an agent to mechanically update subjective beliefs in the presence of partial information. We then generalize DPK to dynamic imprecise probability kinematics (DIPK), which allows the agent to express their initial beliefs via a set of probabilities in order to further take ambiguity into account. We provide bounds for the lower probability associated with the updated probability sets, and we study the behavior of the latter, in particular contraction, dilation, and sure loss. Examples are provided to illustrate how the methods work.

math.ST↗

arXiv2021

Subspace Differential Privacy

Many data applications have certain invariant constraints due to practical needs. Data curators who employ differential privacy need to respect such constraints on the sanitized data product as a primary utility requirement. Invariants challenge the formulation, implementation, and interpretation of privacy guarantees. We propose subspace differential privacy, to honestly characterize the dependence of the sanitized output on confidential aspects of the data. We discuss two design frameworks that convert well-known differentially private mechanisms, such as the Gaussian and the Laplace mechanisms, to subspace differentially private ones that respect the invariants specified by the curator. For linear queries, we discuss the design of near-optimal mechanisms that minimize the mean squared error. Subspace differentially private mechanisms rid the need for post-processing due to invariants, preserve transparency and statistical intelligibility of the output, and can be suitable for distributed implementation. We showcase the proposed mechanisms on the 2020 Census Disclosure Avoidance demonstration data, and a spatio-temporal dataset of mobile access point connections on a large university campus.

cs.CR↗

arXiv2020

Congenial Differential Privacy under Mandated Disclosure

Differentially private data releases are often required to satisfy a set of external constraints that reflect the legal, ethical, and logical mandates to which the data curator is obligated. The enforcement of constraints, when treated as post-processing, adds an extra phase in the production of privatized data. It is well understood in the theory of multi-phase processing that congeniality, a form of procedural compatibility between phases, is a prerequisite for the end users to straightforwardly obtain statistically valid results. Congenial differential privacy is theoretically principled, which facilitates transparency and intelligibility of the mechanism that would otherwise be undermined by ad-hoc post-processing procedures. We advocate for the systematic integration of mandated disclosure into the design of the privacy mechanism via standard probabilistic conditioning on the invariant margins. Conditioning automatically renders congeniality because any extra post-processing phase becomes unnecessary. We provide both initial theoretical guarantees and a Markov chain algorithm for our proposal. We also discuss intriguing theoretical issues that arise in comparing congenital differential privacy and optimization-based post-processing, as well as directions for further research.

cs.CR↗

arXiv2020

Transparent Privacy is Principled Privacy

In a technical treatment, this article establishes the necessity of transparent privacy for drawing unbiased statistical inference for a wide range of scientific questions. Transparency is a distinct feature enjoyed by differential privacy: the probabilistic mechanism with which the data are privatized can be made public without sabotaging the privacy guarantee. Uncertainty due to transparent privacy may be conceived as a dynamic and controllable component from the total survey error perspective. As the 2020 U.S. Decennial Census adopts differential privacy, constraints imposed on the privatized data products through optimization constitute a threat to transparency and result in limited statistical usability. Transparent privacy presents a viable path toward principled inference from privatized data releases, and shows great promise toward improved reproducibility, accountability, and public trust in modern data curation.

stat.ME↗

arXiv2020

Geometric Conditions for the Discrepant Posterior Phenomenon and Connections to Simpson's Paradox

The discrepant posterior phenomenon (DPP) is a counter-intuitive phenomenon that can frequently occur in a Bayesian analysis of multivariate parameters. It refers to the phenomenon that a parameter estimate based on a posterior is more extreme than both of those inferred based on either the prior or the likelihood alone. Inferential claims that exhibit DPP defy the common intuition that the posterior is a prior-data compromise, and the phenomenon can be surprisingly ubiquitous in well-behaved Bayesian models. In this paper we revisit this phenomenon and, using point estimation as an example, derive conditions under which the DPP occurs in Bayesian models with exponential quadratic likelihoods and conjugate multivariate Gaussian priors. The family of exponential quadratic likelihood models includes Gaussian models and those models with local asymptotic normality property. We provide an intuitive geometric interpretation of the phenomenon and show that there exists a nontrivial space of marginal directions such that the DPP occurs. We further relate the phenomenon to the Simpson's paradox and discover their deep-rooted connection that is associated with marginalization. We also draw connections with Bayesian computational algorithms when difficult geometry exists. Our discovery demonstrates that DPP is more prevalent than previously understood and anticipated. Theoretical results are complemented by numerical illustrations. Scenarios covered in this study have implications for parameterization, sensitivity analysis, and prior choice for Bayesian modeling.

math.ST↗

arXiv2019

A Gibbs sampler for a class of random convex polytopes

We present a Gibbs sampler for the Dempster-Shafer (DS) approach to statistical inference for Categorical distributions. The DS framework extends the Bayesian approach, allows in particular the use of partial prior information, and yields three-valued uncertainty assessments representing probabilities "for", "against", and "don't know" about formal assertions of interest. The proposed algorithm targets the distribution of a class of random convex polytopes which encapsulate the DS inference. The sampler relies on an equivalence between the iterative constraints of the vertex configuration and the non-negativity of cycles in a fully connected directed graph. Illustrations include the testing of independence in 2x2 contingency tables and parameter estimation of the linkage model.

stat.CO↗

arXiv2019

Exact Inference with Approximate Computation for Differentially Private Data via Perturbations

This paper discusses how two classes of approximate computation algorithms can be adapted, in a modular fashion, to achieve exact statistical inference from differentially private data products. Considered are approximate Bayesian computation for Bayesian inference, and Monte Carlo Expectation-Maximization for likelihood inference. Up to Monte Carlo error, inference from these algorithms is exact with respect to the joint specification of both the analyst's original data model, and the curator's differential privacy mechanism. Highlighted is a duality between approximate computation on exact data, and exact computation on approximate data, which can be leveraged by a well-designed computational procedure for statistical inference.

stat.CO↗

arXiv2019

Simultaneous Inference Under the Vacuous Orientation Assumption

I propose a novel approach to simultaneous inference that alleviates the need to specify a correlational structure among marginal errors. The vacuous orientation assumption retains what the normal i.i.d. assumption implies about the distribution of error configuration, but relaxes the implication that the error orientation is isotropic. When a large number of highly dependent hypotheses are tested simultaneously, the proposed model produces calibrated posterior inference by leveraging the logical relationship among them. This stands in contrast to the conservative performance of the Bonferroni correction, even if neither approaches makes assumptions about error dependence. The proposed model employs the Dempster-Shafer Extended Calculus of Probability, and delivers posterior inference in the form of stochastic three-valued logic.

stat.ME↗