THE DESIGN AND ANALYSIS OF EXPERIMENTS. By Oscar Kempthorne. New York, John Wiley and Sons, Inc., 1952. 631 pp. $8.50. This book by a teacher of statistics (as well as a consultant for \"experimenters\") is a comprehensive study of the philosophical background for the statistical design of experiment. It is necessary to have some facility with algebraic notation and manipulation to be able to use the volume intelligently. The problems are presented from the theoretical point of view, without such practical examples as would be helpful for those not acquainted with mathematics. The mathematical justification for the techniques is given. As a somewhat advanced treatment of the design and analysis of experiments, this volume will be interesting and helpful for many who approach statistics theoretically as well as practically. With emphasis on the \"why,\" and with description given broadly, the author relates the subject matter to the general theory of statistics and to the general problem of experimental inference. MARGARET J. ROBERTSON

The Design and Analysis of Experiments

Statistics for Spatial Data.

Publishing data about individuals without revealing sensitive information about them is an important problem. In recent years, a new definition of privacy called k-anonymity has gained popularity. In a k-anonymized dataset, each record is indistinguishable from at least k − 1 other records with respect to certain identifying attributes.In this article, we show using two simple attacks that a k-anonymized dataset has some subtle but severe privacy problems. First, an attacker can discover the values of sensitive attributes when there is little diversity in those sensitive attributes. This is a known problem. Second, attackers often have background knowledge, and we show that k-anonymity does not guarantee privacy against attackers using background knowledge. We give a detailed analysis of these two attacks, and we propose a novel and powerful privacy criterion called e-diversity that can defend against such attacks. In addition to building a formal foundation for e-diversity, we show in an experimental evaluation that e-diversity is practical and can be implemented efficiently.

/pdf/l-diversity-privacy-beyond-k-anonymity-54qdj1526d.pdf

L-diversity: Privacy beyond k-anonymity

A fruitful direction for future data mining research will be the development of techniques that incorporate privacy concerns. Specifically, we address the following question. Since the primary task in data mining is the development of models about aggregated data, can we develop accurate models without access to precise information in individual data records? We consider the concrete case of building a decision-tree classifier from training data in which the values of individual records have been perturbed. The resulting data records look very different from the original records and the distribution of data values is also very different from the original distribution. While it is not possible to accurately estimate original values in individual data records, we propose a novel reconstruction procedure to accurately estimate the distribution of original data values. By using these reconstructed distributions, we are able to build classifiers whose accuracy is comparable to the accuracy of classifiers built with the original data.

Privacy-preserving data mining

Publishing data about individuals without revealing sensitive information about them is an important problem. In recent years, a new definition of privacy called \kappa-anonymity has gained popularity. In a \kappa-anonymized dataset, each record is indistinguishable from at least k—1 other records with respect to certain "identifying" attributes. In this paper we show with two simple attacks that a \kappa-anonymized dataset has some subtle, but severe privacy problems. First, we show that an attacker can discover the values of sensitive attributes when there is little diversity in those sensitive attributes. Second, attackers often have background knowledge, and we show that \kappa-anonymity does not guarantee privacy against attackers using background knowledge. We give a detailed analysis of these two attacks and we propose a novel and powerful privacy definition called \ell-diversity. In addition to building a formal foundation for \ell-diversity, we show in an experimental evaluation that \ell-diversity is practical and can be implemented efficiently.

/pdf/l-diversity-privacy-beyond-k-anonymity-43op5i6gzs.pdf

L-diversity: privacy beyond k-anonymity

This article discusses theory and method of complementary cell suppression and related topics in statistical disclosure control. Emphasis is placed on the development of methods that are theoretically broad but also practical to implement. The approach draws from areas of discrete mathematics and linear optimization theory.

https://www.jstor.org/stable/info/2287463

Suppression Methodology and Statistical Disclosure Control

https://www.stat.washington.edu/NRCSE/pdf/trs26_ozone.pdf

A review of statistical methods for the meteorological adjustment of tropospheric ozone

Statistical Disclosure Limitation

It is often necessary to round values in a two-way statistical table, that is, replace each value by an adjacent integer multiple of an appropriately chosen integer rounding base. Such is the case when statistical data are to be presented in increments, such as personal income presented in multiples of $1,000 or retail sales in units of $1 million, or when counts must be adjusted prior to release to reduce the risk of statistical disclosure (Cox, McDonald, and Nelson 1986). It is desirable that the rounded array also be additive along rows and columns and to the grand total. A table satisfying these conditions is called a controlled rounding of the original table. If, as is often the case, entries that are already integer multiples of the base must remain unchanged, the controlled rounding is said to be zero-restricted. Controlled rounding is an important adjunct to statistical methods for adjusting contingency tables such as iterative proportional fitting (Ireland and Kullback 1968), because suc...

A Constructive Procedure for Unbiased Controlled Rounding

The two-dimensional controlled selection problem and the problem of maximizing the overlap of old and new primary sampling units after restratification and change of selection probabilities have been studied for several decades but have never been completely solved until now. Using transportation theory, complete solutions are obtained here for these and other problems. The solution to the controlled selection problem is based on a specific transportation model that was originally developed, in a previous paper by Cox and Ernst (1982), to solve completely the controlled rounding problem, namely the problem of optimally rounding real-valued entries in a two-way tabular array to adjacent integer values in a manner that preserves the tabular (additive) structure of the array. This model is also applied to other statistical problems, such as raking and statistical disclosure for frequency count tabulations and microdata.

Lawrence H. Cox

Papers

Suppression Methodology and Statistical Disclosure Control

A review of statistical methods for the meteorological adjustment of tropospheric ozone

Statistical Disclosure Limitation

A Constructive Procedure for Unbiased Controlled Rounding

Applications of Transportation Theory to Statistical Problems