On the Difficulties of Disclosure Prevention in Statistical Databases

A privacy-preserving statistical database enables the data analyst to learn properties of the population as a whole, while protecting the privacy of the individuals whose data were used in creating the database. A rigorous treatment of privacy requires definitions: What constitutes a failure to preserve privacy? What is the power of the adversary whose goal it is to compromise privacy? What auxiliary information is available to the adversary (newspapers, medical studies, labor statistics) even without access to the database in question? Of course, utility also requires formal treatment, as releasing no information, or only random noise, clearly does not compromise privacy; we will return to this point later. However, in this work privacy is paramount: we will first define our privacy goals and then explore what utility can be achieved given that the privacy goals will be satisfied.