{"id":"afea5b92-615d-40da-be11-0a98e7d6b4da","arxiv_id":"2501.14329","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"low","formal_verification":"none","parameter_count":0,"one_line_summary":"OLS regression for A/B tests can be run on k-anonymized aggregate data (counts and sums) and return the same coefficients, enabling privacy-preserving interaction tests and CUPED adjustment.","lead":"This paper shows that standard A/B test statistics can be computed from grouped, de-identified summaries of user data instead of individual records, with identical results. That could help companies reduce stored personal data and simplify privacy compliance.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Exact OLS equivalence breaks when k-anonymity is achieved by generalizing covariates; the paper only demonstrates low-cardinality, un-generalized keys.","rationale":"The reader's weakest_assumption identifies the need for every covariate in the model to be a low-cardinality field used to define the classes. That is the right condition, but it does not fully capture the conflict between standard k-anonymization and exact OLS. The paper's examples all use naturally categorical covariates where the aggregation key stores exact values and each cell happens to have count ≥ 3. However, k-anonymity as classically defined often requires generalization or suppression of high-cardinality continuous attributes to reach a target k. Once a covariate is binned, the equivalence-class table no longer contains the exact individual values, so the formulas in Sections 5 and 9 compute the Gramian and X'y for the binned variable, not for the original microdata. The central claim therefore overstates the scope if interpreted as applying to any k-anonymized release. This is a scope/clarity issue rather than an internal algebraic error: the algebra is correct when the key contains the exact regression covariates and no generalization is applied. The paper should explicitly restrict the claim to that setting and discuss the bias/approximation introduced when k-anonymity is achieved by reducing granularity. Because this is a condition that can be fixed by revision and does not invalidate the worked examples, the reader's conditional verdict remains appropriate.","tokens_in":13296,"tokens_out":19321,"duration_ms":177318,"concrete_test":"Simulate n=2000 with treatment T, continuous covariate X ~ N(0,1), outcome Y = 0.5*T + 0.3*X + ε. (1) Compute microdata OLS of Y on T and X. (2) Bin X into deciles (or use a k-anonymization tool) so each T×bin cell has at least k=20 observations; store bin midpoints as the covariate value, with count and sum Y per cell. (3) Recompute OLS from the aggregate table using the Section 9 formulas (demean the midpoints, form X'X and X'y, invert). (4) Compare the treatment coefficient, its homoskedastic standard error, and residual sum of squares to the microdata values. If they differ, the 'same regression results' claim fails for generalized k-anonymous data. Also repeat with X discretized into deciles before the microdata regression; the aggregate results should then match, confirming the claim only holds when the model is defined on the released bins.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim in Section 1 — that equivalence-class data yield the same regression results as microdata — is proved only for aggregation keys whose stored values are the exact values used in the regression design. Sections 5 and 9 construct the Gramian from counts and from value·count / value²·count, which requires that every user in a class shares the same exact covariate value. But Section 2 identifies k-anonymity with reducing both cardinality and granularity. In any standard k-anonymization pipeline, a continuous or high-cardinality covariate is binned or generalized to make each class count ≥ k. After binning, the table stores a bin label or midpoint, not the individual’s value. The Gramian computed from those generalized values is the Gramian of the binned variable, not of the original covariate; it differs from the microdata Gramian whenever the original values vary within a bin. Consequently the OLS coefficients, standard errors, and F-tests are not identical to microdata OLS. The paper never discusses this discrepancy, and its examples (Tables 1–7) only use naturally categorical covariates with no generalization. Thus the headline claim is accurate only if the regression model is specified on the released, generalized categories from the outset — a restriction that is not stated in the abstract or the title.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes performing OLS regression on k-anonymized equivalence-class summaries rather than on user-level microdata. For dummy-coded categorical designs and for low-cardinality numeric covariates, it shows how to construct the Gramian X'X and the vector X'y from class counts, outcome sums, and covariate-weighted sums, so that the resulting coefficients, default OLS standard errors, and nested-model F-tests match microdata OLS. Two use cases are developed: partial F-tests for interactions and heterogeneous treatment effects, and CUPED-style regression adjustment following Lin and Ding. The paper also contrasts local and global k-anonymization architectures and argues that the approach supports GDPR/CPRA data minimization.","tokens_in":13541,"tokens_out":18690,"duration_ms":161628,"significance":"If the equivalence claim is properly scoped, this is a practical contribution to privacy-preserving A/B testing: it gives an algebraically direct way to obtain standard OLS output from aggregate tables, with storage and compute savings and a clear connection to data-minimization regulation. The derivations are not circular, since beta is obtained from count and sum statistics through the normal equations rather than by fitting a prediction model, and the worked examples plus the Excel comparison are helpful. The main weakness is that the scope of the headline claim is broader than what is demonstrated: the reconstruction requires exact-value aggregation keys, whereas standard k-anonymity involves generalization. The numeric errors and the under-specified local-update protocol also need correction before the paper can be relied upon.","major_comments":[{"comment":"The headline equivalence claim is stated without the restriction that the aggregation key contains exactly the covariates used in the regression. In Sections 5 and 9, X'X and X'y are reconstructed from class counts and from value*count and value^2*count; this is valid only when every user in a class has the same exact covariate value. Section 2, however, defines k-anonymity as also involving reduced granularity, i.e., generalization of variable values. Under generalization, the released table stores a bin label or midpoint, so the aggregate OLS solution is the OLS solution for the binned design, not for the original microdata; the coefficients, standard errors, and F-tests differ whenever values vary within a bin. The paper's own altered example in Section 10 has a class with count 2, so it would not satisfy k=3 without suppression or generalization. Please restrict the claim to exact-value aggregation keys whose class counts already satisfy the chosen k, and state explicitly that generalization and suppression are out of scope, or extend the method to generalized covariates and quantify the discrepancy.","section":"Section 2; Sections 5 and 9"},{"comment":"The second component of X'y_a has a sign error. The expression (-0.944*2.17) + (0.056*7.01) + (1.056*2.17) is approximately +0.638, but the paper reports -0.6339. With the correct sign and the exact demeaning mean of 35/18, solving the normal equations gives beta_a = (1.285, 0.2596), which matches the covariate coefficient in Table 7, rather than the reported beta_a = (1.285, 0.256). Please correct this example and propagate the change through Res_SS_a, the Ding variance estimate, and the reported t-statistics.","section":"Section 10"},{"comment":"The local protocol is under-specified in a way that affects both reproducibility and the privacy claim. The first message 'Test1:B:3' is said to update row R6, but the second message shown, 'Test1:B:Time on App_old:4:Time on App:2', omits the covariate value '3' and no rule is given for how the server validates or routes the update. The protocol also relies on the server not retaining the raw telemetry messages after updating the aggregates; if those messages are logged, the statement in Section 12 that the local approach collects data 'without ever storing individual level data' does not hold. Please specify the exact message schema, the retention/discard policy, and the release policy, since early collection rows may have counts below the chosen k.","section":"Section 3.1"}],"minor_comments":[{"comment":"The phrase 'increasing the Count field by 4 (3+1)' should read 'by 1, from 3 to 4'; the current wording is arithmetically inconsistent with the update described.","section":"Section 3.1"},{"comment":"The stated complexity of constructing the Gramian from microdata, O(n^2 k), is not the standard cost of forming X'X; the usual outer-product construction is O(n k^2). Please correct or define the intended operation.","section":"Section 5"},{"comment":"The value called TSS_pooled is the raw sum of squared outcomes (17.91 + 19.63 = 37.54), not the centered total sum of squares shown in Excel's ANOVA. The footnote explains the centering, but the main text should state this explicitly to avoid confusion.","section":"Section 7"},{"comment":"The rounded entry '7.01' for the R2 sum is inconsistent with Table 6A's 7.0961, which rounds to 7.10; please check all rounded values in the example.","section":"Section 10"},{"comment":"The abstract and introduction should state early that the equivalence result assumes the regression covariates are exactly the low-cardinality fields used to form the equivalence classes, so that readers do not apply the method to generalized k-anonymous data.","section":"Abstract and Section 1"}],"recommendation":"major_revision","confidential_remarks":"The algebraic identity is correct for the supported exact-value designs, and the paper is potentially publishable after revision. The main scientific risk is overclaiming in the title and abstract: a reader could apply the method to a standard k-anonymized dataset with generalized covariates and obtain a binned-data OLS solution while believing it equals the original microdata solution. The Section 10 sign error and the under-specified local protocol are fixable but should be corrected before further circulation."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper has one solid core: if you store only counts, sums, and sums of squares in equivalence classes, you can reconstruct X'X and X'y for dummy-variable and low-cardinality designs, and the OLS estimates are identical to microdata. That identity is correct, and the author shows it clearly in the SQL-style examples. The partial F-test for detecting A/B test interactions and the CUPED-on-aggregates use case are genuinely useful recipes for privacy-conscious experimentation programs. If the only data you keep is aggregate, these are the right normal equations to build.\n\nSoft spots, in order of importance:\n\n1. The central claim is narrower than the abstract suggests. The proof only works when the equivalence class key contains the exact covariate values that appear in the regression design. But k-anonymity in practice is usually achieved by generalization—binning a continuous covariate or collapsing rare categories. After any such binning, the Gramian built from the released categories is the Gramian of the binned variable, not the original microdata. The paper notes in Section 2 that reducing granularity is part of k-anonymity, but it never states that the exact-equivalence property does not survive generalization. That is a real overstatement, and the title makes it worse. The fix is to add a sentence in the abstract and Section 5: the equivalence holds when the aggregation key is the model matrix.\n\n2. The Section 10 example has a sign error. The weighted sum for X'y_a should be positive, not negative, and consequently the printed beta_a (0.256) is inconsistent with the printed X'y_a. The final results happen to be right after recomputation, but the reader cannot follow the arithmetic. Needs a careful cleanup.\n\n3. The local protocol in Section 3.1 is under-specified. Handling repeat sessions by sending the old aggregate total leaks information and complicates the 'you can't lose what you never had' claim. The claim also depends on the client never retaining raw telemetry, which should be stated as an assumption.\n\n4. Novelty is modest. Regression from sufficient statistics is classical, and the paper should cite that lineage. But the specific packaged application to A/B testing is not present in the cited work.\n\nThis paper is a reasoned practitioner's note, not a research breakthrough. It deserves a serious referee—an applied statistician can verify the algebra and assess the privacy framing. I would accept it for peer review with major revisions expected, mostly on precision of the claims.","headline":"The algebraic identity is real and the A/B testing recipes are practical, but the paper overstates generality by ignoring that k-anonymization via generalization breaks exact OLS equivalence.","tokens_in":14041,"tokens_out":4512,"would_cite":false,"duration_ms":37174,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["62J05"],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper shows that OLS on k-anonymized equivalence-class data gives the same coefficients, standard errors, and test statistics as OLS on the original user-level data for supported designs.","keywords":["k-anonymity","equivalence classes","data minimization","ordinary least squares","A/B testing","partial F-test","regression adjustment","CUPED"],"falsifier":"Run the same regression specification on microdata and on equivalence-class tables using a continuous covariate that was not part of the aggregation key: the aggregate Gramian cannot encode that covariate, so the coefficients will not match. A second check is to compute Eicker-White heteroskedasticity-robust standard errors from the microdata; the aggregate tables cannot reproduce them because those errors require per-observation residuals.","tokens_in":13092,"feed_emoji":"🔒","tokens_out":11241,"duration_ms":88964,"temperature":0.7,"pith_summary":"The paper tries to establish that a standard OLS regression for A/B testing can be run on k-anonymized aggregates — counts, per-class sums of the outcome, and per-arm sums of squares — instead of on raw user rows, with exactly the same numerical answer. Regression coefficients, standard errors, partial F-tests for interactions and heterogeneous treatment effects, and CUPED-style regression adjustment all come out identical to microdata OLS for the supported designs. This matters because GDPR and similar data-minimization mandates push organizations to store less personal data, and this method gives them a way to run many standard analyses without ever touching individual-level data. A by-product is a large drop in storage and compute cost when the number of equivalence classes is much smaller than the number of users.","feed_headline":"K-anonymized A/B tests match raw-data OLS exactly","feed_subtitle":"Aggregate equivalence-class tables reproduce coefficients, errors, and F-tests, cutting storage and privacy exposure.","key_machinery":"The central object is the equivalence-class pivot table: for each unique combination of treatment arm and quasi-identifier values, it stores the count and the sum of the outcome, while a separate table stores the total sum of squares of the outcome per treatment arm. These counts and sums are exactly the entries needed to build the Gramian $X'X$ and the vector $X'y$ for dummy-variable designs; the numeric-covariate design uses value-weighted and squared-value-weighted counts. The partial F-test for interactions is computed from residual sums of squares of nested models, both derived from the same aggregate tables. The mechanism is that every OLS quantity used in these A/B testing procedures is a sum over observations, and sums over users inside each class collapse to class-level totals.","core_discovery":"The central claim is that the OLS normal equations are fully determined by aggregate sufficient statistics when the design matrix is built from the same low-cardinality categorical fields used to define equivalence classes. For dummy-coded designs, the Gramian matrix $X'X$ reduces to simple and joint counts and $X'y$ reduces to conditional sums of the outcome, both read directly from the pivot table. For low-cardinality numeric covariates, the Gramian entries use $\\sum (\\text{value}_i \\cdot \\text{count}_i)$ and $\\sum (\\text{value}_i^2 \\cdot \\text{count}_i)$, with outcome sums in $X'y$; the worked example gives the same ATE estimate as individual-level regression. Residual sums of squares come from the pooled or per-arm total sum of squares $\\sum y^2$ minus $\\beta'(X'X)\\beta$, which yields the standard errors. Where microdata would need flexible heteroskedasticity-robust standard errors, the paper switches to a conservative variance estimator that stays computable from aggregates.","pith_inferences":["Beyond the paper, the same Gramian-from-counts identity should transfer to observational and survey OLS whenever all covariates are low-cardinality categorical fields, so the method is not limited to randomized experiments.","Beyond the paper, regression pipelines that accept only aggregate inputs would make incidental re-identification of specific users structurally harder for downstream analysts, an operational privacy benefit the paper does not develop.","Beyond the paper, a direct testable extension is to fully crossed interaction designs with more than two factors, where the nesting of Gramians that powers the partial F-test should continue to hold.","Beyond the paper, robustness procedures built on per-observation residuals — clustered standard errors, the bootstrap, or Eicker-White heteroskedasticity-robust errors — form a boundary the aggregate tables cannot cross, since those quantities are not functions of class totals alone."],"forward_implications":["Any A/B test comparison that can be written as OLS on low-cardinality categorical or numeric covariates can be run from aggregate tables without retaining user-level rows.","Partial F-tests give a single omnibus statistic for interactions between concurrent experiments and for categorical heterogeneous-treatment-effect checks, regardless of the number of arms.","Regression adjustment for variance reduction works from the same aggregates, with a conservative standard error available when treatment-arm sample sizes differ.","Storage and Gramian-construction cost drop from $O(n^2 k)$ to $O(m^2 k)$ when the number of equivalence classes $m$ is much smaller than the number of users $n$.","The local protocol can stop collecting raw telemetry after updating the aggregates, so raw data never needs to be retained."],"supporting_citations":[{"why":"Defines k-anonymity and the equivalence-class aggregation the method assumes.","marker":"[Samarati and Sweeney, 1998]"},{"why":"Defines CUPED, the regression-adjustment technique the aggregate method reproduces.","marker":"[Deng et al., 2013]"},{"why":"Supplies the ANCOVA2 regression-adjustment framework used in the numeric-covariate example.","marker":"Lin [2013]"},{"why":"Supplies the conservative variance estimator used for the treatment-effect standard error without microdata.","marker":"Ding [2023]"},{"why":"Provides the population-ATE variance term used in the regression-adjustment example.","marker":"[Imbens and Wooldridge, 2009]"}],"fun_headline_variants":["Anonymized A/B tests: exact OLS, zero microdata","Run A/B tests on aggregates, get identical OLS results","K-anonymity meets OLS: exact regressions without raw data","Privacy-preserving A/B tests: same coefficients, no individual rows","Aggregate tables, exact OLS: A/B testing without microdata"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method is valid only when every covariate in the regression is a low-cardinality field used to define the equivalence classes, and, in the local variant, raw telemetry must not be retained after the aggregates are updated.","fun_headline_variants_meta":{"raw":{"variants":["Anonymized A/B tests: exact OLS, zero microdata","Run A/B tests on aggregates, get identical OLS results","K-anonymity meets OLS: exact regressions without raw data","Privacy-preserving A/B tests: same coefficients, no individual rows","Aggregate tables, exact OLS: A/B testing without microdata"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000997,"raw_usage":{"total_tokens":4220,"prompt_tokens":945,"completion_tokens":3275,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":561,"completion_tokens_details":{"reasoning_tokens":3182}},"tokens_in":561,"tokens_out":3275,"duration_ms":21916,"temperature":1.0,"reasoning_tokens":3182,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T15:15:16.524443+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same regression specification on microdata and on equivalence-class tables using a continuous covariate that was not part of the aggregation key: the aggregate Gramian cannot encode that covariate, so the coefficients will not match. A second check is to compute Eicker-White heteroskedasticity-robust standard errors from the microdata; the aggregate tables cannot reproduce them because those errors require per-observation residuals.","supporting_citations":[{"cited_title":"Protecting privacy when disclosing information: k-anonymity and its enforcement through generalization and suppression, 1998","cited_arxiv_id":null,"evidence_quote":"Defines k-anonymity and the equivalence-class aggregation the method assumes."},{"cited_title":"Improving the sensitivity of online controlled experiments by utilizing pre-experiment data","cited_arxiv_id":null,"evidence_quote":"Defines CUPED, the regression-adjustment technique the aggregate method reproduces."},{"cited_title":"Agnostic notes on regression adjustments to experimental data: Reexamining freedman’s critique","cited_arxiv_id":null,"evidence_quote":"Supplies the ANCOVA2 regression-adjustment framework used in the numeric-covariate example."}],"review_version":1}