{"id":"0665dc3e-69e8-4512-abc6-04ba48606608","arxiv_id":"2505.03072","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"SafeTab-H adds discrete Gaussian noise to household counts under a formal differential-privacy guarantee, and this paper provides the algorithm description, privacy proof, and parameter selection for the 2020 Detailed DHC-B release.","lead":"This paper describes SafeTab-H, the algorithm the U.S. Census Bureau uses to add formal privacy protection to 2020 Census household type and tenure tables broken out by detailed race and ethnicity. It explains the algorithm, proves its privacy guarantee, and documents how the Census Bureau chose the accuracy and privacy parameters.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The privacy proof treats T01001 as a fixed exogenous input, but in the deployed pipeline it is a private SafeTab-P output; Theorem 1 therefore proves only conditional zCDP and does not establish an end-to-end guarantee for the DHC-B release.","rationale":"After re-deriving the sensitivity argument, the internal proof is sound for fixed h: each record contributes to at most s groups, the unbounded sensitivity is √s, the bounded sensitivity is √(2s), and the discrete Gaussian scaling in Algorithm 3 gives the claimed ρ and 2ρ factors. The postprocessing steps in §6.3 are covered by Lemma 2, and the public KeySet construction does not invalidate the conditional guarantee. I found no internal inconsistency in Theorems 1–2. The real soft spot is the exogeneity of T01001. The paper is transparent about this (Sections 3.1.2, 3.2, 6.4), but the reader's strongest claim extrapolates to the release-level guarantee, and that extrapolation is exactly where the conditional proof becomes insufficient. Since SafeTab-P itself is differentially private, the gap is repairable by composition under a unified neighboring definition, so the appropriate verdict remains conditional; no rejection is warranted. The claimed open-source code is not linked, which is a reproducibility issue but not a correctness flaw in the privacy analysis.","tokens_in":19826,"tokens_out":14062,"duration_ms":150187,"concrete_test":"Model h as SafeTab-P(person_records) and analyze the composed mechanism M(x)=SafeTab-H(df(x), h(x)). Take a population group whose true T01001 count is exactly one above θ3 and let a single householder race change move it one below; trace Algorithm 2's branch selection and compute the L2 norm of the change in the combined HT/T count vector (T03004 8-cell basis vs T03001 1-cell basis, and T04002 vs T04001). If that norm exceeds √s, Theorem 1's Subclaim 1 fails when h is allowed to vary; if it does not, compute the Rényi divergence D_α for α>1 and compare with (ρ_P+ρ_total)·α. A successful check must either state the added SafeTab-P budget needed or show the end-to-end guarantee holds without it.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Sections 3.1.2 and 3.2 explicitly define the T01001 counts (T,h) as fixed exogenous inputs, and the proof of Theorem 1 leans on this: Subclaim 1 assumes \"the population group P and its corresponding T01001 count c are fixed\" before bounding the sensitivity of the adaptive vectorization by 1. In the deployed system, Section 6.4 says the input is the output of SafeTab-P computed from the same confidential 2020 CEF, and Section 1 notes that SafeTab-P outputs feed SafeTab-H. Thus a change to one household record can also change h(P), including crossing a threshold θ1, θ2, θ3, or ψ1 in Algorithm 2. The proof never bounds this effect: the selected table basis, and even the set of released population groups, becomes data-dependent. Consequently Theorem 1 establishes ρtotal-zCDP only conditional on the realized T01001 output; it does not by itself prove a formal zCDP guarantee for the combined DHC-A/DHC-B release. The note under Table 9 (total population published without noise, bounded budgets \"stressed\") reinforces that the neighboring semantics at the national total are delicate. This is an acknowledged scoping limitation rather than a hidden inconsistency, but it is load-bearing for any claim that the full Detailed DHC-B release is formally differentially private end-to-end.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper describes SafeTab-H, the disclosure-avoidance algorithm used to produce the 2020 Census Detailed DHC-B household-type and tenure tabulations. It gives a pseudocode specification of the algorithm, proves that the algorithm satisfies zero-concentrated differential privacy (zCDP) with respect to addition/removal of a household record and bounded zCDP with a factor-two loss, discusses the implementation in the Tumult Analytics framework, and reports the parameter choices and expected margins of error for the production release. The central privacy argument bounds the L2 sensitivity of the adaptive vectorization procedure and applies the discrete Gaussian mechanism with stability-scaled noise, then composes over population-group levels and table classes.","tokens_in":20149,"tokens_out":8805,"duration_ms":79454,"significance":"If the claimed privacy guarantee held end-to-end, this would be a valuable systems-and-theory case study: it is one of the first published descriptions of a deployed disclosure-avoidance system with a formal zCDP analysis, a clean sensitivity argument that correctly accounts for the stability of the record-to-population-group mapping, and a practical error analysis using discrete Gaussian tail bounds. The paper also provides reproducible open-source implementation details and an explicit parameter-accuracy trade-off analysis. These strengths are real and should be credited. However, the significance is contingent on closing a scoping gap in the privacy claim, because the proof conditions on T01001 counts that are themselves outputs of a separate private algorithm (SafeTab-P); the end-to-end guarantee for the Detailed DHC-B release is therefore not established as written.","major_comments":[{"comment":"The privacy proof treats the T01001 counts (T,h) as fixed, exogenous inputs (Sections 3.1.2 and 3.2), and the sensitivity argument in Theorem 1 explicitly assumes that \"the population group P and its corresponding T01001 count c are fixed\" (Subclaim 1). In the deployed system, however, these counts are outputs of SafeTab-P computed from the same confidential 2020 CEF (Section 6.4), and the introduction notes that SafeTab-P outputs feed SafeTab-H. A change to a single household record can therefore change h(P), can change the threshold comparisons in Algorithm 2 (c > θ1, θ2, θ3, ψ1), and can change the set T of population groups that receive releases via SafeTab-P suppression (Section 6.3.2). None of these effects are bounded in the proof. Consequently, Theorem 1 establishes ρtotal-zCDP only conditional on the realized T01001 output, and the paper does not prove the end-to-end guarantee advertised in Section 2.6 (\"with respect to arbitrary changes of any household record's values\"). The note under Table 9 and the discussion in Section 6.4 show that the authors are aware of the issue, but the abstract and introduction nevertheless state the guarantee unconditionally. The authors should either (a) restrict the privacy claim to the conditional statement and adjust the abstract and Section 2.6 accordingly, or (b) provide a composition analysis of SafeTab-P followed by SafeTab-H that accounts for the effect of household-record changes on T01001, or (c) give a formal argument that T01001 is unaffected by the neighboring relation used. As written, this is a load-bearing gap in the central claim.","section":"§3.1.2, §3.2, §5 (Theorems 1 and 2), §6.4"}],"minor_comments":[{"comment":"The formula \"ρt = 1.92 / ⌊MOE⌋^2\" appears to use the floor of the MOE where the preceding derivation gives ρ = 1.92/MOE^2; please clarify or correct the expression.","section":"§7.1, Corollary 2"},{"comment":"The proof of Subclaim 2 (the tenure vectorization) is omitted as \"nearly identical\" in both theorems; since the tenure vector uses a different set of thresholds and categories, a one-sentence explanation of why the identical argument applies would help the reader verify the proof.","section":"§5, Theorems 1 and 2"},{"comment":"The notation \"T1 counts\" should read \"T01001 counts\"; also, the subscript in \"ρt i\" is rendered ambiguously and should be typeset as ρ_i^t.","section":"Table 8"},{"comment":"In the else branches, v_HT.append(df.count()) appends a scalar to a vector; the pseudocode should make explicit that a one-element vector is appended, or the vectorization should be defined consistently for all branches.","section":"Algorithm 2"},{"comment":"The sentence \"Because the DHC releases total housing unit counts without noise infusion, SafeTab-H does not produce statistics for geographic areas where no occupied or vacant housing units exist\" is confusing on first reading; clarify the connection to the input-sourcing discussion and to the claim about geographic areas with no housing units.","section":"§6.4"},{"comment":"The phrase \"bounded privacy-loss budgets in this table were stressed by Census Bureau staff\" is vague; please explain what \"stressed\" means in terms of the privacy guarantee, or omit the remark if it is not part of the technical analysis.","section":"Table 9 note"}],"recommendation":"major_revision","confidential_remarks":"This is a system-description paper with a formal privacy proof. The main gap is the conditional nature of the zCDP guarantee: the proof fixes T01001, which in production is a SafeTab-P output. This is addressable by either explicitly scoping the claims or adding a composition analysis, but it affects the paper's central advertised guarantee. The paper is otherwise well structured, and the sensitivity analysis and error analysis are clean. The reliance on the authors' own Tumult Analytics library is not itself a problem, but an independent specification of the privacy accounting in the implementation would strengthen the paper's credibility."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThis is a good paper to know about if you follow the Census DAS or care how DP is actually deployed at national scale. It gives a complete, readable pseudocode description of SafeTab-H, the algorithm behind the 2020 Detailed DHC-B, including the adaptive table-variant selection, the stability-9 accounting, and the postprocessing steps. That level of operational detail is rare, and it is the main contribution. The components are standard (discrete Gaussian, zCDP composition), but the specific combination and the honest parameter tables make this a useful reference.\n\nThe privacy proof is correct for the algorithm as specified. The sensitivity argument in Subclaim 1 is clean: with T01001 fixed, each added record changes exactly one basis cell, and the stability bound gives Euclidean sensitivity sqrt(s). Applying Lemma 3 with rho/s per level and composing is textbook but done carefully. I do not see a gap in the math as presented.\n\nThe soft spot is the one the stress-test note flags: T01001 is treated as fixed and exogenous (Sections 3.1.2 and 3.2), but in deployment it is an output of SafeTab-P computed from the same confidential CEF. Section 6.4 confirms this. So Theorem 1 proves zCDP for SafeTab-H conditional on its T01001 input, not for the combined DHC-A/DHC-B release. The paper is fairly explicit about treating T01001 as an input, and it never claims end-to-end composition, so this is a scoping limitation rather than a hidden contradiction. But it is load-bearing if anyone cites this paper to say the Detailed DHC-B release is formally DP end-to-end. The note under Table 9 about stressed bounded budgets reinforces that the semantics at the national total are delicate.\n\nSmaller issues: the proof of Subclaim 2 is omitted as \"nearly identical,\" which is fine. The adaptive thresholds (theta and psi) are not disclosed, and the claimed open-source code is not linked; both hamper full reproducibility, but they are policy and logistics, not scientific flaws.\n\nWho should read this: DP practitioners wanting a concrete large-scale case study, and anyone studying the 2020 Census disclosure avoidance system. It deserves a serious referee and publication, ideally with the code link and threshold values added, and with an explicit sentence that the stated guarantee is for SafeTab-H conditional on SafeTab-P outputs, not for the composed pipeline.\n\nRecommendation: send to peer review. I would accept it with minor revisions.","headline":"Solid system description of a deployed Census DP algorithm; the proof is correct as scoped, but it conditions on T01001 counts that are themselves private SafeTab-P outputs, so the headline guarantee does not cover the full pipeline.","tokens_in":20713,"tokens_out":1619,"would_cite":true,"duration_ms":17716,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"SafeTab-H proves a formal zero-concentrated differential-privacy guarantee for the Detailed DHC-B household-type and tenure tabulations, with noise scaled to a nine-way per-record stability.","keywords":["differential privacy","zero-concentrated differential privacy","discrete Gaussian mechanism","disclosure avoidance","2020 Census","household type and tenure","race and ethnicity tabulations","stability"],"falsifier":"Feed SafeTab-H two neighboring household databases that are identical except for one added or removed record, with a fixed budget allocation, and empirically estimate the Renyi divergence of the two output distributions across several orders alpha; if any alpha shows D_alpha greater than rho_total times alpha, the stated zCDP claim is false. A concrete implementation would repeat this over many noise draws for a single population-group level with s=9 and compare against the theorem; to test the caveat rather than the theorem, rerun the same check while also allowing the T01001 input to differ between the two neighbors, which is the setting the paper's proof leaves open.","tokens_in":19631,"feed_emoji":"🔐","tokens_out":7326,"duration_ms":74413,"temperature":0.7,"pith_summary":"SafeTab-H is the disclosure-avoidance mechanism behind the 2020 Census's Detailed DHC-B, the release that tabulates household type and tenure by detailed race, ethnicity, and tribal affiliation across geographies. The paper's central claim is a formal privacy theorem: if each population-group level is given a privacy budget, then the whole algorithm satisfies rho_total-zero-concentrated differential privacy for the addition or removal of any household record, and bounded 2*rho_total-zCDP for arbitrarily changing one household's values. A sympathetic reader should care because this gives the fine-grained household tables a provable, composable guarantee rather than a best-effort suppression scheme, while keeping accuracy predictable: directly computed cells have a 95% margin of error at most floor(1.96*sqrt(s/(2*rho))) with s=9. The proof treats the total-population counts that choose table granularity as fixed, non-sensitive inputs, although in production those counts come from an earlier private release.","feed_headline":"Household census tables get a formal privacy guarantee","feed_subtitle":"Discrete Gaussian noise gives each detailed race-and-tenure count a provable differential-privacy bound.","key_machinery":"The load-bearing object is the stacked count vector for each population-group level plus the VECTOR DISCRETE GAUSSIAN mechanism. The vector is built by assigning each household to the population groups determined by its householder's race and ethnicity codes, so one record can appear in at most nine groups at any level, giving a stability of s=9 and hence an L2 sensitivity of at most sqrt(s) under addition or removal of one record. The mechanism adds independent discrete Gaussian noise with variance 1/(2*rho) to each entry, scaled to rho_i/s per level, which is exactly what converts the sensitivity bound into a zCDP guarantee and produces the closed-form margin-of-error formula. The adaptive choice of table granularity is driven by the T01001 counts, which the proof fixes as non-sensitive inputs so the choice itself adds no privacy loss.","core_discovery":"On its own terms, the paper establishes that Algorithm 1, which flat-maps each household to the population groups it belongs to, adaptively selects a household-type variant (T03001 through T03004) and a tenure variant (T04001 or T04002) by comparing the population group's published T01001 total to thresholds, vectorizes the basis counts, and adds independent discrete Gaussian noise, satisfies rho_total-zero-concentrated differential privacy. The proof shows that the stacked vector for a level changes in at most s=9 entries by 1 under addition or removal of one household, giving L2 sensitivity sqrt(s), so the discrete Gaussian mechanism with rho_i/s per entry delivers rho_i-zCDP at that level; sequential composition sums the per-level budgets. The bounded-neighbor version doubles each budget to account for a simultaneous removal and addition. The same analysis yields a concrete error bound: with privacy budget rho, each directly computed cell has a 95% margin of error at most floor(1.96*sqrt(s/(2*rho))), and the parameter section shows how specified margins of error fix the privacy budgets.","pith_inferences":["In the real production pipeline the T01001 counts are themselves outputs of an earlier differentially private release computed from the same confidential file, so the paper's guarantee is conditional; the true end-to-end budget for DHC-B after DHC-A would require a composition analysis of the two mechanisms.","The same stability-and-discrete-Gaussian recipe applies to any tabular system where one record can touch a bounded number of overlapping cells; a testable extension is to run SafeTab-H on synthetic data with known true counts to verify that empirical error distributions match the stated margin-of-error bound across geography levels.","If suppression triggers are considered part of the released mechanism rather than fixed postprocessing, the paper's postprocessing argument depends on those decisions being made from public outputs; a stricter audit would check whether the finished release, including suppression, still satisfies the stated zCDP guarantee.","The bounded-neighbor budget doubling is conservative for edits that do not cross population-group thresholds, so a more granular analysis could attribute privacy loss proportional to the number of table cells actually changed by an edit."],"forward_implications":["Each cell of the released Detailed DHC-B carries a formal zCDP guarantee, and combining the DHC-B with other releases requires only adding their privacy-loss budgets.","Accuracy is set in advance: any directly computed cell with budget rho has a 95% margin of error at most floor(1.96*sqrt(s/(2*rho))), so the margin-of-error targets fix the required rho.","Edits to a single household, such as changing its reported race or tenure, cost bounded 2*rho_total-zCDP, a known factor-of-two over addition-and-removal privacy loss.","All postprocessing, including marginal aggregation, suppression, and coterminous-geography consistency, happens after noise is added, so none of it weakens the guarantee.","The stability constant s=9 is data-independent and fixed by the eight-race-code cap, so the proof's budget accounting does not depend on what the census data actually contains."],"supporting_citations":[{"why":"Defines zero-concentrated differential privacy and supplies the sequential composition and postprocessing lemmas used in Theorems 1 and 2.","marker":"[8]"},{"why":"Supplies the discrete Gaussian mechanism, its zCDP sensitivity guarantee, and the tail bounds used for the margin-of-error calculations.","marker":"[9]"},{"why":"Defines stability as the maximum number of queried cells a record can touch, which fixes s=9 in the sensitivity argument.","marker":"[7]"},{"why":"Sets the global privacy-loss budget and design parameters for the 2020 disclosure avoidance system that SafeTab-H must meet.","marker":"[6]"},{"why":"Specifies the Detailed DHC-A technical documentation, including the T01001 table and the detailed race and ethnicity groups that define population group levels.","marker":"[3]"}],"fun_headline_variants":["Household census counts get a provable privacy bound","SafeTab-H: zCDP guarantee for detailed census tables","Discrete Gaussian noise gives census tables DP with tight error bounds","2020 census household stats: provable privacy with zCDP","SafeTab-H: discrete Gaussian noise for census privacy"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The guarantee depends on treating the published total-population counts (T01001) that select each population group's table versions as fixed, non-sensitive inputs; in production those counts are outputs of an earlier private release from the same confidential data, and the paper does not compute the combined privacy loss of running both algorithms.","fun_headline_variants_meta":{"raw":{"variants":["Household census counts get a provable privacy bound","SafeTab-H: zCDP guarantee for detailed census tables","Discrete Gaussian noise gives census tables DP with tight error bounds","2020 census household stats: provable privacy with zCDP","SafeTab-H: discrete Gaussian noise for census privacy"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001617,"raw_usage":{"total_tokens":6421,"prompt_tokens":916,"completion_tokens":5505,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":532,"completion_tokens_details":{"reasoning_tokens":5422}},"tokens_in":532,"tokens_out":5505,"duration_ms":35983,"temperature":1.0,"reasoning_tokens":5422,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T04:22:25.986348+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Feed SafeTab-H two neighboring household databases that are identical except for one added or removed record, with a fixed budget allocation, and empirically estimate the Renyi divergence of the two output distributions across several orders alpha; if any alpha shows D_alpha greater than rho_total times alpha, the stated zCDP claim is false. A concrete implementation would repeat this over many noise draws for a single population-group level with s=9 and compare against the theorem; to test the caveat rather than the theorem, rerun the same check while also allowing the T01001 input to differ between the two neighbors, which is the setting the paper's proof leaves open.","supporting_citations":[{"cited_title":"Privacy Integrated Queries: An Extensib le Platform for Privacy-preserving Data Analysis","cited_arxiv_id":null,"evidence_quote":"Defines stability as the maximum number of queried cells a record can touch, which fixes s=9 in the sensitivity argument."},{"cited_title":"https://www.census.gov/programs-surveys/decennial-c ensus/2020-census/planning-ma October 2019","cited_arxiv_id":null,"evidence_quote":"Sets the global privacy-loss budget and design parameters for the 2020 disclosure avoidance system that SafeTab-H must meet."},{"cited_title":"https://www2.census.gov/programs-surveys/decennial/ 2020/technical-documentation","cited_arxiv_id":null,"evidence_quote":"Specifies the Detailed DHC-A technical documentation, including the T01001 table and the detailed race and ethnicity groups that define population group levels."}],"review_version":1}