Pith. sign in

REVIEW 5 major objections 4 minor 9 references

PHSafe: Disclosure Avoidance for the 2020 Census Supplemental Demographic and Housing Characteristics File (S-DHC)

T0 review · 5 major / 4 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read PHSafe proves that the 2020 Census S-DHC file satisfies zero-concentrated differential privacy under a per-person neighboring definition, with privacy loss summed over population group levels.

desk verdict A valuable system paper on a real deployed DP census product; the privacy analysis is mostly sound, and the stress-test concern about Theorem 3 does not sink the theorem, though the proof needs rewriting. read the letter →

arxiv 2505.01254 v1 pith:6CURRAHB submitted 2025-05-02 cs.CR cs.CY

William Sexton , Skye Berghel , Bayard Carlson , Sam Haney , Luke Hartman , Michael Hay , Ashwin Machanavajjhala , Gerome Miklau
show 5 more authors
Amritha Pai Simran Rajpal David Pujol Ruchit Shrestha Daniel Simmons-Marengo
This is my paper · ORCID
classification cs.CRcs.CY
keywords differentialprivacyzero-concentrateddiscreteGaussianmechanism2020Censussupplementaldemographicandhousingcharacteristicsfiledisclosureavoidanceprivatejoinsprivacy-lossaccounting
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper presents PHSafe, the disclosure-avoidance algorithm the U.S. Census Bureau used to protect the 2020 Census Supplemental Demographic and Housing Characteristics File (S-DHC). It establishes that adding discrete Gaussian noise to person-by-household tabulation counts yields a formal zero-concentrated differential privacy guarantee, despite the difficulty that changing one person's record can alter the properties of more than one household. The privacy argument works by bounding the stability of a truncate-and-join step and then converting that stability into a zCDP budget per population group level. A careful reader would care because this is a rare, fully documented production deployment of differential privacy on national census data, with explicit parameters and accuracy targets.

What carries the argument

The load-bearing object is the truncate-and-join operator of Algorithm 3: it keeps at most τ person records per household identifier, drops any non-unique household records, and then performs an inner join on MAFID. Lemma 6 proves this operator is (2τ+2)-stable, which is what turns a person-level neighboring change into a bounded change to the count vector feeding the discrete Gaussian mechanism. The second piece is the multidimensional discrete Gaussian mechanism of Algorithm 5, whose tail bounds (via a proposition of Canonne, Kamath, and Steinke) let the authors translate a chosen noise scale into a 90% margin of error, and thereby into a privacy-loss parameter ρ_i.

What would settle it

Compute, using the actual 2020 Census Edited File, the maximum symmetric difference of the truncate-and-join output over all single-person record additions, removals, and value changes; if any case exceeds 2τ+2 for the join output (or 2 for the unit view), the zCDP bound fails.

Watch

Extended reading notes

Core claim

The central claim is that the PHSafe algorithm, as it produces the S-DHC tables, satisfies ρ = Σ_{i∈[1,ω]} ρ_i-zCDP for Algorithm 1 and bounded ρ = Σ_{i∈[1,ω]} 2ρ_i-zCDP for the bounded-neighbor variant. The critical step is Lemma 6: the truncate-and-join operator that attaches household attributes to person records is (2τ+2)-stable, where τ caps the number of persons kept per household. Given this stability, the vectorized discrete Gaussian mechanism run with scale (2τ+2)²/(2ρ_i) per population group level composes to the stated guarantee, and the bounded-DP conversion follows by treating a changed record as a deletion plus an addition, giving the √2 sensitivity factor that doubles the budget.

Load-bearing premise

The argument stands on the assumption that altering a single person's record can change at most two household records, so the (2τ+2) join-stability bound and the 2-stability of the unit view are not underestimates.

Editorial extensions

If this is right

  • If the proof is correct, the S-DHC release carries a quantified, formal privacy guarantee that holds against an adversary who may change any one person's record values, including which household that person belongs to.
  • The (2τ+2) stability bound gives a reusable recipe for private joins between a high-multiplicity table and a unique-key table: truncate the high-multiplicity side, enforce uniqueness on the other, and the sensitivity is linear in τ.
  • The paper's MOE formulas mean that any future S-DHC-like product can choose privacy budgets and truncation thresholds directly from accuracy targets, without rederiving the noise-to-error relationship.
  • The bounded zCDP conversion shows that the same algorithm also gives a guarantee under the more common 'change one record' neighbor definition, at the cost of doubling each level's budget.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the stability analysis transfers, the same truncate-and-join template could be applied to other government statistical products that join person-level and household-level records, provided the unit view is verified to be 2-stable on real data.
  • The proof's reliance on a √2 factor for bounded neighbors suggests a general lesson: for queries that can change several cells simultaneously, the bounded-neighbor budget should account for both the deletion and the addition directions rather than only the symmetric difference size.
  • One testable extension is to measure empirically, on the full census microdata, whether any single-person change ever moves more than two household records; if it did, the (2τ+2) bound would need revision or a larger budget.
  • The MOE-based parameter tuning implicitly assumes truncation error is negligible relative to noise error; a user of the released tables should treat the published credible intervals as covering only the noise component, not truncation or coverage error.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. The paper describes PHSafe, the disclosure-avoidance algorithm used by the U.S. Census Bureau to produce the 2020 Census Supplemental Demographic and Housing Characteristics File (S-DHC). It gives pseudocode for the algorithm, which filters, joins, truncates, and then adds discrete Gaussian noise to count vectors for each population-group level. The paper states and proves four theorems: Theorems 1 and 2 claim unbounded zCDP guarantees for Algorithm 1 and Algorithm 2, and Theorems 3 and 4 claim bounded zCDP guarantees with twice the per-level budgets. The proof strategy centers on a stability analysis of the truncate-and-join operator (Lemma 6), a 2-stable model of the unit dataframe, and group privacy under composition. The paper also describes the Tumult Analytics implementation, parameter tuning via an Excel tool (PHExplore), and the resulting MOE targets and privacy-loss budgets in Table 10.

Significance. If the proofs are correct, this is a valuable case study of a large-scale deployment of differential privacy at a national statistical agency. The paper gives explicit, reproducible pseudocode, derives privacy-loss budgets for a real product, and documents the privacy-utility trade-offs in a concrete setting. The stability analysis of household-level joins and the explicit treatment of truncation thresholds are useful contributions to the differential privacy literature. The paper also clearly separates the formal privacy abstraction from implementation details and parameter choices.

major comments (5)
  1. [§5.3, Theorem 3] The proof of Theorem 3 asserts that a bounded-neighbor replacement results in an L2 sensitivity of sqrt(2)(2τ+2), based on the claims that adding a record increases a single cell by at most (2τ+2) and removing a record decreases a single cell by at most (2τ+2). These claims are not established: a single add/remove step can affect multiple cells (for example, a change in household type can move several joined rows between cells), and the proof does not show that the two effect vectors have disjoint supports or otherwise justify the sqrt(2) factor. This bound is load-bearing because it directly supports the 'Bounded Privacy Loss' column of Table 10; if the true bounded sensitivity is 2(2τ+2), then the bounded ρ values in Table 10 are understated by a factor of 4. The authors should either provide a rigorous proof of the bounded L2 sensitivity, or revise the bounded-privacy budgets accordingly.
  2. [§5.2, Theorem 2] The proof of Theorem 2 concludes with D_α ≤ α·Σ_i ρ_i/2, which contradicts the theorem statement ρ = Σ_i ρ_i. Tracing through Algorithm 2, the unit-view transformation is 2-stable, so the count-vector sensitivity is 2 (not 1 as stated in the proof), and the base mechanism is called with Δ=2 and parameter ρ_i; Lemma 3 therefore gives per-level privacy ρ_i, not ρ_i/2. The proof text should be corrected so that it yields the stated bound.
  3. [§5.3, Theorem 4] Theorem 4's proof contains the phrase 'given a privacy parameter of ρ_i/4' and then concludes D_α ≤ α·2ρ_i. Since Algorithm 2 invokes the base mechanism with parameter ρ_i and Δ=2, the per-level bounded privacy would be 2ρ_i only if the bounded sensitivity is 2√2; the role of ρ_i/4 in the argument is unclear. Additionally, the proof repeats the unsubstantiated 'single cell' reasoning from Theorem 3. The derivation should be rewritten coherently, or the bounded-privacy claim adjusted.
  4. [§5.1, near Lemma 6] The proof of Lemma 6 relies on the assertion that the unit dataframe derived from the base person dataframe is 2-stable with respect to a one-person change, supported only by an example of a household-type change. Since this stability factor appears in all four theorems and in the noise calibration of Algorithm 2, the paper should provide a formal definition of the base person dataframe and a proof that the unit-view transformation has stability at most 2, including cases where the householder is added or removed. As written, the informal argument leaves open the possibility that a single person change could affect more than one household record, which would increase the sensitivity.
  5. [Table 10 note, §7.3.1] The note under Table 10 states that the total population of the United States is published without noise and that the bounded privacy-loss budgets were 'stressed' for purposes of interpreting the privacy guarantee. If any S-DHC cell is released without noise, the claimed bounded zCDP guarantee for the full product does not follow from Theorems 3 and 4. Please clarify whether this un-noised statistic is part of the PHSafe release and, if so, how the privacy guarantee applies; if it is a separately published statistic outside the S-DHC, state that explicitly.
minor comments (4)
  1. [§5.1, Lemma 6 proof] The statement that the post-truncation unit dataframe differs by at most 2 records is asserted for the unit view without a formal derivation; a more detailed justification or a reference would improve rigor.
  2. [§7.1, Corollary 2] The formula ρ = 1.3448Δ^2/⌊MOE⌋^2 uses the floor of the MOE in the denominator, which is unusual; please clarify whether the floor applies to the MOE bound or to the resulting ρ.
  3. [Throughout] There are numerous typographical issues, including 'T uning' in section headings, spacing around 'R´enyi', and 'P .L. 94-171'; the manuscript should be proofread carefully.
  4. [§6.3] The claim that preprocessing filters do not change the stability analysis is plausible, but the paper should explicitly state that the formal privacy proofs cover the pseudocode abstraction rather than the full implementation unless a stability-equivalence proof is supplied.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: the unbounded zCDP proof is self-contained from external stability and discrete-Gaussian lemmas; the bounded-conversion sqrt(2) step is a proof gap, not circularity.

full rationale

PHSafe's main claimed privacy guarantee does not reduce to its inputs. Theorem 1 is derived from Lemma 6 (the Algorithm 3 truncate-and-join is (2τ+2)-stable) and Lemma 3 (discrete Gaussian mechanism privacy with sensitivity parameter Δ), using standard zCDP composition and stability lemmas. Lemma 6's proof is a stability composition over the top-τ truncation (cited to Ebadi et al.) and the unit-view 2-stability induced by a base-person-record change; none of these ingredients assumes the theorem's conclusion. The bounded-zCDP conversion in Section 5.3 contains a load-bearing but unproved assertion that a replacement has L2 sensitivity sqrt(2)(2τ+2) rather than (2τ+2) or 2(2τ+2); this is a correctness or proof-completeness concern, not a circular one, because the bounded guarantee is not defined by that assertion. The privacy-loss budgets in Table 10 and the MOE/ρ relation in Corollary 2 are policy targets and algebraic consequences of an external tail bound, not fitted values relabeled as predictions. The paper's self-citations (Tumult Analytics [9] and the programming-framework lemma [6]) describe implementation or standard composition facts and are not the load-bearing evidence for the main theorem. Manuscript-visible limitations, including the Table 10 footnote about internally stressed bounded budgets and Section 6's informal argument that input validation, preprocessing, and the single-run implementation do not alter stability, are transparency caveats about interpretation and proof formality, not circular derivations. Accordingly, no step reduces to its own input.

Assumptions & free parameters 2 free parameters · 6 assumptions · 0 invented entities

The central privacy proof relies on standard DP machinery (zCDP composition, discrete Gaussian tail bounds, stability-based analysis). The only paper-specific assumptions are the 2-stability of the unit view and the (2τ+2)-stability of the truncate-and-join, both argued in Section 5.1. No new entities are postulated; parameters are policy choices.

free parameters (2)
  • Truncation threshold τ = 10 for PH1/PH2/PH4/PH7; 6 for PH3/PH6; N/A for denominator tables
    Limits the number of persons per household in the join; chosen as a policy/accuracy trade-off, not estimated from data.
  • Per-level privacy-loss budgets ρ_i = Varies by table and population group level; unbounded values range from 0.000022 to 0.662976 in Table 10
    Allocated per population group level; derived from MOE targets via Corollary 2 and approved by the Census Bureau's DSEP committee.
assumptions (6)
  • standard math Definition of ρ-zCDP and sequential composition/postprocessing properties
    Invoked throughout Section 4.4 and used in the proofs of Theorems 1-4.
  • standard math Discrete Gaussian tail bound and zCDP guarantee (Canonne et al., Lemma 3)
    Used in Lemma 3, Corollary 1, and the budget calculations in Section 7.1.
  • standard math Top-τ truncation is 2-stable (Ebadi et al.)
    Used in Lemma 6 to bound the person-side stability of the private join.
  • domain assumption The unit view is 2-stable with respect to a change in one base person record
    Section 5.1 assumes changing one person affects at most one household record; this drives the (2τ+2) stability bound.
  • standard math Group privacy for zCDP (Lemma 2)
    Used to lift per-level guarantees through the stable transformation T.
  • ad hoc to paper All unbounded ρ-zCDP mechanisms also satisfy bounded 4ρ-zCDP
    Stated without proof or citation in Section 5.3; used only as a baseline comparison, not in the main derivations.

how reviews work

0 comments
Cite this review

Pith. "Pith review of PHSafe: Disclosure Avoidance for the 2020 Census Supplemental Demographic and Housing Characteristics File (S-DHC)." pith.science (2026). https://pith.science/paper/6CURRAHB

@misc{pith2026250501254,
  author       = {Pith},
  title        = {Pith review of: PHSafe: Disclosure Avoidance for the 2020 Census Supplemental Demographic and Housing Characteristics File (S-DHC)},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6CURRAHB}},
  note         = {Machine review of arXiv:2505.01254}
}
read the original abstract

This article describes the disclosure avoidance algorithm that the U.S. Census Bureau used to protect the 2020 Census Supplemental Demographic and Housing Characteristics File (S-DHC). The tabulations contain statistics of counts of U.S. persons living in certain types of households, including averages. The article describes the PHSafe algorithm, which is based on adding noise drawn from a discrete Gaussian distribution to the statistics of interest. We prove that the algorithm satisfies a well-studied variant of differential privacy, called zero-concentrated differential privacy. We then describe how the algorithm was implemented on Tumult Analytics and briefly outline the parameterization and tuning of the algorithm.

Figures

Figures reproduced from arXiv: 2505.01254 by the authors.

Figure 1
Figure 1. Stability of the J view. The person dataframe and unit dataframe are derived from the base person dataframe via a stability 1 and 2 transformation, respectively. Recall that, depending on the table in question, the PHSafe algorithm takes one of two forms: Algorithm 1 or Algo￾rithm 2. Here, we show how the privacy loss of each of these algorithms is derived. These values are with respect to unbounded zCDP, the conver… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

9 extracted references · 4 canonical work pages

  1. [1]

    Code Title 13—Census

    U.S. Code Title 13—Census. https://www.law.cornell.edu/uscode/text/13

  2. [2]

    Potential Privacy Lapse Found in Americans’ 2010 Census Data

    Seth Borenstein. Potential Privacy Lapse Found in Americans’ 2010 Census Data. https: //apnews.com/article/aba8e57c145047b5bab11b62baaa7f7a, February 2019

    work page 2010

  3. [3]

    https://www.census.gov/programs-surveys/ decennial-census/2020-census/planning-management/memo-series/ 2020-memo-2019_25.html, October 2019

    Memorandum 2019.25: 2010 Demonstration Data Products – Design Parameters and Global Privacy-Loss Budget. https://www.census.gov/programs-surveys/ decennial-census/2020-census/planning-management/memo-series/ 2020-memo-2019_25.html, October 2019

    2019

  4. [4]

    Concentrated Differential Privacy: Simplifications, Exten- sions, and Lower Bounds

    Mark Bun and Thomas Steinke. Concentrated Differential Privacy: Simplifications, Exten- sions, and Lower Bounds. CoRR, abs/1605.02065, 2016

    arXiv 2016

  5. [5]

    Privacy Integrated Queries: An Extensible Platform for Privacy-preserving Data Analysis

    Frank McSherry. Privacy Integrated Queries: An Extensible Platform for Privacy-preserving Data Analysis. In Ugur C ¸ etintemel, Stanley B. Zdonik, Donald Kossmann, and Nesime Tat- bul, editors, Proceedings of the ACM SIGMOD International Conference on Management of Data, SIGMOD 2009, Providence, Rhode Island, USA, June 29 - July 2, 2009, pages 19–30. ACM, 2009

    work page 2009

  6. [6]

    A Programming Framework for OpenDP

    Marco Gaboardi, Michael Hay, and Salil Vadhan. A Programming Framework for OpenDP. 2020

    work page 2020

  7. [7]

    Canonne, Gautam Kamath, and Thomas Steinke

    Cl ´ement L. Canonne, Gautam Kamath, and Thomas Steinke. The Discrete Gaussian for Dif- ferential Privacy. CoRR, abs/2004.00010, 2020

    arXiv 2004

  8. [8]

    Sampling and Partitioning for Differential Privacy

    Hamid Ebadi, Thibaud Antignac, and David Sands. Sampling and Partitioning for Differential Privacy. In 2016 14th Annual Conference on Privacy, Security and Trust (PST) , pages 664–673, 2016

    work page 2016

Show all 9 references
  1. [9]

    Tumult Analytics: A Robust, Easy-to-use, Scalable, and Expressive Framework for Differential Privacy

    Skye Berghel, Philip Bohannon, Damien Desfontaines, Charles Estes, Sam Haney, Luke Hart- man, Michael Hay, Ashwin Machanavajjhala, Tom Magerlein, Gerome Miklau, Amritha Pai, William Sexton, and Ruchit Shrestha. Tumult Analytics: A Robust, Easy-to-use, Scalable, and Expressive ...

    2022 arXiv

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.