◇ OpenCyber Academy
Doctoral research · Chapter 3 · English

Chapter 3 — Original contribution proposal

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Original contribution proposal

Lesson map

Lesson 03 published. Map, example, EX015.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Hypotheses"]
  N2["3.2 Generalisation as the baseline"]
  N3["3.3 Choosing the baseline setting"]
  N4["3.4 Planners as judges of utility"]
  N5["Lab — Generalisation and suppression for k = 5"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX015"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Hypotheses"]
  N2["3.2 Generalisation as the baseline"]
  N3["3.3 Choosing the baseline setting"]
  N4["3.4 Planners as judges of utility"]
  N5["Lab — Generalisation and suppression for k = 5"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX015"]

[Learning outcomes]
    |
    v
[3.1 Hypotheses]
    |
    v
[3.2 Generalisation as the baseline]
    |
    v
[3.3 Choosing the baseline setting]
    |
    v
[3.4 Planners as judges of utility]
    |
    v
[Lab — Generalisation and suppression for k = 5]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX015]

Learning outcomes

You will (1) write a doctoral proposal with hypotheses and criteria; (2) generalise records to reach k-anonymity; (3) explain the utility cost of generalisation.

3.1 Hypotheses

Ines states two hypotheses. H1: a differentially private release of origin-destination counts with epsilon one yields lower measured linkage risk than a k-anonymised journey file with k equal to five. H2: planners will accept the differentially private counts for timetable decisions at that epsilon, defined as at least two of three planners rating them usable. Each hypothesis has a measurable criterion and a stated threshold set before data exist. Prof. Aaltonen asks her to justify both thresholds in writing, which she does by citing the authority's current planning practice and the error tolerance planners already accept in manual surveys.

3.2 Generalisation as the baseline

To build a fair baseline, Ines must produce a k-anonymous file that a competent data steward would actually release. She generalises zones into blocks and birth years into bands, and any rider still in a group smaller than five is suppressed. The lab tries four settings on 20,000 synthetic riders. Exact values would suppress every record, two-zone blocks with five-year bands still suppress 51.4%, four-zone blocks with five-year bands suppress only 0.1%, and eight-zone blocks with ten-year bands suppress none. Each step that removes suppression also blurs where people actually travel.

3.3 Choosing the baseline setting

Ines chooses four-zone blocks and five-year bands as the baseline, because it suppresses only 24 of 20,000 riders while keeping 1,400 classes. The coarser eight-zone setting suppresses nothing but merges distinct suburbs that planners need to distinguish. She records the choice and its reason in the protocol, because a weak baseline would make differential privacy look better than it is. This follows the advice in NIST SP 800-188 that de-identification choices should be documented and justified for the intended release, so that reviewers can see whether the comparison was fair.

3.4 Planners as judges of utility

Utility is often measured only as numerical error, but Ines's hypothesis H2 asks people who use the data. Three Valemont planners will each receive the same set of journey tables, produced by both methods, without labels, and rate whether they could use each for a timetable decision. Ines will also report mean absolute error so that readers can compare her result with other studies. She explains in the proposal that combining a human judgement with a numerical metric makes the study more relevant to the authority's actual decision about what kind of data to publish.

Lab — Generalisation and suppression for k = 5

# Generalise synthetic rider records until every class has k >= 5; report suppression and information loss.
import random
from collections import Counter
r = random.Random(7)
riders = [(r.randrange(40), r.randrange(40), r.randrange(1940, 2008)) for _ in range(20000)]
def gen(x, zw, yw):
    return (x[0] // zw, x[1] // zw, x[2] // yw)
for zw, yw in [(1, 1), (2, 5), (4, 5), (8, 10)]:
    keys = [gen(x, zw, yw) for x in riders]; c = Counter(keys)
    small = sum(1 for k in keys if c[k] < 5)
    print(f"zones/{zw:<2d} years/{yw:<2d} classes {len(c):6d}  suppressed for k=5 {small:6d} ({small/len(keys):5.1%})")

Run with python3 lab_kanon.py. Verified output:

zones/1  years/1  classes  18228  suppressed for k=5  20000 (100.0%)
zones/2  years/5  classes   5430  suppressed for k=5  10282 (51.4%)
zones/4  years/5  classes   1400  suppressed for k=5     24 ( 0.1%)
zones/8  years/10 classes    175  suppressed for k=5      0 ( 0.0%)

Worked example

Ines states H1 and H2 with thresholds, generalises synthetic records and chooses four-zone blocks with five-year bands as the k = 5 baseline: 1,400 classes and 24 riders suppressed.

Synthetic case. All figures come from the synthetic population; NIST SP 800-188 and Sweeney (2002) are real.

Errors and limits

Three planners are a small panel; acceptance is a coarse measure. The baseline is one reasonable choice among several.

Exercises

Synthesis

Chapter 3 fixes hypotheses, a fair k-anonymity baseline and a two-part utility test. Chapter 4 pilots the differentially private release.

Continue studying — chapter 03 of 08

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →