Reply to Sanchéz et al.: Multiplicity does not protect privacy

The assertion of Sanchéz, Domingo-Ferrer, and Muralidhar (1) that an individual’s privacy is protected by virtue of having a record that appears multiple times in the data is wrong. This is why we do not focus our article on singletons.

As a concrete example using features that are available in the American Community Survey (ACS) data on which we run experiments, suppose that it is known that there are two 46-y-old married men with a particular racial designation and level of educational attainment within the dataset. These features might be publicly known since they are not features the individuals intend to hide. Even if these two individuals match on all other features as well—that is, they share the same record prototype—if we are able to learn it, then we have learned facts about both of them (e.g., their citizenship status, their income, etc.) that they may not have wanted to share. It does not matter that we cannot determine which record corresponds to which individual (the question does not even make sense, as the records are identical) since we have learned private information about both. This is a well-documented flaw with anonymization methods such as k-anonymity, which have been largely discredited in the privacy literature (2, 3). We note that in a recent PNAS commentary on our article, scientists from the US Census Bureau itself appear to agree that our methods indeed constitute a meaningful privacy threat (4).

Despite the fact that we did not design our method to reconstruct singletons, our method nevertheless often does. For example, on the ACS Folktables dataset, using the 19 features described in the coverage task, at a match rate of 90%, 15% of the reconstructed records are singletons. At a match rate of 80%, this fraction of singletons increases beyond 20%. These numbers are typical for the datasets examined in our article. There is a long history of increasingly powerful attacks on “anonymized” and “aggregated” data. There is every reason to believe that methods optimized for reconstructing singletons specifically could be devised if this were taken to be the goal.

We stand by all of the assertions, commentary, and results in our article.