Distribution-Preserving Statistical Disclosure Limitation

One approach to limiting disclosure risk in public-use microdata is to release multiply-imputed, partially synthetic data sets. These are data on actual respondents, but with confidential data replaced by multiply-imputed synthetic values. A mis-specified imputation model can invalidate inferences because the distribution of synthetic data is completely determined by the model used to generate them. We present two practical methods of generating synthetic values when the imputer has only limited information about the true data generating process. One is applicable when the true likelihood is known up to a monotone transformation. The second requires only limited knowledge of the true likelihood, but nevertheless preserves the conditional distribution of the confidential data, up to sampling error, on arbitrary subdomains. Our method maximizes data utility and minimizes incremental disclosure risk up to posterior uncertainty in the imputation model and sampling error in the estimated transformation. We validate the approach with a simulation and application to a large linked employer-employee database.statistical disclosure limitation; confidentiality; privacy; multiple imputation; partially synthetic data

Convex cones of generalized multiply monotone functions and the dual cones

Let $n$ and $k$ be nonnegative integers such that $1\le k\le n+1$. The convex cone $\mathcal{F}_+^{k:n}$ of all functions $f$ on an arbitrary interval $I\subseteq\mathbb{R}$ whose derivatives $f^{(j)}$ of orders $j=k-1,\dots,n$ are nondecreasing is characterized in terms of extreme rays of the cone $\mathcal{F}_+^{k:n}$. A simple description of the convex cone dual to $\mathcal{F}_+^{k:n}$ is given. These results are useful in, and were motivated by, applications in probability. In fact, the results are obtained in a more general setting with certain generalized derivatives of $f$ of the $j$th order in place of $f^{(j)}$. Somewhat similar results were previously obtained in the case when the left endpoint of the interval $I$ is finite, with certain additional integrability conditions; such conditions fail to hold in the mentioned applications.Comment: Version 2: More applications given; two typos fixe