Search results

Steve Fienberg had an enormous influence on how I think about statistical science and a huge impact on my career. Steve's research is of course legendary; he made fundamental contributions to Bayesian inference, categorical data analysis, disclosure control, official statistics, and record linkage, to name key areas where our research interests overlapped. The statistical insights in this work are brilliant and important -- and directly inspired several of my papers, including my first paper in JASA. The innovations in Steve's work target and respond to real, high impact problems in official statistics with leading edge methodology intended to make it into practice. His example of being an academic statistician who improves the practice of official statisticians on the ground is one that I try to emulate in my official statistics research.
Although I was not one of Steve's students, I was the beneficiary of his mentorship. At conferences and workshops, and at reciprocating visits to CMU and Duke, Steve generously gave me many hours of his time, answering questions about research, official statistics, advising students, career options and paths, and life in general. I valued his advice dearly and followed it. I also have benefitted from Steve's mentorship in a more indirect way: I have been a post-doc mentor to two of his Ph.D. students. I can say from first hand experience that Steve's students are wonderful, both as scholars and as people. As I would have expected coming from Steve's tutelage.

When sharing microdata (i.e., data on individuals) with the public, organizations face competing objectives. On the one hand, they strive to release data files that are useful for a wide range of statistical purposes and easy for secondary data users to analyze with standard statistical methods. On the other hand, they must protect the confidentiality of data subjects' identities and sensitive attributes from attacks by ill-intentioned data users. To address such threats, organizations typically alter microdata before sharing it with others; in fact, most public-use data sets with unrestricted access have undergone one or more disclosure protection treatments. This research synthesis reviews statistical approaches to protecting data confidentiality commonly used by government agencies and survey organizations, with particular emphasis on their impacts on the accuracy of secondary data analyses. In general terms, it discusses potential biases that can result from the disclosure treatments, as well as when and how it is possible to avoid or correct those biases. The synthesis is intended for social scientists doing secondary data analysis with microdata; it does not prescribe best practices for implementing disclosure protection methods or gauging disclosure risks when disseminating microdata. Adapted from the source document.

Abstract
Recently, several organizations have considered using differentially private algorithms for disclosure limitation when releasing count data. The typical approach is to add random noise to the counts sampled from, for example, a Laplace distribution or symmetric geometric distribution. One advantage of this approach, at least for some differentially private algorithms, is that analysts know the noise distribution and hence have the opportunity to account for it when making inferences about the true counts. In this article, we present Bayesian inference procedures to estimate the posterior distribution of a subset proportion, that is, a ratio of two counts, given the released values. We illustrate the methods under several scenarios, including when the released counts come from surveys or censuses. Using simulations, we show that the Bayesian procedures can result in accurate inferences with close to nominal coverage rates.

To limit disclosures, statistical agencies and other data disseminators can release partially synthetic, public use microdata sets. These comprise the units originally surveyed; but some collected values, for example, sensitive values at high risk of disclosure or values of key identifiers, are replaced with multiple draws from statistical models. Because the original records are on the file, there remain risks of identifications. In this paper, we describe how to evaluate identification disclosure risks in partially synthetic data, accounting for released information from the multiple datasets, the model used to generate synthetic values, and the approach used to select values to synthesize. We illustrate the computations using the Survey of Youths in Custody.

When releasing individual-level data to the public, statistical agencies typically alter data values to protect the confidentiality of individuals' identities and sensitive attributes. When data undergo substantial perturbation, secondary data analysts' inferences can be distorted in ways that they typically cannot determine from the released data alone. This is problematic, in that analysts have no idea if they should trust the results based on the altered data.To ameliorate this problem, agencies can establish verification servers, which are remote computers that analysts query for measures of the quality of inferences obtained from disclosure-protected data. The reported quality measures reflect the similarity between the analysis done with the altered data and the analysis done with the confidential data. However, quality measures can leak information about the confidential values, so that they too must be subject to disclosure protections. In this article, we discuss several approaches to releasing quality measures for verification servers when the public use data are generated via multiple imputation, also known as synthetic data. The methods can be modified for other stochastic perturbation methods.

Abstract
Multivariate categorical data nested within households often include reported values that fail edit constraints—for example, a participating household reports a child's age as older than his biological parent's age—and have missing values. Generally, agencies prefer datasets to be free from erroneous or missing values before analyzing them or disseminating them to secondary data users. We present a model-based engine for editing and imputation of household data based on a Bayesian hierarchical model that includes (i) a nested data Dirichlet process mixture of products of multinomial distributions as the model for the true latent values of the data, truncated to allow only households that satisfy all edit constraints, (ii) a model for the location of errors, and (iii) a reporting model for the observed responses in error. The approach propagates uncertainty due to unknown locations of errors and missing values, generates plausible datasets that satisfy all edit constraints, and can preserve multivariate relationships within and across individuals in the same household. We illustrate the approach using data from the 2012 American Community Survey.

AbstractOften in surveys, key items are subject to measurement errors. Given just the data, it can be difficult to determine the extent and distribution of this error process and, hence, to obtain accurate inferences that involve the error-prone variables. In some settings, however, analysts have access to a data source on different individuals with high-quality measurements of the error-prone survey items. We present a data fusion framework for leveraging this information to improve inferences in the error-prone survey. The basic idea is to posit models about the rates at which individuals make errors, coupled with models for the values reported when errors are made. This can avoid the unrealistic assumption of conditional independence typically used in data fusion. We apply the approach on the reported values of educational attainments in the American Community Survey, using the National Survey of College Graduates as the high-quality data source. In doing so, we account for the sampling design used to select the National Survey of College Graduates. We also present a process for assessing the sensitivity of various analyses to different choices for the measurement error models. Supplemental material is available online.

Agencies seeking to disseminate public use microdata, i.e., data on individual records, can replace confidential values with multiple draws from statistical models estimated with the collected data. We present a famework for evaluating disclosure risks inherent in releasing multiply-imputed, synthetic data. The basic idea is to mimic an intruder who computes posterior distributions of confidential values given the released synthetic data and prior knowledge. We illustrate the methodology with artificial fully synthetic data and with partial synthesis of the Survey of Youth in Custody.

Abstract
In many survey settings, population counts or percentages are available for some of the variables in the survey, for example, from censuses, administrative databases, or other high-quality surveys. We present a model-based approach to utilize such auxiliary marginal distributions in multiple imputation for unit and item nonresponse in complex surveys. In doing so, we ensure that the imputations produce design-based estimates that are plausible given the known margins. We introduce and utilize a hybrid missingness model comprising a pattern mixture model for unit nonresponse and selection models for item nonresponse. We also develop a computational strategy for estimating the parameters of and generating imputations with hybrid missingness models. We apply a hybrid missingness model to examine voter turnout by subgroups using the 2018 Current Population Survey for North Carolina. The hybrid missingness model also facilitates modeling measurement errors simultaneously with handling missing values. We illustrate this feature with the voter turnout application by examining how results change when we allow for overreporting, that is, individuals self-reporting that they voted when in fact they did not.

Panel studies typically suffer from attrition. Ignoring the attrition can result in biased inferences if the missing data are systematically related to outcomes of interest. Unfortunately, panel data alone cannot inform the extent of bias due to attrition. Many panel studies also include refreshment samples, which are data collected from a random sample of new individuals during the later waves of the panel. Refreshment samples offer information that can be utilized to correct for biases induced by non-ignorable attrition while reducing reliance on strong assumptions about the attrition process. We present a Bayesian approach to handle attrition in two-wave panels with one refreshment sample and many categorical survey variables. The approach includes (1) an additive non-ignorable selection model for the attrition process; and (2) a Dirichlet process mixture of multinomial distributions for the categorical survey variables. We present Markov chain Monte Carlo algorithms for sampling from the posterior distribution of model parameters and missing data. We apply the model to correct attrition bias in an analysis of data from the 2007–08 Associated Press/Yahoo News election panel study.

Several statistical agencies use, or are considering the use of, multiple imputation to limit the risk of disclosing respondents' identities or sensitive attributes in public use files. For example, agencies can release partially synthetic datasets, comprising the units originally surveyed with some values, such as sensitive values at high risk of disclosure, or values of key identifiers, replaced with multiple imputations. We describe how secondary analysts of such multiply-imputed datasets can implement Bayesian model selection procedures that appropriately condition on the multiple datasets and the information released by the agency about the imputation models. We illustrate by deriving Bayes factor approximations and a data augmentation step for stochastic search variable selection algorithms.