Tải bản đầy đủ - 0 (trang)
2 Solving a Maximum Entropy Problem Analytically - the Symmetric Case as Illustrative Example

# 2 Solving a Maximum Entropy Problem Analytically - the Symmetric Case as Illustrative Example

Tải bản đầy đủ - 0trang

Computational Issues in the Design of Transition Probabilities

(12')

241

pij ¼ 2Àln2 þ k3 þ k2 vij for j = i + 1, . . ., i + D.

1

2

According to the deﬁnition of bs and As, constraint g2 pi ị ẳ 0 is now

PD

PD

1Àpii

2

V

j¼1 pij j À 2 ¼ 0, and constraint g3 pi ị ẳ 0 is

jẳ1 pij ẳ 2 :

V

, where vk2 ị :ẳ

To make g2 pi ị ẳ 0 hold, we now let pij k2 ị :ẳ 2k2 vij 2vk

2ị

Pi ỵ D k2 v2 2 PD k2 j2 2

ij v ẳ

j . Then, to make g3 pi ị ẳ 0 hold as well, we let

ij

jẳi ỵ 1 2

jẳ1 2

PD

P

1

pii :¼ 1 À 2 j¼1 pij . Note, this is only well deﬁned as long as D

j¼1 pij \ 2 holds for a

choice of k2 .





2

If we deﬁne k3 :¼ log2

V

2vðk2 Þ

1

2ln2 , then also (12’) holds.

So far, the candidate probability distribution pi actually depends on the choice of

k2 , e.g. pi ẳ pi k2 ị. The nal step is ﬁnding the maxima of (9), that is maximize the

entropy S ðpi ðk2 ÞÞ with respect to k2 . This is a straightforward – though a little cumbersome - analytical exercise. Saving the effort here, Fig. 1a presents a graphical

solution for the case of D = 2. Obviously, the maximum is around k2 = 0.9. Figure 1b

shows the resulting maximum entropy probability distribution.

1

As nal observation: With a :ẳ 2ln2 ỵ k3 and b :ẳ eln2ịk2 , (12) can be re-written

2

as: pij ¼ aebvij , reminding of the functional form of a normal distribution with zero

expectation.

Fig. 1a. Shannon’s entropy for the instance

D = 2; symmetrical case; 0:3 k2 1

2.3

Fig. 1b. Maximum entropy distribution for

the instance D = 2; symmetrical case

Software Solution for the Maximum Entropy Problem

While it might be feasible to implement a little procedure to carry out the steps of the

approach taken in the illustrative example for the symmetric case, for the general case

this would be difﬁcult. It is therefore very advisable to restore to the well-known

algorithms for non-linear optimization problems. To obtain the solutions discussed in

Sect. 2.4, the Nlopt package [11] has been used via its R-interface routine nloptr [16].

From this package we decided to use a sequential quadratic programming algorithm for

nonlinearly constrained gradient-based optimization (supporting both inequality and

equality constraints), based on the implementation described in [12] and [13]. In order

242

S. Giessing

to execute an instance, seven arguments have to be passed to the interface routine

nloptr. See the Appendix for a list and illustration of those arguments.

2.4

Adding Constraints to the Maximum Entropy Based Approach

A simple measure of information loss, easy to communicate to data users is the

probability for data to preserve their true value, pii , or the cumulated probability for the

P

data to change by less than d (for small d, like d = 1): dj¼Àd pij . Disregarding the fact

that this will reduce the entropy (when the other important parameter, e.g. the variance

is ﬁxed), one might be tempted to prefer transition probability distributions with high

probabilities in the center (even though this will be at the cost of increasing the tails of

the distribution, i.e. the probabilities for larger changes). This can be achieved with the

software solution outlined in Sect. 2.3 and in the Appendix by adding constraints to

impose lower bounds on the respective probabilities. Especially in combination with

such additional constraints, it sometimes happens that in the solution obtained, the left

hand side of the probability distribution does not increase monotonously: we get

piðiÀkÞ \piðiÀjÞ for some j [ k, which may not be appreciated. To avoid this, more

constraints can be added to enforce monotony.

Figures 2a and b compare three transition probability distributions for maximum

perturbation D = 5 and condition (3) requiring that no cell values 1 and 2 appear in the

perturbed data, e.g. js :¼ 2. Two of the distributions were obtained as maximum

entropy solutions for parameter settings of V = 2 vs. V = 3. For V = 2, the ﬁgures

present also another distribution, computed with the LP-heuristic explained in [9].

Figure 2a presents the distributions obtained for i = 3, and Fig. 2b those obtained for

the symmetric case.

Fig. 2a. Transition probability distributions

for D = 5; i = 3, js ¼ 2

Fig. 2b. Transition probability distributions

for D = 5; symmetric case ði ! 8Þ

Note that a distribution almost identical to the leptokurtic distribution resulting

from the LP-heuristic of [9] is obtained by the maximum entropy approach, when we

add constraints on the elements on the diagonal of the transition matrix, pii, and on the

off-diagonal elements pii1ị and pii ỵ 1ị ; to dene the respective probabilities of the

Computational Issues in the Design of Transition Probabilities

243

‘target’ distribution as lower bounds. This is, however, at the “expense” of higher

probabilities in the tails of the distribution4 which are of course rather undesirable.

Another observation from experiments with the approach is that changing the

maximum perturbation (to, for example, D = 4 or D = 10), while keeping the variance

V = 2 or V = 3 constant, reproduces the probability distribution almost exactly, for

larger D of course with longer, but very flat tails.

The software solution outlined in Sect. 2.3 facilitates the computation of probability distributions satisfying the basic properties of the random noise outlined in the

beginning of Sect. 2, and to experiment with the main parameters (V, D, pii ) which

obviously affect the usability of the perturbed data and are easy to interpret. In order to

determine these parameters appropriately, however, disclosure risk issues must also be

taken into account.

3 Evaluating Disclosure Risk with the Shuttle Algorithm

Disclosure risk measures of the type that measure, for example, the percentage of

perturbed data identical with the true data as proposed and discussed in [1, 14] and,

lean in some way on a scenario where the users of the data mistake perturbed data for

“true”, ignoring information on the SDC method offered by the data provider. The

present paper assumes a different scenario: we assume a data user (rather “snooper”)

who is well aware of the perturbation and tries to undo it with certain differencing

attacks. On the basis of this scenario the following general requirement for tabular data

protection methods makes sense also in the context of a perturbative method not

preserving additivity, e.g. not preserving the “logical” table relations (i.e. interior cells

sum up to the respective margins) for the perturbed data.

A method that is in this sense non-additive5 should ensure that it can be expected

that the feasibility intervals that can be computed for protected, sensitive data are not

disclosive (c.f. [10], Sect. 4.3.1.) Notably, the idea is to assess this property of a

method (viz.: choice of parameters) by a rigorous preparative study – not in the

production phase of table generation and perturbation!

Feasibility intervals are typically computed by means of linear programming

(LP) methods (see for example [5]). Solutions can be obtained for each cell of interest

by minimizing and maximizing a variable representing its cell value, subject to a set of

constraints expressing the “logical” table relations, and some a priori upper and lower

bounds on unknown cell values. Note, in the setting of a perturbative SDC method,

generally all the cells are assumed to be “unknown”. Our intruder only assumes to

know for each cell a lower and upper bound. This increases of course the size of the

problem to be solved and hence computations times, especially when table relations

tend to be ‘long’, with many interior cells contributing to the same marginal.

4

5

For example, in the symmetric case, with D = 5: pi(i−5) = pi(i+5) ≅ 0.0006 without the additional

constraints, ≅0.009 with constraint on the diagonal element, and ≅0.01 with additional constraint on

the off-diagonal elements.

Notably, the ABS Census TableBuilder product is additive in this sense, because of a subsequent

algorithm implemented in the product that restores additivity to the table.

244

S. Giessing

The objective of the research step envisioned is to compute intervals for all cells of

large high-dimensional tables for various settings, regarding for example the

assumptions on the a priori bounds made by the intruder, different settings for the noise

etc. We decided not to rely on a LP based tool, but to implement a generalized version

of the shuttle algorithm [2] in SAS, which had also certain practical advantages in the

processing and management of the instances, even though there might be a theoretical

disadvantage: there might be cases, where the LP algorithm produces better solutions.

In such cases the shuttle algorithm would underestimate the true risks6.

The mathematical formulation of the version of the shuttle algorithm we use is

briefly presented in the following (for more details and a toy example the reader is

referred to [8]):

Let a table be “deﬁned” by a set of cell indices I and a set of table relations J. For

cell c 2 I let JT ðcÞ identify the set of table relations in which this cell is the margin, and

JB ðcÞ the set of table relations in which cell c is one of the interior cells. For relation

j 2 J let tj 2 I denote the index of the margin cell and Bj & I the set of indices of the

L

“bottom” cells contributing to this margin. Finally, for c 2 I let xU

c and xc upper and

lower bounds for its true cell value which may change in the course of executing the

algorithm.

Like the “original” algorithm, the generalized version consists basically of two

steps (referred to in the following as L-step and U-step) which are repeated alternatingly. Starting from the original a priori bounds (the ones assumed to be known to the

L

intruder) for xU

c and xc , each step will use the results of the previous step to compute

several new candidate bounds for all interior cells and compare

those candidate bounds

S

to the “previous” bound: For a given interior cell b 2 j2J Bj , one candidate bound is

computed for every table relation j 2 JB ðbÞ containing this cell.

In the U-step, a candidate bound for cell b is computed by taking the difference

between upper bound of the marginal cell xU

tj and the sum of all lower bounds on the

P

other interior cells in the same table relation i2Bj ;i6¼b xLi . The upper bound of cell b,

P

U

U

L

xU

b ; will be replaced in the U-step by xb ðjÞ :¼ xtj À

i2Bj ;i6¼b xi , if for one j 2 JB ðbÞ the

U

candidate bound is tighter, i.e. xU

b ð j Þ < xb .

The L-step works in the same way, but here we take the difference between lower

bound of the marginal cell xLtj and the sum of all upper bounds xU

i on the other interior

L

cells in the same table relation. The lower bound of cell b, xb ; will be replaced, if for

one j 2 JB ðbÞ the candidate bound is tighter, i.e. xLb ð jÞ > xLb . The algorithm stops, when

no bound improvement is reached in the previous pair of steps, L or U.

In the original setting of [2], the cell values of the margins are assumed to be

known. In our setting they are not. We therefore compute when the algorithm

S starts and

after every U-step (before starting the L-step) for every margin cell t 2 j2J ftj g new

6

In the literature [3, 15] there is some discussion as to which extent it could be expected that solutions

obtained by the shuttle algorithm coincide with the solutions that would be obtained solving the

respective linear programming problems. For some (admittedly: few) test tables we have actually

compared the results and found no differences.

Computational Issues in the Design of Transition Probabilities

candidate upper bounds xU

t jị :ẳ

P

i2Bj

245

U

xU

i ; replacing in this additional step xt by

U

U

xU

t ð jÞ; if for one j 2 JT ðtÞ the candidate bound is tighter, i.e. xt ð jÞ < xt . Similarly, at

the start of the algorithm and between an L- and the next U-step a lower bound xLt will

P

be replaced by xLt jị :ẳ i2Bj xLi ; if xLt ð jÞ [ xLt for one j 2 JT ðtÞ:

4 Test Application

Our test data set consists of 31 two-way tables available for about 270 geographical units

on different levels of a hierarchy. Taking those relations (like f.e. the district –

municipality relations) into account too, the tables are actually 3-dimensional. The 31

two-way tables are given by cross combinations of nine variables. Two with 2 categories, one with 3, two with 4, the others with 7, 9, 19 and 111 categories. The

geography relations also tend to be ‘long’ with often more than 10, or even up to 100

categories. The current implementation does not consider any hierarchical relations:

bounds are computed independently for all tables. The test tables are tables of population counts.

The shuttle algorithm is used to compare the effects of different protection methods:

we look at a number of variants of deterministic rounding and at variants of additive

noise. The rounding methods were included for sake of comparison, in the ﬁrst place.

For the rounding we assume that data users are aware of the a priori bounds which

directly result from the rounding rule. Denote R the rounding base and nc R the rounded

count for cell c 2 I: Then xLc :ẳ max0; nc R R ị and xU

c :ẳ nc R þ R Þ are the

þ

À

known a priori bounds. R ; R denote the maximum upper and lower rounding

deviation. For example in case of rounding base R = 3: R ỵ ¼ RÀ ¼ 1:

For the additive noise we assume two different scenarios: A. The maximum perturbation D is published. B. The maximum perturbation D is not published, but the

intruder is able to estimate it at D ± 2. Under scenario A:xLc :ẳ max0; ~xc Dị and

xU

xc ỵ D are known a priori bounds for a true count xc given the perturbed count

c :¼ ~

~xc . Under scenario B. We assume estimated a priori bounds xLc :¼ maxð0; ~xc À D 2ị

and xU

xc ỵ D ỵ 2

c :ẳ ~

In the test application, we used bases of 3, 5, 7, 9, 10 and 11 for the rounding

methods. The additive noise was created with the transition probabilities derived in [9]

for maximum perturbations D = 3, 4 and 5.

During execution of the shuttle algorithm, we record the cases where one of the

L U

bounds xLb ; xU

b ; xt ; xt is replaced by a tighter (candidate) bound, noting in particular the

iteration step and the equation j at which a replacement occurs. After the execution the

results are investigated. Cases where ﬁnal upper and lower bounds for a cell coincide

with each other, matching the true cell value (i.e. they are exact bounds) are categorized

according to that original cell value (1; 2; 3–10; >10). Figures 3a, b, 4a, b and c present

indicators computed on the basis of the evaluation.

Every data point in those ﬁgures refers to one of the 31 structural types of our test

tables, resulting from the crossing of pairs of the nine variables mentioned above with

the geography dimension. Data points are sorted by table size (#cells = number of table

246

S. Giessing

cells, summed across all geographical units) to visualize an obvious general trend for

higher values of the indicators in smaller tables.

For the indicators, we count for each cell the number of equations (at most 3, for the

3-dimensional test data) with bound replacements, i.e. where during execution of the

algorithm an upper or lower bound was replaced by a tighter one. Results are summed

across all cells and across all tables relating to the data point, divided by the respective

number of table cells and multiplied by 100. So the theoretical maximum for indicators

is 300 %. We refer to the indicator deﬁned this way as “indicator for disclosure risk

potential”.

For a second, more direct indicator, the “disclosure risk indicator”, we count for the

enumerator of the indicator equations with bound replacements only for those cells

where the algorithm ﬁnally returns exact bounds, i.e. where the algorithm discloses the

exact true counts.

Figures 3a and b present results for the disclosure risk indicator, grouped by

original count size (1; 2; 3–10; >10) of the disclosed cells, for rounding to base 3

(Fig. 3a) and rounding to base 5 (Fig. 3b).

Fig. 3a. Disclosure risk indicator for rounding to base 3, by original count size

Fig. 3b. Disclosure risk indicator for rounding

to base 5, by original count size

An interesting pattern is that many of the peaks in the observations for rounding to

base 3 are observed for table types where one of the variables in the respective pair of

spanning variables has 2 categories only. For rounding to base 5, on the other hand,

most peaks occur at table types involving a 4-categories variable. This can be regarded

as empirical conﬁrmation of a theoretical result explained in [7]:

The original values of a table row with l inner cells and a margin cell, protected by

rounding to base R, can be retrieved exactly, when lR þ þ RÀ or lRÀ þ R þ is a

multiple of R.

For rounding base 3 such a relation exists for the case of l = 2 categories

(2R ỵ ỵ R ẳ 2 ỵ 1 ẳ 3ị: For rounding base 5 it exists in the case of l = 4 categories

(4R ỵ ỵ R ẳ 8 ỵ 2 ẳ 10ị:

Computational Issues in the Design of Transition Probabilities

247

For rounding bases 7 and 10, exact bound retrievals were very rare7, for rounding

bases 9 and 11 no such cases were observed, nor for any of the additive noise variants.

Especially for the additive noise this is not so surprising considering another result of [7]:

The original values of a table row with l inner cells and a margin cell, protected by

rounding to base R, can be retrieved exactly, when the pattern of the rounding differences is either I ịR ỵ R ỵ . . .R ỵ jRÀ , or ðII ÞRÀ RÀ . . .RÀ jR þ :

So, all inner cells must have been perturbed by the maximum amount D in one

direction, and the total must have been perturbed by D in the other direction. For the

l ỵ 1

stochastic noise method such events occur with approximate probability pii ỵ Dị

which is very small, considering the flat tails of the transition probabilities used to

create the noise.

Retrieval of exact bounds and hence the original count is a rather direct risk of

disclosure, especially where small cells are concerned. The disclosure risk indicator is

thus a very informative disclosure risk measure. On the other hand, one should not

interpret an indicator value of zero as evidence for zero disclosure risk. After all, such

cases might eventually occur in other tables, not taken into account in the testing, or

they might have occurred, if the observed data had been a little different, or if additional

complexities – like hierarchical relations between some of the variables – had been

taken into account.

This risk of underestimating the disclosure risk is reflected in the indicator for

disclosure risk potential, introduced above. Figures 4a and b compare this indicator for

the additive noise variants with maximum perturbations D = 3, 4 and 5, for the intruder

scenarios A (ABS3, ABS4, ABS5, c.f. Figure 4a) and B (with a priori interval bounds

increased by +2: ABS3_2, ABS4_2, ABS5_2, c.f. Figure 4b), and for the stronger

variants of rounding, i.e. to rounding bases 7, 9, 10 and 11 (Fig. 4c).

For the noise, we observe a strong reduction in the indicators when maximum

perturbation is increased. While for ABS3 the indicator values vary between about

15 % and 3 %, for ABS5 the range is on a different scale, between ca. 1.9 % and

0.5 %. The effect is similar (even slightly stronger) when the maximum perturbation is

kept, but not published: actually the range for the scenario B variant ABS3_2, for

which the shuttle algorithm starts with a priori intervals of the same size (i.e.: 10) as for

scenario A variant ABS5, varies between 1.8 % and 0.02 %.

Notably, 10 is also the size of the a priori intervals for rounding to base 11, but here

indicator values are again on a much higher scale (compared to noise), varying between

about 60 % and 3 %. For all deterministic rounding variants (including rounding to

base 3 and to base 5 not presented in the ﬁgure) the indicator values are remarkably

similar. Also interesting is the effect that the general trend for higher indicator values in

smaller tables, visible for the rounding variants and the least protective noise variant

ABS3, vanishes in the variants with the lowest indicator values.

7

Exact bounds were obtained for only 17 of the 31 structural types, for altogether 44 cell/equation

cases. Apart from two structural types with disclosure risk indicators of 0.25 % and 0.1 % for

original count sizes 3–10, indicators were at most 0.05 %. For rounding base 10, exact bounds were

obtained for 20 cell/equation cases, all in the same structural type and only concerning cells with

original counts >10.

248

S. Giessing

Fig. 4a. Disclosure risk potential indicator

Fig. 4b. Disclosure risk potential indicator for

Fig. 4c. Disclosure risk potential indicator for Rounding to bases 7, 9, 10 and 11

A ﬁnal observation is that most bound improvements occur during the ﬁrst combination of U- and L-step. For the additive noise, this is the case in more than 95 % of

the cases for almost all structural types of test tables. For deterministic rounding, at

least 75 % of bound improvements occur during this ﬁrst step. The algorithm always

came to end after at most 6 steps.

5 Summary and Outlook

In its ﬁrst part, this paper has explored the suggestion of [14] to determine the transition

probability distributions of additive noise by maximizing entropy, looking at the

mathematical formulation of the approach. For sake of illustration, the paper has

explained how to derive a solution analytically in a relatively simple special case. The

ﬁrst part of the paper concludes with suggestions for how to employ the R-interface

routine nloptr for the NLopt nonlinear-optimization package to compute transition

probabilities, presenting some examples of distributions produced this way.

The topic addressed in the second part is disclosure risk estimation. The paper has

outlined an implementation of a generalized version of the shuttle algorithm [2]. As test

application the algorithm has been used on a major set of 3-dimensional tables. We

have compared disclosure risks associated to several variants of deterministic rounding

Computational Issues in the Design of Transition Probabilities

249

and additive noise, using one more and one less direct indicator for disclosure risk. As a

side result, this test application has delivered an empirical proof of the high disclosure

risks associated to rounding to base 3 as protection method. The paper has also proven

empirically that although rounding to larger rounding bases reduces disclosure risks

effectively, the disclosure risk potential of additive noise is considerably lower than that

of deterministic rounding when we compare variants with the same maximum deviation. For additive noise, looking at only the more direct risk indicator of the two, no

cases of disclosure risk were observed, even for rather weak settings of noise

parameters.

For future work, it is foreseen to use the algorithm for a rigorous assessment and

comparison of disclosure risks and risk potentials for several variants (e.g.: parameter

settings) of additive noise, taking into account also more than 3-dimensional instances

and, overall, a much larger set of instances. However, it is not at all intended to cover

the enormous set of tables which can theoretically be generated by ‘on-the-fly’ table

production. When ﬁxing parameters, this “under-coverage issue” in disclosure risk

estimation must be taken into account appropriately.

Acknowledgements. The author gratefully acknowledges the contribution of Jonas Peter who

during his time as a student at Destatis has developed the R-code described in Sect. 2.3 and the

Appendix.

Appendix

Arguments passed in R to the interface routine nloptr for the package Nlopt.

• x0: start-solution for pi. Use for example a vector of 1's. Vector length must equal

the number of columns of the coefﬁcient matrix A.

• eval_f: list with two entries representing

the objective

function of the maximum

À1

Á

entropy problem, and its gradient ln2 ỵ log2 pij ị j2Ji which for nloptr can simply

be stated as: “objective” = sum(x * log2(x)), and “gradient” = log2(x)+1)

• lb, ub: vectors of upper and lower bounds for pi. Same vector length as x0. For ub,

a vector of 1's will do. For lb, use a vector of e(e > 0, f.i. e := 10-7). For discussion of

more elaborate settings, see Sect. 2.4.

• eval_g_ineq: list with two entries representing the inequality constraints, to be

stated formally as, e.g. “constraints” =constr, and “jacobian” = grad. The vector

constr consists of (at least) two elements. One is the second term in the left hand

side of (7), which could be stated as sum(vɅ2 * x) − V8. The other one relates to

condition (6) and could be stated as x − 1. Matrix grad is composed of (at least) the

8

In our present code the second equality constraint (g2 (pi ) = 0, i.e. the constraint expressing the

requirement that perturbations shall have a ﬁxed variance of V) is handled as inequality constraint,

deﬁning V as an upper bound, as in most practical instances the variance of the maximum entropy

solution anyway assumes the value of this parameter.

250

S. Giessing

two respective gradient vectors which are actually identical to the last two rows of

matrix A. Further inequality constraints could be implemented to enforce monotony9, c.f. Sect. 2.4.

• eval_g_eq: list with two entries representing the equality constraints, to be stated

formally as, e.g. “constraints” = constr, and “jacobian” = grad, where constr is a

vector listing the ﬁrst and the last term of the left hand side of (7), like f.e. as (sum

(v * x) − 0, sum(x) − 1), and grad is a matrix composed of the two respective

gradient vectors, which is obviously identical to the matrix that results when we

delete the second row of matrix A.

• opts: Argument for the selection of a speciﬁc optimization algorithm and respective

parameters10

References

1. Andersson, K., Jansson, I., Kraft, K.: Protection of frequency tables – current work at

Statistics Sweden. In: Joint UNECE/Eurostat Work Session on Statistical Data

Conﬁdentiality, Helsinki, Finland, 5 to 7 October 2015. http://www1.unece.org/stat/

platform/display/SDCWS15

2. Buzzigoli, L., Giusti, A.: An algorithm to calculate the lower and upperbounds of the

elements of an array given its marginals. In: Statistical Data Protection (SDP 1998)

Proceedings, Eurostat, Luxembourg, pp. 131–147 (1998)

3. Buzzigoli, L., Giusti, A.: Disclosure control on multi-way tables by means of the shuttle

algorithm: extensions and experiences. In: Bethlehem, J.G., van derHejden, P.G.M. (eds.)

Computational Statistics 2000, COMPSTAT Proceedings in Computational Statistics 200.

Physica-Verlag, Heidelberg

4. EUROSTAT, Methodology for Statistics Unit B1: Minutes of the Working Group on

Methodology, 7 April 2016

5. Fischetti, M., Salazar-González, J.J.: Models and algorithms for optimizing cell suppression

problem in tabular data with linear constraints. J. Am. Stat. Assoc. 95, 916–928 (2000)

6. Fraser, B., Wooton, J.: A proposed method for conﬁdentialising tabular output to protect

against differencing. In: Monographs of Ofﬁcial Statistics, Work session on Statistical Data

Conﬁdentiality, Eurostat-Ofﬁce for Ofﬁcial Publications of the European Communities,

Luxembourg, pp. 299–302 (2006)

7. Giessing, S.: Anonymisierung von Fallzahltabellen durch Rundung. In: Paper presented at

the Sitzung des Arbeitskreises für Fragen der mathematischen Methodik am 17.06.1991 in

8. Giessing, S.: Report on issues in the design of transition probabilities and disclosure risk

estimation for additive noise. Statistisches Bundesamt (Unpublished manuscript)

Add one element (x[j] − x[j+1]) to the vector constr for each index j pointing to the right hand side of

the distribution. Extend matrix grad by an additional column vector: The vector entries referring to

indices j and j+1 should be 1 and (-1), resp. All other entries are 0.

10

In our implementation we have deﬁned local_opts as the following list: “algorithm” =

“NLOPT_LD_SLSQP”, “xtol_rel” = 1.0e−7, “maxeval” = 100000, and “local_opts” = local_opts,

where local_opts is another list: (“algorithm” = “NLOPT_LD_MMA”,“xtol_rel” = 1.0e−7)

9

Computational Issues in the Design of Transition Probabilities

251

9. Giessing, S., Höhne, J.: Eliminating small cells from census counts tables: some

considerations on transition probabilities. In: Domingo-Ferrer, J., Magkos, E. (eds.) PSD

2010. LNCS, vol. 6344, pp. 52–65. Springer, Heidelberg (2010)

10. Hundepool, A., Domingo-Ferrer, J., Franconi, L., Giessing, S., Schulte Nordholt, E., Spicer,

K., de Wolf, P.P.: Statistical Disclosure Control. Wiley, Chichester

11. Johnson, S.G.: The NLopt nonlinear-optimization package. http://ab-initio.mit.edu/nlopt

12. Kraft, D.: A software package for sequential quadratic programming, Technical Report

DFVLR-FB 88-28, Institut für Dynamik der Flugsysteme, Oberpfaffenhofen, July 1988

13. Kraft, D.: Algorithm 733: TOMP–Fortran modules for optimal control calculations. ACM

Trans. Math. Softw. 20(3), 262–281 (1994)

14. Marley, J.K., Leaver, V.L.: A method for conﬁdentialising user-deﬁned tables: statistical

properties and a risk-utility analysis. In: Proceedings of 58th World Statistical Congress,

pp. 1072–1081 (2011)

15. Roehrig, S.F.: Auditing disclosure in multi-way tables with cell suppression: simplex and

shuttle solutions. In: Paper Presented at: Joint Statistical Meeting 1999, Baltimore, 5–12

August 1999

16. Ypma, J.: Introduction to nloptr: an R interface to Nlopt (2014). https://cran.r-project.org/

web/packages/nloptr/vignettes/nloptr.pdf

### Tài liệu bạn tìm kiếm đã sẵn sàng tải về

2 Solving a Maximum Entropy Problem Analytically - the Symmetric Case as Illustrative Example

Tải bản đầy đủ ngay(0 tr)

×