Functionality
The targeted record swapping can be applied with the function
recordSwap(). All other functions in the package are called
from inside recordSwap() and are only exported for testing
purposes. The function has the following arguments:
recordSwap(std::vector< std::vector<int> > data, int hid,
std::vector<int> hierarchy,
std::vector<std::vector<int>> similar,
double swaprate,
std::vector<std::vector<double>> risk, double risk_threshold,
int k_anonymity, std::vector<int> risk_variables,
std::vector<int> carry_along,
int &count_swapped_records,
int &count_swapped_hid,
std::string log_file_name,
int seed = 123456)- data micro data containing ONLY integer values, rectangular table format.
- hid column index in which refers to the household identifier.
- hierarchy column indices of variables in which refer to the geographic hierarchy in the micro data set. For instance county > municipality > district.
- similar vector of vector containing the similarity profiles that are sets of variables in which should be considered when swapping households. corresponds to the first set similarity variables, to the second set and so on.
- swaprate double between 0 and 1 defining the proportion of households which should be swapped, see details for more explanations
- risk vector of vector containing the risk of each
individual for each hierarchy level.
risk[0]corresponds to the risks of the first record for all hierarchy levels,risk[1]for the second record and so on. Should be ignored, for now, it is not fully tested yet. - risk_threshold risk threshold, which determines if a record has to be swapped and over which hierarchy level. This overwrites k_anonymity. Should be ignored, for now, it is not fully tested yet.
- k_anonymity integer defining the threshold of high
risk households (k-anonymity). A record is not at risk if
k_anonymity >= counts. - risk_variables column indices of variables in which
will be considered for estimating the risk. This is only used if
riskwas not supplied. - carry_along column indices of variables in which
are additionally swapped. These variables do not interfere with the
procedure of finding a record to swap with. This parameter is only used
at the end of the procedure when swapping the hierarchies. We note that
the variables to be used as
carry_alongshould be at household level. In case it is detected that they are at individual level (different values withinhid), a warning is given because unexpected results may occur since the first observed value within the Household for any variable is used for all members in the swapped household. - count_swapped_records, count_swapped_hid count number of households and records swapped
- log_file_name path for writing a log file. The log
file contains a list of household IDs (
hid) that could not have been swapped and is only created if any such households exist. - seed integer defining the seed for the random number generator, for reproducibility.
IMPORTANT: The argument data contains
the micro data and can be understood as a vector of vectors. Inside the
function, data is expected to contain each column of the
input data as std::vector<int> which are then again
stored in an std::vector< std::vector<int> >.
So data[0] addresses variables of the first record and
data[0][0] the first column of the first record. The same
logic hold for the argument risk.
Some differences to SAS-Code
Risk definition
- C++-Code: Risk is calculated using counts over the
geographic hierarchies (
hierarchy) and the combination of all risk variables. - SAS-Code: Risk is calculated using counts for each
geographic hierarchy (
hierarchy) and risk variable separately. These risks are then combined to produce a single risk value for each record.
Sampling probability
- C++-Code: Sampling probability \(p_{y,h}\) for household \(y\) at the geographic hierarchy \(h\) is derived from the risks \(r_{i,h}\) of all individuals living in the same household. The risk \(r_{i,h}\) for each individual \(i\) in geographic hierarchy (\(h\)) is currently estimated through the k-anonymity rule. \(r_{i,h}\) is then defined as
\[ r_{i,h} = (\sum\limits_{j=1}^{N_{g_1}}1[v_{1(i)}=v_{1(j)} \land ... \land v_{p(i)}=v_{p(j)}])^{-1} \quad , \]
with \(v_1,\ldots,v_p\) as a set of risk variables, \(N_{g_1}\) as the number of persons living in region \(g_1\) and \(1[...]\) as the indicator function. \(1[v_{1(i)}=v_{1(j)} \land ... \land v_{p(i)}=v_{p(j)}]\) is 1 if individual \(j\) as the same values for risk variables \(v_1,\ldots,v_p\) as individual \(i\) and is 0 otherwise. Casually speaking
\[ r_{i,h} \sim \frac{1}{counts} \quad . \]
The sampling probability for household \(y\), \(p_{y,h}\) in hierarchy \(h\), is then defined by the maximum of risk across all household member
\[ p_{y,h} = \max_{i\text{ in household }y}(r_{i,h}) \quad . \] This sampling probability is used for selecting households for swapping as well as donor households.
- SAS-Code: Sampling probability is derived from multiple factors.
\[ p_i = \begin{cases} 0.999 \quad \text{for low risk household} \\ \frac{b\cdot N_{high}}{SA\cdot c-b\cdot c} \quad \text{for }b>0 \\ \frac{0.2\cdot N_{high}}{SA\cdot c-0.2\cdot c} \quad \text{for }b=0 \\ \frac{0.1\cdot N_{high}}{SA\cdot c-0.1\cdot c} \quad \text{for }b<0 \end{cases} \] where \[ b = SA - N_{high}\\ c = N_{netto} - N_{high} \] with \(SA\) as the sample size, \(N_{high}\) as the number of high risk households in the geographic area and \(N_{netto}\) the number of non-imputed records in the geographic area.
Swapping Records
- C++-Code: Swaps are made in every hierarchy level
and records which do not fulfil the k-anonymity are swapped. The donor
set of records to be swapped with is always made out of every record
which does not belong to the same geographic area as the swapped
households. At the lowest hierarchy level, an additional number of
households is swapped such that the proportion of households swapped is
equal to the number in
swaprate. If the proportion of already swapped households succeeds these values then records that do not fulfil the k-anonymity are also swapped.
Example for swapping households. The number represents the number of high risk households at each hierarchy level.
Figure 1 displays an example with hierarchy levels NUTS1 > NUTS2 > NUTTS3 where the numbers of high risk households are displayed at the end of the edges. For instance, in the first NUTS1 region, there are 5 high risk households that will be swapped with households from other NUTS1 regions. In the first NUTS2 region, there are 10 high risk households that will be swapped with households that are not in the same NUTS2 region. At the lowest level, the NUTS3 regions, the number of swaps, \(n_{swaps}\) for the first district is defined by
\[ n_{swaps} = 2 + Rest\\ Rest = \max(0,N\cdot s - n_{already}) \] with \(N\) as the number of households in the district, \(n_{already}\) as the number of already swapped households in the district and \(s\) as the swap rate.
- SAS-Code Swaps are made in every hierarchy level and depending on the sampling probability, high risk households are more likely to be swapped than low risk households, but they are not mandatorily swapped. The number of swappes in each hierarchy level is defined by the number of high risk records and the total number of records in the geographic area. For instance, having the geographic hierarchy county > municipality > district, the number of Swaps in the municipality \(m\) of county \(n\) is defined by
\[ SWAP_m = \frac{SIZE_m+RISK_m}{2} \] where \(SIZE_m\) can be derived by using the reciprocal number of households of each municipality in county \(n\).
\[ SIZE_m = \frac{N_m^{-1}}{\sum_iN_i^{-1}}\cdot sN_n \] with \(N_m\) as the number of households in municipality \(m\), \(s\) the global swaprate and \(N_n\) as the number of households in county \(n\). \(RISK_m\) can be derived using the proportion of high risk households in each municipality
\[ RISK_m = \frac{H_m}{\sum_iH_i}\cdot sN_n \]
with \(H_m\) as the proportion of high risk households in municipality \(m\).