disclosure_risk

Measures the two classical disclosure risks of a synthetic version of
confidential microdata (census, survey, register data), from the point of
view of an intruder who knows the key variables (quasi-identifiers such
as age, sex and region) of a person in the real data.<ul>
<li>Identity disclosure -- replicated uniques. Records whose combination
of key variables is unique in the real data are the most exposed. The
share of these real uniques whose key combination also occurs exactly
once in the synthetic data (<code>replicated_uniques</code>, Nowok, Raab and
Dibben, 2016) indicates how many synthetic records could be taken for a
real, identifiable person.</li>
<li>Attribute disclosure -- correct attribution probability (CAP). For
every real record, the intruder looks up the synthetic records with the
same key values and predicts each <code>target</code> (sensitive) variable: the
most frequent category, or the median for numeric targets. <code>cap</code> is the
share of real records for which the prediction is correct (numeric
targets: within <code>tolerance</code> relative error or <code>abs_tolerance</code> absolute
error), among those with at least
one matching synthetic record. <code>cap_baseline</code> is the same share when the
intruder ignores the synthetic data and predicts the overall mode or
median; <code>cap_uniques</code> restricts the CAP to real uniques. A CAP close to
the baseline means that the synthetic data reveal little beyond what
is known from population-level statistics (Taub et al., 2018).</li>
</ul>Numeric key variables are matched exactly; coarsen them first (e.g. age
in years or 5-year bands) if they are continuous.

Generates synthetic versions of numeric, categorical, mixed-type
and time-series data. Marginal distributions are modelled with
interpolated empirical quantile functions and dependence with Gaussian or
Student-t copulas (Sklar, 1959). Discrete and categorical variables enter
the copula through the distributional transform (Ruschendorf, 2009,
<doi:10.1016/j.jspi.2009.05.030>), and their latent correlations are
estimated by maximum likelihood as polychoric (Olsson, 1979,
<doi:10.1007/BF02296207>) and polyserial (Olsson, Drasgow and Dorans,
1982, <doi:10.1007/BF02294164>) correlations. Unordered categories are
placed on their latent coordinate in an order estimated from their
association with the other variables. Missing values are
modelled by missingness indicators inside the copula, so that
missingness may depend on other variables. Supports stratified models,
a closeness parameter with calibration to a target distance or
disclosure-risk level, chunked generation of very large data sets,
optional hybrid copula and conditional CART or GAM synthesis for
one continuous response (requiring 'rpart' or 'mgcv'), training-only
automatic selection of the conditional engine, experimental nominal
conditional synthesis of one unordered categorical response (requiring
'nnet'), copula vector-autoregressive and bootstrap time-series synthesis,
augmentation of small training sets for machine learning, and random
generation from multivariate distributions and elliptical and
Archimedean copulas. Fidelity, utility and disclosure risk are assessed
with marginal distances, association matrices, propensity score
mean-squared error (Snoke et al., 2018, <doi:10.1111/rssa.12358>),
confidence-interval overlap, correct attribution probability and
distance to closest record, with 'ggplot2' visualisations. Data can be
read from and written to CSV, TSV, RDS, RData, Parquet, Feather, HDF5,
JSON, NDJSON, Excel, SPSS, Stata, SAS and fst files. The
empirical-quantile and copula approach builds on ideas of the
'synthesizer' package by Mark van der Loo.

Bogdan Oancea

SynthesizerPlus

Synthetic Data Generation with Copulas, Evaluation and
Multi-Format I/O

disclosure_risk function

<dl><dt>real, synthetic</dt>
<dd>Data frames with the key and target variables.</dd>
<dt>keys</dt>
<dd>Character vector of key variables (quasi-identifiers).</dd>
<dt>target</dt>
<dd>Character vector of sensitive variables for attribute
disclosure (optional).</dd>
<dt>ignore</dt>
<dd>Optional columns to leave out entirely, typically direct
identifiers (which differ between real and synthetic files and would
otherwise hide exact copies).</dd>
<dt>tolerance</dt>
<dd>Relative tolerance for a correct prediction of numeric
targets (default 0.1, i.e. 10 percent).</dd>
<dt>abs_tolerance</dt>
<dd>Absolute tolerance for numeric targets (default 0).
A prediction is correct if \(|\hat y - y| \le
\max(\mathrm{tolerance} \cdot |y|, \mathrm{abs\_tolerance})\). A purely
relative tolerance is (essentially) zero for a true value of 0, so use
<code>abs_tolerance</code> for targets with meaningful zeros (e.g. income of
non-earners), in the units of the target.</dd></dl>

Arguments

Measures the two classical disclosure risks of a synthetic version of
confidential microdata (census, survey, register data), from the point of
view of an intruder who knows the key variables (quasi-identifiers such
as age, sex and region) of a person in the real data.<ul>
<li>Identity disclosure -- replicated uniques. Records whose combination
of key variables is unique in the real data are the most exposed. The
share of these real uniques whose key combination also occurs exactly
once in the synthetic data (<code>replicated_uniques</code>, Nowok, Raab and
Dibben, 2016) indicates how many synthetic records could be taken for a
real, identifiable person.</li>
<li>Attribute disclosure -- correct attribution probability (CAP). For
every real record, the intruder looks up the synthetic records with the
same key values and predicts each <code>target</code> (sensitive) variable: the
most frequent category, or the median for numeric targets. <code>cap</code> is the
share of real records for which the prediction is correct (numeric
targets: within <code>tolerance</code> relative error or <code>abs_tolerance</code> absolute
error), among those with at least
one matching synthetic record. <code>cap_baseline</code> is the same share when the
intruder ignores the synthetic data and predicts the overall mode or
median; <code>cap_uniques</code> restricts the CAP to real uniques. A CAP close to
the baseline means that the synthetic data reveal little beyond what
is known from population-level statistics (Taub et al., 2018).</li>
</ul>

Numeric key variables are matched exactly; coarsen them first (e.g. age
in years or 5-year bands) if they are continuous.

Disclosure risk of synthetic microdata — disclosure_risk

<dl>

<dt>real, synthetic</dt>
<dd>Data frames with the key and target variables.</dd>


<dt>keys</dt>
<dd>Character vector of key variables (quasi-identifiers).</dd>


<dt>target</dt>
<dd>Character vector of sensitive variables for attribute
disclosure (optional).</dd>


<dt>ignore</dt>
<dd>Optional columns to leave out entirely, typically direct
identifiers (which differ between real and synthetic files and would
otherwise hide exact copies).</dd>


<dt>tolerance</dt>
<dd>Relative tolerance for a correct prediction of numeric
targets (default 0.1, i.e. 10 percent).</dd>


<dt>abs_tolerance</dt>
<dd>Absolute tolerance for numeric targets (default 0).
A prediction is correct if \(|\hat y - y| \le
\max(\mathrm{tolerance} \cdot |y|, \mathrm{abs\_tolerance})\). A purely
relative tolerance is (essentially) zero for a true value of 0, so use
<code>abs_tolerance</code> for targets with meaningful zeros (e.g. income of
non-earners), in the units of the target.</dd>

</dl>

disclosure_risk: Disclosure risk of synthetic microdata

Description

Usage

Value

Arguments

References

Examples