Differential Privacy in the U.S. Census — After the Belief That Totals Are Safe Fell Apart

A Country That Counts Everyone Every 10 Years

Once every 10 years, the United States counts every person living in the country. This task is the census, and the U.S. Census Bureau, a federal government agency, handles it. The census is an obligation set by the U.S. Constitution. That number is used to redivide seats in the federal House of Representatives among states and redraw every electoral district in the country (DOI: 10.1145/3219819.3226070, from page 1 of the Census Bureau presentation abstract). Where and how much federal budget is divided is also decided based on this number (PMID 41191500). People answer items like age, sex, and race, and the Census Bureau receives those answers with a promise to keep them secret (DOI: 10.2478/jos-2023-0018).

The results come out as tables. The 2010 census published over 150 billion numbers across 180 table bundles. Most of those tables came out in the smallest district units used by the census, and some such districts are places where only a single person lives (DOI: 10.1162/99608f92.4a1ebf70). This means that even the headcount by sex and age group was made public for districts where very few people live.

Totals like "how many women in this district" have no names. Because of this, it is easy to assume that individuals are hardly revealed when only totals are released. For half a century, statistical agencies also regarded that summary tables inherently reveal less than individual-level records, applying weaker protections to tables than to individual-level records. The 2010 U.S. census also applied different rules to tables and individual-level records based on this premise (DOI: 10.1162/99608f92.4a1ebf70).

In the 2020 census, the Census Bureau abandoned this premise. As announced in 2017, it decided to deliberately add random values to the published numbers and let data users know how large that margin of error is (DOI: 10.21428/2c646de5.7ec6ab93, 2022 case study). This article follows what that decision prevented, what price it paid, and who decided its magnitude.

Numbers That Have Already Been Touched

The tables in the 2010 census were not raw numbers either. Disclosure avoidance is the entire set of measures statistical agencies take before releasing results to ensure that no single respondent can be identified from those results. Disclosure avoidance up to 2010 relied on swapping. Data swapping is a method of taking the responses of easily identifiable households and exchanging them with the responses of other households. The Census Bureau used this method from 1990 to 2010, keeping the specific mechanics largely secret (DOI: 10.1145/3709025.3712210).

For decades, the Census Bureau intentionally introduced errors into tables and public individual-level data files without disclosing how much error was added or the exact method used (DOI: 10.21428/2c646de5.7ec6ab93). The census numbers prior to 2020 were also intentionally altered numbers, and what was new in 2020 was that the method and magnitude of introducing that error were being disclosed.

Swapping had preserved numbers. Even when households were swapped, the total population of the smallest geographic area remained unchanged (DOI: 10.1162/99608f92.abc2c765). The fact that the exact population of each area was published is one of the conditions that the attack in the next section relies on.

People Reconstructed from 34 Tables

As early as 2018, the Census Bureau disclosed internal research findings showing that the protective measures in the 2000 and 2010 censuses had serious vulnerabilities. Those vulnerabilities were exposed by a 2003 mathematical result called the "Database Reconstruction Theorem" (DOI: 10.1145/3219819.3226070). Mock attacks measuring just how large those vulnerabilities were in practice came afterward.

A reconstruction attack is an attack that takes only published aggregate numbers and pieces them backward to recreate individual records that produced those numbers. John Abowd and other researchers simulated this attack against the 2010 census and verified the results against confidential raw data. This research came out as a 2023 National Bureau of Economic Research (NBER) working paper (DOI: 10.3386/w31995) and was published in a journal in 2025 (DOI: 10.1162/99608f92.4a1ebf70). Using just 34 out of the 180 published table bundles, they reconstructed five items of individual records: living block, sex, age, race, and Hispanic origin.

The heavier finding is that attackers can check their own answers. Using only public data, attackers were able to confirm that all records were perfectly reconstructed in blocks accounting for 70% of the total population, or 97 million people (DOI: 10.1162/99608f92.4a1ebf70). This means they knew which neighborhood reconstructions were correct without looking at an answer key.

The researchers even tested re-identification, the process of re-linking records stripped of their owner's identity back to a specific person ("Personal Data and Anonymization — Erase the Name, and the Person Remains"). Within blocks where reconstruction was perfect, they could guess with 95% accuracy what 3.4 million people—whose race and ethnicity differed from the majority in their block—had actually answered for the race and ethnicity items. This accuracy was the same as when checked against confidential raw data and was much higher than the statistical baseline (DOI: 10.3386/w31995). This means the responses of people whose race and ethnicity differed from others in the neighborhood could be exposed. The researchers concluded that the flaw in the 2010 system lay in the assumption that "grouping into totals prevents accurate reconstruction."

Results from other researchers pointed in the same direction. They used an optimization method involving randomness to recreate entire individual-level records from aggregate numbers, and even ranked each recreated record by its likelihood of existing in the actual data. This was confirmed in both the 2010 census data and other survey data derived from the census (PMID 36800385). The authors noted that these rankings could be used to select targets for subsequent actions such as identity theft or hate crimes.

An Area Where Three People Live

Let us imagine that three people live in a certain area. One table counts the number of men and women in this area. Another table counts the numbers by age group, and yet another counts the overlap of gender and age groups. Looking at just a single table, it is impossible to know which record belongs to which of the three people. However, there are only a few combinations of records that simultaneously satisfy the exact counts of the same three people viewed from multiple angles, and as the tables increase, they can be narrowed down to a single one. Recovering them in this way is an unnamed record, and linking that record to who they are is yet another step.

Regarding where the risk arises, different perspectives point to different places. The Census Bureau pointed out a weakness exposed by reconstruction theorems (DOI: 10.1145/3219819.3226070). Other researchers concluded with the risk of precisely releasing aggregate numbers from large datasets (PMID 36800385). The side that refuted the reconstruction threat claim viewed that while reconstruction is not all that easy, down to which geographic unit exact numbers are released matters more for protection than which protection method is used (DOI: 10.2478/jos-2023-0017). The three sides overlap on the point that the way exact numbers are released divides the risk.

As defined in "Personal Data and Anonymization", differential privacy is a method that intentionally mixes noise into the results, making the released result hardly change whether any single person's data is included or excluded. If a random value of sufficient magnitude is added to each table in the three-person area, even if one finds combinations that fit the numbers, the grounds for believing those are the actual three people become weak. Researchers including Abowd also reported in 2020 that the system blocks attacks relying on reconstruction (DOI: 10.1162/99608f92.4a1ebf70).

Another study compared the two methods focusing on one concrete harm. People living in government-subsidized housing may omit unauthorized children or cohabitants from their responses out of fear of detection and eviction. They showed that with a simple and cheap reconstruction attack combining census and housing authority public statistics, subsidized households living in violation of residency criteria in 2010 could be found. In synthetic data experiments, the 2010-style random swapping did not significantly lower the precision of this attack, whereas the 2020-style differential privacy did (DOI: 10.1162/99608f92.39d8bfa4).

The Number That Sets the Size of the Noise

If you are going to mix in noise, you have to decide how much to mix. The privacy budget is the number in differential privacy that determines how much protection you are giving up; the larger the value, the smaller the noise, making the numbers more accurate and the protection weaker. It is commonly written with the Greek letter epsilon ($\varepsilon$) (DOI: 10.1145/3267323.3268949). There is a reason it is called a "budget." The differential privacy system can sum up the privacy losses that accumulate when asking multiple questions about confidential data and keep them bound within a set limit (DOI: 10.1145/3294052.3322188, conference lecture abstract). The budget is split between geographic units like states and counties and different types of tables, and the accuracy depends on the total size of the budget and how it is divided (DOI: 10.1162/99608f92.5cd8024e).

There is a comparison to help you physically feel the size of the budget. When a 2018 test system was run on the 1940 census data, the error and exposure at a budget of 1.0 were similar to a sample counting a randomly selected 50% of the US population. At a budget of 4.0, it was similar to a 90% sample. The actually measured privacy loss was considerably smaller than the upper bound guaranteed by theory, and the authors viewed this result as the start of a discussion on the balance between accuracy and protection (PMID 32478311).

Numbers mixed with noise are hard to use as they are. Population counts might come out negative, or the neighborhood numbers might not add up to the city number. Unlike other differential privacy applications, census statistics must be smoothed out after adding noise before they can be used (DOI: 10.1126/sciadv.abk3283). Post-processing is the step of refining the noise-mixed numbers back into usable tables that have no negative numbers and where the top and bottom sums match. The 2020 system post-processed the noise-infused numbers to create one record per person, and used them to produce tables for redistricting. Some numbers were left as they were without noise, as determined by census bureau policy (DOI: 10.1162/99608f92.529e3cb9, explanation by census bureau officials).

Post-processing revives usefulness, but it also comes with a price. The noise-mixed numbers before post-processing had too much noise to be used directly without an error model, especially for Hispanics and various racial groups. When they went through post-processing, the noise decreased, resulting in accuracy similar to when data was swapped (DOI: 10.1126/sciadv.adl2524). On the other hand, analysis suggests that post-processing to eliminate negative numbers creates accuracy gaps between groups in itself, and that the stricter the budget, the worse those gaps are. This study, tested using the Australian census and others, also reported that giving different budgets to different groups can significantly reduce those gaps (DOI: 10.1109/tifs.2025.3528222).

Between the Pieced-Together Record and the Finder

There is a counterargument that reconstruction threats have been inflated. Researchers Krish Muralidhar and Josep Domingo-Ferrer traced the roots of the claim in 2023 that producing accurate statistics makes it highly likely the entire dataset will be reconstructed—namely, that merely exporting data automatically exposes it to reconstruction—and concluded that the claim is wrong. They argued that properly using existing disclosure avoidance techniques can prevent reconstruction, and also warned that using reconstruction quality as a metric for re-identification inflates the re-identification risk figures (DOI: 10.2478/jos-2023-0017). They pointed out that a reconstructed record being correct and knowing whose record it is are distinct steps.

The response published in the same journal took the opposite view. This response was written by Simson Garfinkel, a co-author of the Abowd et al. mock-attack paper, and he is also the author of the 2022 case study cited earlier. The claim of the response is that differential privacy was the only realistic choice for protecting the 2020 Census, and traditional techniques were not an option (DOI: 10.2478/jos-2023-0018). Researchers including Abowd also examined this question. They reported that enhanced swapping with comparable accuracy failed to protect secrecy, and number-suppression methods that partially prevented reconstruction broke the legal purpose of redistricting (DOI: 10.3386/w31995).

Even with differential privacy, some exposure remains. Systems that have gone through trial phases still did not prevent people's races from being accurately guessed from the data (DOI: 10.1126/sciadv.abk3283). Pointing out that surnames and places of residence can be used to estimate race does not violate differential privacy, but it significantly increases the risk of exposing information that the Census Bureau tried to protect (DOI: 10.1162/99608f92.abc2c765). As "Personal Data and Anonymization" points out, differential privacy only prevents a person from standing out more just because they were included in the data; it does not promise to prevent people from guessing individuals using neighborhood statistics.

The root of the disagreement lies in how risk is measured. When evaluating risk measurement methods against pre-determined criteria, no single method satisfied all criteria. The method used by differential privacy, which compares "what happens when that person is left out," satisfied the most criteria, while the method measuring absolute risk satisfied the fewest (PMID 37831744). The authors noted that much of the criticism poured on differential privacy is criticism that would equally apply to any technology that does not equate to directly viewing confidential data without restriction.

When Small Numbers Shake

In a trial running the new system in advance on 2010 data, the cost of protection showed up first in small numbers. Calculated with actual COVID-19 death curves, using noisy population counts as the denominator severely distorted death rates and sometimes resulted in them exceeding 100%. The distortion was especially large in groups of under 1,000 people, which made up 40% of county-level age and sex groupings and 60% of race groupings (DOI: 10.1177/2378023121994014). The authors wrote that the Census Bureau should consider a larger budget, and data users should consider grouping data together.

Several similar results emerged. With the system at the proposal stage, death rate estimates were projected to fluctuate more for non-Hispanic Black and Hispanic people than for non-Hispanic white people, with larger changes in less populated and less urbanized areas. The authors suggested that research on racial disparities in death rates could be affected (PMID 32467167). With the final-version demonstration data, county-level Medicaid enrollment rates—meaning public health insurance enrollment rates for low-income populations—showed errors of up to 10%, especially in small subgroups and minority racial groups. At the state level, the errors were small enough to be negligible (PMID 35524543). With the finalized system, county-level population counts and growth rates deviated significantly more than under the previous method across all Black, Hispanic, and American Indian groups examined in this study, and the deviation grew sharply from cities to rural areas (PMID 38770012). County net migration estimates were accurate enough to use in only about half of counties using five-year age groupings, and the authors concluded that future accuracy depends on the Census Bureau's budget allocation (PMID 39421854).

Results pointing in the opposite direction carry equal weight. Massachusetts neighborhood-level premature mortality rates were 166.4, 166.4, and 166.3 per 100,000 residents regardless of whether the denominator used was the original population count, the population count with differential privacy applied, or the population count from another sample survey, and the results were similar when broken down by sex and race. The authors concluded that neighborhood-level health disparity estimates may not be affected (PMID 33351654). Examining neighborhood-level disparities in Massachusetts and Georgia using three sets of demonstration data, the overall patterns of disparities by racial group and economic deprivation level did not collapse. The problem from the initial version where Black population death rate errors were larger than those for non-Hispanic whites in Massachusetts was also reduced in the new version (PMID 37595037). The accuracy of methods estimating race using surnames and places of residence dropped slightly for American Indians and Alaska Natives, while remaining nearly unchanged for other groups (PMID 38742620).

The two sets of studies mostly measured different things. The studies showing fluctuation typically looked at small numbers at the county level and ratios derived from those numbers, while the studies showing resilience typically looked at the overall pattern of inequality across multiple neighborhoods within a state. However, even studies measuring inequality disagreed with one another, and they tested different versions of the system. The Census Bureau substantially changed the system between the final demonstration data and the actual release (DOI: 10.21428/2c646de5.7ec6ab93). It has been pointed out that the 2010 official numbers used as the baseline for comparison are also swapped numbers and not true values, and the research team that received this critique replied that policy evaluations remain meaningful even without true values (DOI: 10.1162/99608f92.abc2c765). An independent evaluation concluded that the errors of the two methods are generally no larger than other census errors, but can be substantial in regions with small total populations (DOI: 10.1126/sciadv.adl2524). Even if the magnitude of the error is similar, the two methods can differ in the direction in which they skew (DOI: 10.1145/3709025.3712210). Whether errors ruin an analysis depends on what is being measured, at what scale, and with which version of the system.

Drawing the Lines for Electoral Districts

When it comes to drawing electoral districts, the conclusions diverged sharply. Districts must have nearly equal populations, and in the United States, this is known as the "one person, one vote" principle. A 2021 study reported that the prototype system systematically undercounted populations in racially mixed and politically mixed voting districts, producing unpredictable racial and partisan skews. It also suggested that under current interpretations, it would likely violate the "one person, one vote" standard (DOI: 10.1126/sciadv.abk3283).

Other researchers found reassuring evidence. Looking closely at nine regions in Texas and Arizona, the 2020 system did not threaten the tasks of balancing district populations, accurately portraying district demographic compositions, or spotting signals of race-based voting polarization (DOI: 10.1162/99608f92.22fd8a0e). A 2026 study generated and compared millions of state legislative district plans using machines. While the sharp legal thresholds could amplify the effects of noise and large discrepancies did actually occur, they appeared manageable and correctable with a simple model. The authors concluded that, at least for state legislatures, Alabama's argument that differential privacy "prevents the states' right to draw fair lines" lacks a solid basis (DOI: 10.1177/15331296261434381).

The three conclusions examined different regions with different yardsticks. The 2021 study measured the skew itself produced by the prototype system, while the 2026 study even weighed whether discrepancies could be corrected by comparing 2010 demonstration data against 2010 official data. This debate even spilled over into lawsuits against the U.S. Department of Commerce (DOI: 10.2478/jos-2023-0017).

Who Decided the Budget?

The value of the budget was decided through a choice, not a calculation. According to a 2022 case study, the Census Bureau did not disclose how it determined the privacy budget value for the 2020 redistricting data (DOI: 10.21428/2c646de5.7ec6ab93). What remained undisclosed was the process of picking the value, while the official guarantees tied to the value were announced (PMID 41191500). The difficulties the Census Bureau encountered when actually adopting differential privacy also included the task of setting this value (DOI: 10.1145/3267323.3268949). As of 2014, there was still no rigorous method for choosing epsilon, and that choice was a matter of weighing interests between analysts who wanted to know something from the data and participants who had to decide whether to hand over their data (DOI: 10.1109/csf.2014.35).

Because accuracy depends heavily on the size and allocation of the budget, this policy decision is fundamentally important. This is the conclusion of a study that examined segregation metrics using the 1940 census, and the authors recommended that the Census Bureau work with users to decide where to allocate the budget and release documentation and tools to gauge the reliability of the published statistics (DOI: 10.1162/99608f92.5cd8024e).

Analyses also emerged showing that the allocated budget was not fully used. When privacy loss was summed up more precisely, the 2020 census was providing considerably stronger protection than the official guarantee across all eight geographic units. The authors reported that the Census Bureau added more noise than necessary, and that it could have reduced the variance of the noise by 15.08 to 24.82% while maintaining nearly the same protection (PMID 41191500). This means more accurate numbers were possible under the same protection. There is also a public server version showing that under the same guarantees, changing post-processing significantly increased accuracy at the county and neighborhood levels (DOI: 10.48550/arxiv.2603.10099, preprint).

The human problem also remained. The redistricting data released in August 2021 arrived with formal protection guarantees for the first time for decennial census redistricting data (DOI: 10.48550/arxiv.2209.03310, preprint). Around that time, thousands of stakeholders worried that differential privacy would blur the numbers so much that they would become unusable (DOI: 10.21428/2c646de5.7ec6ab93). Technical uncertainty shook user trust, and some analyses suggest that restoring trust requires more than just technical fixes or improved communication (DOI: 10.1162/99608f92.66882f0e). Others argue that producing fair outcomes for marginalized groups requires communication that includes all user groups, just as much as algorithmic design does (PMID 39220199).

Garfinkel's response described the cost of differential privacy like this. Differential privacy has a social cost, and that cost lies in practitioners having to acknowledge that there is an unavoidable trade-off between the usefulness of official statistics and the privacy loss of respondents (DOI: 10.2478/jos-2023-0018). The authors of the 2021 redistricting study similarly wrote that policymakers must confront the trade-off between data utility and privacy protection (DOI: 10.1162/99608f92.abc2c765). Both sides, whose conclusions diverged, meet at this sentence.

When Totals Are Safe and When They Are Not

The belief that "as long as you only release totals, individuals will not be exposed" holds true within certain limits. The larger you group the numbers and the fewer numbers you release, the closer you get to that belief. When accurate numbers are released in countless tables down to the smallest district level, as in the 2010 Census, personal records could almost be reconstructed. The mere fact of grouping into totals does not guarantee protection; how small a unit, how many numbers, and how precisely they are released largely determine the risk.

Instead of preventing that reconstruction, differential privacy left errors in the numbers for small groups. Whether those errors ruined analyses varied by analysis. Many results showed that numbers for minority groups in small counties swung wildly, while several results showed that the overall patterns of neighborhood-level inequality held up. Which result you got depended on what you measured, at what size, and with which version of the system. Conclusions about electoral districts split depending on the region and the yardstick. Where to stand between those two outcomes is largely determined by the size and division of the privacy budget, and choosing that value remains a choice rather than a calculation.

The path by which name-cleared individual records point to people again is covered next in "Re-identifying De-identified Data — Who Can Find a House Once the Nameplate Is Gone?". The basics of the three tools—adding noise, hiding in a crowd, and collecting less—are found in "Personal Data and Anonymization — Erase the Name, and the Person Remains".

Source Papers

• "The U.S. Census Bureau Adopts Differential Privacy" (2018, presentation abstract on page 1) — DOI: 10.1145/3219819.3226070 — The census is a constitutional survey used for apportioning the House of Representatives and redrawing all legislative districts. Internal research confirmed serious vulnerabilities in the 2000 and 2010 protection mechanisms revealed by the Dinur–Nissim (2003) reconstruction theorem, leading to the design of a differential privacy release system.
• "The 2020 US Decennial Census is more private than you (might) think." (2025) — PMID 41191500 — The foundation for federal budget allocation and electoral districts. Precise loss accounting allows all eight geographic units to receive stronger protection than the official guarantee, with noise variance reducible by 15.08 to 24.82%.
• "Comment to Muralidhar and Domingo-Ferrer (2023) – Legacy Statistical Disclosure Limitation Techniques Were Not An Option for the 2020 US Census of Population And Housing" (2023, by Simson Garfinkel alone — co-author of the simulation attack paper) — DOI: 10.2478/jos-2023-0018 — Differential privacy was the only realistic choice. Social costs mean acknowledging the trade-off between utility and privacy loss.
• "A Simulated Reconstruction and Reidentification Attack on the 2010 U.S. Census" (2025) — DOI: 10.1162/99608f92.4a1ebf70 — 180 table bundles and 150 billion numbers, mostly at the block level. Five items reconstructed from 34 tables, verifying the complete reconstruction of 70% of blocks (97 million people), with race and ethnicity inferred with 95% accuracy for 3.4 million people. The 2020 system prevents reconstruction attacks.
• "A Simulated Reconstruction and Reidentification Attack on the 2010 U.S. Census: Full Technical Report" (2023, by John Abowd et al., National Bureau of Economic Research (NBER) working paper) — DOI: 10.3386/w31995 — When using 38 age brackets, at most 20.1% differ by even a single value. Precision matches confidential data. Enhanced swapping fails to protect, and incomplete masking destroys the utility for redistricting.
• "Differential Privacy and the 2020 US Census" (2022, Garfinkel's case study) — DOI: 10.21428/2c646de5.7ec6ab93 — Published in 2017, using noise plus post-processing instead of swapping. For decades, errors were introduced without disclosing the magnitude or method. In 2020, error magnitudes were announced. Significant changes occurred between the final demonstration data and the official release, with the budget decision process kept private.
• "Evaluating the Impacts of Swapping on the US Decennial Census" (2025) — DOI: 10.1145/3709025.3712210 — Swapping was used from 1990 to 2010, with details kept private. Even when error magnitudes are similar, the direction of bias can differ from TopDown.
• "Comment: The Essential Role of Policy Evaluation for the 2020 Census Disclosure Avoidance System" (2023) — DOI: 10.1162/99608f92.abc2c765 — Benchmark data are not true values, but policy evaluation remains valid. Block populations remain invariant under swapping. Surname- and geography-based race estimation does not violate differential privacy, but significantly increases exposure risk. Policy makers must confront the utility-protection trade-off.
• "Confidence-ranked reconstruction of census microdata from published statistics." (2023) — PMID 36800385 — Complete row reconstruction and confidence ranking from aggregate statistics. Confirmed in the 2010 census and ACS. The risks of publishing precise aggregates.
• "Database Reconstruction Is Not So Easy and Is Different from Reidentification" (2023) — DOI: 10.2478/jos-2023-0017 — The claim that reconstruction happens automatically is incorrect. It can be avoided with traditional techniques, and the geographic level at which exact numbers are published matters more. Using reconstruction quality as a measure of re-identification exaggerates the risk. Mention of legal proceedings.
• "Quantifying Privacy Risks of Public Statistics to Residents of Subsidized Housing" (2025) — DOI: 10.1162/99608f92.39d8bfa4 — Cheap reconstruction attacks combining public statistics can identify subsidized households violating 2010 residency criteria. In synthetic data, swapping fails to significantly reduce precision, whereas differential privacy does.
• "Issues Encountered Deploying Differential Privacy" (2018) — DOI: 10.1145/3267323.3268949 — Workforce and computing environments, accounting for all uses, setting epsilon values, and a lack of verification tools.
• "Differential Privacy and the US Census" (2019, lecture abstract) — DOI: 10.1145/3294052.3322188 — Strictly bounding and controlling cumulative privacy loss across multiple interactions.
• "Assessing the Impact of Differential Privacy on Measures of Population and Racial Residential Segregation" (2022) — DOI: 10.1162/99608f92.5cd8024e — Compared using the 1940 census. Accuracy depends on the total budget and the allocation between geography and queries, highlighting the fundamental importance of policy decisions. Recommendations for user collaboration, documentation, and tools.
• "Differential privacy in the 2020 US census: what will it do? Quantifying the accuracy/privacy tradeoff." (2019) — PMID 32478311 — End-to-end system on 1940 data. A budget of 1.0 is similar to a 50% sample, and 4.0 to a 90% sample. Measured loss is considerably smaller than theoretical guarantees. Further discussion is needed.
• "The use of differential privacy for census data and its impact on redistricting: The case of the 2020 U.S. Census" (2021) — DOI: 10.1126/sciadv.abk3283 — Post-processing is required after adding noise. Mixed precinct undercounts, unpredictable bias, potential violations of one person, one vote, and inability to prevent individual race prediction.
• "The 2020 Census Disclosure Avoidance System TopDown Algorithm" (2022) — DOI: 10.1162/99608f92.529e3cb9 — Post-processing noisy measurements and policy-determined invariants to produce a record file per person and housing unit, and generating tables for redistricting.
• "Evaluating bias and noise induced by the U.S. Census Bureau's privacy protection methods" (2024) — DOI: 10.1126/sciadv.adl2524 — Noisy measurement files have excessive noise (Hispanics and multiracial individuals) if used without an error model. Accuracy after post-processing is comparable to swapping. Errors are generally no larger than other sources of error, but substantial in low-population areas.
• "Privacy and Fairness Analysis in the Post-Processed Differential Privacy Framework" (2025) — DOI: 10.1109/tifs.2025.3528222 — Non-negative post-processing inherently introduces fairness issues. Severe unfairness under tight budgets. Tested using the Australian census, and group-specific budgets significantly reduce discrepancies.
• "Differential Privacy in the 2020 Census Will Distort COVID-19 Rates" (2021) — DOI: 10.1177/2378023121994014 — Noisy denominators severely distort mortality rates, sometimes exceeding 100%. Especially large in groups under 1,000 people (40% of county age-by-gender groups, 60% of race groups). Consideration of larger budgets and data aggregation.
• "How differential privacy will affect our understanding of health disparities in the United States." (2020) — PMID 32467167 — Estimated mortality rates for non-Hispanic Blacks and Hispanics change more under the proposed algorithm, with larger changes in low-population and less urbanized areas.
• "The effect of differential privacy on Medicaid participation among racial and ethnic minority groups." (2022) — PMID 35524543 — County-level errors up to 10% based on 2010 demonstration data, especially in small groups and minority races. State-level errors are small and negligible.
• "The 2020 US Census Differential Privacy Method Introduces Disproportionate Discrepancies for Rural and Non-White Populations." (2022) — PMID 38770012 — With the finalized algorithm, county populations and growth rates deviate significantly for all groups except total population and non-Hispanic Whites, with discrepancies surging in rural areas.
• "Differential Privacy and the Accuracy of County-Level Net Migration Estimates." (2022) — PMID 39421854 — Based on 2020 public demonstration data, net migration estimates for 5-year age groups are useful in only about half of counties. Large in counties under 50,000 people, ages 65 and older, and Hispanics. Dependent on budget allocation.
• "Impact of Differential Privacy and Census Tract Data Source (Decennial Census Versus American Community Survey) for Monitoring Health Inequities." (2021) — PMID 33351654 — Early mortality rates at the Massachusetts neighborhood level: 166.4/166.4/166.3 (per 100,000 people). Inequality estimates may remain unaffected.
• "Impacts of census differential privacy for small-area disease mapping to monitor health inequities." (2023) — PMID 37595037 — Three types of demonstration data, Massachusetts and Georgia. Overall patterns of inequality are not compromised. The inflated error for Black populations in the initial edition is improved in the new edition.
• "Differential Privacy Protections in 2020 U.S. Decennial Census Data Do Not Impede Measurement of Racial and Ethnic Disparities." (2024) — PMID 38742620 — Surname- and geography-based race estimation accuracy decreases slightly for American Indians and Alaska Natives, with almost no impact on other groups.
• "Private Numbers in Public Policy: Census, Differential Privacy, and Redistricting" (2022) — DOI: 10.1162/99608f92.22fd8a0e — Nine regions in Texas and Arizona, without threatening the detection of population balance, demographic composition, and racial polarization signals.
• "Understanding and Mitigating the Impacts of Differentially Private Census Data on State-Level Redistricting" (2026) — DOI: 10.1177/15331296261434381 — A very large number of state legislative district plans. Thresholds amplify the impact of noise, leading to large discrepancies that can nevertheless be captured and corrected with simple models. Insufficient basis for the Alabama plaintiffs' claims at the state legislative level.
• "Differential Privacy: An Economic Method for Choosing Epsilon" (2014) — DOI: 10.1109/csf.2014.35 — Lack of a rigorous method for choosing epsilon. Balancing the interests of analysts and participants.
• "Denoising the US Census: Succinct Block Hierarchical Regression" (2026, preprint) — DOI: 10.48550/arxiv.2603.10099 — Significant improvements in county and neighborhood-level accuracy using new post-processing under the same guarantees and constraints.
• "Bayesian and Frequentist Semantics for Common Variations of Differential Privacy: Applications to the 2020 Census" (2022, preprint) — DOI: 10.48550/arxiv.2209.03310 — The summary file for redistricting released on August 12, 2021 was produced with formal privacy guarantees for the first time.
• "Differential Perspectives: Epistemic Disconnects Surrounding the U.S. Census Bureau's Use of Differential Privacy" (2022) — DOI: 10.1162/99608f92.66882f0e — Technical and procedural uncertainties weaken users' trust in data and institutions. Restoring trust requires more than fixing technology or improving communication.
• "Equitable differential privacy." (2024) — PMID 39220199 — Achieving fair outcomes requires inclusive communication at every stage, alongside algorithmic design.
• "An in-depth examination of requirements for disclosure risk assessment." (2023) — PMID 37831744 — No risk measurement framework satisfies all criteria. Counterfactual comparison is satisfied the most, and absolute risk the least. Much of the criticism applies to all technologies that do not involve direct and unrestricted access.