Communicating aggregate percentage changes in data without exposing individual contributors

Question

So i have a dataset that tracks widget production from 100 different factories, each individually owned and highly competitive. Each line contains the factory name, the date of production, and the # of widgets produced.

As expected, some widget factories produce way more widgets than others. In fact, the top few factories typically account for 70% of widget production.

I am the government and hold and see all of this data, but no individual widget factory has all of the data. However, I would like to provide "aggregate" statistics to all widget producers such that they can compare their own factory's performance to the "industry average".

However, I cannot do a simple weighted average, as this would expose the growth rate of the top few factories. Down-weighting the top producers will give me growth rates that correlate with the "total" widget growth rate, but would not have the same magnitude, so I don’t think that number is particularly useful.

What are typical solutions to this issue? I want to show an accurate % change in total industry widget production from week to week, but don't want to put anyone at a disadvantage. This seems like a problem the bureau of labor statistics would run into frequently, for example if they are posting monthly manufacturing data and certain sectors only have a small number of primary contributors to those numbers. Would do they do in these scenarios? How are they "anonymizing" the data while still making it useful?

Answer 1

To prevent the average from leaking the value associated any individual factory, you would typically use differential privacy, for example by adding Laplace noise of scale $\frac{C}{n\varepsilon}$ to your average, where:

• $C$ is the maximum contribution of any given factory (that you have to fix in advance, based on your knowledge of the problem space and typical data distributions, not based on the real data)
• $n$ is the number of factories,
• $\varepsilon$ is the desired privacy parameter.

If any factory's value is larger than $C$, you have to clamp its value (replace it by $C$). If the values you're averaging can be negative, you also need a lower bound $B$, and the scale of the noise is $\frac{C-B}{n\varepsilon}$.

Now, if only one or a handful of factories have a completely oversized contribution compared to the rest, this noise might be too large to get meaningful results. But if that's the case, you're essentially trying to solve an impossible problem: if the statistic inherently leaks data about large factories when reasonably accurate… the trade-off between accuracy and privacy leakage might be an unacceptable one.