Coarsening and Generalization Policy¶
Release-transformation policy — instantiates Reconstruction-Resistant Disclosure Design
Lowers the resolution of a release — coarser geography, time, categories, or numbers — until any individual hides inside a group large enough that no member stands out.
Once you know which quasi-identifiers expose people, the bluntest reliable defence is simply to stop reporting them so precisely. The Coarsening and Generalization Policy protects a release by lowering its resolution — a region instead of an address, an age band instead of a birth date, a broad category instead of a rare one — until any individual is hidden inside a group large enough that no member stands out. Its defining move is climbing a generalization hierarchy: each field carries ladders from specific to general, and the policy fixes how far up each ladder a release must go before it is allowed out. Unlike its perturbation-based siblings it adds no falsehood — every published value stays true, only coarser — and unlike suppression it keeps every record, trading precision rather than deleting data. The policy also records what precision it surrendered, and can set different rungs for different recipients.
Example¶
A city transit authority wants to publish trip data so researchers can study travel patterns, but raw trips — precise GPS endpoints and second-level timestamps — would let anyone trace a rider from a known home to a clinic. The coarsening policy sets the rungs: origins and destinations reported at the level of roughly one-square-kilometre zones, times rounded to the hour, rider attributes like age reported in bands. The governing rule is that no published origin–destination–hour cell may describe fewer than, say, a few dozen trips; where a zone is too sparse, the policy climbs another rung, merging it with a neighbour, until the cell is crowded enough to hide its riders.
Researchers still see that mornings flow downtown and evenings back out; they no longer see that one rider goes from a specific block to a specific clinic at 8:47 each Tuesday. And the same dataset can ship at a finer rung to a vetted university under a data-use agreement and a coarser one to the open public — the protection dialled to the trust of the recipient.
How it works¶
- Define generalization hierarchies per field — the ladders from exact value to broad bucket that coarsening is allowed to climb.
- Set a group-size target — the minimum number of people any released combination must describe before it can go out.
- Recode to the coarsest rung that clears the target, either uniformly across the release or only for the sparse, exposed cells.
- Vary the rung by recipient tier, applying coarser resolution to lower-trust audiences, and log the precision surrendered against the release's purpose.
What distinguishes it is that protection comes from resolution alone, monotonically: you can always coarsen further, and the output stays a set of true statements.
Tuning parameters¶
The dials that adapt the policy to a specific release:
- Group-size target — the minimum number of people any released combination must describe; larger hides better but flattens the data toward uselessness.
- Per-field granularity — how far up each ladder to climb, field by field; coarsening the wrong field wastes utility, while coarsening the right one buys protection cheaply.
- Global vs local recoding — one resolution everywhere versus coarsening only the sparse cells; local keeps more detail but complicates the release and can leak which cells were touched.
- Per-tier resolution — finer data for vetted, agreement-bound recipients and coarser for the open public; more tiers extract more utility but multiply the surfaces to defend.
- Suppression fallback — what to do with outliers no feasible coarsening can hide: drop them, or keep climbing until the field collapses.
When it helps, and when it misleads¶
Its strength is that it is truthful, auditable, and intuitive: it directly implements the idea of hiding each person in a crowd of look-alikes, and it preserves any analysis that survives lower resolution.[n1]
Its failure mode is that crowd size alone is not enough. If everyone in a group shares the sensitive value, an observer learns it without ever singling anyone out — the homogeneity attack — which is why grouping by size is strengthened by also requiring diversity within each group. Coarsening also degrades utility quietly, and it is easily run backwards: coarsen just enough to clear a compliance threshold while the real exposure survives. The discipline is to set the target from the threat model, check group diversity and not merely size, and measure utility loss against the stated purpose rather than a checkbox.
How it implements the components¶
Coarsening fills the transformation side of the archetype — the components a release-shaping policy produces:
release_transformation_policy— the generalization hierarchies and rung-selection rules are the transformation policy: they specify exactly how raw values are coarsened before release.utility_loss_and_purpose_record— it logs which precision was surrendered on which field, so the cost is weighed against the release's purpose rather than hidden.recipient_tier_model— it encodes different resolution rungs for different recipient classes, from open public to agreement-bound researcher.
Coarsening is one transformation among siblings: it neither injects calibrated noise (Noise or Randomization Release) nor suppresses thin cells outright (Small-Cell Suppression Rule), and it does not account cumulative exposure across releases — that is composition_and_query_control, owned by Differencing Attack Scan and Query Rate and Overlap Limit.
Related¶
- Instantiates: Reconstruction-Resistant Disclosure Design — coarsening is the workhorse transform that lowers a release's resolution to the level the risk budget allows.
- Sibling mechanisms: Noise or Randomization Release · Small-Cell Suppression Rule · Differencing Attack Scan · Auxiliary-Prior Review Workshop · Linkage Attack Test · Membership Inference Probe · Model Inversion Red Team · Post-Release Reconstruction Monitor · Privacy Budget Accounting · Query Rate and Overlap Limit · Synthetic or Perturbed Data Validation
Editorial Notes¶
Form Classification¶
Form family: Rule, Policy & Commitment
Rationale: Lowers the resolution of a release — coarser geography, time, categories, or numbers — until any individual hides inside a group large enough that no member stands out, making its operative form a standing rule, threshold, contractual commitment, or policy constraint governing future conduct.
Independent corroboration: The frozen evidence defines Coarsening and Generalization Policy as 'Lowers the resolution of a release — coarser geography, time, categories, or numbers — until any individual hides inside a group large enough that no member stands out', so its operative form is Rule, Policy & Commitment.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Computer Science & Software Engineering
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Specialized
Rationale: Data-privacy engineering established generalization hierarchies and k-anonymity-style release rules that lower quasi-identifier resolution.
Related originating lineages:
- Statistics & Experimental Design — Statistical disclosure control supplies re-identification testing and group-size criteria.
- Ethics of Technology & AI Governance — Privacy governance supplies recipient-specific release constraints and composition safeguards.
Review resolution: Both reviewers agree on computer_science as primary. Reading the mechanism confirms that its defining operation belongs to that lineage; the final record retains statistics_experimental_design, tech_ethics_ai_governance only as materially formative origin and keeps present-day application breadth separate from provenance.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
Coarsening composes with itself safely, but not across inconsistent releases: publish the same data once at a coarse rung and later at a finer one and the pair can be differenced back toward the original. Fix the resolution once per dataset and hold it, or route the cross-release check to Differencing Attack Scan.
[n1] Hiding each record in a group of at least k indistinguishable others is k-anonymity (Latanya Sweeney), achieved chiefly through generalization and suppression. Its known weakness to homogeneous and background-knowledge attacks is what motivated the l-diversity and t-closeness refinements, which add the within-group diversity requirement noted above. ↩