Small-Cell Suppression Rule¶
Release rule — instantiates Reconstruction-Resistant Disclosure Design
Suppresses, merges, or coarsens any output cell built from too few contributors, so a sparse count can't single out the handful of people behind it.
In any table, the danger lives in the thin cells. A count of "1" or "2" does not merely describe a group — it is a person or two, and anyone holding a little context can name them. Small-Cell Suppression Rule is the release rule that finds every such thin cell across a table and refuses to publish it as-is: it blanks it, merges it into a neighbor, rounds it to a base, or delays it until more contributors accumulate. Its defining move, distinct from adding noise or setting a query budget, is a threshold on contributor count applied cell by cell — below the threshold, a value simply does not ship in recoverable form. It is the oldest and most legible move in statistical disclosure control, operating on the table's own structure rather than on randomness or access.
Example¶
A state education department publishes test-score pass rates by school, grade, and subgroup — including race, disability, and English-learner status. For a large school the cross-tabs are harmless, but "8th grade, students with disabilities, passing math" at a small rural school may rest on 3 students, and "0 of 3 passed" names those children to anyone in town. The Small-Cell Suppression Rule scans every published cell and suppresses any backed by fewer than, say, ~10 students. Crucially, it suppresses a second set of cells too: if only one subgroup in a row is hidden, its value is recoverable by subtracting the visible cells from the published row total, so complementary cells must go as well. The department records which cells were withheld and why, so the pattern of suppression does not itself become a tell. Small-cell suppression of this kind is standard practice in education and health reporting governed by confidentiality rules.
How it works¶
- Set a minimum contributor count. Fix a threshold k below which no cell may publish an exact value.
- Sweep the whole table. Flag every under-threshold cell, including margins and cross-tabs — this pass is a full inventory of where the table exposes too few people (primary suppression).
- Suppress complementarily. Hide enough additional cells that suppressed values can't be recovered by differencing rows or columns against published totals (secondary suppression).
- Choose the treatment per cell. Blank, merge into a coarser category, round to a base, or delay — trading protection against how much analytic detail survives.
Tuning parameters¶
- Threshold k — the minimum contributor count; higher protects smaller groups but blanks more of the table.
- Treatment — suppress versus merge versus round versus delay; each trades a different kind of usability for the same protection.
- Complementary-suppression aggressiveness — how many extra cells to hide to block recovery-by-subtraction; too little leaks, too much guts the table.
- Sensitivity weighting — whether some variables (health, sexuality, immigration status) carry a higher threshold than benign ones.
- Cross-release consistency — whether the same cells are suppressed every period; suppression that shifts between versions can itself leak the hidden value.
When it helps, and when it misleads¶
Its strength is that it is simple, auditable, and aimed straight at the highest-risk outputs — the sparse cells where one row is one person — with a rule anyone can check. It needs no randomness and degrades utility only where the data was most dangerous.
Its failure mode is that naive primary-only suppression is a trap: it looks safe while each hidden value sits one subtraction away from any total that was published, which is why complementary suppression is not optional. Suppression patterns that drift between releases leak across versions. And because a blanked cell is conspicuous, teams are tempted to publish the "almost safe" cell of 4 or 5 to avoid an ugly gap — spending protection for cosmetics. The discipline is to derive k from the re-identification risk, suppress complementarily, and hold the pattern stable across releases.[n1]
How it implements the components¶
Small-Cell Suppression Rule fills the structural-surface side of the archetype — finding the risky outputs and bounding what remains after treatment:
disclosure_surface_inventory— its cell-by-cell sweep enumerates exactly where the table exposes too few contributors, cataloguing the thin cells, margins, and cross-tabs that make up the disclosure surface.residual_reconstruction_risk_record— the threshold k is a stated bound on leftover risk: after suppression, no published cell singles out fewer than k people, and the record notes where complementary suppression still leaves inference possible.
It does not perturb the values it does publish (Noise or Randomization Release), govern repeated querying (Query Rate and Overlap Limit), or generalize categories wholesale (Coarsening and Generalization Policy) — it removes the thin cells and leaves the rest exact.
Related¶
- Instantiates: Reconstruction-Resistant Disclosure Design — supplies the cell-level suppression that keeps sparse tabular outputs from naming their few contributors.
- Sibling mechanisms: Noise or Randomization Release · Coarsening and Generalization Policy · Query Rate and Overlap Limit · Synthetic or Perturbed Data Validation · Post-Release Reconstruction Monitor · Differencing Attack Scan
Editorial Notes¶
Form Classification¶
Form family: Rule, Policy & Commitment
Rationale: Small-Cell Suppression Rule operates as a standing rule, threshold, contractual commitment, or policy constraint governing future conduct because it suppresses, merges, or coarsens any output cell built from too few contributors, so a sparse count can't single out the handful of people behind it.
Independent corroboration: The frozen evidence defines Small-Cell Suppression Rule as 'Suppresses, merges, or coarsens any output cell built from too few contributors, so a sparse count can't single out the handful of people behind it', so its operative form is Rule, Policy & Commitment.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Statistics & Experimental Design
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Specialized
Rationale: Suppressing or coarsening sparse cells is a statistical disclosure-control technique. Census methodology explicitly uses cell suppression to protect contributors while retaining publishable aggregates; law supplies privacy duties.
Related originating lineages:
- Accounting & Auditing — accounting_auditing contributes reconciliation, controls, traceability, and independent assurance to this mechanism's defining operation—Suppresses, merges, or coarsens any output cell built from too few contributors, so a sparse count can't single out the handful of people behind it—without displacing the selected primary historical lineage.
- Data Science & Analytics — Automated publication pipelines implement count thresholds and complementary suppression.
- Law & Governance — Privacy rules require protection of identifiable persons in released statistics.
- Public Administration & Policy — Public administration, policy implementation, and program oversight supplies a parallel or contributing lineage for the mechanism's defining operation: suppresses, merges, or coarsens any output cell built from too few contributors, so a sparse count can't single out the handful of people behind it.
- Security Studies & Intelligence Analysis — Sparse combinations create inference attacks despite removed direct identifiers.
Review resolution: The blind reviewers disagree on primary lineage (statistics_experimental_design versus law_governance). Authoritative or primary research supports statistics_experimental_design as the best historical origin: Suppressing or coarsening sparse cells is a statistical disclosure-control technique. Census methodology explicitly uses cell suppression to protect contributors while retaining publishable aggregates; law supplies privacy duties. The cited U.S. Census Bureau, Cell Suppression Methodology directly supports the mechanism's defining operation. All independently supported contributing domains are retained without an arbitrary cap. origin_mode=cross_disciplinary_synthesis records lineage, while domain_reach=specialized records later applicability separately from provenance.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Researched adjudication after independent review; high confidence.
Sources consulted:
Notes¶
Primary suppression alone is a common and dangerous half-measure: a single hidden cell in a row is fully recoverable by subtracting the visible cells from a published total. The rule is only sound with complementary suppression, and it pairs naturally with a Differencing Attack Scan that checks whether any suppressed value remains recoverable across the released tables and their prior versions.
[n1] k-anonymity — the property that every released record is indistinguishable from at least k−1 others on the quasi-identifiers an observer could know. A minimum-cell-size rule is one way to approximate it for tabular output: no published figure rests on fewer than k contributors. ↩