Threshold Suppression¶

Rule — instantiates Side-Channel Leakage Containment

Withholds any output that rests on too few underlying records — suppressing small cells so a released aggregate can't be narrowed down to expose an individual protected state.

An aggregate built from very few individuals barely aggregates at all — a count of "1", or an average over two people, points straight back at them. Threshold Suppression is the rule that refuses to publish such outputs: it sets a minimum support k and withholds (or merges upward) any cell, group, or answer backed by fewer than k records. Its defining move is a binary keep-or-withhold decision on released aggregates, based on their underlying support — not reshaping an output's size (that's padding) or its timing (that's scheduling), but declining to emit it at all when too little crowd stands behind it. The threshold k is the concrete distinguishability bound: below it, an aggregate would resolve individuals, so it never ships.

Example¶

A school district publishes graduation rates broken down by school, grade, and demographic group — genuinely useful for spotting gaps, and dangerous exactly where the breakdown gets thin. Some intersections contain only two or three students; publishing "100% for group X at school Y" would effectively name them and disclose a protected educational record. The suppression rule withholds every cell whose support falls below k — say roughly ten students — so the thin intersections simply don't appear.

Suppressing the small cells is not enough on its own, though: if the row and column totals are still published, a suppressed cell can often be recovered by subtracting the visible cells from the margin. So the rule also applies complementary suppression, withholding just enough additional cells that no suppressed value can be back-solved from the totals. Analysts still get every robust aggregate; the handful of cells that would expose individuals — and the cells needed to protect them from subtraction — are held back.

How it works¶

Set the minimum support k. Fix the smallest number of underlying records an output may rest on, from the tolerated leakage budget.
Primary-suppress thin cells. Scan for cells with support below k and withhold them.
Complementary-suppress to block back-solving. Withhold enough additional cells that suppressed values can't be reconstructed from published margins.
Merge as an alternative to drop. Where dropping costs too much utility, roll thin cells up into a coarser category that clears k.

Tuning parameters¶

Threshold k — the core dial. Higher k is safer but suppresses more and publishes less; it is the minimum-support bound in one number.
Complementary-suppression aggressiveness — how many extra cells are withheld to block differencing. More is safer but erases more data.
Suppress vs. merge-up — drop thin cells, or aggregate them into a coarser bucket that meets k. Merging preserves totals at the cost of granularity.
Definition of support — what counts toward k (distinct people, records, events). The wrong unit gives false safety.
Interaction with rounding — whether surviving cells are also rounded, since exact counts near k can still narrow things down.

When it helps, and when it misleads¶

Its strength is that it is simple, legible, and widely accepted for tabular releases: the threshold is easy to explain to a stakeholder and easy to audit after the fact, and it closes the "an aggregate that isn't really aggregate" leak directly. For published statistics it is often the first and most defensible control.

Its failure modes are well known and mostly about what suppression alone misses. Naive small-cell suppression without complementary suppression is defeated by differencing against published totals — the cell looks hidden but is trivially recoverable. Too low a k gives false safety; too high wrecks utility. And the classic misuse is to pick k to preserve as much data as possible rather than to meet the risk — running the threshold backwards from the desired output volume. The underlying principle is k-anonymity: each released record should be indistinguishable within a group of at least k, and small-cell suppression is one way to enforce it.^[1] The discipline that keeps it honest is to pair suppression with complementary suppression and a query-composition limit, because without both, differencing reopens the very cell that was suppressed.

How it implements the components¶

This rule fills the aggregation-and-suppression components for released aggregates:

aggregation_and_suppression_rule — the keep-or-withhold-on-support rule, including the complementary suppression that blocks back-solving from margins.
distinguishability_or_leakage_budget — realizes the tolerated budget as a concrete minimum-support threshold k below which nothing is released.

It withholds; it does not reshape. Padding a response to a uniform size is Response Padding or Coarsening; stripping revealing metadata is Metadata Minimization Filter; and suppressing rare events inside *internal telemetry rather than published aggregates is Privacy-Preserving Telemetry View.*

Instantiates: Side-Channel Leakage Containment — withholds aggregates too thin to hide the individuals behind them.
Consumes: Residual Leakage Review Board sets the threshold k and the leakage budget the rule enforces.
Sibling mechanisms: Query Rate and Composition Limit · Response Padding or Coarsening · Privacy-Preserving Telemetry View · Side-Channel Inventory Workshop · Residual Leakage Review Board · Secret-Independent Resource Scheduling · Side-Channel Regression Test · Batching and Delayed Release · Broker Visibility Partitioning · Cache Partitioning or Flush Rule · Constant Response Envelope · Controlled Noise Injection · Differential Observation Test · Error Message Normalization · Metadata Minimization Filter

Notes¶

Suppression and the query limit are complements: complementary suppression protects a single published table from differencing, while Query Rate and Composition Limit protects an interactive service from being differenced across many queries. The threshold k here is the same tolerated budget the Residual Leakage Review Board sets and that Response Padding or Coarsening realizes as a bucket width — one budget, three enforcement shapes.

References¶

[1] k-anonymity (Sweeney) requires that every released record be indistinguishable from at least k−1 others on the identifying attributes, so no individual can be singled out. Suppressing cells with fewer than k underlying records is one mechanism for meeting that requirement in tabular data. ↩