# Confidence-Ranked Reconstruction of Census Microdata from Published Statistics

arXiv: https://arxiv.org/abs/2211.03128 · HTML: https://mlsanity.com/paper/2211.03128/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 35 references that are in the map.
- First posted on arXiv 6 Nov 2022.

## Builds on (most cited first, 6 of 6)

- [Retiring Adult: New Datasets for Fair Machine Learning](https://mlsanity.com/paper/2108.04884/) (2021)
- [Iterative Methods for Private Synthetic Data: Unifying Framework and New Methods](https://mlsanity.com/paper/2106.07153/) (2021)
- [Differentially Private Query Release Through Adaptive Projection](https://mlsanity.com/paper/2103.06641/) (2021)
- [Private Synthetic Data for Multitask Learning and Marginal Queries](https://mlsanity.com/paper/2209.07400/) (2022)
- [Linear Program Reconstruction in Practice](https://mlsanity.com/paper/1810.05692/) (2018)
- [Confidentiality Protection in the 2020 US Census of Population and Housing](https://mlsanity.com/paper/2206.03524/) (2022)

## Built on by (most cited first, 16 of 16)

- [Reconstruction Attacks on Machine Unlearning: Simple Models are Vulnerable](https://mlsanity.com/paper/2405.20272/) (2024)
- [A Linear Reconstruction Approach for Attribute Inference Attacks against Synthetic Data](https://mlsanity.com/paper/2301.10053/) (2023)
- [The Inadequacy of Similarity-based Privacy Metrics: Privacy Attacks against "Truly Anonymous" Synthetic Datasets](https://mlsanity.com/paper/2312.05114/) (2023)
- [Resampling methods for private statistical inference](https://mlsanity.com/paper/2402.07131/) (2024)
- [Defending Against Data Reconstruction Attacks in Federated Learning: An Information Theory Approach](https://mlsanity.com/paper/2403.01268/) (2024)
- [The 2020 US Decennial Census is more private than you (might) think](https://mlsanity.com/paper/2410.09296/) (2024)
- [Towards Regulatable AI Systems: Technical Gaps and Policy Opportunities](https://mlsanity.com/paper/2306.12609/) (2023)
- [Model Agnostic Differentially Private Causal Inference](https://mlsanity.com/paper/2505.19589/) (2025)
- [A Unified Framework for Adversary-Aware Differential Privacy Bounds](https://mlsanity.com/paper/2507.08158/) (2025)
- [Rethinking Anonymity Claims in Synthetic Data Generation: A Model-Centric Privacy Attack Perspective](https://mlsanity.com/paper/2601.22434/) (2026)
- [An Examination of the Alleged Privacy Threats of Confidence-Ranked Reconstruction of Census Microdata](https://mlsanity.com/paper/2311.03171/) (2023)
- [DeSIA: Attribute Inference Attacks Against Limited Fixed Aggregate Statistics](https://mlsanity.com/paper/2504.18497/) (2025)
- [Generate-then-Verify: Reconstructing Data from Limited Published Statistics](https://mlsanity.com/paper/2504.21199/) (2025)
- [Nosy Layers, Noisy Fixes: Tackling DRAs in Federated Learning Systems using Explainable AI](https://mlsanity.com/paper/2505.10942/) (2025)
- [Differentially Private Synthetic Data Release for Topics API Outputs](https://mlsanity.com/paper/2506.23855/) (2025)
- [A Sieve-Accelerated Quadrature Method for Exact Privacy Accounting in the 2020 U.S. Decennial Census](https://mlsanity.com/paper/2606.29835/) (2026)

## Abstract (arXiv)

A reconstruction attack on a private dataset D takes as input some publicly accessible information about the dataset and produces a list of candidate elements of D. We introduce a new class of data reconstruction attacks based on randomized methods for non-convex optimization. We empirically demonstrate that our attacks can not only reconstruct full rows of D from aggregate query statistics Q(D)∈ ℝm, but can do so in a way that reliably ranks reconstructed rows by their odds of appearing in the private data, providing a signature that could be used for prioritizing reconstructed rows for further actions such as identify theft or hate crime. We also design a sequence of baselines for evaluating reconstruction attacks. Our attacks significantly outperform those that are based only on access to a public distribution or population from which the private dataset D was sampled, demonstrating that they are exploiting information in the aggregate statistics Q(D), and not simply the overall structure of the distribution. In other words, the queries Q(D) are permitting reconstruction of elements of this dataset, not the distribution from which D was drawn. These findings are established both on 2010 U.S. decennial Census data and queries and Census-derived American Community Survey datasets. Taken together, our methods and experiments illustrate the risks in releasing numerically precise aggregate statistics of a large dataset, and provide further motivation for the careful application of provably private techniques such as differential privacy.