Compromising statistical databases responding to queries about means

Abstract

This paper describes how to compromise a statistical database which only answers queries about arithmetic means for query sets whose cardinality falls in the range [ k, N - k ], for some k > 0, where N ≥ 2 k is the number of records in the database. The compromise is shown to be easy and to require only a little preknowledge; knowing the cardinality of just one nonempty query set is usually sufficient. This means that not only count and sum queries, but also queries for arithmetic means can be extremely dangerous for the security of a statistical database, and that this threat must be taken into account explicitly by protective measures. This seems quite important from a practical standpoint: while arithmetic means were known for some time to be not altogether harmless, the (perhaps surprising) extent of the threat is now shown.