Restriciting Queries that Might Lead to Compromise

The feasibility of an inference control that determines at the time of a query whether a requested statistic could lead to compromise is investigated. One candidate is the "fail-safe" control, which restricts any statistic whose implied query sets are too small (or too large). We shall show that this control is infeasible, and does not prevent many compromises. By comparison, the cell suppression procedures used by census bureaus prevent compromise, but are also infeasible for on-line database systems.