§05 — The red-team

This is where the case earns the right to be believed: by reporting the evidence against its own dramatic version — the P4 discipline turned on itself. The agency’s researchers reconstructed synthetic census tables with a Boolean-satisfiability solver and measured the match rate — the fraction of true records the reconstruction recovered.

The attack	Exact match rate (StatCan’s own result)
Rounded tables (what StatCan publishes)	~27% (σ 8%)
Coincidence floor (chance, from population stats alone)	~15% (σ 5%)
Unrounded tables (which StatCan does not publish)	~90%

Read it honestly. On the rounded tables, reconstruction barely clears chance — and the authors say so: the reconstructed rate is “not substantially” above the coincidental one, which “suggests that many of the reconstructed matches might be accidental.” Only on the unrounded tables did matching reach ~90%, from which they conclude “random rounding is to some degree successful in hindering a reconstruction attack.” Even an intruder who knows every record but one is mostly stopped: a missing age is recovered about half the time, gender about 75% (against a 50% coin-flip), marital status about 25%. The honest headline: the published table, by itself, mostly does not reverse. Any write-up that says “you can de-anonymize the StatCan table” dies on this page.primary

Counter: a safeguard that works against the single-source attack is real. Hold that — then ask the question the single-source test cannot: what happens when the table is not used by itself?