Randomized response is a long-standing method for estimating the prevalence of sensitive attributes while protecting respondent privacy. It is increasingly used to generate synthetic binary data from real personal records, enabling data storage and sharing while protecting individual privacy. While surveys emphasize accurate estimation, synthetic data generation prioritizes privacy. Statisticians typically set sample sizes to achieve a target statistical power. However, we show that high power can increase the risk of privacy violations. We consider established randomized response designs with respect to statistical power and differential privacy, which quantifies the leakage of privacy. Our results reveal that common design strategies can yield either insufficient power or excessive privacy loss. We provide optimal parameter choices for randomized response models that jointly satisfy desired power and differential privacy constraints. We motivate and evaluate our approaches using a dataset from a randomized response survey conducted via Amazon Mechanical Turk on tax return misreporting, providing a policy-relevant testbed. Simulation studies evaluate the existence of optimal design parameters, identify designs that minimize the required sample size, and quantify sample size inflation relative to direct questioning. We provide a user-friendly web application (Shiny App) available at https://iitg.ac.in/pgapps/DP_RR/ for designing randomized response studies to facilitate adoption.

翻译：暂无翻译