This technical white paper provides an overview of the Urban Institute’s privacy-preserving validation server version 3.0 prototype. The goal of the prototype is to provide a testable solution to government agencies looking to improve and automate statistical disclosure control processes. Building on version 2.0, the latest prototype introduces a dedicated administrator interface, enhanced privacy protections and statistical validity, and usability updates informed by feedback from researchers, agency staff, and privacy experts. We hope that testing with researchers and agencies, continuous improvement, and dissemination of our learnings will lead to significantly increased access to valuable data and insights used to craft better public policy.

Why This Matters

Our work responds to the growing recognition that traditional, manual disclosure control methods are increasingly inadequate in the face of modern re-identification risks and often slow in releasing valuable data.

What We Found

The version 3.0 prototype introduces several key improvements: a newly developed administrator interface, privacy and statistical validity enhancements recommended by experts, and a suite of usability updates based on feedback from the user studies.

• Administrator interface. To make the management of user submissions simpler and more seamless, the version 3.0 system includes a dedicated interface for administrators (or data stewards) to manage and monitor activity within the validation server. Through this interface, administrators can review users and projects with access to the system, monitor and adjust privacy budgets, review requests to release results or disclose error messages, and audit activity to understand disclosure risks associated with their data assets.
• Improved statistical validity. We revised the method to add noise only to a subset of base statistics for regressions. All other regression output statistics are derived from these base statistics after noise is applied, preserving their internal consistency and ensuring validity for statistical inference.
• Error handling. We adopted a hybrid approach. Uploaded scripts are first run against a synthetic dataset that mirrors the structure (variable names and types) of the confidential data. If the script runs successfully on synthetic data but fails on the confidential dataset, the error is routed to the administrator via the new administrator interface.
• Edge-case protection. To mitigate this risk, version 3.0 of the validation server enforces a non-zero sensitivity for every statistic by specifying a minimum sensitivity of 1. In addition, we introduced explicit upper and lower bounds on privacy loss (epsilon) values across all requested statistics.
• Multiple datasets and projects. Both features are now implemented in the version 3.0 prototype. Multiple users can be assigned to a project, sharing the same privacy budget and viewing each other’s submissions.”
• Consolidated privacy budgets. Each project now has a single privacy budget.
• Specify error tolerances. The interface now lets users specify an approximate error tolerance directly. The system uses this to calculate the privacy budget cost, which is displayed immediately.
• Explanatory text and tooltips. We added more detailed explanatory text and tooltips throughout the interface to clearly define terminology and remind users how these concepts are implemented in the system.
• Security and scalability. The latest release is hosted within an isolated AWS GovCloud environment. The application now runs in private subnets with no direct internet access, and we improved the system’s reliability and scalability using AWS CloudFormation infrastructure-as-code templates.

How We Did It

In September 2024, we released a technical white paper describing version 2.0 of the validation server prototype. Following the release, we immediately engaged a wide range of stakeholders to gather feedback. In February 2025, we convened our advisory board of 24 experts, and they provided extensive feedback along with suggested priorities for improvement. Once we identified what improvements to include in version 3.0, we conducted 18 user testing sessions between February 2025 and April 2025 to ensure they were properly implemented.