Peláez–Lamata’s CI in Poisson-ICT Models

• Peláez–Lamata’s CI is an exact finite-sample confidence interval for sensitive trait prevalence within the Poisson-ICT framework, constructed via numerical inversion of its cumulative distribution.
• The methodology balances privacy and accuracy by tuning the parameter λ and adjusting sample sizes, ensuring nominal frequentist coverage across all π.
• Empirical examples show that increasing sample size narrows the interval while higher λ values widen it, highlighting the trade-off between anonymity and precision.

The Peláez–Lamata confidence interval (CI), as presented in the context of item count techniques (ICT) for estimating the prevalence of sensitive traits, refers to an exact finite-sample confidence interval for the sensitive fraction $\pi$ in the Poisson-ICT model. In this paradigm, responses are structured to protect respondent privacy when estimating the proportion of a population possessing a sensitive attribute, by leveraging a mixture of Bernoulli and Poisson variables and a randomized sampling framework. The construction, as fully detailed by Jaworski & Zieliński, achieves nominal frequentist coverage for all $\pi$ and is governed by the interplay between sample size, a privacy-tuning parameter, and observed data (Jaworski et al., 2024).

1. Poisson-ICT Model Setup and Notation

The ICT model is formalized by randomly splitting a population sample of size $n$ into two subsamples, $n_1$ and $n_2$ ($n = n_1 + n_2$). Each participant is characterized by:

• $Z_i \sim \mathrm{Bernoulli}(\pi)$: the sensitive binary trait, with prevalence $\pi$.
• $X_i \sim \mathrm{Poisson}(\lambda)$: a “neutral” count variable, independent of $Z_i$.

Individual responses are not directly observed. Instead:

• Group 1 ($\pi$0 respondents): $\pi$1
• Group 2 ($\pi$2 respondents): $\pi$3

The model relies on the no-design-effect and no-liars assumptions as per Blair & Imai (2012), and $\pi$4 is a design parameter selected for privacy control.

The principal observed statistic is:

$\pi$5

where

• $\pi$6,
• $\pi$7.

Because $\pi$8 and $\pi$9 are independent, the cumulative distribution function (CDF) for $n$0 given $n$1 is

$n$2

2. Construction of the Exact Confidence Interval

The CI for $n$3 is constructed by inverting the acceptance region derived from $n$4, which is monotonic in $n$5. For an observed statistic $n$6 and two-sided confidence level $n$7 (e.g., $n$8), the lower and upper confidence bounds $n$9 and $n_1$0 are defined by:

$n_1$1

Where the CDF for $n_1$2 at integer $n_1$3 can be evaluated via a Skellam distribution mass function, $n_1$4, using the modified Bessel function of the first kind, $n_1$5, and Marcum-Q representation. Solving (3a) and (3b) numerically (as there is no closed-form) yields the CI endpoints.

3. Sensitivity of Interval Length to Privacy and Sample Size

The CI’s random length, $n_1$6, responds to both $n_1$7 and $n_1$8:

• $n_1$9 increases in $n_2$0; this reflects the privacy-accuracy tradeoff (more noise widens the CI).
• $n_2$1 decreases in $n_2$2; sample size increases precision.
• $n_2$3 is maximal near $n_2$4 and minimized near $n_2$5 or $n_2$6 for fixed $n_2$7.

Practical study design must balance $n_2$8 (privacy) and $n_2$9 (efficiency) to attain a desired interval width. Sufficient $n = n_1 + n_2$0 for targeted CI length, given privacy $n = n_1 + n_2$1, can be computed empirically. For example, with $n = n_1 + n_2$2, $n = n_1 + n_2$3, and privacy-tuned $n = n_1 + n_2$4, achieving an average interval length $n = n_1 + n_2$5 requires $n = n_1 + n_2$6, and $n = n_1 + n_2$7 for $n = n_1 + n_2$8 (Jaworski et al., 2024).

4. Privacy Protection and Tuning of $n = n_1 + n_2$9

Respondent anonymity is formalized by requiring that $Z_i \sim \mathrm{Bernoulli}(\pi)$0 with high probability $Z_i \sim \mathrm{Bernoulli}(\pi)$1 for all $Z_i \sim \mathrm{Bernoulli}(\pi)$2. Conditional probabilities for $Z_i \sim \mathrm{Bernoulli}(\pi)$3 given an observed response are:

• Subtraction arm ($Z_i \sim \mathrm{Bernoulli}(\pi)$4): $Z_i \sim \mathrm{Bernoulli}(\pi)$5, $Z_i \sim \mathrm{Bernoulli}(\pi)$6
• Addition arm ($Z_i \sim \mathrm{Bernoulli}(\pi)$7): $Z_i \sim \mathrm{Bernoulli}(\pi)$8, $Z_i \sim \mathrm{Bernoulli}(\pi)$9, and $\pi$0 if $\pi$1

Selecting $\pi$2 requires solving two numerical inequalities to ensure the privacy guarantee holds; e.g., for $\pi$3, $\pi$4, $\pi$5, minimal $\pi$6 (Jaworski et al., 2024).

5. Coverage Properties and Comparison with Asymptotic Methods

The exact CI derived by inversion satisfies

$\pi$7

guaranteeing (at least) nominal coverage for all sample sizes. This outperforms the method-of-moments (MM) Normal-based CI, which:

• Uses $\pi$8 with variance estimator

$\pi$9

• Under-covers, especially for moderate $X_i \sim \mathrm{Poisson}(\lambda)$0 (actual coverage can be \textless $X_i \sim \mathrm{Poisson}(\lambda)$1).

6. Implementation Details and Numerical Examples

Numeric computation of $X_i \sim \mathrm{Poisson}(\lambda)$2 uses standard routines for the Skellam CDF (e.g., R’s pskellam or Marcum-Q via mpmath). The binomial mixture is then summed as per equation (1). Root-finding for $X_i \sim \mathrm{Poisson}(\lambda)$3 and $X_i \sim \mathrm{Poisson}(\lambda)$4 on the interval $X_i \sim \mathrm{Poisson}(\lambda)$5 can employ bisection (e.g., R's uniroot). $X_i \sim \mathrm{Poisson}(\lambda)$6 provides the one-to-one mapping to confidence limits.

Illustrative example: $X_i \sim \mathrm{Poisson}(\lambda)$7, $X_i \sim \mathrm{Poisson}(\lambda)$8, $X_i \sim \mathrm{Poisson}(\lambda)$9, $Z_i$0 yields numerically $Z_i$1, $Z_i$2. Tabulated results further support study planning; Table 2 in the cited work gives values for the supremum expected CI length over $Z_i$3.

7. Significance and Research Context

The exact finite-sample CI for $Z_i$4 in the Poisson-ICT model, as constructed by Jaworski & Zieliński, provides a rigorous methodological advance in privacy-preserving inference for sensitive survey items. By leveraging the monotonicity property of $Z_i$5, the method maintains at least nominal coverage for any $Z_i$6, irrespective of sample size or privacy parameter, and natively supports design-time privacy tuning via $Z_i$7. Both theoretical and empirical comparisons establish its superiority to conventional asymptotic CIs under operational regimes relevant to indirect questioning and privacy-ensured statistics (Jaworski et al., 2024).