Semantic Metadata Schema for Risks and Mitigations

Semantic Metadata Schema for Risks and Mitigations Associated with Outputs from Trusted Research Environments Trupti Padiya 1 , Jim Smith, Felix Ritchie, Elizabeth Green, University of the West of England 2 1. Executive Summary The document proposes a semantically structured metadata schema adhering to W3C standards, to represent risks and mitigations associated with statistical outputs, for the process of statistical disclosure control. The semantic metadata schema (from now referred to as “schema”) is designed to address the following core objectives: • Provide a modular, scalable design that can adapt to changing needs and be easily integrated into automated processing systems. • Enable principled comparisons between manual processes and the functionality provided by different versions of automated software. • Support extensibility and serve as a basis for supporting complex output structures such as AI models. Table of Contents 1. Executive Summary ........................................................................................... 1 2. Purpose and Scope ........................................................................................... 2 3. Modelling the Statbarn Taxonomy ....................................................................... 5 4. Schema for different statbarns ........................................................................... 7 5. Key Benefits of the Schema .............................................................................. 20 6. Conclusion ..................................................................................................... 20 7. References ..................................................................................................... 20 8. Appendix: Classes and properties in the Semantic Metadata Schema for Statistical Risks and Mitigations.............................................................................................. 21 1 Corresponding author. [email protected] 2 The authors acknowledge with gratitude valuable insights and constructive feedback from Amy Tilbrook, Ben Derrick and Paul White. 2. Purpose and Scope This document proposes a semantically structured metadata schema adhering to W3C standards, to represent risks and mitigations associated with research outputs, for the process of statistical disclosure control. The semantic metadata schema (from now referred to as “schema”) is designed to address the following core objectives: • Provide a modular, scalable design that can adapt to changing needs and be easily integrated into automated processing systems. • Enable principled comparisons between manual processes and the functionality provided by different versions of automated software. • Support extensibility and serve as a basis for supporting complex output structures such as AI models. To create this schema we build on two complementary developments: the statbarn (Green, Ritchie and White 2024) (Ritchie, et al. 2023), and the Data Privacy Vocabulary (DPV) (J. Pandit, et al. 2024) and its Risk Extension (Esteves, Golpayegani, et al., Data Privacy Vocabulary 2025). We also make an important distinction between (i) conducting risk assessments, and (ii) making disclosure control decisions. This distinction allows us to deliberately side-step two issues: • The sensitivity of different data sets: Risks may result from a given form of analysis, even if the nature of the data means they have no meaningful impact. • Rules vs. Principles-based output checking: Regardless of whether a TRE will allow ‘exceptions’, disclosure control decisions should be informed by a thorough risk assessment. 2.1. Background: The Statbarn Framework The Statbarns taxonomy (Green, Ritchie and White 2024) (Ritchie, et al. 2023) … is a framework to classify all statistical terms by their disclosure characteristics, including risk, exceptions and mitigation measures. This statbarn massively reduces the dimensionality of the disclosure checking problem, as well as providing improved clarity. It also creates a feasible basis for automatic disclosure control checking (Green et al 2024) The taxonomy groups different types of analyses into 14 different ‘Statbarns’ according to the nature of the outputs they produce and the various associated disclosure risks. It is consistent with existing best practice as highlighted in, for example, the Secure Data Access Professionals handbook (Griffiths et al 2019). Importantly, it aims to provides a route for National Statistics Institutes (NSIs), and a wide range of TREs to find consensus on manual practice. However, many NSIs, and increasingly TREs make use of (semi) automated tools as part of their OSDC practice, such as Tau Argus, Table - builder, DataSHIELD or SACRO. The goal of ensuring consistency creates a demand for a set of unambiguous, human-readable and machine actionable statements describing best practice. 2.2. Background: Data Privacy Vocabulary The schema uses a rich semantic representation to model the Statbarn Taxonomy adhering to the World Wide Web Consortium (W3C) standards. It includes core concepts of statbarn (e.g., statistical terms, risks, mitigations) organised as class hierarchies extended from the Data Privacy Vocabulary (DPV) (J. Pandit, et al. 2024) and its Risk Extension (Esteves, Golpayegani, et al., Data Privacy Vocabulary 2025). DPV is an established, internationally recognised vocabulary and ontology, which represent concepts about use and processing of data, their associated risks and impacts, and can aid reasoning relevant to data privacy. The DPV Risk extension consists of concepts related to information associated with risks. The schema mainly builds on two key concepts: • dpv:Risk represents the concept of 'risk' i.e. a possibility or potential of negative events to occur and is indicated using the relation dpv:hasRisk. • dpv:RiskMitigationMeasure represents a method or process or control to mitigate the risk, and is associated using the relation dpv:isMitigatedByMeasure and these are accompanied by a rich set of relationships, constraints, and attributes such as likelihoods, and measures, facilitating machines to understand and reason about risks and mitigations associated with processes. The schema serves as a key component for a lightweight ontology using OWL/RDF to enable structured representation and reasoning about privacy-related disclosure risks and mitigation measures without needing overly complex logical structures. In addition, SHACL will be used to specify some meta-data (e.g. the cardinality of relationships) and validate knowledge-graphs (representing sets of analyses) and enforce rules. For example, we use SHACL to specify that for a given dataset there is exactly one `minimumThreshold’ for the number of respondents in a cell. Our proposed schema creates a new class Statbarn, and leverages existing DPV properties, and SDC-specific extensions of classes/concepts to create a semantic model of OSDC. The conceptual overview is illustrated in Figure 1. Figure 1 Conceptual Overview of Risks and Mitigations for OSDC The major classes/concepts that are extended from DPV are dpv:Risk, dpv:Likelihood, dpv:RiskMitigationMeasure, and dpv:OrganisationalMeasure. Figure 1 shows likelihood with 5 likelihood levels e.g. very high, high, moderate, low and very low. It is possible to add likelihood levels at the scale of 3 e.g. high, moderate, low or at the scale of 7 e.g. extremely high, very high, high, moderate, low, very low, extremely low. The properties of the DPV Vocabulary reused in this schema are dpv:hasRisk, dpv:hasRiskAssessment, dpv:hasLikelihood, dpv:hasOrganisationalMeasure, and dpv:isMitigatedByMeasure. Class level restrictions are applied to the properties that are reused from DPV, to emphasis their semantic context for the domain of SDC. The schema is easier to understand, integrate, and extend. 3. Modelling the Statbarn Taxonomy “Statbarn” serves as the base class in the schema. The statbarn framework includes 14 statistical terms, and they are modelled as subclasses of the base class – Statbarn, as shown in Figure 2. Statbarn has following subclasses: 1) Frequencies, 2) StatisticalHypothesisTest, 3) Position, 4) Shape, 5) LinearAggregations, 6) Mode, 7) EndPoints, 8) NonlinearConcentrationRatios, 9) CalculatedRatios, 10) HazardSurvivalTables, 11) GiniCoefficient,12) LinkedMultilevelTables, 13) Clusters, and 14) CorrelationCoefficients. Figure 2 Statbarn Hierarchy 3.1. Extending dpv:Risk The dpv:Risk class is extended to represent several types of risks associated with different statbarns. The hierarchy of the risks is depicted in Figure 3. Figure 3 Types of Risks in SDC 3.2. Extending dpv:RiskMitigationMeasure The dpv:RiskMitigationMeasure is extended to represent risk mitigation measures associated with different risks. Figure 4 shows the hierarchy of risk mitigation measures used for the statbarn. Clearly this is not complete (for example, algorithms for achieving Differential Privacy could be a sub-class of ‘Targeted Noise’). However, as our aim is to provide a unique namespace for this schema, it can simply be extended to encompass more mitigations. 3.3. Extending dpv:RiskAssessment The dpv:RiskAssessment is extended to represent various checks associated with different statbarns as shown in Figure 5. These checks form the basis of risk assessment for output disclosure control. To make the schema generally applicable and to separate dpv:RiskAssessment from TRE and dataset-specific choices, they have associated parameters. Figure 4 Types of Risk Mitigation Measures in SDC Figure 5 Types of Risk Assessments in SDC 3.4. Extending dpv:OrganisationalMeasure The dpv:OrganisationalMeasure is extended to represent various organisational measures - typically numerical or Boolean values - provided by TREs. These are used to parameterise risk assessment checksfor example, the size of the smallest group allowed (Minimum Threshold), or whether Class Disclosure is an issue (RequiredZerocheck) – and may vary between TREs and datasets. They represent vital aspects of the TREs (or their data owners) risk appetite. These are shown in Figure 6. Figure 6 Organisational measures from TREs for risk assessments. Appendix 1 provides additional details about all the classes and properties defined and used in the schema. The statbarns: Linked multilevel tables and Clusters needs refinement and hence are not represented in this document. 4. Schema for different statbarns The next sections present visualisations of all the Statbarn schemas, starting with a worked example of how the most common – ‘frequencies’ is created. 4.1. Statbarn: Frequencies Figure 7 presents the schema for the statbarn “Frequencies” detailing associated risks and mitigations. Figure 8 shows all the subclass hierarchy of Frequencies: AlluvialFlow, CrossTab, FrequencyTable, Histogram, and so on. These subclasses inherit all the risk associations, risk likelihood and risk mitigation measures. These figures are graph models representing the schema and provides foundation for a knowledge graph, but this is less amenable to human inspection. We have colourcoded it to make it more human-readable: • The statbarn (type of query) is in yellow • Potential risks are in orange • Mitigations are in green • Associated with each risk is a check (purple) with associated parameters (blue). • The risk likelihood (beige) is calculated through of combination of (i) check results, and (ii) whether a mitigation has been applied. Figure 7 Statbarn: Frequencies Figure 7 describes that every instance of Frequencies is associated with specific types of privacy risks: LowCounts, Differencing and ClassDisclosure. In turn, each risk represents details about their risk assessments and mitigations. In this case it can be seen (visually) or inferred (programmatically) that Suppression and Noise are valid mitigations for all three risks. Diving deeper, LowCount is a risk associated with Frequencies, and must be checked for the minimum threshold and if it fails the check, there is a higher likelihood of risk, and the mitigation measures (e.g. suppression) must be applied. The idea is captured by the semantic model: • Class LowCount is associated to class MinimumThresholdCheck using dpv:hasRiskAssessment. • MinimumThresholdCheck further links to the class MinimumThreshold, which holds a literal value provided by the TRE. • The class LowCount is also connected to the dpv:Likelihood using dpv:hasLikelihood to represent the likelihood of the risk. • The risk LowCount is mitigated by Noise, Rounding, or Suppression via dpv:isMitigationMeasure The other two risks present are modelled in the same way. Note that we use the organisational measure RequiredZeroCheck to provide a mechanism for TREs to state that class disclosure is not an issue for their data. The graphical representation of the schema suggests that the risk posed by LowCount in frequencies data can be 1) recognized, 2) assessed, and 3) mitigated via known SDC techniques. Similarly, other risks like ClassDisclosure and Differencing, their likelihood, and their mitigation measures pertaining to the Frequencies statbarn can be interpreted from Figure 7. Figure 8 Subclass hierarchy for Frequencies 4.2. Statbarn: Position Figure 9 represents the schema for the statbarn “Position”. Figure 10 shows all the subclass hierarchy of Position: Quartile, Box plot and so on. Figure 9 Statbarn: Position Figure 10 Subclass hierarchy for Position 4.9. Statbarn: HazardSurvival Tables Figure 22 represents the schema for the statbarn “Hazard Survival Tables”. Figure 23 shows all the subclasses of HazardSurvivalTables: Kaplan_Miere, HazardTables and SurvivalTables. Figure 22 Statbarn: Hazard Survival Tables Figure 23 Subclass hierarchy for Hazard Survival Tables 4.10. Statbarn: Gini Coefficient Figure 24 represents the schema for the statbarn “Gini Coefficient”. Figure 25 shows GiniCoefficient has a subclass GiniCurves. Figure 24 Statbarn: Gini Coefficient Figure 25 Subclass hierarchy for Gini Coefficient 4.11. Statbarn: Correlation Coefficients Figure 26 represents the schema for the statbarn “Correlation Coefficients”. Table 1 presents diverse types of Corelation Coefficients, each is represented as a subclass of the CorrelationCoefficients class. Table 1 Types of Corelation Coefficient ANCOVA Multinomial logit Binary Logistic Regression Multiple regression Canonical Correlation Multivariate analysis of variance Contrast Coefficients Odds Ratios (estimated) Correlation Coefficients Omnibus tests of model coefficients Covariates Panel data models General linear model Partial correlation coefficients Kendall’s rank Phi coefficient Kernel Estimates Probit Linear Regression Coefficients Standardised regression coefficients Logistic regression Structural equation modelling Logit Three-stage least squares Log-linear for higher order tables Two-stage least squares Longitudinal estimation Two-way analysis of variance MANCOVA Zero-order correlation Figure 26 Statbarn: Corelation Coefficients 4.12. Statbarn: Statistical Hypothesis Test Figure 27 represents the schema for the statbarn “Statistical Hypothesis Test”. Table 2 presents different types of Statistical Hypothesis Tests and each is represented as a subclass of the StatisticalHypothesisTest. Table 2 Types of Statistical Hypothesis Test Adjusted R Squared Eigenvalues – Scree plots Mauchly's sphericity test Analysis of variance Eta Squared McNemar's test ANOVA Friedman test Nagelkerke R Squared Bartlett’s Test of Sphericity Homogeneity of Regression Paired t-tests Box’s Test of Equality of Covariance Matrices Homogeneity of Variance Parallel analysis Chi-Squared test Homogeneity of VarianceCovariance matrices Partial eta squared Cochran’s Q test Hosmer-Lemeshow test Pearson’s product-moment correlation coefficient Coefficient of determination Independent t-tests Pearson’s r Cohen’s d Kaiser–Meyer–Olkin test Principal component analysis Cohen’s kappa coefficient Kappa Measure of Agreement Pseudo-R-squared Confidence intervals Kolmogorov-Smirnov test R Squared Cox & Snell R Squared Kruskal-Wallis test Spearman’s rank correlation coefficient Cramer’s V Lambda Tukey’s honesty significant difference test Discriminant Function Analysis Levene’s test Wilcoxon signed rank test Discriminant Validity Mann-Whitney U test Wilks’s Lambda Figure 27 Statbarn: Statistical Hypothesis Tests 5. Key Benefits of the Schema • Formalise Statistical Outputs, Privacy Risks, and mitigations: The schema provides a structured, machine-readable framework for the statbarn taxonomy that semantically models risks related to statistical outputs and recommends suitable mitigations adhering to W3C standards. • Facilitates Automated Reasoning: The schema facilitates automated reasoning to determine which risks apply to given statistical outputs because the concepts and relationships are explicitly defined using semantics and connected to standardised vocabularies e.g. the Data Privacy Vocabulary (DPV). • Ensures Conceptual Consistency and Interoperability: The schema extends the DPV framework for the domain of Statistical Disclosure Control, standardised definitions, and promotes interoperability. 6. Conclusion The schema provides a formal framework for reasoning about statistical outputs in terms of their privacy risks. It can facilitate automated tools to infer which risks apply and guides through applicable risk mitigations. It creates consistency in how statistical disclosure control concepts are described and linked with DPV concepts. This metadata schema for the statbarn serve as a foundation for statistical disclosure control and can support complex output structures such as AI models. 7. References Esteves, Beatriz, Delaram Golpayegani, Georg P. Krog, Harshvardhan J. Pandit , Julian Flake , and Paul Ryan . 2025. Data Privacy Vocabulary. 16 March. https://w3c.github.io/dpv/2.1/dpv/. Green, Elizabeth, Felix Ritchie, and Paul White. 2024. “The statbarn: A New Model for Output Statistical Disclosure Control.” International Conference on Privacy in Statistical Databases. Springer Nature Switzerland. 284-293. Griffiths, E,.Greci, G., Kotrotsios, Y., Parker, S., Scott, J., Welpton, R., Wolters A., and Woods, C. (2019) Handbook on Statistical Disclosure Control for Outputs Secure Data Access Professionals https://securedatagroup.org/wpcontent/uploads/2019/10/sdc-handbook-v1.0.pdf J. Pandit, Harshvardhan, Beatriz Esteves, Georg P. Krog, Paul Ryan, Delaram Golpayegani, and Julian Flake. 2024. “Data Privacy Vocabulary (DPV) – Version 2.0.” In International Semantic Web Conference. Springer Nature Switzerland. 171-193. Ritchie, Felix, Elizabeth Green, Jim Smith, Amy Tilbrook, and Paul White. 2023. “The SACRO guide to statistical output checking (Version 1).” doi:https://zenodo.org/records/10282526. 8. Appendix: Classes and properties in the Semantic Metadata Schema for Statistical Risks and Mitigations Table 3 Classes in the Semantic Metadata Schema for Statistical Risks and Mitigations Classes Superclass Description Statbarn Owl:Thing It is the base class of the taxonomy representing domain-specific concept related to statistical disclosure control classification framework. LowCount dpv:Risk Represents a disclosure risk where attributes can be inferred from the data. ClassDisclosure dpv:Risk Represents disclosure risk where disclosure happens at a class/category level. Differencing dpv:Risk Representing disclosure risk from comparing linked tables to find differences. LowDOF dpv:Risk Represents disclosure risk associated with less variability in data. Dominance dpv:Risk Represents a disclosure risk that arises when a small number of contributors account for a large proportion of a cell’s total value. AuxiliaryInfo dpv:Risk Represents a disclosure risk when external or background knowledge can be combined with released data to re-identify individuals or infer confidential attributes. ImplicitTables dpv:Risk Represents a disclosure risk when sensitive information can be inferred indirectly by comparing related tables or sub tables. Noise dpv:RiskMiti gationMeasu re Represents technique to mitigate disclosure risks that involves adding random variation to data to mask individual values. Rounding dpv:RiskMiti gationMeasu re Represents technique to mitigate disclosure risks by modifying numerical values (e.g., counts or totals) to the nearest specified base. Suppression dpv:RiskMiti gationMeasu re Represents technique to mitigate disclosure risks by removing specific data values with high disclosure risk. Outlier Removal dpv:RiskMiti gationMeasu re Represents technique to mitigate disclosure risks by excluding extreme or unique data points. Aggregation dpv:RiskMiti gationMeasu re Represents technique to mitigate disclosure risks by combining individual data points into broader categories or groups. MinimumThresholdCheck dpv:RiskAss essment Represents a check required for Minimum threshold. PresenceOfLinkedTablesCheck dpv:RiskAss essment Represents a check required for presence of linked tables. PrsesenceOfZerosCheck dpv:RiskAss essment Represents a check required for presence of zeros. RequiredZeroCheck dpv:RiskAss essment Represents a check required for assessing the risk of class disclosure whether the TRE specifies Presence of Zeros to be checked or not. Some organizations view zero values as a disclosure risk requiring a ZeroCheck, while others do not, so it is important to assess whether a ZeroCheck is required in each context. PQCheck dpv:RiskAss essment Represents a check that evaluates statistical outputs using a PQ Test. NKCheck dpv:RiskAss essment Represents a check that applies the NK Test. MinimumDOFCheck dpv:RiskAss essment Represents a check that evaluates whether the degrees of freedom in statistical outputs meet the predefined MinimumDOF threshold. StatbarnDataCheck dpv:RiskAss essment Represents a check that verifies whether the data displayed in a Statbarn is relevant and appropriate for release. MinimumThreshold dpv:Organis ationMeasur e Represents an organisation measure for minimum threshold designed to reduce disclosure risk by setting a minimum count or value that data cells must meet to be published. It is associated with a decimal value. PresenceOfZero dpv:Organis ationMeasur e Represents an organisation measure that flags or monitors whether zero values occur in data cells, as the presence of zeros can increase disclosure risk, It is associated with a Boolean value. PresenceOfLinkedTables dpv:Organis ationMeasur e Represents an organisation measure that identifies or monitors when multiple related tables or datasets are linked, as such connections can increase disclosure risk. It is associated with a Boolean value. ZeroCheck dpv:Organis ationMeasur e Represents an organisation measure from TREs if presence of zero is checked and is associated with a Boolean value. PRatio dpv:Organis ationMeasur e Represents an organisation measure that evaluates disclosure risk using a statistical test, where a p-value indicates whether the data meet acceptable thresholds for safe release. It is associated with decimal value. NValue dpv:Organis ationMeasur e Represents an organisation measure used in the NK test to represent the minimum number of contributors required in a cell to consider it non-disclosive. KValue dpv:Organis ationMeasur e KValue is an organisational measure used in the NK test to specify the maximum allowable contributions. MinimumDOF dpv:Organis ationMeasur e Represents an organisational measure that sets the minimum acceptable degrees of freedom for statistical outputs. StatbarnRelevantShowData dpv:Organis ationMeasur e Represents an organisational measure that ensures only necessary and relevant data is displayed. Frequencies Statbarn Frequencies is one of the statbarn. Frequencytable, Histogram, PieChart, ScatterGraph, Heatmap, LineGraph, and so on. Frequencies Subclasses of Frequencies. StatisticalHypothesisTests Statbarn Statistical hypothesis tests is one of the statbarn. Position Statbarn Position is one of the statbarn. Quartile, Box plot and so on. Position Subclasses of Position. Shape Statbarn Shape is one of the statbarn. Kurtosis, StandardDeviation, and so on. Shape Subclasses of Shape. LinearAggregations Statbarn Linear Aggregations is one of the statbarn. Mean, Sum, BarGraph, and so on Linear Aggregations Subclasses of LinearAggregations. Mode Statbarn Mode is one of the statbarn. Clusters Statbarn Clusters is one of the statbarn. EndPoints Statbarn End Points is one of the statbarn. Minimum, Maximum, and Range EndPoints Subclasses of EndPoints. NonLinearConcentrationRatios Statbarn Non-linear Concentration Ratios is one of the statbarn. HerfindhalHirschmanIndex NonLinearC oncentration Ratios Subclass of NonLinearConcentrationRatios. CalculatedRatios Statbarn Calculated Ratios is one of the statbarn. CalculatedAnalysis, OddRatios, and RiskRatios CalculatedR atios Subclasses of CalculatedRatios. CorelationCoefficients Statbarn Corelation Coefficients is one of the statbarn. HazardSurvivalTables Statbarn Hazard Survival Tables is one of the statbarn. Kaplan_Miere, HazardTables and SurvivalTables HazardSurvi valTables Subclasses of HazardSurvivalTables. GiniCoefficient Statbarn Gini Coefficient is one of the statbarn. GiniCurves Ginicoefficie nt Subclass of Ginicoefficient. LinkedMultilevelTables Statbarn Linked Multilevel Tables is one of the statbarn. Table 4 Properties in the Semantic Metadata Schema for Statistical Risks and Mitigations Property Type Description dpv:hasRisk Object Property Links Statbarn to Risks. Class-level restrictions on dpv:hasRisk are applied. For example, the class Frequencies is defined with restrictions on the property dpv:hasRisk such that it must be associated with at least one of these risk classes: ClassDisclosure, Differencing, or LowCount. dpv:hasRiskAssessment Object Property Links Risks to Risk Assessments to assess it. Class-level restrictions on dpv:hasRiskAssessment are applied. For example, the class LowCount is defined with restrictions on the property dpv:hasRiskAssessment such that it must be associated with at least one instance of the class MinimumThresholdCheck. dpv:hasOrganisationMeasure Object Property Links Risk Assessments to Organisation Measures. Class-level restrictions are applied to specify the type of measure relevant in each risk assessment. Eg. MinimumThresholdCheck must include an organisational measure of type MinimumThreshold. dpv:isMitigatedbyMeasure Object Property Links risks to their mitigation measures. class-level restrictions on dpv:isMitigatedByMeasure are applied. For example, for the risk class LowCount, it has either of the mitigation measures to apply: Suppression, Noise or Rounding dpv:hasLikelihood Object Property Links Risk concept with Likelihood and Risk Assessment with Likelihood adhering to the semantics of DPV. Necessary classlevel restrictions are applied, and it is contextualised without redefining global domain and range. dpv:hasRiskLevel Object Property Links risks to its risk levels. Same as DPV. hasDecimalValue Data Property Used in restrictions to specify fixed types of property values (e.g. thresholds)