Fable
The granary report that sprinkles salt
The mountain village granary published each household's total remaining grain every month so caravans could arrange carts and horses. In the past the village chief simply added them up, and everyone believed the total would not expose individuals. Later only a few households in the village still grew rare wheat. When one household made a receipt and a return, the published total visibly jumped, and others quickly guessed that household's harvest. The village chief first removed household names. But by comparing totals over several consecutive months, people could still infer who had sold an extra cart or whose household might run out of food.
One accountant proposed a strange method: before each announcement, sprinkle a little salt according to the rules, giving the total a controlled tiny deviation.
Villagers worried that the reports were inaccurate. The calculator explained that a single report no longer exposed whether a particular household was present; multiple queries would also consume budget and could not endlessly approach the truth.
The granary keeps accurate original records and only adds noise to the external statistical results, while limiting the number of queries, granularity, and combinations. The caravan can still judge the broad trend, but it is hard to pin down a single household.
Later, some people deliberately asked similar questions over and over, hoping to extract individuals from the differences. The entire system rejected queries that exceeded the budget.
What the granary learned was not "to dirty the data," but to establish a mathematical boundary between usable statistics and individual privacy, so that the existence of a single person does not determine the answer.
The accountant also wrote the salt-sprinkling rules for the village chief to see: salt could not be sprinkled at will; a little more today and a little less tomorrow had to follow the dice tray, otherwise outsiders could still guess the true number from the pattern. Only then did the village chief realize that protecting privacy does not rely on vagueness, but on provable bias.
At the year-end grain distribution, the village still settled precisely using internal accounts; to caravans, neighboring villages, and the market, it gave only salted statistics. Everyone sacrificed a little clarity in exchange for each household not having to expose its grain jar to everyone's abacus. The villagers were therefore willing to keep submitting true internal accounts, because they knew the public accounts would not single out one family's circumstances. This boundary kept the statistics useful and still protected those who stayed silent. Outsiders saw the trend, and the villagers kept their room to maneuver. The village chief also dared to keep publishing the monthly report. More stable. Reliable.