Randomized Response: Estimating Sensitive Behavior While Protecting Privacy

Surveys about sensitive behavior face a serious measurement problem. Respondents may refuse to answer or may provide an answer they believe is safer or more socially acceptable.

Examples include questions about:

academic misconduct;
illegal drug use;
tax evasion;
workplace rule violations;
stigmatized health conditions;
discriminatory behavior.

Even if participants are selected randomly, dishonest responses can create response bias.

Randomized response is a survey technique designed to reduce this problem. It introduces controlled randomness into each answer so that an interviewer cannot confidently infer an individual’s true status. At the same time, the prevalence of the behavior can still be estimated across many respondents.

The Sensitive Survey Problem

Suppose the research question is:

What proportion of college students have ever cheated during an exam?

Asking directly may produce inaccurate responses because some students may:

fear judgment;
fear disciplinary consequences;
distrust confidentiality assurances;
feel embarrassed;
intentionally conceal the behavior.

Let:\[ C= \text{the respondent has engaged in the behavior}. \]

The population quantity of interest is:\[ p=P(C). \]

A direct survey estimates \(p\) using the proportion answering yes. But if some respondents with \(C=1\) answer no, the estimate will tend to be too low.

The Randomized-Response Protocol

Each respondent privately tosses a fair coin twice.

The first toss determines which question to answer:

if the first toss is tails, answer the sensitive question;
if the first toss is heads, answer the random question.

The two questions are:

Sensitive question

Have you ever cheated during an exam in college?

Random question

Was the second coin toss tails?

The respondent reports only “yes” or “no.” The researcher does not observe either coin toss and does not know which question was answered.

Why the Protocol Protects the Respondent

A reported “yes” can arise in two ways:

the sensitive question was selected and the truthful answer was yes;
the random question was selected and the second toss was tails.

Therefore, a yes response does not reveal with certainty that the respondent engaged in the sensitive behavior.

Likewise, a no response can result from:

the sensitive question being selected and the truthful answer being no;
the random question being selected and the second toss being heads.

The randomness provides plausible deniability.

The researcher cannot identify an individual’s true status from one randomized response, but can estimate the group prevalence from the collective response rate.

The statement that an individual answer reveals “nothing” is too strong. An answer may change the probability assigned to the respondent’s status, but it does not determine that status.

Defining the Events

Let:\[ Q_1=\text{the sensitive question is selected} \]\[ Q_2=\text{the random question is selected} \]\[ Y=\text{the reported answer is yes}. \]

Because the first coin is fair:\[ P(Q_1)=\frac{1}{2} \]

and:\[ P(Q_2)=\frac{1}{2}. \]

If the sensitive question is selected:\[ P(Y\mid Q_1)=p. \]

If the random question is selected, the respondent says yes when the second toss is tails:\[ P(Y\mid Q_2)=\frac{1}{2}. \]

Applying the Law of Total Probability

A yes response can occur through either question:\[ Y=(Y\cap Q_1)\cup(Y\cap Q_2). \]

The two possibilities are mutually exclusive, so:\[ P(Y) = P(Y\cap Q_1)+P(Y\cap Q_2). \]

Using the general multiplication rule:\[ P(Y) = P(Y\mid Q_1)P(Q_1) + P(Y\mid Q_2)P(Q_2). \]

Substitute the protocol probabilities:\[ P(Y) = p\left(\frac{1}{2}\right) + \left(\frac{1}{2}\right)\left(\frac{1}{2}\right). \]

Therefore:\[ \boxed{ P(Y)=\frac{1}{2}p+\frac{1}{4} } \]

The observed yes rate contains:

a component caused by the sensitive behavior;
a known component caused by randomization.

Solving for the Sensitive Proportion

Starting with:\[ P(Y)=\frac{1}{2}p+\frac{1}{4}, \]

subtract \(1/4\):\[ P(Y)-\frac{1}{4} = \frac{1}{2}p. \]

Multiply by 2:\[ \boxed{ p=2P(Y)-\frac{1}{2} } \]

If the population yes probability were known, this equation would recover the sensitive-behavior prevalence.

In a survey, \(P(Y)\) is estimated using the observed sample proportion:\[ \hat{q} = \frac{\text{number of yes responses}}{n}. \]

The randomized-response estimator is:\[ \boxed{ \hat{p} = 2\hat{q}-\frac{1}{2} } \]

Numerical Example

Suppose:

27 respondents say yes;
30 respondents say no.

The total sample size is:\[ n=27+30=57. \]

The observed yes proportion is:\[ \hat{q} = \frac{27}{57} \approx0.4737. \]

Apply the estimator:\[ \hat{p} = 2(0.4737)-0.5. \]

Therefore:\[ \hat{p} \approx0.4474. \]

As a percentage:\[ \boxed{ \hat{p}\approx44.7\% } \]

The point estimate for the sensitive behavior among the population represented by this sampling and response process is approximately 44.7%.

It should not automatically be generalized to all college students. That requires a representative sampling design, truthful compliance with the protocol, and an adequate sample size.

Frequency Interpretation

The logic can also be understood with hypothetical counts.

Suppose 1,000 people follow the protocol and the true sensitive proportion is 44.7%.

Approximately half receive the sensitive question:\[ 1000\left(\frac{1}{2}\right)=500. \]

Among those 500, approximately 44.7% answer yes:\[ 500(0.447)\approx224. \]

The other 500 receive the random question. Approximately half observe tails on the second toss:\[ 500\left(\frac{1}{2}\right)=250. \]

The expected total number of yes responses is:\[ 224+250=474. \]

Thus, the expected yes proportion is:\[ \frac{474}{1000}=47.4\%. \]

The raw yes rate is higher than the sensitive-behavior rate because some yes responses are deliberately generated by chance.

Probability Tree

The protocol can be represented as:

			
First coin toss
├── Sensitive question: 0.50
│   ├── Yes: p              → 0.50p
│   └── No: 1 − p           → 0.50(1 − p)
└── Random question: 0.50
    ├── Second toss tails: 0.50  → 0.25
    └── Second toss heads: 0.50  → 0.25

		

The total yes probability is obtained by adding the two yes branches:\[ P(Y)=0.50p+0.25. \]

The total no probability is:\[ P(Y^c) = 0.50(1-p)+0.25. \]

These sum to one:\[ 0.50p+0.25+0.50(1-p)+0.25=1. \]

Sampling Uncertainty

The estimate 44.7% is based on only 57 responses. It therefore contains substantial random sampling variation.

Because:\[ \hat{p}=2\hat{q}-0.5, \]

its approximate standard error is:\[ \operatorname{SE}(\hat{p}) = 2\operatorname{SE}(\hat{q}). \]

For a sample proportion:\[ \operatorname{SE}(\hat{q}) \approx \sqrt{ \frac{ \hat{q}(1-\hat{q}) }{ n } }. \]

Therefore:\[ \operatorname{SE}(\hat{p}) \approx 2 \sqrt{ \frac{ \hat{q}(1-\hat{q}) }{ n } }. \]

Using:\[ \hat{q}=\frac{27}{57}\approx0.4737, \]

we obtain:\[ \operatorname{SE}(\hat{p}) \approx 2 \sqrt{ \frac{ (0.4737)(0.5263) }{ 57 } } \approx0.132. \]

The standard error is approximately 13.2 percentage points.

A rough 95% interval based on a normal approximation is:\[ 0.447 \pm 1.96(0.132). \]

This gives approximately:\[ (0.188,0.706). \]

Thus, the plausible range is wide. The point estimate alone should not be reported as though it were highly precise.

For small samples or estimates near the boundaries, an interval based on the binomial likelihood or an appropriate Bayesian model is preferable to a simple normal approximation.

The Privacy–Precision Tradeoff

Randomized response protects privacy by deliberately adding noise. That same noise makes the population estimate less precise.

In a direct truthful survey:\[ \hat{p}_{\text{direct}} = \frac{\text{yes responses}}{n}. \]

In this randomized design:\[ \hat{p}=2\hat{q}-0.5. \]

The factor of 2 amplifies variation in the observed yes rate. As a result, randomized response generally requires a larger sample than direct questioning to achieve similar statistical precision.

This is a fundamental tradeoff:

more randomization provides stronger individual protection;
less randomization provides more precise estimates;
insufficient privacy may reduce truthful participation;
excessive noise may make estimates too uncertain.

A good design balances privacy, trust, and precision.

A General Randomized-Response Formula

Suppose:

the sensitive question is selected with probability \(r\);
the random question is selected with probability \(1-r\);
the random question produces yes with probability \(a\).

Then:\[ P(Y) = r p+(1-r)a. \]

Solving for \(p\):\[ \boxed{ p = \frac{ P(Y)-(1-r)a }{ r } } \]

The sample estimator is:\[ \boxed{ \hat{p} = \frac{ \hat{q}-(1-r)a }{ r } } \]

For the two-fair-coin design:\[ r=\frac{1}{2} \]

and:\[ a=\frac{1}{2}, \]

so:\[ \hat{p} = \frac{ \hat{q}-1/4 }{ 1/2 } = 2\hat{q}-\frac{1}{2}. \]

Why the Estimate Can Fall Outside 0 and 1

Random sampling variation can produce:\[ \hat{q}<0.25 \]

or:\[ \hat{q}>0.75. \]

The formula would then give:\[ \hat{p}<0 \]

or:\[ \hat{p}>1. \]

This does not mean a true probability lies outside the valid range. It means the unconstrained estimator has been pushed beyond the boundary by sampling noise, noncompliance, or model mismatch.

Possible responses include:

reporting a constrained estimate;
using likelihood-based inference;
using a Bayesian model with support from 0 to 1;
increasing sample size;
investigating whether respondents followed the protocol.

Simply clipping the estimate to 0 or 1 changes its statistical properties and should be explained.

Individual Privacy Is Not Absolute

A randomized response creates uncertainty about each individual’s status, but privacy is not unlimited.

Suppose the true group prevalence is \(p\). For a respondent who says yes:\[ P(C\mid Y) = \frac{ P(Y\mid C)P(C) }{ P(Y) }. \]

Under this protocol, a respondent with \(C=1\) says yes when:

the sensitive question is selected; or
the random question is selected and the second toss is tails.

Therefore:\[ P(Y\mid C) = \frac{1}{2} + \left(\frac{1}{2}\right) \left(\frac{1}{2}\right) = \frac{3}{4}. \]

A respondent with \(C=0\) says yes only through the random branch:\[ P(Y\mid C^c) = \left(\frac{1}{2}\right) \left(\frac{1}{2}\right) = \frac{1}{4}. \]

Thus, yes is more likely among respondents with the sensitive status, but it does not reveal the status with certainty.

The protocol reduces disclosure risk; it does not make the response statistically unrelated to the truth.

Protocol Compliance Is Essential

The estimator assumes that respondents:

use fair coins or an equivalent random mechanism;
follow the first-toss routing rule;
answer the selected question truthfully;
report the resulting yes or no accurately;
do not reveal their coin outcomes.

If participants ignore the procedure, choose their preferred question, or answer the sensitive question dishonestly, the estimator may be biased.

Clear instructions, simple procedures, trust, and credible privacy protections are therefore essential.

Sampling Design Still Matters

Randomized response protects answer privacy. It does not make a convenience sample representative.

The final estimate can still suffer from:

selection bias;
undercoverage;
nonresponse bias;
voluntary participation;
misunderstanding;
unequal protocol compliance.

To estimate a broader student population, researchers still need:

a clearly defined target population;
an appropriate probability sample;
adequate response rates;
suitable weighting;
transparent uncertainty estimates.

Two kinds of randomization must not be confused:

random selection determines who enters the survey;
randomized response determines how an individual answer is disguised.

Randomized Response and Local Privacy

Randomized response is an early example of adding randomness before information leaves the respondent.

The researcher receives only the randomized answer, not the private status. This differs from collecting sensitive raw answers and adding noise later.

The modern idea of local differential privacy uses a closely related principle: each participant randomizes their information on their own device before transmitting it.

For a binary randomized mechanism:\[ P(Y=1\mid C=1)=0.75 \]

and:\[ P(Y=1\mid C=0)=0.25. \]

The ratio is:\[ \frac{0.75}{0.25}=3. \]

The same ratio applies to the corresponding no probabilities in the opposite direction. This mechanism therefore satisfies a binary local privacy bound with:\[ \varepsilon=\log 3. \]

A smaller \(\varepsilon\) generally provides greater privacy but less statistical precision.

When Randomized Response Is Useful

The technique is most useful when:

the behavior is sensitive;
direct answers are likely to be distorted;
aggregate prevalence is more important than individual classification;
respondents trust the random mechanism;
the protocol can be followed privately;
the sample is large enough to absorb added noise.

It is less suitable when:

individual follow-up is required;
participants cannot understand the procedure;
the random mechanism cannot be trusted;
the sample is too small;
legal or ethical obligations require direct intervention;
exact individual records are necessary.

Ethical Considerations

Privacy-preserving mathematics does not replace ethical research practices.

Researchers should still provide:

informed consent;
a clear explanation of the procedure;
voluntary participation;
secure data handling;
minimal collection of identifying information;
transparent reporting;
support resources when appropriate;
institutional oversight where required.

Sensitive questions can create discomfort even when responses are randomized.

Common Mistakes

Interpreting the raw yes rate as prevalence

The observed 47.4% yes rate includes deliberately random yes responses.

The adjusted estimate is:\[ 2(0.474)-0.5\approx0.447. \]

Claiming an individual yes proves the behavior

The respondent may have answered the random question.

Claiming an individual response contains no information

Randomization provides plausible deniability, but the response can still change probabilities.

Ignoring sampling uncertainty

With only 57 respondents, the estimate is highly uncertain.

Generalizing beyond the sampled population

Randomized response protects privacy but does not solve selection or coverage bias.

Assuming everyone followed the protocol

Noncompliance can bias the estimate.

Forgetting the known random component

The estimator must subtract the yes responses expected from randomization.

A Reliable Analysis Process

Define the sensitive behavior precisely.
Define the target population.
Choose a representative sampling method.
Specify the randomized-response mechanism.
Derive \(P(Y)\) under the protocol.
Solve algebraically for the prevalence \(p\).
Estimate \(P(Y)\) from the observed responses.
calculate the prevalence estimate.
Quantify sampling uncertainty.
Assess compliance and possible nonresponse.
Explain the privacy guarantee accurately.
Report the population limitations.

Key Takeaway

Randomized response protects individual privacy by mixing truthful answers with known random noise. In the two-coin protocol,\[ P(Y)=\frac{1}{2}p+\frac{1}{4}, \]

so the sensitive-behavior prevalence is estimated by:\[ \hat{p}=2\hat{q}-\frac{1}{2}. \]

With 27 yes responses among 57 participants:\[ \hat{p} = 2\left(\frac{27}{57}\right)-\frac{1}{2} \approx44.7\%. \]

The added randomness protects individuals but reduces precision. The estimate remains dependent on representative sampling, protocol compliance, truthful responses, and adequate sample size.