Differential Privacy of Hierarchical Census Data: An Optimization Approach