Statistical databases aim to provide frequencies, averages, and other statistics about groups of persons (or organizations), while protecting the confidentiality of the individuals represented in the database. This objective is difficult to achieve, as users of statistical databases have a host of inference techniques at their disposal for retrieving information about identifiable persons (e.g., see [36,15,16,14,17,26, 31].) There are two broad categories of inference controls: controls that place restrictions on the set of allowable statistics, and controls that add noise to the data or to the released statistics. This paper focuses on restriction techniques.