K-Anonymity

The first step in applying k-anonymity is identifying quasi-identifiers (QIs) — attributes that are not direct identifiers (like name or SSN) but can be linked with external datasets to re-identify individuals.

• Common QIs: Date of birth, ZIP code, gender, and race
• Risk: Sweeney's landmark study showed 87% of the U.S. population is uniquely identifiable using only 5-digit ZIP, gender, and date of birth
• Process: Domain experts must explicitly declare QI sets before anonymization begins

Records are grouped into equivalence classes — sets of records that share identical values across all quasi-identifiers. Each equivalence class must contain at least k records to satisfy the privacy guarantee.

• k=5: Every QI combination appears at least 5 times in the dataset
• Trade-off: Larger k values increase privacy but reduce data utility
• Failure mode: Records in equivalence classes smaller than k are suppressed or generalized

To achieve k-anonymity, QI values are generalized — replaced with broader, less specific values using predefined hierarchies. This reduces granularity while preserving analytical utility.

• Age: Exact age (34) → age range (30-39) → decade (30s) → suppressed
• ZIP code: Full 5-digit (90210) → 4-digit (9021*) → 3-digit (902**) → city-level
• Domain-specific: ICD-10 codes can roll up to chapter-level categories
• Challenge: Over-generalization destroys statistical validity for rare subgroups

Records that cannot be grouped into an equivalence class of size k without excessive generalization are suppressed — removed entirely from the released dataset.

• Threshold logic: If generalization to meet k would collapse too many distinct values, suppression is preferred
• Outlier risk: Rare medical conditions or demographic combinations are disproportionately suppressed
• Bias implication: Suppression introduces systematic bias by removing minority populations from analytical datasets

K-anonymity's most critical limitation: it does not protect against attribute disclosure when all records in an equivalence class share the same sensitive attribute value.

• Example: If all k=5 records in a ZIP code × age group share an HIV-positive diagnosis, the adversary learns the sensitive attribute without re-identification
• Solution: l-diversity extends k-anonymity by requiring diversity of sensitive values within each equivalence class
• Real-world impact: This vulnerability drove the development of stronger models like t-closeness and differential privacy

K-anonymity assumes the adversary lacks external knowledge about individuals. When attackers possess auxiliary information, the model's guarantees break down.

• Attack vector: An adversary knows a target's QI values and that they are in the dataset — k-anonymity only ensures they match k records, but if all k share a sensitive trait, privacy is breached
• Mitigation: Combine with differential privacy for mathematical guarantees against arbitrary background knowledge
• Practical lesson: K-anonymity alone is insufficient for high-sensitivity healthcare data release

A mathematical framework providing provable privacy guarantees by injecting calibrated noise into data or algorithms. Unlike K-Anonymity, which focuses on indistinguishability within groups, DP ensures that the output of an analysis is statistically indistinguishable whether or not any single individual is included. The privacy budget epsilon (ε) quantifies the maximum information leakage, making it the gold standard for synthetic data generation in regulated healthcare contexts.

An extension of K-Anonymity that addresses the homogeneity attack. A dataset satisfies L-Diversity if each equivalence class (group of records sharing the same quasi-identifiers) contains at least L distinct values for sensitive attributes. This prevents attackers from inferring a sensitive diagnosis simply because all members of a K-Anonymous group share the same condition.

A refinement of L-Diversity that prevents skewness attacks by requiring the distribution of a sensitive attribute within any equivalence class to be within a threshold T of its global distribution. Measured using the Earth Mover's Distance, T-Closeness ensures that the semantic closeness of values is preserved, preventing an attacker from learning that a patient's condition is 'more severe' than the population average.

A privacy attack where an adversary determines whether a specific record was used to train a machine learning model. For synthetic data, this tests whether generated records inadvertently memorize and leak training examples. Defenses include differential privacy during training and rigorous nearest neighbor adversarial accuracy testing to ensure generated records do not collapse onto real individuals.

Attributes that do not uniquely identify an individual alone but can do so when combined. Examples in healthcare include date of birth, ZIP code, and gender. K-Anonymity operates by generalizing or suppressing QIDs to ensure each combination appears at least K times. Identifying and correctly scoping QIDs is the foundational step in any anonymization pipeline.

A privacy metric that measures the difficulty of distinguishing real from synthetic records. It compares the distance between a record and its nearest neighbor in the same dataset versus the opposing dataset. An NNAA score near 0.5 indicates perfect privacy—the attacker cannot distinguish real from synthetic better than random chance. Scores deviating significantly signal potential re-identification risk.