k-Anonymity

The foundational mechanism of k-anonymity is the formation of equivalence classes—groups of records that share identical values across a defined set of quasi-identifiers (e.g., ZIP code, age, gender). Each equivalence class must contain at least k records to satisfy the privacy guarantee. For example, if k=5, every combination of ZIP code, age, and gender appearing in the released dataset must appear at least 5 times. This prevents an attacker from isolating a single individual even when armed with external demographic data.

To achieve k-anonymity, raw attribute values are transformed using domain generalization hierarchies that replace specific values with broader, less precise categories. A ZIP code like 02139 might be generalized to 0213*, then to 021**, and finally to 02***. Age values are typically mapped to intervals (e.g., 34 → [30-39]). This systematic coarsening reduces granularity while preserving analytical utility. The height of the hierarchy determines the trade-off between privacy protection and data precision.

When generalization alone cannot achieve the required k threshold without destroying data utility, cell suppression or tuple suppression is applied. Cell suppression replaces individual attribute values with a null marker, while tuple suppression removes entire outlier records from the dataset. Records with rare combinations of quasi-identifiers—such as a 98-year-old in a sparsely populated ZIP code—are typically suppressed because they resist safe grouping. Excessive suppression, however, introduces statistical bias and reduces sample size.

A critical limitation of k-anonymity is its inability to protect against homogeneity attacks. If all k records in an equivalence class share the same sensitive attribute value—such as all having the same disease diagnosis—an attacker who knows a target belongs to that class learns the sensitive value with certainty, despite the k-grouping. This vulnerability motivated the development of stronger models like l-diversity, which requires diversity of sensitive values within each equivalence class, and t-closeness, which constrains the distribution of sensitive values.

k-anonymity assumes a specific set of quasi-identifiers known to the attacker, but it does not account for background knowledge attacks where the adversary possesses additional external information beyond those quasi-identifiers. For instance, if an attacker knows a target's profession or marital status—attributes not included in the quasi-identifier set—they may still narrow down the equivalence class to a single individual. This highlights the model's dependence on accurate threat modeling and comprehensive quasi-identifier selection during the anonymization design phase.

The minimal generalization principle seeks to find the optimal anonymization that satisfies k-anonymity while maximizing data utility. Algorithms like Mondrian multidimensional partitioning and Incognito traverse the lattice of possible generalization strategies to identify the transformation that imposes the least information loss. Information loss is typically measured using metrics such as the normalized certainty penalty or discernibility metric, which quantify how much precision has been sacrificed relative to the original data.

A set of non-sensitive attributes that, when combined, can uniquely or near-uniquely identify an individual by linking to external datasets. k-Anonymity works by generalizing or suppressing these attributes.

• Examples: Date of birth, gender, and 5-digit ZIP code (87% of the U.S. population is uniquely identified by this triplet)
• Contrast with: Direct identifiers (name, SSN) which are simply removed, not generalized
• Risk: Quasi-identifiers are the attack vector exploited in linkage attacks

An enhancement to k-Anonymity that addresses the homogeneity attack. It requires that each k-anonymous equivalence class contains at least l well-represented values for each sensitive attribute.

• Distinct l-diversity: At least l distinct sensitive values per group
• Entropy l-diversity: The entropy of sensitive values exceeds a threshold
• Limitation: Does not protect against skewness attacks where an attacker infers high probability of a specific sensitive value

A further refinement that requires the distribution of a sensitive attribute in any equivalence class to be within a threshold t of its distribution in the overall dataset. This prevents skewness attacks that l-diversity misses.

• Uses Earth Mover's Distance to measure distributional distance
• Protects against attribute disclosure, not just identity disclosure
• More computationally expensive than k-anonymity or l-diversity alone

The primary threat that k-Anonymity defends against. An adversary cross-references quasi-identifiers in a de-identified dataset with an external identified dataset to re-identify records.

• Famous example: Latanya Sweeney re-identified Massachusetts Governor William Weld's medical records by linking anonymized GIC data with the Cambridge voter registration list
• Defense: Ensuring each quasi-identifier combination maps to at least k records

A privacy breach where all records in a k-anonymous equivalence class share the same sensitive attribute value. Even though the individual is hidden in a group of k, the sensitive value is trivially disclosed.

• Example: If all women aged 30-35 in ZIP 02138 have HIV+, knowing a target is in that group reveals their diagnosis
• Mitigation: l-Diversity explicitly prevents this by requiring diverse sensitive values per group

A mathematical framework providing a provable privacy guarantee that the output of a query is statistically indistinguishable whether or not any single individual is included in the dataset. Unlike k-Anonymity, it is syntactic rather than semantic.

• Parameter ε (epsilon): Quantifies the privacy loss budget; lower values mean stronger privacy
• Mechanism: Adds calibrated Laplace or Gaussian noise to query results
• Adopted by: U.S. Census Bureau for 2020 decennial census data releases