Linkage Attack

Quasi-identifiers are attributes that are not unique on their own but become identifying when combined. Common examples include:

• Date of birth + ZIP code + gender (Latanya Sweeney's landmark demonstration identified 87% of the U.S. population using only these three fields)
• Admission and discharge dates cross-referenced with public obituary records
• Employer + occupation matched against LinkedIn profiles

The attacker does not need a name or Social Security number—they exploit the combinatorial uniqueness of residual attributes that were left intact to preserve analytical utility.

The attack's power derives from joining de-identified records with publicly available auxiliary datasets that contain overlapping attributes. Common external sources include:

• Voter registration databases (name, address, DOB, party affiliation)
• Property tax records (owner name, property address, sale price)
• Commercial data brokers (aggregated consumer profiles with thousands of attributes)
• Social media profiles (self-disclosed demographic and location data)

The attacker performs a deterministic join on shared columns, effectively reversing the de-identification by matching the quasi-identifier fingerprint to a known identity.

Attackers employ probabilistic and deterministic matching algorithms originally developed for legitimate data integration tasks:

• Deterministic matching: Exact joins on shared identifiers (e.g., ZIP code + DOB)
• Probabilistic matching: Fuzzy string comparison using Jaro-Winkler distance or TF-IDF cosine similarity to handle typos, abbreviations, and formatting inconsistencies
• Blocking techniques: Partitioning datasets into blocks by high-certainty attributes (e.g., state) to reduce the computational complexity of all-pairs comparison
• Supervised classification: Training models on known matches to predict linkage probability for candidate pairs

These techniques routinely achieve 95%+ precision when sufficient quasi-identifiers overlap between datasets.

A composition attack occurs when an adversary combines multiple independently released de-identified datasets that all pertain to the same individuals. Each dataset alone may satisfy a privacy threshold, but their intersection reveals additional quasi-identifiers:

• Dataset A: Demographics (age, gender, ZIP)
• Dataset B: Medical encounters (diagnosis codes, procedure dates)
• Dataset C: Pharmacy claims (drug names, fill dates)

By linking A, B, and C on shared attributes, the attacker constructs a comprehensive profile with enough granularity to uniquely identify individuals. This is the primary reason differential privacy frameworks account for cumulative information leakage across multiple releases.

Time-stamped data creates unique re-identification vectors because temporal sequences are highly individualistic:

• Hospital admission/discharge timestamps matched against public social media check-ins or news reports of accidents
• Lab test ordering sequences correlated with known clinical pathways that reveal condition onset windows
• Pharmacy fill dates cross-referenced with insurance claims databases that contain precise transaction timestamps

Even when exact dates are shifted using a date shift algorithm, the relative intervals between events often remain intact to preserve clinical utility—and these interval patterns can serve as a distinctive fingerprint for re-identification.

Genetic data presents a uniquely irreversible re-identification risk because DNA is inherently identifying:

• Y-chromosome STR haplotypes matched against recreational genealogy databases (e.g., GEDmatch, FamilyTreeDNA) can identify male relatives and triangulate to the subject
• SNP arrays containing hundreds of thousands of variants can be cross-referenced with direct-to-consumer testing databases
• Even aggregate allele frequency data from genome-wide association studies has been shown to allow detection of an individual's participation in a study cohort

Unlike quasi-identifiers, genomic data cannot be meaningfully de-identified—it is the ultimate persistent identifier, making linkage attacks against genomic datasets particularly high-impact.

A foundational privacy model that protects against linkage attacks by ensuring each record in a dataset is indistinguishable from at least k-1 other records based on quasi-identifiers. If an attacker attempts to link external data using attributes like ZIP code, birth date, and sex, they will always find at least k matching records, preventing unique re-identification.

• Generalization: Replaces specific values with broader categories (e.g., birth year instead of full date)
• Suppression: Removes outlier records or values that would break anonymity groups
• Limitation: Vulnerable to homogeneity and background knowledge attacks even when k is satisfied

The statistical probability that an adversary can correctly match de-identified records to specific individuals using auxiliary information. This risk is the central metric that de-identification pipelines must minimize. Linkage attacks exploit residual re-identification risk when quasi-identifiers remain in released data.

• Prosecutor Risk: Probability of re-identifying a specific targeted individual
• Journalist Risk: Probability that any individual in the dataset can be re-identified
• Marketer Risk: Proportion of records that can be re-identified at scale

Risk is measured through formal re-identification risk assessments that simulate adversary capabilities against the dataset.

A mathematical framework providing provable guarantees against linkage attacks by injecting calibrated noise into query results. Unlike syntactic models like k-anonymity, differential privacy ensures that the presence or absence of any single individual in the dataset is statistically indistinguishable.

• Epsilon (ε): Privacy budget parameter controlling the trade-off between accuracy and privacy
• Laplace Mechanism: Adds noise drawn from a Laplace distribution to numeric outputs
• Exponential Mechanism: Used for non-numeric queries where direct noise injection is impractical

Differential privacy is the gold standard for preventing linkage attacks because it makes no assumptions about the adversary's auxiliary knowledge.

Attributes that do not uniquely identify an individual in isolation but can do so when combined and cross-referenced with external datasets. These are the primary enablers of linkage attacks. Common quasi-identifiers in healthcare data include:

• Demographics: Date of birth, gender, 5-digit ZIP code, ethnicity
• Clinical context: Admission and discharge dates, rare diagnoses, procedure dates
• Geographic indicators: Hospital location, county, census tract

Effective de-identification requires identifying and transforming quasi-identifiers, not just removing direct identifiers like names and SSNs. The Safe Harbor method removes 18 identifiers but may still leave quasi-identifier combinations exploitable.

A data protection technique that replaces direct identifiers with artificial pseudonyms or tokens while preserving the ability to re-link data under controlled conditions. Unlike anonymization, pseudonymized data remains subject to privacy regulations because re-identification is possible.

• Consistent mapping: Same individual receives the same pseudonym across all records
• Reversible: A secure mapping table allows authorized re-identification
• Risk: If the mapping table is compromised or quasi-identifiers remain, linkage attacks become possible

Pseudonymization is often used in clinical research where longitudinal tracking is required but direct identifiers must be hidden from analysts.

A HIPAA-compliant de-identification method where a qualified statistician certifies that the risk of re-identification is very small based on accepted statistical and scientific principles. This method directly addresses linkage attack risk through formal analysis.

• Adversary modeling: Evaluates what external data an attacker might possess
• Risk threshold: Typically requires re-identification risk below a specified probability
• Documentation: Requires a written certification of the methodology and risk determination

Expert Determination is more flexible than Safe Harbor because it allows retaining useful data elements if the overall re-identification risk remains acceptably low.