Privacy Protectin Models and Defamation caused by k-anonymity

Introduction of Privacy
Protection Mathematical Models
Private Information Retrieval
IR with Homomorphic Encryption
k-anonymity
l-diversity
Defamation caused by k-Anonymity
Hiroshi Nakagawa
The University of Tokyo

Overview of Privacy Protection Technologies
Whose privacy?
questioner Data subject whose personal data is in DB
Transform
query
Homomorphic
encryption
Private IR
Add
dummy
Semantic
preserving
query
transform
Decompose
query
Secure
computation：
Encrypt query
and DB by
questioner’s
secret key. Then
search w.o.
decryption
Method? What data is perturbed?
DB Whether
respond or
not
Query audit
response
Add noise
Differential
Privacy=Math.
models of added
noise
Deterministic
vs
Probabilistic
Transform
many has
the same QI
k-anonym.
l-diversity
t-close
anatomy
psudonymize：randomize
Personal ID by hash func.
1/k-anonym, obscurity

Whose privacy?
questioner Data subject whose personal data is in DB
Transform
query
Homomorphic
encryption
Private IR
Add
dummy
Semantic
preserving
query
transform
Decompose
query
Secure
computation：
Encrypt query
and DB by
questioner’s
secret key. Then
search w.o.
decryption
Method? What data is perturbed?
DB Whether
respond or
not
Query audit
response
Add noise
Differential
Privacy=Math.
models of added
noise
Deterministic
vs
Probablistic
Transform
many has
the same QI
k-anonym.
l-diversity
t-close
anatomy
psudonymize：randomize
Personal ID by hash func.
1/k-anonym, obscurity
Overview of Privacy Protection Technologies

(PIR)

Why user privacy should be protected in IR?
 While we mainly focused on privacy protection of
personal data in DB, user privacy of query in IR should be
protected as well.
 Knowledge-based scheme to create privacy-preserving but
semantically-related queries for web search engines
– David Sanchez, Jordi Castella-Roca, Alexandre Viejo
– Information Sciences, http://dx.doi.org/10.1016/j.ins.2012.06.025

Why user privacy should be protected in IR?
• IT companies in US transfer or even sell user profile to the
government authorities such as:
– AOL responds more than 1000 a month,
– Facebook responds 10 to 20 request a day
– US Yahoo sells its members’ account, e-mail by 30$-40$ for
one account
• These make amount of profit for IT companies , but
no return to data subjects.
– Even worse, bad guy may steel them.
• Then, internet search engine users should employ technologies
that protect him/herself identity from search engine.

What information a user wants keep
secret from the search engine?
Anonymity: a user does not want to be inferred
who send a query from S.E.
 Tor (onion routing)
 A proxy user mixes up several users queries and send
them to S.E.
Obfuscation: S.E. does not know the exact query,
even if the S.E. knows who sends a query.
What should be kept secret is:
– A set of words that consist of the query
– More generally, what the user wants to search.
– Majority of research is for Web search cases.

Keep secret the location a user sends a query
• A user wants to use a location based services
such as showing near by good restaurants, but
does not want the service provider his/her
location
• Using the tursted third party :TPP if exists
User ID, location
response
TPP alters the user ID and
location if necessary
response
The service
provider using a
user’s location
A user TPP

Mixing up several users’ locations
• In case of no TPP, several users trusting each other make a group, and use the
location based services
• L(n) is a location of a user whose ID=n
• Starting from ID=1, and add up each user’s location and finally k th user sends the
mixed up locations and request the services
• Each user only memorizes the previous user’s ID and when receives the response ,
return it to the previous user as shown in the figure below.
• By shuffling locations, each user does not recognize which response is for whose
reqest.
• Similar to k-anonymization.
ID=1
ID=２
ID=3
ID=４
[１，L(1)]
[L(1),2,L(2)] [L(1),2,L(2),3,L(3)]
Request for services
[L(1),L(2),L(3),L(4),4]
サービス結果リスト
[Res(1),Res(2),
Res(3),Res(4)]
[Res(1),Res(2),
Res(3),Res(4)]
[Res(1),Res(2),
Res(3),Res(4)]
[Res(1),Res(2),
Res(3),Res(4)]
The service
provider using a
user’s location
①
②
③
④
⑤
⑥⑦
⑧

 Researchers in industry send queries to S.E. to search the
DB. Their queries indicate the information of R&D of their
company.
 They want to make the queries secret from S.E. of the DB.
 Ex. Query including both chemical compound A and B, which is
crucial for R&D.
Data Base
Try to preserve
the whole
contents of the
DB.
Query
Try to keep secret the query
Queries are the company’s
secret about their R&D.

what should be kept secret?
• Information which can identify a searcher of
DB or a user of services.
• Internet ID, name
• Location from where a searcher send the query
• Time of sending the query
• Query contents
• See next slide
• Existence of query

Query length and structure
should be kept secret
• In case of a query consists of words,
– Add dummy words, or replace the word with word(s) of same meaning
• A set of words having some structure such as
sentences, ordered sequence of words
– More complex paraphrasing is needed
• Location info., numerical info. etc.
– Add noise, reduce the precision or whatever

How to make it difficult to infer
the real query ?  Obfuscation
• A query is divided into words. Each word is used as
distinct query
• Add noise, say confusing words, to the query
• Replace a query word with semantically similar
word(s)
 When we get response( list of documents, etc.), we have to
select out the originally intended answer from them.

Outlook of PIR with obfuscation
Searcher’s profile：X＝ multinomial
distribution of 𝑝𝑖 which is the probability
of i th topic
Dummy
Generation
System：
DGS
Internet
Semantic
Classification
R,R,R
D,R,D,D,R
R:real query
D:dummy query
：generated by DGS
Q,Q,Q
D and R are
indistinguishable
from S.E.
Semantically
classification
Profile
refiner
X
Y
Dummy
filter
Z learned with profile
and dummy
Throw
awayQ if
regareded as
dummy
Revise
profile by
Q
regarded
as true
query
Search Engine: S.E.
（possibly adversary）Questioner：A
Y is the
inferred
value of
X

Supplemental explanation
 A questioner : A makes dummy queries D by DGS(dummy
generater system) based on the real query R, and send R
and D to the search engine: S.E., which might be an
adversary.
 S.E. receives Q which actually consists of R and D. Then S.E.
learns a questiner’s profile Z, and classifies Q into real
query and dummy queries.
 In this setting, the questioner wants Q not be classified into
R and D. In addition, he/she would not like his/her profile
inferred by S.E.. That is why adding D or replacing true R
with other words.

Original
DB
Encrypted
DB
Encrypted
response
Encrypt DB with PKq.
Big DB requires big
amount of time to
encrypt.
Questioner has both
of public key:PKq
and secret key:SKq
Query encrypted
with PKq
Decrypt with SKq
Searching without
decryption.
Questioner’s Public key: PKq
Addition (and multiplication) can be done without
decryption for encrypted data if homomorphic
public key encryption is employed.

N
Finger print
Finger print expressions of
Chemical compound DB：much
smaller than the original
chemical compound formulaEncrypt this compound:X
with additive homomorphic
encryption:Enc(X)
Enc(X)and public key PKq
Encrypt DB with received
PKq, and calculate the
similarity based on Tversky
values between Enc(X) and
each encrypted compound.
Encrypted Tversky
values: Tv(X)
Decrypt Tv(X)
with SKq and
get to know the
similar
compound with X
Researcher in
chemical industry
０１１
０１１・・・
０１１・・・
００１・・・
１０１・・・
Chemical Compounds IR based on Secure Computation:
Developed by AIST Japan
X:

motivation
Can we anonymize personal data only by removing
invididula ID such as name and exact address?
No
Private information can be inferred by combining the
publicly open data: Link Attack
Un-connetable anonymity in Japanese medicine mainly for
research purpose: Pseudonymize and delete the linking data
between psedonym and personal ID.
 If the linking data is not deleted, we call “Connetable anonymity.”
Un-connetable anonymity is thought to be protecting patients’
personal medical data because this kind of data are only
confined in the medical organization.
If, however, the patients’ data are used in nursing care
organization or medicine related companies such as
pharmaceutical companies.

Classic Example of Link
• Sweeney [S01a] said the governor of Massachusetts
William Weld ‘s medical record was identified by
linking his medical data which deletes his name, and
the voter as shown in the figure.
• Combining both database
• 6 people have the same birth date of the
governor
• Within these 6 people, three are male.
• Within these three, only one has the
same ZIP code!
• According to the US 1990 census data,
– 87% of people are uniquely identified by zipcode, sex, and birth
 K-anonymization was proposed to remedy this situation.
Voter List
Ethnicity
Diagnosis
Medication
Total charge
ZIP Name
Birth date Adress
Sex Data
registered
Party
affiliation
Medical
Data

• Two methods to protect personal data stored in databases from link
attacks when this database is transferred or sold to the third party.
– Method１： Only Randomly sampled personal data is transferred
because whether specific person is stored in this sample DB or not is
unknown.
– Method2： Transform Quasi ID ( address, birthdate, sex ) less accurate
ones in order that at least k people has the same less accurate Quasi ID:
k-anonymization.
– In the right DB of the figure below, 3 people has the same (less accurate)
Quasi ID, say old lady, young girl, young boy 3-anonymity
3-anonymity DB
Transform Quasi ID
into less accurate
ones to make DB 3-
anonymity.

Example of transforming Quasi ID less
accurate
• Attribute of Quasi ID
– Personal ID（explicit identifiers） is deleted: anonymize
– Quasi ID can be used to identify individuals
– Attribute, especially sensitive attribute value should be
protected
Personal ID Quasi ID Sensitive info.
name Birth date gender Zipcode Disease name
John 21/1/79 M 53715 flu
Alice 10/1/81 F 55410 pneumonia
Beatrice 1/10/44 F 90210 bronchitis
Jack 21/2/84 M 02174 sprain
Joan 19/4/72 F 02237 AIDS
The objective : Keep each individual identified by Quasi ID
delete

Terminology: identify, specify
• Just the summary of basic terminology in Japanese
 specify：A data record becomes known to match to the real world
uniquely specified natural person by linking an anonymized
personal DB and other non anonymized personal DB
 identify：Data records of several DBs, are known to be the unique
same person’s data record by linking Quasi ID of these DBs
 Without identified, specification is generally hard
 Neither identified nor specified case: Non-identify&non-specify
 Identified but not specified: Identify&non-specify
27

k-anonymization
• Sweeney and Samarati [S01, S02a, S02b]
• k-anonymization: transform quasi IDs to less accurate ones
so that at least k people have the same quasi IDs.
– By k-anonymization, the probability of being identified becomes
less than 1/k against link attack.
• Method
– Generalization of quasi ID values, or suppress a record having a
certain value of quasi ID.
• Not adding noise to attribute value
• Notice the tradeoff between privacy protection and data
value degradation ( especially for data mining)!
– Don’t transform more than necessary for k-anonymity!

Example of k-anonymity
Birth day gender Zipcode
21/1/79 M 53715
10/1/79 F 55410
1/10/44 F 90210
21/2/83 M 02274
19/4/82 M 02237
Birth day gender Zipcode
group 1
*/1/79 human 5****
*/1/79 human 5****
suppress 1/10/44 F 90210
group 2
*/*/8* M 022**
*/*/8* M 022**
Original DB 2-anonymized DB

Generalizations (1)
• Every node of the same level of classification tree are generalized as
shown in the figure below:
• Global generalization  accuracy downgraded a lot
– If a lawyer and an engineer are generalized as a specialist, then a musician and a painter
are generalized as an artisit, too.
• sepcialist artist
• lawyer engineer musician painter
• Only generalizing nodes in the subtree
– Even if a lawyer and an engineer are generalized as a specialist, a musician and
a painter are not generalized. Avoiding non-necessary generalization.
• sepcialist artist
•
30

Generalizations (2)
• Only one of children in a subtree is generalized
• specialist artist
• Local generalization :
– not all records but individual records are
generalized .
– Good point is less accuracy reduction.
• i.e. John(lawyer)  John(specialist) but Alex(lawyer) still
remains a lawyer. 31

Evaluation function in k-anonymization
• K-anonymization algorithm uses the following evaluation function
to control whether generalization continues or stop.
• minimal distortion metric:MD
– The number of lost precise data by generalization.
– For example, 10 engineers are generalized into specialist, MD=10
• 𝐼𝐿𝑜𝑠𝑠 𝑣𝑔 =
𝑣 𝑔 −1
𝐷 𝐴
: The loss when more precise data than 𝑣𝑔 is
generalized to 𝑣𝑔
•
𝑣𝑔 is the number of kinds of data of 𝑣𝑔’s children.
𝐷𝐴 is the number of kinds of data of 𝑣𝑔
′
s attribute:A
32

Math science Bio science
Mathematics Statistics Chemistry Biology
𝐷𝐴 =4 𝑣𝑔 =2
𝐼𝐿𝑜𝑠𝑠 𝑣𝑔 =
𝑣𝑔 − 1
𝐷𝐴
=
2 − 1
4
=
1
4
33

• Trade-off between information accuracy and
privacy
• 𝐼𝐺𝑃𝐿(𝑠) =
𝐼𝐺 𝑠
𝑃𝐿 𝑠 +1
– s means generalizing to data
– 𝐼𝐺 𝑠 is the loss of information gain or MD by
applying s
– 𝑃𝐿 𝑠 is the degree of anonymization by applying s
• If k-anonymization, the degree is k.
34

Lattice for generalization
k-anonymity
zipcode Birth date sex
Lattice for generalization of all quasi
IDs
Objective
Minimum generalization
Subject to k-anonymity
generality
less
more
Z0
Z1
Z2
={53715, 53710, 53706, 53703}
={5371*, 5370*}
={537**}
B0
B1
={26/3/1979, 11/3/1980, 16/5/1978}
={*}
<S0, Z0>
<S1, Z0> <S0, Z1>
<S1, Z1>
<S1, Z2>
<S0, Z2>
[0, 0]
[1, 0] [0, 1]
[1, 1]
[1, 2]
[0, 2]
S0
S1
={Male, Female}
={Person}

Use lattice for efficient generalization
incognito [LDR05]
Using monotonicity
<S0, Z0>
<S1, Z0> <S0, Z1>
<S1, Z1>
<S1, Z2>
<S0, Z2>
(I) Generalization property (~rollup)
if k-anonymity at a node
then nodes above the node satisfy k-anonymity
(II) Subset prpperty (~apriori)
if a set of quasi ID does not satisfy k-anonymity at a node
then a subset of the set of quasi ID does not satisfy k-
anonymity
e.g., <S1, Z0> satisfies k-anonymity
 <S1, Z1> and <S1, Z2> satisfy k-anonymity
e.g., <S0, Z0> k-匿名性でない
 <S0, Z0, B0> and <S0, Z0, B1> k-匿名性でない
To simplify, only about <S,Z>

Example Case:
Dividing does not anonymize
Example of Incognito
2 quasi ID , 7 data point
zipcode
sex
group 1
w. 2 tuples
group 2
w. 3 tuples
group 3
w. 2 tuples
not 2-anonymity
2-anonymity

Examples [LDR05, LDR06]
Each dimension is
sequentially
generalized
incognito [LDR05]
Each dimension is
independently
generalized
mondrian [LDR06]
All dimensions are
generalized at the same
time
topdown [XWP+06]
Strength of generalization

Mondrian
[LDR06]
2－anonymity

Grouping by boundary length[XWP+06]:
Bad
generalization
Long rectangle
Low datamining
accuracy
Good
generalization
Rectangle near
square
High datamining
accuracy

Topdown [XWP+06]
split algorithm
Start with the most distant two data points
• Heuristics
• aggregate to 2 groups from seeds to
The near point is to combined to the group so
that the boundary length of the combined
group is the minimum among cases other
point is combined.
The right figure shows the growing of red and
green group by adding ①, ② and ③.
①②
③
③
②
①

The problem of k-anonymity
• ４-anonymity example
• Homogeneity attack: The third group only consists of cancer patients. Then if combine
other DB, the four people in the third group are known to be cancer patients.
• Background knowledge attack: If it is known that in the first group is there one Japanese
who has rarely cardiac disease, the Japanese person’s illness is inferred as infectious
disease.
id Zipcode age nationality disease
1 13053 28 Russia Cardiac disease
2 13068 29 US Cardiac disease
3 13068 21 Japan Infectious dis.
4 13053 23 US Infectious dis.
5 14853 50 India Cancer
6 14853 55 Russia Cardiac disease
9 13053 31 US Cancer
10 13053 37 India Cancer
11 13068 36 Japan Cancer
12 13068 35 US Cancer
id Zipcode age nationality disease
1 130** <30 ∗ Cardiac disease
2 130** <30 ∗ Cardiac disease
3 130** <30 ∗ Infectious dis.
4 130** <30 ∗ Infectious dis.
5 1485* ≥40 ∗ Cancer
6 1485* ≥40 ∗ Cardiac disease
7 1485* ≥40 ∗ Infectious dis.
8 1485* ≥40 ∗ Infectious dis.
9 130** 3∗ ∗ Cancer
10 130** 3∗ ∗ Cancer
11 130** 3∗ ∗ Cancer
12 130** 3∗ ∗ Cancer
Anonymous DB 4-anonymity DB

l-diversity
[MGK+06]
• The purpose is that the sensitive information in each group is not skewed.
– Prevent homogeneity attack
– Prevent background knowledge attack
l-diversity (intuitive definition)
That a group is l-diverse is defined as at least
l kinds of values in the group.

44
name age sex disease
John 65 M flu
Jack 30 M gastritis
Alice 43 F pneumonia
Bill 50 M flu
Pat 70 F pneumonia
Peter 32 M flu
Joan 60 F flu
Ivan 55 M pneumonia
Chris 40 F rhinitis
john flu
Peter flu
Joan flu
Bill flu
Alice pneumonia
Pat pneumonia
Ivan pneumonia
Jack gastritis
Chris rhinitis
Divide into
disease
based sub
Databases
l-diversity algorithm part１
•DB is divided according to each value of sensitive information( disease
name).

45
John flu
Peter flu
Joan flu
Bill flu
Alice pneumonia
Pat pneumonia
Ivan pneumonia
Jack gastritis
Chris rhinitis
John flu
Joan flu
Alice pneumonia
Ivan pneumonia
Chris rhinitis
Peter flu
Bill flu
Pat pneumonia
Jack gastritis
Each of these two groups contains at
least 3 diseases: 3-diversity
l-diversity algorithm part２
•Select records from each of left hand side date group and sequentially add each of
the right hand side data group

Anatomy [Xiaokui06]
• Divide the original table( appeared in l-divesity algorithm part 1) into two
tables. The left and right table are only linked by group ID, here 1 and 2.
• 3-diversity
46
Group ID disease frequency
１ flu ２
１ pneumonia ２
１ rhinitis １
２ flu ２
２ pneumonia １
２ gastritis １
name age sex Group
ID
John 65 M １
Jack 30 M １
Alice 43 F １
Bill 50 M １
Pat 70 F １
Peter 32 M ２
Joan 60 F ２
Ivan 55 M ２
Chris 40 F ２ Data mining is done on these two tables.
Since each value is not generalized, the
expected accuracy is high.

Side effects of k-anonymity
Defamation

name age sex address Location at 2016/6/6 12:00
John 35 M Bunkyo hongo 11 K consumer finance shop
Dan 30 M Bunkyo Yusima 22 T University
Jack 33 M Bunkyo Yayoi 33 T University
Bill 39 M Bunkyo Nezu 44 Y hospital
John 30’s M Bunkyo K consumer finance shop
Dan 30’s M Bunkyo T University
Jack 30’s M Bunkyo T University
Bill 30’s M Bunkyo Y hospital
４-anonymize
Dan , Jack and Bill are not recognized a person different
from John by 4-anonyumity, all four persons are suspected
to stay at K consumer finance shopk-anonymization
provokes defamation on Dan, Jack and Bill.

John 35 M Bunkyo hongo 11 K consumer finance shop
Dan 30 M Bunkyo Yusima 22 K consumer finance shop
Jack 33 M Bunkyo Yayoi 33 K consumer finance shop
Bill 39 M Bunkyo Nezu 44 K consumer finance shop
Exchange one person to
make DB 2-diversity
By 2-diversifying, Alex becomes strongly suspected to be at K
consumer finance shop  l-diversity provokes defamation
l-diversity makes situation worse
These values shows all four is
at K consumer finance shop
John 30’s M Bunkyo K consumer finance shop
Dan 30’s M Bunkyo K consumer finance shop
Jack 30’s M Bunkyo K consumer finance shop
Alex 30’s M Bunkyo Ｔ Univeristy

k-anonymity provokes defamation
in sub area aggregation
k-anonymmized area : at
least k people are in this area
consumer
finance
shop
This university student who is
trying to find a job, is
suspected to stay at consumer
finance shop, and this situation
is not good for his job seeking
process.
Defamation

Why defamation happens?
• Case study
– A job candidate who is a good university student.
– He is in k people group that includes at least one
person who went to a consumer finance shop.
– A company he tries to take entrance examination
does not want hire a person who goes to a
consumer finance shop.
– He is suspected to go to a consumer finance
shop. defamation!
– At the same time he is a good university student.

Back ground situation of defamation
• Case study cont.
– If the company deletes him from candidate list, it must
use another time and money, say X, to check another
candidate:
– If the company hires a bad buy, it will suffer a certain
amount of damage, say Y, by his bad behavior.
– Then if the expected value of Y is more than X, the
company becomes very negative, otherwise not
negative about him.
– This is a defamation from an economical point of view.

Back ground situation of defamation
• Case study cont.
– Another factor is the probability that he actually
went to a consumer finance shop.
– This probability is proportional to the number of
consumer finance shop visitors, say s, in k people of
k-anonymity group.
– Then the relation is sketched in the figure on next
slide.

1
0 1
The subjective
probability of the
company suspects him
The expected
damage if the
company hires
him
The money
the company
has to spend
for checking
another
candidate
s/k

1
0 1
The subjective
probability of the
company suspects him
The expected
damage if the
company hires
him
The money
the company
has to spend
for checking
another
candidate
s/k
In this area, the company does
not pay if it suspects him
In this area, the company
should suspect him to avoid
the expected damage
C
The border
line between
defamation or
not

Solution
• Then the solution is simple:
– Make the border line as small as possible.
– But how?
• We can revise k-anonymization algorithm in order to
minimize the number of bad behavior guys in k-
anonymity group.
– This revision, however, reduce the accuracy of the data.
– Then the problem comes to be a optimization problem:
Maxmize Accuracy of data
subject to number of bad guys ≤ 1
in k-anonymity group

A consumer finance shop is devided into 4 parts to
reduce # of poepole visit it is less or equal than one
K-anonymity area isdevided
into 4 areas
A concumer
finance
shop

Outline of algorithm
1. Do k-anonymization.
2. If one group includes more than one bad guys
① Then combine this and two nearest groups
② Do k-anonymization to this combined group to make
two groups that includes at most one bad guys.
③ If step ② fails,
④ then go back to one step in 1. Do k-anonymization,
namely try to find another generalization in k-
anonymization.

Reference
• [LDR 05]LeFevre, K., DeWitt, D.J., Ramakrishnan, R. Incognito: Efficient Full-domain k-Anonymity.
SIGMOD, 2005.
• [LDR06]LeFevre, K., DeWitt, D.J., Ramakrishnan, R. Mondrian Multidimensional k-Anonymity. ICDE,
2006.
• [XWP+06] Xu, J., Wang, W., Pei, J., Wang, X., Shi, B., Fu, A., Utility-Based Anonymization Using Local
Recoding. SIGKDD, 2006.
• [MGK2007]MACHANAVAJJHALA,A. KIFER,D. GEHRKE,J. and VENKITASUBRAMANIAM, U. l-Diversity:
Privacy Beyond k-Anonymity. ACM Transactions on Knowledge Discovery from Data, Vol. 1, No. 1,
Article 3,2007
• [S01] Samarati, P. Protecting Respondents' Identities in Microdata Release. IEEE TKDE, 13(6):1010-
1027, 2001.
• [S02a] Sweeney, L. k-Anonymity: A Model for Protecting Privacy. International Journal on
Uncertainty, Fuzziness and Knowledge-based Systems, 2002.
• [S02b] Sweeney, L. k-Anonymity: Achieving k-Anonymity Privacy Protection using Generalization
and Suppresion. International Journal on Uncertainty, Fuzziness and Knowledge-based Systems,
2002.
• Ninghui Li,Tiancheng Li,Venkatasubramanian, S. “t-Closeness: Privacy Beyond k-Anonymity and –
Diversity”. ICDE2007, pp.106-115, 2007.
• [SMP] Sacharidis, D., Mouratidis, K., Papadias, D. k-Anonymity in the Presence of External
Databases（to be appeared)
• [Xiaokui06] X. Xiaokui and T. Yufei. (2006). Anatomy: Simple and Effective Privacy Preservation.
VLDB, 139-150.

Privacy Protectin Models and Defamation caused by k-anonymity

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to Privacy Protectin Models and Defamation caused by k-anonymity (20)

More from Hiroshi Nakagawa (20)

Recently uploaded (20)

Privacy Protectin Models and Defamation caused by k-anonymity