k-Anonymity: A Model for Protecting Privacy
International Journal of Uncertainty Fuzziness and Knowledge-Based Systems, 2002 · paper · Computer science
Proposes k-anonymity, a model in which each person in a released dataset cannot be distinguished from at least k-1 others, plus deployment policies. It also examines re-identification attacks on such releases and says the model underlies the Datafly, μ-Argus and k-Similar systems.
Checked: PDF from epic.org, fetched 4 Oct 2026. Page numbers are those of that PDF.
1 finding
Substance Example 4 states "|T[Gender ="m"]| = 6. |T[Gender ="f"]| = 5." but Figure 2 has Gender m for t1, t2, t7–t11 (7 tuples) and f for t3–t6 (4 tuples).
- p. 9 Example 4
|T[Gender ="m"]| = 6. |T[Gender ="f"]| = 5.
- p. 9 Figure 2 table, Gender column
Figure 2 Example of k-anonymity, where k=2
- p. 9 Figure 2 table, Gender column
Figure 2 Example of k-anonymity, where k=2 and QI={Race, Birth, Gender, ZIP}
Judge's note: I counted the rows on the page 9 image. m: t1, t2, t7, t8, t9, t10, t11 = 7. f: t3, t4, t5, t6 = 4. The other counts match the table: Race 6/5, Birth 1964=5, 1965=4, 1967=2, ZIP 9/2.
Second check: another model agreed
Report a problem with this finding
7 minor (typos and the like; most checked by the judge only)
Wording Definition 2 (p7) writes the quasi-identifier as "Q_T" (and Q_V in Example 2); from Definition 3 (p8) on it becomes "QI_RT"/"QI_T"/"QI_PT" with no statement that these are the same notation.
- p. 7 Definition 2 and Example 2
A quasi-identifier of T, written QT
- p. 8 Definition 3
QIRT be the quasi-identifier associated with it
Judge's note: Checked pages 7 and 8. The notation change is real, but readers can infer that the symbols mean the same thing, so this is minor.
Second check: another model agreed
Report a problem with this finding
Wording Example 7 (p12): "Assume a k-anonymity solution based on PT is provided, and that it is called GTt1", but GTt1 contains the tuples added at t1, so it must be based on PTt1.
- p. 12 Example 7
Assume a k-anonymity solution based on PT is provided, and that it is called GTt1.
Judge's note: The page 12 image shows the sentence directly after "PT becomes PTt1". GTt1 = GT3 ∪ {two new tuples} can only come from PTt1. The subscript appears to be missing.
Second check: another model agreed
Report a problem with this finding
Typo Page 2: "along the lines of the those shown in the leftmost circle of Figure 1" has a superfluous word ("the those").
- p. 2 Example 1, second paragraph
of the those shown in the leftmost circle
- p. 2 Example 1, second paragraph
of the those shown in the leftmost circle of Figure 1
Judge's note: The page 2 crop shows "of the those shown". One of the two determiners is redundant.
Second check: none (judge only)
Report a problem with this finding
Typo Page 5: "has expanded the scope and nature of inference control problems and exasperated established operating practices" uses 'exasperated' where 'exacerbated' is meant.
- p. 5 End of Section 2.4
exasperated established operating practices
- p. 5 Section 2.4, final 'In summary' paragraph
problems and exasperated established operating practices
Judge's note: The page 5 crop shows 'exasperated'. In context the intended sense is 'made worse'.
Second check: none (judge only)
Report a problem with this finding
Typo Example 6 (p11): "if GT3 used the quasi=identifier QI ∪ {Problem}" has '=' in place of a hyphen.
- p. 11 Example 6
used the quasi=identifier QI
- p. 11 Example 6
GT3 used the quasi=identifier QI
Judge's note: The page 11 image shows the equals sign. Everywhere else the paper writes 'quasi-identifier'.
Second check: none (judge only)
Report a problem with this finding
Typo Example 7 adds tuples with BirthDate "9/7/65" and "11/4/65", while PT in Figure 4 uses four-digit years (e.g. "9/20/1965").
- p. 12 Example 7
9/7/65
- p. 11 Figure 4 PT
9/20/1965
Judge's note: Checked the images of pages 11 and 12. The date format is inconsistent, but the meaning is clear; cosmetic only.
Second check: none (judge only)
Report a problem with this finding
Typo Section 4.3 (p12): "were added to the privately held table T0, so it comes Tt" should read "becomes".
- p. 12 Section 4.3, first paragraph
table T0, so it comes Tt
- p. 12 Section 4.3
table T0, so it comes Tt.
- p. 12 4.3 Temporal attack
so it comes Tt
Judge's note: The page 12 image shows 'comes'.
Second check: none (judge only)