k-anonymity and its limits against linkage attacks
anonymization fundamentals.
define k-anonymity via indistinguishable quasi-identifier groups, apply generalization and suppression, then show homogeneity or linkage attacks break it.
What's really being asked
This checks whether you know a foundational anonymization technique, can apply it concretely, and critically understand why it is necessary but not sufficient, which leads to its successors.
The full answer
Define k-anonymity: a released dataset is k-anonymous if every record is indistinguishable from at least k minus one other records with respect to the quasi-identifiers, the attributes that are not unique alone but together can re-identify someone, such as zip code, age, and gender. To apply it to patient records, you transform the quasi-identifiers so that records fall into equivalence groups of size at least k. Use generalization, for example truncating a five-digit zip to its first three digits and bucketing exact age into ranges like thirty to forty, and use suppression to drop or mask rare outlier records that cannot be grouped. The diagnosis is the sensitive attribute you want to protect, not a quasi-identifier. Then explain the limits. The homogeneity attack: if all k records in a group share the same diagnosis, knowing someone is in that group reveals their diagnosis even though k-anonymity holds. The background-knowledge attack: an attacker who knows extra facts about the target can rule out group members and link them to a record. These gaps motivate l-diversity, which requires diverse sensitive values per group, and t-closeness, which constrains the sensitive-value distribution.
The mistakes people make
Treating k-anonymity as a complete privacy guarantee. Generalizing the sensitive attribute instead of the quasi-identifiers. Ignoring suppression of outliers, leaving unique records. Not naming any concrete attack that defeats it.
What usually comes next
How do l-diversity and t-closeness address these attacks? How do you choose k? How does differential privacy differ fundamentally?
A concrete example
You set k equal to five, generalize zips to three digits and age to ten-year bands, and suppress two unique records. A group of five patients all share zip 021, age 40 to 50. But if all five carry the diagnosis HIV, an attacker who knows their neighbor is a forty-five-year-old in that zip immediately learns the diagnosis, a homogeneity attack that k-anonymity alone cannot stop.
Interview question
A patient dataset is properly 5-anonymous on quasi-identifiers, yet an attacker still learns a target's diagnosis. What weakness most likely enabled this?
- a.The dataset had fewer than five total records
- b.Quasi-identifiers were generalized too aggressively
- c.All records in the target's equivalence group share the same diagnosisCorrect
- d.The diagnosis column was deleted entirely
Why? this is the answer
This is the homogeneity attack: k-anonymity hides which record is the target but not the sensitive value if every record in the group shares it. l-diversity addresses this. Over-generalization and deleting the diagnosis would not leak it.
Just read this? Test yourself on what you have been reading.
Read the original → en.wikipedia.org
- #k-anonymity
- #data-privacy
- #anonymization
- #linkage-attack
- #l-diversity
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles