Microaggregation is a technique for disclosure limitation aimed at protecting the privacy of data subjects in microdata releases. It has been used as an alternative to generalization and suppression to generate @math -anonymous data sets, where the identity of each subject is hidden within a group of @math subjects. Unlike generalization, microaggregation perturbs the data and this additional masking freedom allows improving data utility in several ways, such as increasing data granularity, reducing the impact of outliers, and avoiding discretization of numerical data. @math -Anonymity, on the other side, does not protect against attribute disclosure, which occurs if the variability of the confidential values in a group of @math subjects is too small. To address this issue, several refinements of @math -anonymity have been proposed, among which @math -closeness stands out as providing one of the strictest privacy guarantees. Existing algorithms to generate @math -close data sets are based on generalization and suppression (they are extensions of @math -anonymization algorithms based on the same principles). This paper proposes and shows how to use microaggregation to generate @math -anonymous @math -close data sets. The advantages of microaggregation are analyzed, and then several microaggregation algorithms for @math -anonymous @math -closeness are presented and empirically evaluated.
@cite_21 an approach to attain @math -closeness-like privacy is proposed which, unlike the methods based on generalization suppression, is perturbative. Also, @cite_21 guarantees the threshold @math only on average and uses a distance other than EMD. Another computational approach to @math -closeness is presented in @cite_0 @cite_25 which aims at connecting @math -closeness and differential privacy; @cite_0 @cite_25 also use a distance different from EMD but their method is non-perturbative (the truthfulness of the data is preserved).
@cite_0 @cite_21 @cite_25
1967525428 2147324825 2045134072
k-anonymity and e-differential privacy are two mainstream privacy models, the former introduced to anonymize data sets and the latter to limit the knowledge gain that results from including one individual in the data set. Whereas basic k-anonymity only protects against identity disclosure, t-closeness was presented as an extension of k-anonymity that also protects against attribute disclosure. We show here that, if not quite equivalent, t-closeness and e-differential privacy are strongly related to one another when it comes to anonymizing data sets. Specifically, k-anonymity for the quasi-identifiers combined with e-differential privacy for the confidential attributes yields stochastic t-closeness (an extension of t-closeness), with t a function of k and e. Conversely, t-closeness can yield e-differential privacy when t=exp(e 2) and the assumptions made by t-closeness about the prior and posterior views of the data hold. t-Closeness is a privacy model recently defined for data anonymization. A data set is said to satisfy t-closeness if, for each group of records sharing a combination of key attributes, the distance between the distribution of a confidential attribute in the group and the distribution of the attribute in the entire data set is no more than a threshold t. Here, we define a privacy measure in terms of information theory, similar to t-closeness. Then, we use the tools of that theory to show that our privacy measure can be achieved by the postrandomization method (PRAM) for masking in the discrete case, and by a form of noise addition in the general case. k-Anonymity and e-differential privacy are two main privacy models proposed within the computer science community. Whereas the former was proposed for privacy-preserving data publishing, i.e. data set anonymization, the latter initially arose in the context of interactive databases and was later extended to data publishing. We show here that t-closeness, one of the extensions of k-anonymity, can actually yielde-differential privacy in data publishing when t =exp(e). We detail a construction based on bucketization that realizes the previous implication; hence, as an ancillary result, we provide a new computational procedure to achieve t-closeness and e-differential privacy in data publishing.