Privacy Models Reference

Formal privacy model specifications, parameter guidance, and selection criteria. Slim, lookup-focused counterpart to Module 04. Use this when selecting a model, choosing parameters, or explaining guarantees to a client.

Abbreviations used throughout: DDM = dynamic data masking; ARX = open-source structural anonymization tool; CDR = Call Detail Record; DP = differential privacy.

For the underlying techniques, see the techniques reference. For model-to-zone mapping, see architecture patterns. For ARX and Privacy on Beam implementation, see tooling.

Decision tree: which model do I need?

---

Model comparison

Model	Protects against	Mechanism	Key parameter	Primary use case	Main limitation
k-anonymity	Identity disclosure (singling out)	Generalization + suppression	k (min group size)	Record-level datasets	No attribute disclosure protection
l-diversity	Attribute disclosure (homogeneity)	Diverse sensitive values per group	l (min distinct values)	Datasets with sensitive attributes	Fails for low-cardinality / similar values
t-closeness	Attribute inference (distribution skew)	Distribution similarity per group	t (max EMD distance)	Highly regulated contexts	Severe utility loss; hard to parameterize
Differential privacy	Any inference from output	Calibrated noise	ε (budget), δ (failure prob)	Aggregates, external sharing, ML	Budget management; small-group utility loss

Production layering pattern

Data zone	Privacy model	Consumer
Raw zone	None (access-controlled)	ETL pipelines only
Pseudonymized zone	Access controls + DDM	Internal analysts with roles
Anonymized zone (Zone 2)	k-anonymity (k ≥ 50) ± l-diversity	Internal analytics, broad
External sharing (Zone 3)	Differential privacy	Partners, regulators, public

---

k-anonymity

Definition: A dataset satisfies k-anonymity if, for every combination of quasi-identifier values present in the dataset, at least k records share that combination. Every record is indistinguishable from at least k−1 others on all QI fields.

Parameter guidance

Context	Typical k	Rationale
Internal analytics with access controls	5–10	Insiders have limited re-ID motivation/capability
Shared with trusted partners under contract	20–50	Partner has domain knowledge
Published externally or open research	50–100+	Unknown attacker capability; assume auxiliary datasets
Location / mobility data (including CDRs)	100+	Spatio-temporal data structurally resistant (4 points → 95%); overrides lower k values when CDR/mobility data is released externally

Suppression limit: typically 1–5% of records.

Guarantees and limitations

Guarantees	Limitations
Prevents singling out — attacker who knows a target's QI values can narrow to a group of ≥ k	No attribute disclosure protection. Homogeneity attack: if all k records share the same sensitive value, attacker learns it with certainty.
	Background knowledge attack: external info can eliminate possibilities within the equivalence class.
	Joining with auxiliary data CAN destroy the guarantee.

Implementation

• Tool: ARX (optimization over generalization hierarchies)
• Requires: Generalization hierarchies per QI field, designated QI set (modeling decision), suppression limit parameter

---

l-diversity

Definition: A dataset satisfies l-diversity if every equivalence class (defined by QIs) contains at least l distinct, well-represented values for each designated sensitive attribute.

Variants

Variant	Requirement	When to use
Distinct (basic)	l distinct values present	Minimum viable; weakest
Entropy (recommended default)	Values evenly distributed, not just present	Default — prevents skewed groups
Recursive (c,l)-diversity	Strongest distribution requirement	High-sensitivity attributes

Guarantees and limitations

Guarantees	Limitations
Protects against attribute disclosure (homogeneity attack). Knowing someone's group reveals little about their specific sensitive value.	Fails for low-cardinality attributes: binary (churned/not) achieves at most l=2.
	Similarity attack: "stomach cancer, liver cancer, pancreatic cancer" passes l=3 but reveals "has cancer" with certainty.
	Multiple sensitive attributes: achieving l-diversity for each simultaneously requires extreme generalization on smaller datasets.

Implementation

• Tool: ARX (supports all three variants)
• Always paired with: k-anonymity (l-diversity addresses k-anonymity's weakness)

---

t-closeness

Definition: A dataset satisfies t-closeness if the distribution of sensitive attribute values within each equivalence class is within distance t of the distribution in the overall dataset, measured by Earth Mover's Distance (EMD / Wasserstein distance).

Parameter guidance

No intuitive "safe" value — t is a distribution distance metric. Requires understanding the distribution shape and attribute semantics. In practice, most production systems skip t-closeness in favor of k-anonymity + DP.

Guarantees and limitations

Guarantees	Limitations
Bounds attribute inference via distribution skew. Knowing which group someone belongs to reveals at most t additional information (measured by EMD) beyond what overall population statistics reveal. At t=0 the guarantee is perfect; in practice t > 0 allows bounded leakage.	Severe utility loss — forcing every group's distribution close to the overall requires aggressive generalization.
	Hard to parameterize — t lacks intuitive meaning.
	Degenerates when 99%+ of records share one value.
	Computationally expensive.

Implementation

• Tool: ARX
• Practical recommendation: Consider k-anonymity + l-diversity + DP instead. t-closeness is rarely used in production.

---

Differential privacy

Definition: A mechanism M satisfies (ε, δ)-differential privacy if for any two datasets D and D' differing by exactly one record, and for any set of outputs S: P[M(D) ∈ S] ≤ e^ε · P[M(D') ∈ S] + δ. Adding or removing any single person's data changes the probability of any output by at most a controlled amount.

Privacy unit matters: The formal definition says "one record," but person-level privacy requires defining the adjacency at user level — one person may contribute many records (CDRs, transactions, meter readings). In BigQuery, set privacy_unit_column to the user identifier so DP accounts for all of a person's records, not just one row.

Parameter guidance

Parameter	Role	Guidance
ε (epsilon)	Privacy dial — smaller = more noise = stronger privacy	0.1–1.0: strong (Google RAPPOR). 1.0–3.0: moderate (enterprise default start). 4.0–8.0: weaker (Apple local DP). 10+: effectively none.
δ (delta)	Failure probability	Set much smaller than 1/n (dataset size), e.g., 10⁻⁷ for 1M records. Set once, rarely revisit.

ε = 1.0 is a reasonable starting point for a single query.

Guarantees and limitations

Guarantees	Limitations
No analyst can reliably determine whether any specific individual was in the input data.	Budget management: every query consumes budget. Finite queries before guarantee degrades.
Post-processing immunity: any computation on DP output preserves the guarantee.	Utility loss for small groups: noise overwhelms signal when group sizes are small.
Unlike k-anonymity, joining DP output with other data cannot destroy privacy.	Individual-level queries: DP doesn't help when the answer is inherently about one person.
	Requires careful sensitivity calibration per query type.

Composition rules

Rule	Formula	When it applies
Sequential (basic)	k queries with ε₁...εₖ → total = Σεᵢ	Same data, sequential queries
Advanced	k identical queries each with ε → total grows as O(ε√k)	Tighter bound for many identical queries
Parallel	Queries on disjoint data subsets → budgets independent — but subsets must be disjoint by privacy unit, not just by row. A subscriber appearing in multiple cell tower districts means those partitions are NOT disjoint for that subscriber.	Partitioned data where each person falls in exactly one partition (e.g., per-region aggregates by account region)
Rényi DP (RDP)	Tighter bounds via Rényi divergence	Unlocks 20–40% more queries for same total ε

Noise mechanisms

Mechanism	Best for	DP type
Laplace	Counting, sums, histograms	Pure ε-DP (δ=0)
Gaussian	Multi-dimensional queries, ML training (DP-SGD)	(ε,δ)-DP, tighter composition
Exponential	Mode, ranking, categorical outputs	Pure ε-DP

Central vs. local DP

Model	Who adds noise	When to use
Central DP	Trusted curator on query outputs	Data warehouse analytics, partner exports — almost always the Aliz model
Local DP	Each data source before sending	Collecting from end-user devices, IoT, federated learning

Implementation

Tool	Use case
BigQuery DIFFERENTIAL_PRIVACY clause	Query-time DP on aggregates
Privacy on Beam / PipelineDP	Batch pipeline DP
Google Privacy Loss Distribution tool	Budget tracking
OpenDP (Rust/Python)	Custom DP pipelines
DP-SGD	ML training (Gaussian mechanism on gradients)

---

When formal models are essential vs. overkill

Essential	Typically overkill
Data leaves the organization	Data stays within controlled environment with access controls + audit
Contractual/regulatory requirement for "anonymized" with defensible definition	Dev/test environments (static masking or synthetic data sufficient)
High-sensitivity data (location, health, financial)	Operational lookups (pseudonymization + access controls)
Data will be linked with external datasets by consumer	Ephemeral analysis producing aggregates then deleted

Practical test: "If the data were breached or misused by the consumer, would the absence of a formal guarantee be a defensible position?"