7. The De-identification Toolbox
After this video you can
- Apply nine disclosure limitation techniques
- Compute k-anonymity, l-diversity, t-closeness
- Work the Laplace mechanism with numbers
- Quantify the utility you spend
Module 3: Statistical Foundations · Runtime 48:53 · YouTube title: De-identification Tools: k-Anonymity to Differential Privacy
Risk you can measure, you can lower. Nine statistical disclosure limitation techniques worked on Springfield, then the formal models built from attacks: k-anonymity, l-diversity, t-closeness, and differential privacy with the Laplace mechanism computed by hand. Every transformation charges a utility cost, and this video measures it.
In this video
- Nine instruments: suppression, generalization, top-coding, date shifting, noise, microaggregation, swapping, sampling, synthesis
- Each worked on Springfield with the utility cost measured (mean age 42.6 raw, 36.9 after suppressing one record)
- The suppression budget
- k-anonymity computed on Springfield: raw k = 1, k = 2 after generalization and one suppression
- Homogeneity and background-knowledge attacks, l-diversity and why the variant matters, skewness and similarity
- t-closeness and Earth Mover's Distance, computed
- Database reconstruction and why the 2020 Census adopted differential privacy
- Epsilon, the Laplace mechanism worked, and where differential privacy honestly fits for microdata
- One concept, four vocabularies: HIPAA, GDPR, ISO 25237, ISO/IEC 20889
Authorities quoted on screen
45 CFR §164.514(b); GDPR Recital 26 and Article 4(5); ISO 25237; ISO/IEC 20889; ISO/IEC 27559. Models attributed to Sweeney (2002), Li et al. (2007), and Dinur and Nissim (2003).
Worked example
Springfield. Payer distribution 0.556 / 0.333 / 0.111; worst-class EMD 0.389, so the table passes t = 0.4 and fails t = 0.2. Laplace on a count query at ε = 1: scale b = 1, standard deviation 1.41.
Key takeaways
- Nine SDL tools each spend a different kind of utility, and you must measure which.
- The formal models are a ladder built from attacks, and each rung costs more utility.
- Differential privacy bounds influence, scales with n, and does not natively produce truthful microdata.
Coming next: Video 8, Thinking Like the Adversary
You cannot measure re-identification risk until you name the adversary. The risk equation, overall risk = P(attempt) × P(success | attempt), is introduced and then actually multiplied out. Prosecutor, journalist, and marketer risk are each computed, population class sizes are estimated responsibly, and real attack scenarios are mapped onto the right model.
Saved in your browser only — no account, no server.