How it works, and what it cannot tell you

kanon groups the records of a table by the columns an outsider might already know, then measures how small and how uniform those groups are. These are the standard measures from the privacy literature. They tell you a lot about one kind of risk and nothing about several others.

1. Quasi-identifiers and equivalence classes

Removing names and ID numbers does not make a table anonymous. Ordinary attributes such as age, postcode and sex are each harmless, but together they often point at one person. Sweeney called such combinations quasi-identifiers, and showed that a hospital discharge file with no names could be linked to a public voter list on ZIP code, birth date and sex, re-identifying a state governor's medical records. Her estimate was that those three attributes alone were likely to single out about 87% of the US population (Sweeney 2000, cited in Sweeney 2002).

What counts as a quasi-identifier depends on who might attack the data and what else they hold. That choice is yours, not the tool's: kanon suggests columns whose names look like the usual suspects (age, birth date, postcode, sex, nationality, dates), and every number on the results page is only as good as that choice.

Records that share the same values on every quasi-identifier form an equivalence class. If you know a person's quasi-identifier values, you can narrow them down to their class but no further.

2. k-anonymity

A table is k-anonymous when every equivalence class holds at least k records, so each person hides among at least k−1 others with the same visible attributes (Sweeney 2002). kanon reports k as the size of the smallest class. It also reports how many records are unique (a class of one), and the share of records in classes smaller than 2, 5 and 10. k on its own is a worst case; those shares show how widespread the problem is.

3. l-diversity

k-anonymity protects against which row is yours, not against what your row says. Machanavajjhala and colleagues (2007) described two attacks on a k-anonymous table:

• Homogeneity. If everyone in a class has the same sensitive value, knowing someone is in the class reveals it. In their 4-anonymous example, all four people in their thirties from the 130** area have cancer.
• Background knowledge. If a class holds only a few sensitive values, outside knowledge can rule some out. Their first class holds only heart disease and viral infection; knowing that heart disease is rare in a particular person's group leaves one answer.

A class is distinct l-diverse when it contains at least l different sensitive values. Entropy l-diversity is stricter: the class's sensitive values must be spread evenly enough that their entropy is at least log(l). kanon reports both as the worst class: the smallest number of distinct values, and the smallest value of exp(entropy), which you can read as the number of equally likely values the class is worth. It also counts the records that sit in classes with a single sensitive value.

On the paper's 3-diverse table (Figure 3) kanon reports k = 4, distinct l = 3 and entropy l = 2.83: each class has one value twice and two values once, which is worth less than three equally likely values.

4. t-closeness

l-diversity still leaks when the different values are similar, or when a class's mix is very different from the population's. Li, Li and Venkatasubramanian (2007) give a 3-diverse table in which one class has salaries of 3k, 4k and 5k and only stomach diseases: three distinct values, yet an attacker learns that the person is low-paid and has a stomach condition.

t-closeness asks that the distribution of the sensitive attribute in every class be within distance t of its distribution in the whole table. The distance is the Earth Mover's Distance: the least amount of probability mass that must be moved, times how far it moves, to turn one distribution into the other. For categories every move costs the same (equal distance); for numbers a move between neighbouring values costs less than a move across the range (ordered distance). kanon reports the largest distance over all classes. In the paper's example the low-salary class is 0.375 away from the whole table; after re-grouping, no class is more than 0.167 away. kanon reproduces both numbers.

There is no agreed safe value of t. Smaller is closer to the overall distribution, so less is learned from class membership, but also less of the relationship between quasi-identifiers and the sensitive attribute survives for analysis.

5. Prosecutor, journalist and marketer risk

These three re-identification risk measures describe three attackers (El Emam & Dankar 2008). kanon computes them the way the open-source ARX tool does (Prasser et al. 2020). A record in a class of size f has a 1/f chance of being matched correctly by someone who knows its quasi-identifiers.

• Prosecutor: knows the target is in this file. Highest risk is 1/k. Records at risk is the share of records whose 1/f exceeds the threshold you choose (20% by default, meaning classes smaller than 5). Average is the number of classes divided by the number of records.
• Journalist: knows the target is in some larger population the file was drawn from. Class sizes are then counted in the population. If the file is the whole population, journalist risk equals prosecutor risk. If only some rows will be published, mark them with a column (More options on the main page), and the rest of the file serves as the population.
• Marketer: wants to re-identify as many people as possible rather than one in particular. The measure is the expected share of records matched correctly: the average of f/F over records, where F is the population class size. Without a population it equals the prosecutor average.

The colours mark the chosen threshold: red where some records exceed it, amber where classes are within twice the threshold size, green beyond that. Green means "lower", not "safe".

6. Generalisation and suppression

The usual way to raise k is to make values coarser (generalisation) or withhold some of them (suppression). kanon offers the common ones and recomputes after each change:

• Bands for numbers: age 37 becomes 30–39 with bands of 10.
• Keep the first N characters for codes such as postcodes: 13053 becomes 130** with N = 3. Every value is padded to the column's full width, so values of different length do not stay apart.
• Month or year for dates.
• Rare values: values seen fewer than N times in a column become *.
• Record suppression: rows in classes smaller than a chosen size are withheld from the analysis and from the export, or kept with every quasi-identifier set to *.

Each step costs information. Bands of 10 hide age effects inside the band; dropping rare values removes exactly the small groups that some studies need. ARX and similar tools search for the generalisation that loses the least; kanon only lets you try them by hand and see the effect.

7. Limits, and GDPR

A k value is not a guarantee. It is a statement about one table, one choice of quasi-identifiers and one kind of attack.

• The quasi-identifier choice decides everything. If an attacker knows one more attribute than you marked, the classes they see are smaller than the ones measured here.
• Sample uniqueness is not population uniqueness. A record unique in your file may not be unique in the world, and a record in a class of five may still be unique in the population. Rocher, Hendrickx and de Montjoye (2019) estimated that 99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes, and showed that releasing only a small sample does little to prevent it.
• Several releases combine. Two tables, each k-anonymous, can be intersected to pin people down (Ganta, Kasiviswanathan & Smith 2008). Measures here look at one table at a time.
• Inference remains. Even with high k, l and small t, an aggregate pattern can reveal something about every member of a group. That is a property of the data, not a flaw in the generalisation.
• Many attributes make generalisation destructive. With many quasi-identifiers almost every record is unique, and reaching k = 5 can mean suppressing most of the detail.
• Other guarantees exist. Differential privacy (Dwork 2006) bounds what any output reveals about any one person, whatever the attacker knows. It is a different tool for a different job, typically for statistics rather than record-level releases.

Under the GDPR, data are anonymous only when a person is no longer identifiable by any means reasonably likely to be used, by the controller or by anyone else, taking into account cost, time and available technology (Recital 26). Pseudonymised data, such as a table with names replaced by codes, are still personal data. The Article 29 Working Party's Opinion 05/2014 on anonymisation techniques (WP216) asks three questions of any technique: can a person still be singled out, can records be linked across datasets, and can information about a person be inferred? Its assessment is that k-anonymity prevents singling out but leaves linkability and inference risks, that l-diversity and t-closeness reduce the inference risk, and that linkability remains a risk for all three.

An anonymisation decision therefore needs more than this page: a documented assessment of who could attack and with what, the context of the release (public, contract-bound, enclave), the residual risk you accept and why, a review when circumstances change, and usually your data protection officer's or a lawyer's view. kanon gives you numbers for one part of that assessment. It is not legal advice.

8. How the numbers are computed

For n records in classes of size f₁ … f_c (after suppression), with population sizes F_j (equal to f_j without a population), and a sensitive attribute whose overall distribution is Q:

Q is the distribution of the sensitive attribute over all released rows before record suppression. Blank cells are treated as a value of their own. The risk formulas follow ARX's RiskModelSampleSummary; the t-closeness formulas follow Li et al. (2007), section 4. Everything runs in a Web Worker in your browser: the file is dictionary-encoded once, each generalisation is applied once per distinct value, and classes are found with an integer hash, which is why 200,000 rows take well under a second to analyse.

9. How it was checked

The engine the page uses (kanon.js) is tested against things that are not itself:

• The papers' worked examples. Sweeney's Figure 2 gives k = 2. The l-diversity paper's Figure 1 gives k = 1 with every record unique; Figure 2 gives k = 4 with l = 1 (homogeneity), and its first class holds only two conditions (background knowledge); Figure 3 gives k = 4 and l = 3. Generalising Figure 1 with the page's own controls reproduces Figure 3's postcodes exactly. The t-closeness paper's distances of 0.375 and 0.167 are reproduced, as are its Table 4 (3-diverse, 0.375) and Table 5 (0.167-close), which is also reached from its Table 3 with the page's controls.
• ARX 3.9.1 on the UCI Adult data (32,561 records; Becker & Kohavi 1996). For 11 combinations of quasi-identifiers, generalisations, record suppression and a released subset, ARX's equivalence-class histogram, uniqueness and prosecutor, journalist and marketer risk agree with kanon to within 10⁻⁹. ARX's own privacy-model checks confirm every boundary: the table satisfies k-anonymity, distinct and entropy l-diversity and t-closeness at the values kanon reports, and fails just beyond them.
• An independent pandas implementation, written separately, which also generalises the raw data itself and finds the exported file identical, cell for cell.

Seven of the eleven configurations; the full set, with journalist and marketer risk for a 20% released sample, is in the test results of the source.

10. What this page sends

Your file is read with the browser's File API into a Web Worker in this tab. Nothing from it is uploaded, stored on a server or sent to a third party; there is no server-side code. The page loads its own scripts and styles and two fonts from Google Fonts. It sends three one-word usage signals, load, analyse and export, at most once each per visit, to count how often the tool is used. They carry no data from your file. The built-in sample is synthetic: a script generated every row, and it describes no real people.

11. References

1. Sweeney L. k-anonymity: a model for protecting privacy. International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems. 2002;10(5):557–570. doi:10.1142/S0218488502001648
2. Sweeney L. Simple demographics often identify people uniquely. Carnegie Mellon University, Data Privacy Working Paper 3, 2000.
3. Machanavajjhala A, Kifer D, Gehrke J, Venkitasubramaniam M. l-diversity: Privacy beyond k-anonymity. ACM Transactions on Knowledge Discovery from Data. 2007;1(1):3. doi:10.1145/1217299.1217302
4. Li N, Li T, Venkatasubramanian S. t-Closeness: Privacy beyond k-anonymity and l-diversity. IEEE 23rd International Conference on Data Engineering (ICDE). 2007:106–115. doi:10.1109/ICDE.2007.367856
5. El Emam K, Dankar FK. Protecting privacy using k-anonymity. Journal of the American Medical Informatics Association. 2008;15(5):627–637. doi:10.1197/jamia.M2716
6. Prasser F, Eicher J, Spengler H, Bild R, Kuhn KA. Flexible data anonymization using ARX—Current status and challenges ahead. Software: Practice and Experience. 2020;50(7):1277–1304. doi:10.1002/spe.2812. Source: github.com/arx-deidentifier/arx
7. Prasser F, Kohlmayer F. Putting statistical disclosure control into practice: the ARX data anonymization tool. In: Medical Data Privacy Handbook. Springer; 2015:111–148. doi:10.1007/978-3-319-23633-9_6
8. Rocher L, Hendrickx JM, de Montjoye YA. Estimating the success of re-identifications in incomplete datasets using generative models. Nature Communications. 2019;10:3069. doi:10.1038/s41467-019-10933-3
9. Ganta SR, Kasiviswanathan SP, Smith A. Composition attacks and auxiliary information in data privacy. Proceedings of the 14th ACM SIGKDD. 2008:265–273. doi:10.1145/1401890.1401926
10. Dwork C. Differential privacy. ICALP 2006, Lecture Notes in Computer Science 4052:1–12. doi:10.1007/11787006_1
11. Regulation (EU) 2016/679 (General Data Protection Regulation), Recital 26 and Article 4(5). eur-lex.europa.eu/eli/reg/2016/679/oj
12. Article 29 Data Protection Working Party. Opinion 05/2014 on Anonymisation Techniques (WP216), adopted 10 April 2014.
13. Becker B, Kohavi R. Adult [dataset]. UCI Machine Learning Repository, 1996. CC BY 4.0. doi:10.24432/C5XW20