Attacker-Model Re-identification Risk Measurement

Description

Attacker-model re-identification risk measurement estimates, for a table of real records about people that is about to be released or shared, the probability that an attacker who links it with other information could correctly match a record to the person it describes. This record follows the attacker models of El Emam and Dankar (prosecutor and journalist) and of Dankar and El Emam (marketer), as implemented in the ARX tool: the assessor lists the quasi-identifiers (columns such as age, sex, postcode and admission date that an attacker could know or find), groups the records that share the same values on them, and names the attacker being guarded against. For a prosecutor, who knows the target is in the table, a record's risk is one over the size of its group in the table; for a journalist, who does not know this and links to a register of the wider population, it is one over the size of the matching group in that population, estimated with a statistical model when the population counts are not known; for a marketer, who tries to match as many records as possible, the measure is the expected share of records matched correctly. The assessor reports the highest record risk, the average risk and the share of records above a threshold set for the release, which decides whether the table can go out as it is or needs more generalisation or suppression first. It measures how easily records can be matched to people under the stated assumptions, unlike k-anonymity, which transforms the data, and it does not measure what can be learned about someone from values their whole group shares.

Example Use Cases

Privacy

A health insurer releasing claims data for a public prediction competition assumes an attacker who knows a neighbour's age, sex and a few of their claims, and measures each record's risk as one over the size of its group among all the insurer's members. It generalises ages and procedure codes until the measured probability of re-identification is below the 0.05 threshold agreed for the release, then checks the result with simulated matching attacks.

A pharmaceutical company sharing participant-level data from a completed trial with external researchers measures risk against the wider population, not the trial sample, because the participants are a small sample of everyone with the condition. It estimates how many records are unique in that population with ARX's uniqueness models and records the quasi-identifiers, attacker model, estimator and threshold in the data-sharing agreement for the researchers' data access committee to review.

A city transport authority planning to give a commuting dataset of home district, work district, age band and usual travel times to a contractor training a demand-forecasting model runs the assessment, finds a large share of records unique on home and work district together, merges small districts before sharing, and re-runs the assessment to confirm that the share of records above its threshold has fallen below the agreed limit.

Limitations

The numbers are only as good as the list of quasi-identifiers and the attacker model behind them. A column left off the list, or an attacker who knows more (several of a person's hospital visits rather than one), can make records far easier to match than the assessment reports, and the assessor has to guess what other data an attacker holds. Repeating the assessment for stronger attackers, as some releases do with simulated matching, shows how sensitive the result is to these guesses.
It measures the chance of finding which record is a person's, not what can be learned about them. If all 20 records in a group share the same diagnosis, each has a measured risk of 1 in 20, yet anyone known to belong to the group has their diagnosis disclosed. Checks on the sensitive values, such as l-diversity, are needed alongside it when the release contains sensitive columns.
The journalist measure needs to know how common each record's values are in the wider population, which is rarely known and is estimated from the sample with statistical models; an evaluation of four estimators of population uniqueness on six clinical datasets found none accurate in all conditions. A small sample does not make re-identification unlikely in itself: one study estimated that 15 demographic attributes would let 99.98 per cent of Americans be correctly re-identified in any dataset.
There is no universal threshold, and the measure chosen changes the answer. For the same records the prosecutor measure is always at least as high as the journalist measure, so applying it to a release that is a small sample of a population over-protects and strips detail the data's users need; El Emam and Dankar found this effect strongest at small sampling fractions. The threshold, and which measure it applies to, must be justified for each release.
It measures one table as released, at one time. An attacker can combine several releases of the same data, or successive versions of a table that is updated, and longitudinal data, where each person has many events, need the attacker's knowledge of several events to be modelled explicitly. The basic measures do neither, so each additional or updated release needs its own assessment that takes the earlier ones into account.

Resources

Research Papers

Protecting Privacy Using k-Anonymity

Khaled El Emam and Fida Kamal Dankar•Sep 1, 2008

Estimating the re-identification risk of clinical data sets

Fida Kamal Dankar et al.•Jul 9, 2012

A method for evaluating marketer re-identification risk

Fida Kamal Dankar and Khaled El Emam•Mar 22, 2010

Software Packages

ARX Data Anonymization Tool (arx-deidentifier/arx)

ARX is a comprehensive open source data anonymization tool aiming to provide scalability and usability. It supports various anonymization techniques, methods for analyzing data quality and re-ident...

Tutorials

Measuring Risk — Statistical Disclosure Control for Microdata: A Practice Guide for sdcMicro

Documentations

Risk analysis – ARX – Data Anonymization Tool

Related Techniques

Name	Description	Assurance Goals
k-Anonymity	k-Anonymity is a property that a table of real records about people can be made to satisfy before it is released or shared, in which every record shares its values on the quasi-identifiers with at least k-1 other records, so anyone linking the table to another source on those columns always matches a group of at least k records, which is k people only when each person has one record. Quasi-identifiers are columns that are not names or ID numbers but could be found elsewhere and combined to single a person out, such as date of birth, sex and postcode, and because the data holder chooses them, the protection covers only those columns. To reach a chosen k, each quasi-identifier is coarsened along a hierarchy set in advance (exact age to five-year band, full postcode to district), and the values or records that would still sit in a group smaller than k are suppressed, with a search choosing the coarsening that loses least information. The output is the transformed table of real records made less specific, not artificial ones, together with the k it achieves and a measure of the detail lost. Unlike differential privacy, it gives no bound on what an observer can learn, because it blocks linking on the listed columns but does not stop someone learning a sensitive value that everyone in a group shares.	Privacy
Synthetic Data Evaluation	Synthetic data evaluation checks whether an artificial dataset made to stand in for sensitive real records is safe to share and still useful, and reports the trade-off between the two. Privacy is tested by simulating an attacker who holds the synthetic data and some facts about a person, and measuring how accurately the attacker can use the data to infer that person's sensitive values. Fidelity is tested by comparing the synthetic and real data column by column and in pairs of columns. Another check trains a classifier to tell the two apart, and a classifier that cannot beat chance suggests they are statistically alike. Utility is tested by running the analyses or training the models the data is meant for on the synthetic data and comparing the results with those from the real data.	Privacy Reliability
Membership Inference Attack Testing	Membership inference attack testing checks whether someone with access to a trained model can tell if a particular record was in its training data. The tester plays the attacker, using the model's confidence scores, its prediction patterns or its loss on a record, often with shadow models, which are copies trained on similar data whose members are known. The attack is scored on records known to be members and records known to be non-members, which the tester must keep apart. The key result is the share of true members the attack identifies when it wrongly flags only a tiny share of non-members (for example 0.1%), because overall accuracy can hide an attack that identifies a few records with near certainty. The results guide the choice of mitigations, such as differential privacy or regularisation.	Privacy Security