# L-Diversity

K-anonymity is not enough!

Homogeneity attack

* The attacker knows the generalized Quase-Identificiers of a target
* A query reveals the exact same sensitive attributes
* The attacker gets the sensitive attribute of the target
* Issue: lack of diversity in the results

Background knowledge attack

* The attacker can filter out query results using known information

## Solution

### l-diverse k-anonymity

Results from a k-anonymity result of a query must contain l different values for each sensitive attribute

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2FtSr77g5D4mi5omrv0kfv%2F2024-06-18_16-00.png?alt=media&#x26;token=f75c3842-9d55-402d-b75f-5cd12a71e015" alt=""><figcaption></figcaption></figure>

## l-diversity

### 2-anonymity 1-diversity results

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2F5Jkn1xqjMO7CaH3FoSdl%2F2024-06-18_16-01.png?alt=media&#x26;token=03a44f54-d1a5-4488-ab51-025ca5e659af" alt=""><figcaption></figcaption></figure>

### 2-anonymity 2-diversity results

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2FbkIK2rSC4ptd0dctXH7a%2F2024-06-18_16-01_1.png?alt=media&#x26;token=c10b4e07-f084-41f1-9142-d70d97ad04da" alt=""><figcaption></figcaption></figure>

## k-anonymity and l-diversity have flaws

k-anonymity: each equivalence class has at least k records to protect against identity disclosure.

* k-anonymity is vulnerable to homogeneity attacks and background knowledge attacks.

### Attacks on k-anonymity

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2FX4My5ms3PASWgSIIhRgW%2Fimage.png?alt=media&#x26;token=4e98b3a2-e01f-4734-9319-d5715f23fa13" alt=""><figcaption></figcaption></figure>

Homogeneity attack

* Bob is a 27-year old man living in zip code 47678 and Bob’s record is in the table.
* So Bob corresponds to one of the first three records and must have heart disease.

Background knowledge attack

* Carl is a 32-year old man living in zip code 47622. Therefore he is in the last equivalence class in Table 2.
* If you know that Carl has a low risk for heart disease then you can conclude that Carl probably has cancer.

l-diversity: distribution of a sensitive attribute in each equivalence class has at least l “well represented” values to protect against attribute disclosure.

l-diversity is vulnerable to skewness attacks and similarity attacks.

* Skewness: keeping diverse groups may change statistical properties
* Similarity: similar concepts are not handled

### Attacks on l-diversity

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2FMfZ5fAPaGnbYyzGrJzck%2Fimage.png?alt=media&#x26;token=152a0510-f89e-479a-85f9-62c57ac767d5" alt=""><figcaption></figcaption></figure>

Similarity Attack:

* Table 4 anonymizes table 3. Its sensitive attributes are Salary and Disease.
* If you know Bob has a low salary (3k-5k) then you know that he has a stomach related disease.
* This is because l-diversity takes into account the diversity of sensitive values in the group, but does not take into account the semantical closeness of the values.

<figure><img src="https://3490214077-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FAHT7avzIVwxfPJ4pkhhO%2Fuploads%2FtDyVHrMzh8gJ0xQPBKp9%2Fimage.png?alt=media&#x26;token=157bc8fb-5e8c-4648-819a-9714534b8891" alt=""><figcaption></figcaption></figure>

10,000 records about a virus that affects 1% of the population.

Skewness attack: with 2-diversity we have an equal number of positive and negative records.

This gives everyone in this equivalence class a 50% chance of having the virus, which is much higher than the real distribution.
