SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
\begin{array}{l} \Pr \left(\llbracket a _ {\langle 1 \rangle} ^ {1} \rrbracket , \dots , \llbracket a _ {\langle i \rangle} ^ {1} \rrbracket , \llbracket a _ {\langle i + 1 \rangle} ^ {1} \rrbracket | (a _ {\langle 1 \rangle} ^ {1}, y _ {\langle 1 \rangle}), \dots , (a _ {\langle i \rangle} ^ {1}, y _ {\langle i \rangle}), (a _ {\langle i + 1 \rangle} ^ {1}, y _ {\langle i + 1 \rangle})\right) \\ = \Pr \left(\llbracket a _ {\langle 1 \rangle} ^ {1} \rrbracket , \dots , \llbracket a _ {\langle i \rangle} ^ {1} \rrbracket | (a _ {\langle 1 \rangle} ^ {1}, y _ {\langle 1 \rangle}), \dots , (a _ {\langle i \rangle} ^ {1}, y _ {\langle i \rangle})\right) \\ \times \Pr \left(l ^ {1}. c i p h e r _ {1} | \left(a _ {\langle 1 \rangle} ^ {1}, y _ {\langle 1 \rangle}\right), \dots , \left(a _ {\langle i \rangle} ^ {1}, y _ {\langle i \rangle}\right), \left(a _ {\langle i + 1 \rangle} ^ {1}, y _ {\langle i + 1 \rangle}\right)\right) \\ \times \Pr \left(r ^ {1}. c i p h e r _ {1} | (a _ {\langle 1 \rangle} ^ {1}, y _ {\langle 1 \rangle}), \dots , (a _ {\langle i \rangle} ^ {1}, y _ {\langle i \rangle}), (a _ {\langle i + 1 \rangle} ^ {1}, y _ {\langle i + 1 \rangle})\right). \\ \end{array}
$$
We now present some details of compared methods in this work.
- Original RFs<sup>3</sup>: The original plaintext random forests [1] implemented by sklearn;
- PPD-ERTs<sup>4</sup>: The extremely randomized trees algorithm for learning from distributed horizontal partition data [64];
- PivotRFs<sup>5</sup>: A private and efficient solution for tree-based models in a vertical federated learning setting [62], based on a hybrid of threshold partially homomorphic encryption and secure multiparty computation techniques;
- MulPRFs<sup>6</sup>: The original random forest [1] with the secure multiparty computation library MP-SPDZ [94], based on the sh2 protocol to support semi-honest two-party computation;
- AnonyRFs<sup>7</sup>: The random forests based on anonymization library Mondrian, is a top-down greedy data anonymization algorithm for relational dataset [59];
- DiffPrivRFs<sup>8</sup>: Random forests based on differential privacy library Diffprivlib [93].
Tables 4 and 5 summarizes some hyperparameters settings in our experiments. Except for parameters 'n_estimators' and 'α' in leaf splitting, other parameters are set according to their respective references. We set security parameter  $\lambda > 6.4$  according to privacy-preserving requisites as in [89].
<sup>3</sup>The code is downloaded from github.com/scikit-learn/scikit-learn
<sup>4</sup>The code is downloaded from github.com/AminAminifar/kPPDERT-cloud
The code is downloaded from github.com/husdbsystem/pivot
The code is downloaded from github.com/csiro-mlai/decision-tree-mpc
<sup>7</sup>The code is downloaded from github.com/qiyuangong/Mondrian.
<sup>8</sup>The code is downloaded from github.com/IBM/differential-privacy-library
Table 5: Hyperparameter setting of samples' minimum number  $\alpha$  for leaves splitting in experiments.
Parameter	wdbc	cancer	breast	diabetes	german	adver	bibtex	phpB0	pendigits	phish
α	10	10	10	10	10	10	10	10	10	10
Parameter	ailerons	house	a9a	amazon	bank	adult	mnist	miniboone	runwalk	covtype
α	10	100	100	100	100	100	100	100	100	100
Table 6: The orders of magnitude improvement compared to other approaches in Figure 2. 'NA' means that no results were obtained after running out  $10^{6}$  seconds (about 11.6 days).
Dataset	Our encrypted RFs	Original RFs	AnonyRFs	DiffPrivRFs	PPD-ERTs	PivotRFs	MulPRFs	HEldpRFs
wdbc	1	×10-3	×10-3	×10-3	×2	×10	×25	×400
cancer	1	×10-3	×10-3	×10-3	×1.5	×10	×20	×300
breast	1	×10-3	×10-3	×10-3	×2	×13	×30	×103
german	1	×10-3	×10-3	×10-3	×2	×18	×40	×3000
diabetes	1	×10-3	×10-3	×10-3	×2	×15	×25	×850
adver	1	×10-3	×10-3	×10-3	NA	×475	NA	NA
bibtex	1	×10-3	×10-3	×10-3	NA	×328	NA	NA
phpB0	1	×10-3	×10-3	×10-3	NA	NA	NA	NA
pendigits	1	×10-4	×10-4	×10-4	×2	×25	NA	NA
phish	1	×10-3	×10-3	×10-3	×1	×139	×848	NA
ailerons	1	×10-4	×10-4	×10-4	×1	×31	×40	NA
house	1	×10-4	×10-4	×10-4	×1	×31	×38	NA
a9a	1	×10-3	×10-3	×10-3	×1	×453	×762	NA
amazon	1	×10-4	×10-4	×10-4	×1	×51	×31	NA
bank	1	×10-4	×10-4	×10-4	×1.5	×149	×220	NA
adult	1	×10-3	×10-3	×10-3	×2	×211	×276	NA
mnist	1	×10-4	×10-4	×10-4	NA	NA	NA	NA
miniboone	1	×10-4	×10-4	×10-4	×2	×35	NA	NA
runwalk	1	×10-4	×10-4	×10-4	×2	×35	NA	NA
covtype	1	×10-3	×10-3	×10-3	×1	NA	NA	NA
We give the prediction time comparisons (in seconds) for different methods as shown in Figure 4. As we can see, our encrypted random forests take comparable running time with original random forests, AnonyRFs and DiffPrivRFs, since our Gini-impurity preserving encryption method only requires  $O(h)$  time complexity without other additional operations, where  $O(h)$  denotes the height of binary search tree  $\mathcal{BT}$ .
Furthermore, our encrypted random forests show superior efficiency compared to other methods, such as MulPRFs, PPD-ERTs, PivotRFs, and HEldpRFs, with the training time obtained in  $10^{6}$  seconds (almost 11.6 days). This is because MulPRFs, PivotRFs, and PPD-ERTs require expensive communication costs for multi-parity computation, while HEldpRFs takes heavy computation costs on HE scheme. We also present the orders of magnitude improvement of training and prediction time in Table 6 and Table 7, respectively.
We analyze the security across fourteen datasets by randomly selecting an attribute that share a similar trend as other dimensions. We compare our Gini-impurity-preserving scheme with other four privacy-protection methods: differential privacy [93], anonymization [59], order-preserving scheme [96] and HE scheme [42]. The results are depicted in Figure 5.
Inspired from [97], we take the bitwise leakage matrix as our metric. An initial step is to scale and discretize the feature space into integers within the range of  $[0, 2^7]$ , and then we sample 200 representative samples from each dataset to evaluate the security of the feature space. The primary objective in experiment is to safeguard as many bits of the plaintexts as possible. This quantitative
Table 7: The orders of magnitude improvement compared to other approaches in Figure 4. 'NA' means that no results were obtained after running out  $10^{6}$  seconds (about 11.6 days).
Dataset	Our encrypted RFs	Original RFs	AnonyRFs	DiffPrivRFs	PPD-ERTs	PivotRFs	MulPRFs	HEldpRFs
wdbc	1	×3	×3	×3	×38	×1,220	×93	×4,000
cancer	1	×28	×29	×25	×360	×11,052	×851	×41,911
breast	1	×25	×31	×27	×308	×11,631	×776	×44,736
german	1	×4	×5	×4	×115	×2,615	×421	×9,615
diabetes	1	×42	×35	×41	×411	×18,142	×1,642	×64,285
adver	1	×3	×4	×10	NA	×3,821	NA	NA
bibtex	1	×1	×1	×1	NA	×1,528	NA	NA
phpB0	1	×4	×4	×4	NA	NA	NA	NA
pendigits	1	×6	×6	×10	×2384	×18,947	NA	NA
phish	1	×5	×8	×6	×1,966	×1,7619	×2,604	NA
ailerons	1	×6	×9	×8	×1,581	×30,200	×3,600	NA
house	1	×6	×9	×8	×1,581	×30,400	×3,600	NA
a9a	1	×6	×10	×8	×5,482	×27,000	×3,250	NA
amazon	1	×10	×12	×12	×2,208	×54,500	×7,500	NA
bank	1	×14	×18	×20	×5,637	×75,500	×10,000	NA
adult	1	×4	×5	×4	×1,967	×22,054	×2,876	NA
mnist	1	×2	×3	×2	NA	NA	NA	NA
miniboone	1	×6	×9	×9	×1,800	×75,000	NA	NA
runwalk	1	×12	×18	×26	×2,413	×84,000	NA	NA
covtype	1	×7	×10	×8	×2,943	NA	NA	NA
Figure 4: Comparisons of the prediction running time on different random forest. Notice that the y-axis is in log-scale, and full black columns imply that no result was obtained after running out  $10^{6}$  seconds for training (about 11.6 days).
assessment is visualized through a color map: the  $x$ -axis represents the individual bits (1 through 7), while the  $y$ -axis indicates the rank order of the 200 sampled datasets.
The color gradient, ranging from white to red, represents the degree of security, with white correlating to minimal security and red to maximal security. The security degree was normalized within a  $[0,1]$  range to ensure results' consistency. For instance, a security degree of 0 with white color indicates no security, while a security degree of 1 with red color suggests the highest level of security.
As expected, the HE scheme presents the highest security, yet with heavy computational costs. For example, datasets exceeding 3000 samples yielded no results under the HE scheme, even with an extended runtime of  $10^{6}$  seconds. It is also observed that our proposed scheme demonstrated superior security efficacy compared to the other three schemes: differential privacy [93], anonymization [59] and order-preserving scheme [96]. Since those schemes rely on mere data perturbations, compressions, or order information preservation. In comparison, our scheme makes a good balance between security and computational cost.
E Proof of Bitwise Leakage
In this section, we present a comprehensive evaluation of the security properties for our Gini-impurity preserving methods, full homomorphic encryption, anonymization technique, and differential privacy
methods. The security analysis is conducted in the feature space using the bitwise leakage matrix which is proposed by [97].
We focus on a discrete and finite feature space with a fixed size as in [97]. The feature space is defined as  $\mathcal{X} = [0,2^{m - 1}]$ , which means that the feature size is  $m$  bits, and the space ranges from 0 to  $2^{m - 1}$ . Let  $\mathcal{D}$  be the true distribution over the feature space, and dataset  $S = \{a_{1},\dots ,a_{n}\}$  are sampled independently and identically from distribution  $\mathcal{D}$ .
The adversary  $\mathcal{A}$  possesses two types of knowledge to achieve the goal of recovering plaintexts:
- Auxiliary knowledge about a distribution  $\mathcal{D}'$  over the feature space  $\mathcal{X}$  [98], which provides additional information to the adversary.
- Ciphertexts  $\llbracket S\rrbracket$  corresponding to  $S$ , which represents the snapshot of the encrypted data store, as described in Fuller et al. [99].
We re-sort dataset  $S$  with a non-decreasing order, i.e.,  $S = \{a_{\langle 1\rangle},a_{\langle 2\rangle},\dots ,a_{\langle n\rangle}\}$  where  $a_{\langle 1\rangle}\leq a_{\langle 2\rangle}\leq \dots \leq a_{\langle n\rangle}$ . Let  $S\langle i\rangle$  be the  $i$ -th sample in  $S$ , and  $S\langle i\rangle_{[j]}$  be the  $j$ -th bit of  $S\langle i\rangle$  with  $i\in [n]$  and  $j\in [m]$ . Then, we denote by  $b\langle i\rangle_{[j]}$  the adversary's guess for  $S\langle i\rangle_{[j]}$  through the auxiliary knowledge distribution  $\mathcal{D}'$  as follows:
$$
b\langle i\rangle_{[j]} = \arg \max_{b\in \{0,1\}}\operatorname *{Pr}_{\mathcal{D}^{\prime}}\left(S\langle i\rangle_{[j]} = b\right) = \left\{ \begin{array}{ll}0 & \text{for}\quad \mathbb{E}_{\mathcal{D}^{\prime}}[S\langle i\rangle_{[j]}\leq 1 / 2\\ 1 & \text{for}\quad \mathbb{E}_{\mathcal{D}^{\prime}}[S\langle i\rangle_{[j]} > 1 / 2, \end{array} \right.
$$
for  $i \in [n]$  and  $j \in [m]$ . The adversary aims to correctly guess the plaintext  $S\langle i \rangle_{[j]}$  using the auxiliary knowledge  $\mathcal{D}'$ . Let  $\mathcal{L}$  be a  $n \times m$  matrix with
$$
\mathcal {L} (i, j) = \Pr \left(S \langle i \rangle_ {[ j ]} = b \langle i \rangle_ {[ j ]} | \mathcal {D}, \mathcal {D} ^ {\prime}\right) \text {f o r} i \in [ n ] \text {a n d} j \in [ m ].
$$
Similarly to [97], we have
$$
\Pr_ {\mathcal {D}} \left(S \langle i \rangle_ {[ j ]} = 0\right) = \sum_ {s \in S _ {0} ^ {j}} \Pr_ {\mathcal {D}} \left(S \langle i \rangle = s\right) \text {f o r} i \in [ n ] \text {a n d} j \in [ m ],
$$
and  $\operatorname{Pr}_{\mathcal{D}}\left(S\langle i\rangle_{[j]} = 1\right) = 1 - \operatorname{Pr}_{\mathcal{D}}\left(S\langle i\rangle_{[j]} = 0\right)$ , where  $s_{[j]}$  denotes the  $j$ -th bit of  $s$  with  $S_0^j = \{s|s\in S$  and  $s_{[j]} = 0\}$ . This follows that
$$
\mathcal {L} (i, j) = \Pr \left(S \langle i \rangle_ {[ j ]} = b \langle i \rangle_ {[ j ]} | \mathcal {D}, \mathcal {D} ^ {\prime}\right) = \sum_ {s \in S _ {b \langle i \rangle_ {[ j ]}} ^ {j}} \Pr_ {\mathcal {D}} \left(S \langle i \rangle = s\right).
$$
The variable  $\mathcal{L}(i,j)$  represents the probability that an adversary can accurately guess the  $j$ -th bit of the plaintext  $S\langle i\rangle$ . This metric can be considered as a measure of the information security for the ciphertexts  $\llbracket S\langle i\rangle \rrbracket$ , in the sense that a lower value of  $\mathcal{L}(i,j)$  signifies a higher degree of security. Specifically, the bitwise information security of  $\llbracket S\langle i\rangle \rrbracket$  can be quantified as  $1 - \mathcal{L}(i,j)$ , and this metric provides a precise and quantitative assessment of the encryption scheme's security properties.
Specifically, we investigate the correlation among elements of  $\mathcal{L}(i,j)$ , plaintexts, ciphertexts and secret keys. We explore the impact of different encryption parameters on the structure and behavior of  $\mathcal{L}(i,j)$ . Our analysis reveals that the leakage pattern of  $\mathcal{L}(i,j)$  is highly dependent on the specific encryption scheme. Therefore, it is crucial to carefully design and select the appropriate encryption scheme to minimize the risk of information leakage.
We now present the analysis of bitwise leakage matrix  $\mathcal{L}(i,j)$  for our encryption method as follows.
Theorem 7. For our Gini-impurity-preserving encryption and plaintexts  $S$ , we have
$$
L (i, j) = \sum_ {q \in [ i, n - k + i ]} \frac {\mathbb {I} (S \langle q \rangle_ {[ j ]}) = S \langle i \rangle_ {[ j ]})}{n - k + 1} \times \sum_ {s \in S _ {b \langle i \rangle_ {[ j ]}} ^ {j}} \Pr_ {D} \left(S \langle i \rangle = s\right) + s m a l l c o n s t a n t.
$$
Proof. Our Gini-impurity-preserving encryption transfers multiple plaintexts in  $\mathcal{I}_{i'}$  ( $i' \in [k]$ ) to the identical first dimension ciphertext, i.e.,  $c_{i'}$ , as shown in Eqn. (5). Hence, the  $i'$ -th ciphertext  $c_{i'}$  corresponds to multiple plaintexts, and the adversary will guess the true plaintext  $S\langle i \rangle$  of ciphertext
Figure 5: Comparisons of the security degree for the feature space through the bitwise leakage matrix.
$c_{i'}$ . Since the adversary only knows that  $i' - 1$  ciphertexts are smaller than  $c_{i'}$  and  $k - i'$  ciphertexts are larger than  $c_{i'}$ , the adversary can guess the plaintext  $S\langle i \rangle$  from
$$
\{S \langle q \rangle | q \in [ i, n - k + i ] \}
$$
with the same probability. In this way, the probability of adversary guessing  $S\langle i\rangle_{[j]}$  is
$$
P _ {i, j} = \sum_ {q \in [ i, n - k + i ]} \frac {\mathbb {I} (S \langle q \rangle_ {[ j ]} = S \langle i \rangle_ {[ j ]})}{n - k + 1}.
$$
Let  $b\langle i\rangle_{[j]}$  be the adversary's guess for  $S\langle i\rangle_{[j]}$ , we have
$$
b\langle i\rangle_{[j]} = \operatorname *{arg  max}_{b\in \{0,1\}}\operatorname *{Pr}_{\mathcal{D}^{\prime}}\left(S\langle i\rangle_{[j]} = b\right) = \left\{ \begin{array}{ll}0 & \text{for}\quad \mathbb{E}_{\mathcal{D}^{\prime}}[S\langle i\rangle_{[j]}\leq 1 / 2\\ 1 & \text{for}\quad \mathbb{E}_{\mathcal{D}^{\prime}}[S\langle i\rangle_{[j]} > 1 / 2. \end{array} \right.
$$
The probability for the adversary correctly identifies the  $j$ -th bit of the plaintext  $S\langle i\rangle$  is
$$
L(i,j) = P_{i,j}\sum_{s\in S_{b\langle i\rangle [j]}^{j}}\Pr_{D}\left(S\langle i\rangle = s\right) + \text{small constant}  ,
$$
and we complete the proof from Lemma 8.
Lemma 8 (Roy et al. [97]). Let  $\mathcal{D}$  be the input distribution and  $S = \{a_{1},\ldots ,a_{n}\}$  denotes the dataset with each data point sampled i.i.d. from  $\mathcal{D}$ , then we have
$$
\operatorname * {P r} _ {\mathcal {D}} \left(S \langle i \rangle = a ^ {\prime}\right) = \sum_ {j = n - i + 1} ^ {n} \binom {n} {j} \left(\operatorname * {P r} _ {\mathcal {D}} \left(a <   a ^ {\prime}\right)\right) ^ {n - j} \left(\operatorname * {P r} _ {\mathcal {D}} \left(a = a ^ {\prime}\right)\right) ^ {j} f o r \operatorname * {P r} _ {\mathcal {D}} \left(a > a ^ {\prime}\right) = 0  ,
$$
$$
\operatorname * {P r} _ {\mathcal {D}} \left(S \langle i \rangle = a ^ {\prime}\right) = \sum_ {j = i} ^ {n} \binom {n} {j} \left(\operatorname * {P r} _ {\mathcal {D}} \left(a = a ^ {\prime}\right)\right) ^ {j} \left(\operatorname * {P r} _ {\mathcal {D}} \left(a > a ^ {\prime}\right)\right) ^ {n - j} f o r \operatorname * {P r} _ {\mathcal {D}} \left(a <   a ^ {\prime}\right) = 0;
$$
$$
\Pr_ {\mathcal {D}} \left(S \langle i \rangle = a ^ {\prime}\right) = \sum_ {j = 1} ^ {n} \sum_ {k = \max  \{1, i - j + 1 \}} ^ {\min  \{i, n - j + 1 \}} \binom {n} {k - 1, j, n - k - j + 1}) \Delta_ {k - 1, j, n - k - j + 1},
$$
$$
\Delta_ {k - 1, j, n - k - j + 1} = \left(\operatorname * {P r} _ {\mathcal {D}} \left(a <   a ^ {\prime}\right)\right) ^ {k - 1} \cdot \left(\operatorname * {P r} _ {\mathcal {D}} \left(a = a ^ {\prime}\right)\right) ^ {j} \cdot \left(\operatorname * {P r} _ {\mathcal {D}} \left(a > a ^ {\prime}\right)\right) ^ {n - k - j + 1}.
$$
We now provide similar analysis of bitwise leakage matrix  $\mathcal{L}$  for  $\epsilon$ -local differential privacy.
Theorem 9. For  $\epsilon$ -local differential privacy, we have
$$
L (i, j) = \frac {\operatorname * {P r} \left(S \langle i \rangle_ {[ j ]} = b \langle i \rangle_ {[ j ]}\right) + \operatorname * {P r} \left(S \langle i \rangle_ {[ j ]} = S ^ {\prime} \langle i \rangle_ {[ j ]}\right)}{2} + s m a l l c o n s t a n t ,
$$
where  $S$  and  $S^{\prime}$  denotes the plaintexts and ciphertexts, respectively, and
$$
b \langle i \rangle_ {[ j ]} = \arg \max _ {b \in \{0, 1 \}} \operatorname * {P r} _ {\mathcal {D} ^ {\prime}} \left(S \langle i \rangle_ {[ j ]} = b\right) = \left\{ \begin{array}{l l} 0 & i f \quad \mathbb {E} _ {\mathcal {D} ^ {\prime}} [ S \langle i \rangle_ {[ j ]} ] \leq 1 / 2, \\ 1 & i f \quad \mathbb {E} _ {\mathcal {D} ^ {\prime}} [ S \langle i \rangle_ {[ j ]} ] > 1 / 2. \end{array} \right.
$$
Proof. We concern  $\epsilon$ -local differential privacy by adding noise to each individual value. If the adversary attempts to infer the original plaintext  $S\langle i\rangle$ , then it relies on the  $\epsilon$ -differential privacy disturbed data  $S'(i)$  and the auxiliary knowledge distribution  $\mathcal{D}'$ . The adversary guesses the  $j$ -th bit of the  $i$ -th plaintext  $S\langle i\rangle_{[j]}$  through a process of deduction as follows:
$$
S \langle i \rangle_ {[ j ]} = \left\{ \begin{array}{l l} 1 & \text {f o r} b \langle i \rangle_ {[ j ]} = 1 \text {a n d} S ^ {\prime} \langle i \rangle_ {[ j ]} = 1  , \\ 0 & \text {f o r} b \langle i \rangle_ {[ j ]} = 0 \text {a n d} S ^ {\prime} \langle i \rangle_ {[ j ]} = 0  , \\ \text {r a n d o m l y s e l e c t f r o m} \{0, 1 \} & \text {o t h e r w i s e}  . \end{array} \right.
$$
$$
L (i, j) = \frac {\Pr \left(S \langle i \rangle_ {[ j ]} = b \langle i \rangle_ {[ j ]}\right) + \Pr \left(S \langle i \rangle_ {[ j ]} = S ^ {\prime} (i , j)\right)}{2} + \text {s m a l l c o n s t a n t}.
$$
In order to gain a deeper understanding of the security for the  $k$ -anonymous algorithm, we conduct an analysis of the bitwise leakage matrix  $\mathcal{L}$ . This matrix represents the amount of information leakage that occurs when the original data  $X$  is compressed into  $m$  partitions  $\mathcal{K}_1,\mathcal{K}_2,\dots ,\mathcal{K}_t$  by the  $k$ -anonymous algorithm as follows:
$$
\begin{array}{l} \mathcal {K} _ {1} = \left\{a _ {\langle 1 \rangle}, a _ {\langle 2 \rangle}, \dots , a _ {\langle k _ {1} \rangle} \right\} \\ \mathcal {K} _ {2} = \left\{a _ {\langle k _ {1} + 1 \rangle}, a _ {\langle k _ {1} + 2 \rangle}, \dots , a _ {\langle k _ {2} \rangle} \right\} \\ \cdot \cdot \cdot \\ \end{array}
$$
$$
\mathcal {K} _ {t} = \left\{a _ {\langle k _ {t - 1} + 1 \rangle}, a _ {\langle k _ {t - 1} + 2 \rangle}, \dots , a _ {\langle n \rangle} \right\}.
$$
The bitwise leakage matrix  $\mathcal{L}$  quantifies the amount of information that can be inferred about an individual from the corresponding partitions. By analyzing this matrix, we can determine the level of privacy that is maintained by the  $k$ -anonymous algorithm and identify any potential vulnerabilities that could be exploited by an adversary. Then, we give the analysis of bitwise leakage matrix  $\mathcal{L}$  for  $k$ -anonymous algorithm as follows.
Theorem 10. For  $k$ -anonymous algorithm and the plaintexts  $S$ , we have
$$
L (i, j) = \Pr \left(S \langle i \rangle_ {[ j ]} = b \langle i \rangle_ {[ j ]}\right) + s m a l l c o n s t a n,
$$
where  $S\langle i\rangle_{[j]}$  denotes the  $j$ -th bit of  $S\langle i\rangle$  with  $S\langle i\rangle \in \mathcal{K}_q(q\in [t])$  and
$$
b \langle i \rangle_ {[ j ]} = \arg \max _ {b \in \{0, 1 \}} \left\{\sum_ {x \in \mathcal {K} _ {q}} \mathbb {I} [ x _ {[ j ]} = b ] \Pr_ {\mathcal {D} ^ {\prime}} (x) \right\}.
$$
Proof. The  $k$ -anonymity is a privacy-preserving technique that aims to protect the identity of individuals in a dataset. It works by grouping together individuals with similar attributes and pooling their data in a larger group, thus making it difficult for an adversary to identify any specific individual in the group. The  $k$ -anonymity ensures that each group has at least  $k$  individuals with the same attribute values, which further enhances the security of the data.
When the original data  $S\langle i\rangle$  is pooled in the group  $\mathcal{K}_q(q\in [t])$ , the adversary attempts to guess the  $j$ -th bit of the plaintext  $S\langle i\rangle$  using the auxiliary knowledge distribution  $\mathcal{D}'$  and  $\mathcal{K}_q$ . To achieve this,
the adversary guesses  $b\langle i\rangle_{[j]}$  as the value corresponding to the maximum probability of the  $j$ -th bit in group  $\mathcal{K}_q$  as follows:
$$
b \langle i \rangle_ {[ j ]} = \arg \max _ {b \in \{0, 1 \}} \left\{\sum_ {x \in \mathcal {K} _ {q}} \mathbb {I} [ x _ {[ j ]} = b ] \operatorname * {P r} _ {\mathcal {D} ^ {\prime}} (x) \right\}.
$$