Nearly-Linear Time and Massively Parallel Algorithms for $k$-anonymity
Authors: Kevin Aydin
Honghao Lin
David Woodruff
Peilin Zhong
Venue: NeurIPS 2025 poster ()
Keywords: K-anonymity
Nearly-linear time
Massively parallel
Primary area: theory

Abstract: $k$-anonymity is a widely-used privacy-preserving concept that ensures each record in a dataset is indistinguishable from at least $k-1$ other records. In this paper, we revisit $k$-anonymity by suppression and give an $O(k)$-approximation algorithm with a nearly-linear runtime of $\tilde{O}(nd + n^{1+1/C^2}/k^{1/C^2})$ for an arbitrary constant $C$, where $n$ is the number of records and $d$ is the number of attributes. Previous algorithms with provable guarantees either (1) achieve the same $O(k)$ approximation ratio but require at least $O(n^2 k)$ runtime, or (2) provide a better $O(\log k)$ approximation ratio at the cost of an impractical $O(n^{2k})$ worst-case runtime for general $d$ and $k$. Our algorithm extends to the Massively Parallel Computation (MPC) model, where it can be adapted into an MPC algorithm requiring $\tilde{O}(\log^{1+\epsilon} n)$ rounds and total space $O(n^{1+1/C^2}(d+k))$. Empirically, we also demonstrate that our algorithmic ideas can be adapted to existing heuristic methods, leading to significant speed-ups while preserving comparable performance.

Although~\citep{PS07} introduced improvements to achieve more practical runtimes for their $O(\log k)$-approximation algorithm, its worst-case runtime remains $O(n^{2k})$. A natural question arises: can we develop an algorithm with an $o(k)$ approximation ratio and a polynomial runtime? We investigate the single-point $k$-anonymity problem, where the goal is to select $k-1$ additional records to make a given record indistinguishable. Surprisingly, assuming the dense vs random conjecture in complexity theory, we show that for $n = k^c$, no algorithm can achieve a $k^{1 - O(1/c)}$ approximation in $\mathrm{poly}(k)$ time. This provides evidence of the inherent hardness of the $k$-anonymity problem.

Nearly-Linear Time and Massively Parallel Algorithms for k-Anonymity
Kevin Aydin Google Research
Honghao Lin' Carnegie Mellon University honghaol Gandrew. cmu. edu
kaydin@google.com com
David P. Woodruff CMU & Google Research dwoodruff@ndde cmu edu
Peilin Zhong
Google Research p222258columbia edu
Abstract
k-anonymity is a widely-used preraccirreeriingggggo concept that ensures each record in dataset is indistinguishable from least k other records. We revisit k-anonymity by suppression and give an apppooooooinaaoo algorithm with a nearly-linear runtime of Ond + (n/k))/C²+o(1)) for any constant C, where n is the number of records and is the number of attributes. Previous algorithms with provable guarantees either (1) achieve the same O(k) approximation ratio but require at least (n²kk) runtime, or (2) provide a better O(log k) approximation ratio the cost of an impractical (n?2k worst-case runtime for general and k. Our algorithm extends to the Massively Parallel Computation (MPC) model, where it gives an MPC algorithm requiring Ö(log" 1+e n)) rounds and total space On +7 (d +d + k)). Empirically, we also demonstrate that our algorithmic ideas can be adapted existing heuristic methods, leading significant speed-ups while preserving comparable performance. On the hardness side, we study the related single-point k-anonymity problem, where the goal is select h 1 additional records to make a given record indistinguishable Assuming the dense vs random conjecture in complexity theory, we show that for kS, no algorithm can achieve 101/())) approximation in poly(n) time, providing evidence for the inherent hardness the k-anonymity problem.
Introduction
As data becomes increasingly central sreiision-makine research, and business intelligence, ensuring privacy while preserving data utility has become critical challenge. Many datasets contain sensitive information, such health records, financial transactions, or social behavior. However, even after removing direct identifiers (c.g.. names, social security numbers, etc.), inadequate safeguards can still lead re-identification. To mitigate these risks, have become essential for balancing data utility and privacy protection, with k-anonymity [Swe02] standing out as foundational approach.
data publishing techniques
k-anonymity, introduced by [Swe02], ensures that each record a dataset indistinguishable from least k: 1 other records based set of quasi-identiffers. These quasi-identifiers, such age, ZIP code, and gender, may not be uniquely identifying on their own but can enable re-identification when combined with external data sources. By applying generalization and suppression techniques,
"Equal Contribution.
Part of the work was done while Honghao Lin was student researcher in Google Research.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

k-amonymity reduces the risk of re-identification while preserving data utility for analysis. An example can be found in Table I. In this paper, we will only consider the case of suppression where each entry of every attribute is either included in the output, replaced with the "x' character.
Most research on k-anonymity has focused finding the optimal (or near-optimal) k-anonymous dataset. That is, the one that minimizes the number of hidden attributes and thereby best preserves the original data. The work of [MW04] demonstrated that finding the optimal solution is NP-hard but provided an O log k) --approximation algorithm with a runtime exponential in A. Later, [AFK 05] improved this an ( further enhanced the approximation to (log k), though their algorithm has a worst-case runtime of (n²*). ). In addition to algorithms with provable guarantees, other studies have proposed heuristics for various anonymization approaches. For example [LDR06] introduced heuristic algorithm for k-anonymization of quasi-identifiers, utilizing a construction similar to k-d trees, [DXTK15] by freeform generalization and [BKBL07, ZWL* + 18] proposed heuristics based on clustering.
with a runtime of O(n²k). k).. Subsequently. [PS07, KT12]
Age
Marital
Home country
Gender
Age
Marital
country
Gender
20~229
Single
USA
Male
20~29
Single
USA
30--39
Divorce
China
Femaae
30~-39
Femule
20~229
Single
USA
Female
20~29
Single
USA
30~39
Separation
Korea
Fomale
30~399
Female
Table I: An example of 2-anonymization [PS07]
Despite the extensive body of research on k-anonymity, many questions and challenges remain unresolved. First, the fastest algorithm for k-anonymity with a provable guarantee has runtime of O(n2k), where n is the number of data points. As the size of data continues to grow in many scenarios, even an (n²)) runtime may become impractical. This raises the question of whether an algorithm with linear runtime
is possible.
Question 1: Is there an algoritium for k-anonymity that runs in linear time in n while providing a provable approximation guarantee?
Second, to the best of our knowledge, work has studied k-anonymity in the context of massively parallel computation. In fact, most existing algorithms for k-anonymity rely on sequential processing. Therefore, there is strong motivation to develop parallel algorithms that can leverage the power of distributed computing frameworks to achieve faster and more efficient solutions.
Question 2: it possible to design an algorithm for k-anonymity the mas- sively parallel computation model while minimizing the number of communication rounds?
Also, although [PS07] introduced improvements to achieve more practical runtimes for their O(log k)) approximation algorithm, these improvements may only be effective when the dimension d of each point is small. Moreover, their worst-case runtime still remains (n2²). A natural question arises:
Question 3: Is possible develop an algorithm with an olk) approximation ratio and worst-case runtime polynomial in d, and k?
1.1 Our Contributions
We present the first approxxipxiinnnonnn algorithm for k-anonymity with a nearly-linear runtime. Theorem 1.1. Given a table T with n records T4 E rd (i = 1, n)) runs in time Ō nnd + n (n/3)))/(=o(())) -a()) and with high probability outputs an (())-apprxximation to the k-anonymity problem T, where the constant hidden in the approximation rutio depends on C.
there is an algorithm that
For C' Cargge the running time approaches Ö(nd + +o0()), which is nearly the time to read the input. Our algorithm can also be extended to the Massively Parallel Computation model (Section A. with a number of communication rounds that is logarithmic in n.
Theorem 1.2. Given a table T with a records r; E Ed (i=10 1,,,,2, 1;,,..,,,, let 7, E (0, 1). There is a fully scalable MPC algorithm that outputs an O log (1/e2 k) -approximation to the k-anonymity

---

problem on T with high probability. The algorithm takes O time and O (nd + +n!++++0 k) total space.
[los 7
log)+t(n) log log(o)))
parallel
To obtain better understanding of our third question, we propose and study the following single-point k-anonymity problem, where the goal is to select indistinguishable while minimizing the number of hidden attributes among these k points, Assuming the dense vs. random conjecture complexity theory, we show that for kC, no algorithm can achieve a k000(//) approximation in poly(k) time.
additional records to make given record
Theorem 1.3. Assume Conjecture 4.3, and let n = k and d 2 k. There is no algorithm which runs in polynomial n. time that with high probability can output k0-0///)) aaprrxxiaatti to the single-point k-anonymity problem, even if each record is binary.
Theorem 1.3 provides evidence of the inherent hardness of the k-anonymity problem. We remark that open question here is whether we can extend this lower bound to the original k-anonymity problem and obtain a similar hardness.
1.2 Related Work
In addition to the work mentioned above, several studies have explored special cases of k- anonymity. For example, [AFK 05] proposed a a..a11.5511 1.5-aprroiimation algorithm for 2-anonymity and 2-approximation algorithm for 3-anonymity. Similarly. [BDVDP13] presented a polynomial-time algorithm for the case when both d and |Σ] are constant.
On the hardness side, [BDVDP13] showed that finding the optimal solution is w [1]-hard with respect to the value of the solution (and k). Furthermore, [BDVD11] demonstrated that c-approximation is hard for fixed constant in the following cases: (1) |>| = 2 and k: = 3, (2) d > 8 and A: 4. Several studies have extended the definition of k-anonymmiyy by introducing additional constraints, such as l-diversity [MKGV07] and (-closeness [LLV06]. to enhance privacy protection for non-quasi- identifiers. Additionally, [CFL10] introduced the concept of k-isomorphism
social network graphs, which means that the graph can be decomposed into union of & distinct isomorphic subgraphs. Recently, the work of [EEMM24] studied the smooth k-anonymity problem on a binary dataset, where they provide detailed discussion comparing k-anonymity and differential privacy. In particular, in [EEMM24] the authors formally prove the following:
Theorem 1.4. Let M be an arbitrary mechanism that satisfies c-edge differential privacy. Then, in order to achieve E[J(MG)), G)] 2 a, it must hold that e ((llog(a(nm)) where J(...) denotes the Jaccard similarity.
This result suggests that achieving high utility (i.e., preserving the structure of the original graph) under differential privacy requires a large value of c. However, when is large, the algorithm likely maintains the graph G unmodified thus exposing users to re-identification risks. Recall that the guarantee provided by e-DP is: Pr[M(G) E A S e Pr(M(G") E A], which becomes nearly vacuous for large
In contrast, k-anonymity offers a different privacy-utility tradeoff. Prior work shows that if the optimal anonymized graph Eopt satisfies J (E, Eopt) 2 1 - O(1/ log logk), then efficient algorithms can find solutions with comparable utility. Furthermore, in the case of smooth k-anonymity, where edge additions and deletions are allowed, the required assumption can be relaxed to JEE Eopt) 2 0(1).
2 Preliminaries
Notation. In the k-anonymity problem, we are given table T having n records, each with d attributes. A record ri E T is drawn from Dd where V is a finite set of possible values for each attribute. Then r:[j] is the value of the j-th attribute in r,. Let * be a symbol not in Σ. Given record E Ed, let its binary expansion be E {0, 1]d where for i E [d], [E]]] Pi.j = 1 if and only the i-th attribute corresponds to the j-th value in Σ. Given two records x, y E Σ"" let their to distance be diste, (zz, y), which is the number of attributes for which and y differ.
Given two vectors Jr, // E Rm, their & distance is diste, (z, v) v y. Given a finite point set C Rm,, let Pk (r) be the distance between r and its k-th nearest neighbor in P in & distance. Specifically, if r E P we let p1 (r) 0 (i.c., r's 1-st nearest neighbor is r itself).
3

---

2.1 k-Anonymity
Definition 2.1 (k-Suppression Function). k-suppression function maps each r T to ry. by replacing some attributes of r; by Moreover, for every r E T. there exist k - other r1, r E T such that f(r) = f(r1) f(r2) f( Define c(f) to be the cost of f on T, i.e., the number of attributes in T replaced by f. where note that if the same attribute is changed in multiple records, its contribution the cost is the number of records is changed in.
1
Definition 2.2 (k-anonymity via Suppression). In the k-anonymity problem, we are given a table of records and an anonymity parameter k. Our goal is to obtain a k-suppression function f so that fff) is minimized. Specifically, we say f is a C-approximation if c(f) S C -miny' c(f").
Nearly-Linear Time Algorithm for k-Anonymity
In this section, present nearly-linear time approximation algorithm for k-anonymity. At high level, we will first show that achieving an O(k) approximation for k-anonymity can be reduced to solving the minimum-size constrained clustering problem with O(1) pointwise guarantee under the squared fg distance metric. Then, we will give an algorithm that solves this problem in nearly-linear time with high probability.
3.1 Reduction to Minimum Size Constrained Clustering
Recall that we have n records r; (i = =,,2.... 1,2..... table T. For each record r; E Ed, let I, E {0, 1]dهs be its binary expansion (i.e., a one-hot encoding of 7;, see definition in Section 2) and let S denote the set of binary expansions of all records. Then for each pair of records (rirry), the number of differing attributes between r; and ry is given by:
1 distr, (ri-rz) = - e eo (Ix, z,) = distr, (2i, x2)
For each record r,, let be its k-th nearest neighbor in with respect to the lo distance (i.e., the number of attributes which the records differ, and recall that in our definition, the 1-st nearest neighbor of r; is r; itself). Consider an arbitrary partition of the k-anonymity problem on T. Since the group containing r; has at least records, the number of attributes that need to be suppressed for k-anonymity is at least diste, (ri, r2) = (x.)² In the following lemma, we demonstrate that if {PI, ..,,,..PP. with centers c(Pi),c(P))
c(P:) on S, such that for every point S in group P,, the squared &2 distance diste, (p, c(;))² is at most O(1) Pa (p)², then this partition gives an apprxxxppoi the k-anonymity problem on T. Formally, we have
there exists a partition
Lemma 3.1. Suppose that P (PI, P2,....... ...........PP.. is a partition on S with centers ((P)), .., such that for every P., k < P. S 2k: - and for every p E P,.
diste, (p, (o.((P.))) < C ppppp))
for some constant C. Then, the partition P an O(k) aaproxiipt solution for the k-anonymity problem on T.
Proof. Let @ (Q1-Q2," ... .Q,} with centers c(Q1),c(Q2), the k-anonymity problem on T'. For each point p E P. let (p, P.) denote the number of attributes we need to suppress for with group P..
... .c((..) be the optimal solution to
We first upper bound the total number of suppressed attributes over the partition P. Given point p E P., recall that p is a one-hot encoding of some record in table T and let r(p) e T' be the record that p corresponds to. We have
PP)
Σ PEP..
distr (r(p), < Σ
diste =
Σ
1
distr (p, g)²
2
qEP..u#p
qEP..9#p
Σ
(diste, (p.)) + distr, (g, ((P)))))))
gEP..gpp
The first inequality due to the fact that if we need to hide the attribute j. then there must be least one r(g) in I such that the j-th attribute of r(p) and r(g) differ. Taking over all P. and p e P.,

---

and noting that we have
PP - 2k- 1, we get that
Σ PEP PER
Σ
N(p, P:) - (4k 4) Σ ΣΣ
diste, (p. (p, (P:)))
PER
This implics
NO. 44) C. Pn(p)² P:EP PEP:
(1)
PES
from the assumption of the clustering solution. We next turn to lower bound the total number of hidden attributes over the partition Q. Give a E Qi, let p denote its k-th nearest neighbor in S. Then we have
(g. Q.) max dist (v) p'EQ,
Since there least & points in Qi, we have
1 2 distr, (p', 2 5 distro (p. - 2000)22x00 (q)²
(g, Q.) Z max p'EQ:
The last equation holds because both and are one-hot encodings of some records. Taking sum over all Q, and q Q;, we get that
Em(0>
= Σ Σ N(1.9))
(2)
2
yES
QiERoEQ:
Combining (1) and (2) we get that
Σ
N(p, P.) (8k C Σ N(g
PEPP PEP.
QEEQVEQ.
which is what we need.
We next note that the condition PP| < 2k 1 can effectively be removed. If a group P. contains more than 2k 1 points, it can be divided into multiple smaller groups arbitrarily, each satisfying the condition.
Corollary 3.2. Suppose that P = (PI, P2......
...., P.). is partition on S with centers c(Pi), P())) such that for every P.. P. 2 and for every p E P..
distr, (p, cl c(P.)) S C pcpppp)
for some constant C. Then the partition P can be efficiently transferred to another partition P', which is an (pp))xpppo solution to the k-anonymity problem on T.
Finally, since the input to this clustering problem is the binary expansion each record r; (which is in d|E] dimensions) but not the record itself. naively it yields |Σ] factor in time and space, which can be large in practice. However, note that in the entire proof of Corollary 3.2, all we care about are the pair-wise distances. Consequently, reduce the dimension of each point to Ollog n). Recall that since each of the input binary expansions d-sparse, we can compute each embedding 4zz; (d n) time.
use the following Johnson- Lindenstraaus lemma to
Lemma 3.3 (Johnson-Lindenn) Lindenstrauss lemma, [JLS86]). Let & E TRrxd be matrix whose entries are i.d samples from (O 1/r). For every vector E RRd and E (0, 1), we have Pr[(1 - e)||u[|a S [ (1 + <) [|]2]] 2 exp({((2r)))
3.2 Solving the Minimum Size Constrained Clustering Problem
After establishing Corollary 3.2, our goal shifts to finding partition P= = P=PP P2..... .h....,?? P:) on an Olog n) -immeensio pointset S with centers ((Pi)..... c(P)) such that [P.] 2 k. and for every p E P..
(p. < C- pp())p
In the remainder of this section, we shall present an algorithm that solves this problem in time Ö(nd +n (n/k) (/C)))(1)) Our algorithm is inspired by the work of [EMMZ22] that studies this problem in the MPC setting, and their algorithm is not hard adapt into an Ö(nd fond+nl++ee 1,+1/02++(LL) +o(1). time algorithm. This is at least nk time, which can be as large as n² for & = O(n). We will significantly improve upon this runtime by using random sampling to reduce k-th nearest neighbor computations to 1-st nearest neighbor computations, described below. We need the definition of locality sensitive hashing (LSH):
5

---

Lemma 3,4 ([A108, And09]). Let S = {pı.P,,... Pa.... ,nt C R Given two parameters R >> 0 and
Ch 1, there is hash family H. such that vp. S:
1. If 1p - all S R, then Prhem(h(p) = h(q)] 2 P1 where P1 2 1/nn//2+0(1))
2. If [pp - 4lle 2 C. R, then Pricn (p)) = h(q)) & P2 where P2 S 1/n²t and cu > 1 is
universal constant.
Moreover, each hash function can be generated and evaluated in n d time.
We now present our algorithm. At a high level, our algorithm can be divided into the following steps:
1. Sample random subset J C S with |J| O(nn lo) /k). For each pi E J, compute an ((1) approximmaionn to p (pt). Denote this distance by d,. Also compute a set N;, where Nal 2 k - 1 and for every E N; we have dlsste (ps. g) S Q(1) Pk (1:) (Lemma 3.6).
2. For each point 9 not in J. find f(4) in J satisfying diste, (q. [g)) S O(1) minpe. diste, (q. For each p E J, define F(D) = (a E 5 f(g) = p) (Lemma 3.7).
3. For Rg = =3 for = 1, ... Olog d):
(a) Let A C J be the set of point p: where Ry-1 < (P(Pt) S Rg and pj has not been assigned.
(b) Let B S A be the set of point p; where none of the points in N; has been assigned in the previous iteration.
(c) Greedily find one maximal independent set C of B such that the points in C do not share the same point in their neighborhood set N,. For each point p. E C, create a new cluster centered at ps, assign points in N; pt-
(d) For each point p in \ C, assume shares the same neighbor with the point 8 E C, assign p to center s.
(e) For each point p; in A \\ B, assume one of its neighbor in N₂ has been assigned to center 8, assign Pt to s.
(f) Furthermore, suppose that p E J has been assigned to center s, assign all unassigned points q in Fp) to the same cluster if diste, (g. p) I R, (check in each iteration).
It is clear that each cluster we create during this procedure has size at least k. Moreover, each point S during this procedure will be assigned to one cluster. To prove the correctness of the algorithm, we next present the following lemmas.
Lemma 3.5. Given set J' with size [J'| = O(n/k) and distance parameter R. we can preprocess the set J J' in time logn- - (n/k))=1//** +o(2) and then for every point p E J, with probability 1 - 1/n² we can compute a set I such that (1) I has size at least the number of points in J' that are within distance R. from p. and for every point q in I, we have diste, (p. 9) S O(C) R.
Proof. We draw 8 O log P.
independent LSH hash functions Lemma 3.4 with 5 == J J and
parameters R and C. Then, for a fixed E [s] and every q E JJ' we add q into if h2(p) = hz(g).
We next prove the correctness of the algorithm. Consider p. q E J J' with 1|p - 4ll2 2 2c, C- R. Then for fixed i [s). (p) h.(g)) < 1/(n/k)² by Lemma 3.4. By taking union bound over all such pairs of {p. and all i E [s], with probability at least
k/n, we have for any {p.g) S with 1p 11-2122 2 2c, C. R, (p) + hz(4) for all é [s]. Thus, if a point q E I, have 1pp - 4 < 2c,, CO-R0(00 Lemma 3.4, with probability at least - 1/(m//)) there exists an E [s] such that h+(p) = h:(g). By taking a union bound over all {p. q) with ||p - </I2 < R. with probability at least 1 - k/n, we have that q E 7 for all such pairs (p.g) Finally, note that the above procedure only has a success probability of at least 1 1- 1iik-nn k/n, but we can run the same procedure O n) independent times to boost the success probability condition or not by computing the pairwise distances).
R. Now consider two points p, Q E S with |p- g/12 < R. By
1/n² (after obtaining I, we can check whether satisfies the
Lemma 3.6. We can preprocess the point set S and J in time k. (n/K))+1/(=+o0)) and after that for every point p E J, we can with probability at least 1 - 1/n2 compute an aaproxiiiiiiii pslp) to pe(p) in time k (n/k))/C* /o)/////+++((]) with set N, such that |N| 2 k and for every q E N,, we have diste, (p,q) S (p(p).

---

Proof. The procedure is defined as follows. We split J into m = (O) disjoint subsets S/J = J1 U J2 U ...J. Jn. with each |Ji| = n/k. Let R, 2'. For each R, (i 0, 1, (log d)) and every j E [mm], we run the procedure in Lemma 3.5. For a point p E J, let NO be the subset returned by Lemma 3.5 with distance parameter R3, and set J' Jj and specifically, let No be the subset returned by Lemma 3.5 with the set J itself. Let R, be the smallest for which U N k
We use R3 as an approximation to (p) and return the set Nv = - NV.
We next prove the correctness of our algorithm. Let i be the integer for which R:-1 < px( S R. This means there are at least k - points within distance R, from p. From the guarantee of Lemma 3.5 we have that with probability 1 - 1/n2, 10 NYl k - 1. On the other hand, for an RS S Ph (P)) from the guarantee of Lemma 3.5 we have with probability 1 - 1//n², we have No < k 1. Moreover, similar to Lemma 3.5, we have that after taking union bound, with probability at least. 1 - 1/n², for every point E N,, dist , (P. q) S O(C) pxc(p).
Finally, we consider the time complexity of the algorithm. Note that we do not need to explicitly compare the hash value of each pair J). Instead for the point p we care about, we can just look at the cell it falls in for each of the hash functions. Moreover, we can terminate the procedure and return
Nr after the set N, we maintain has size k- 1. Hence, the overall runtime for one point p E J is k. (n/ (n/k))/0++0(1)
Lemma 3.7. Let Q be a subset of J with size logg///// We can pre-process Q and the point set S in time ks (m/kk) (000) such that afterwards, given a point E S, with probability at least 1- 18--1pm 1/n² we can find a point sj E Q in time (n/k)//C*oo) such that diste, (p. s,) S
O(1) min,.eq (p,
Proof. Note that we have QQI S On n n/k). Similarly to what we do in Lemma 3.6, we split S into m Ok)) disjoint subsets S = J1 U J2 U. ... J..m with each |J,|= = ((//k). Let R2 2 For
every R; (i = 0, 1, .... Ollog d)) and every E [m], we run the procedure in Lemma 3.5 on Q J... For point p E S. Let R, be the smallest integer such that there exists an N such that N n Q # 0. and the algorithm will return one arbitrary center se in NO n Q. Similar to the proof of Lemma 3.6. we have that this St satisfies dist,, (p, s2) S O(1) min, diste, (p, 8;), which is what we need. O
Lemma 3.8. For every point p. E J, ifq q E N₁, then we have Pk S O(C) Pk(p). Moreover, every point p of J. with probability least 1 - 1/n2, we have that (f() S O(C)- (p(p).
2-1) denote the set of p,'s true k-nearest neighbors. Note that from the property of N,, we have that diste, (p. q,) S O(C) pk (p). Consider an arbitrary 1j E N, we have that for other qf E N% diste, (gj. ge) E diste, (p,gg 93) + diste, (p. qe)) I O(C+1) 1) Pk (p). This This implies Pk (g:) S O + 1). Pk (p). Moreover, for each p & J, since has size log n/k), we have that with probability at least
Proof. Let No- = 14h
1/n² there exists d/ * p such that d/ J. This implies that minge, diste, q) S (p). Then we have diste, (p. f(p)) S OCC)- minges J diste, (p. 9) < O(C)- pa (p). Then, from similar argument we can get p& (f(p)) S O(C + (p))).
Lemma 3.9. Suppose that in phase j the point p is assigned to s, then we have diste, (p. 8) S 3 Ri-
Proof. The proof is by induction. For j = 11, i.e., before the phase of j = 0, since there is no point assigned at this phase, the lemma statement automatically holds. Now consider the i-th phase. We suppose that every assignment before the i-th phase has radius at most 3- R2-1 = Rz.
We first consider the assignments in step 3c)). In this case, for each point p; C. since R, S (p(p)) S Ry. the distance from p; to the points in its neighbor set N; will be at most R2 which means this assignment has distance at most Ry. We next consider the assignment in step 3(d). In this case, since C' is maximal independent set, we have that for each point p in B \ C. it shares the same neighbor q with points s C. This implies diste, (p. S diste, (p. q) + dist (g. s) < R + R, = 2 R, We next consider the assignment in step 3(e). For each point p. in A \, B, we have that there exists one q E N has been assigned to center s in the previous iterations with distance at most 3 Ry-1 R-- We have dist,, (pi, 8) Σ diste, (pr. Q) + diste, (q, 8) < R, + R3 = 2 Ry-
We finally consider the assignment in step 3(f). Suppose we assign p é J to center then we have we also assign fp) to s. Then we have that diste, (p. 8) S diste, (p. (p)) + dist, (f(p), S
Ry + Rg < 3 Rg.
7

---

Algorithm 1 k- A-Annnymity via Near Neighbors
1: Input: A table T that contain records, parameters h 1.
2: Let ④ E [ be the JL matrix in Lemma 3.3. For each record ri E T, compute //1 ④ <.p:
where p; is a binary expansion ri. Let 5
3: Use Lemma 3.11 obtain partition p {P,, P2..... Pi on S.
4: For each E [ if P| v 2k 1, let P: = [P.]. Otherwise split P. Qú, Q1.2 .. UQe
where k Qi I 2k and let P. (Qi,,, Qi........ Q.,1)
5: Return the partition U Qi
Lemma 3.10. For every p E S, with probability at least 1 - 1/n², is assigned with distance to its center at most O(C)) (x()).
Proof. We first consider the point p E J. Let j be the number such that R < (p) S Rj. Then, from the procedure of the algorithm, we have that must be assigned in or before the phase j. From Lemma 3.9 we have the distance from p to its center will be at most 3 R, S 9 pa (p) - O(9C')
We next consider the points p & J. Let j be the number such that R₃-1 < O(C") (x(p) I Rj- From Lemma 3.8 we have with probability at least 1/n², we have pk (f(( I O(C)- Pk (p) and diste, (p. f fp)) I O(C) (p))). Hence, from the procedure of our algorithm,
have that p must be assigned in or before phase j. which implies the distance from p to its center will be at most 3 Rg S O(9C9). (p)).
By Lemma 3.6, Lemma 3.7, and Lemma 3.10, we get the conrectness of the following lemma.
Lemma 3.11. There an algorithm, which ouiputs partition P (P1, ......, P.} S such that with high probability, for every P.. P&] 2 & and for every E P..
diste, (p, c(P.))² s O(C)) px(p)2
for some constant C. Moreover, the entire procedure runs in time Ō nn (m/R))/0+00))
Proof of Theorem 1.1. The entire algorithm is presented in Algorithm 1. We first prove the correctness of our algorithm. From Lemma 3.11 we have with high probability, the partition P P2....... P.} satisfies for every P.. PP|| 2 k and for every p E P.. diste, (p. c(P.)) O(C)), px(p)2 Then, after splitting the subsets P.] 2 2k, from Lemma 3. we have the partition Q is an (pp-xxxppoi solution to the k-anonymity on the table T. The overall time complexity is n- (m/k)1/C*+0(1))
4 Single-Point k k-Annnymity
We study the following single-point k-anonymity problem.
Definition 4.1 (single-point k-anonymity). In the single-point k-anonymity problem, we are given a table T that contains records and specific record p T. Then, we ask to choose k - 1 other records F1. .2.......... .k. from T with the goal being minimize the number of attributes the group (p, T1, T2...... (k-1) has to be suppressed, i.e., the number of j such that T2,,,,--0
3a, b E (p, (p,r,, .,, -k-1 ), a[j] b[j]-
We say a solution is C-approximation the number hidden (suppressed) attributes in this solution at most C times the number of hidden attributes in the optimal solution.
Upper Bound. We observe a straightforward method to achieve (A: (ok-11-apppeee -paappooximttion: select the i-th nearest neighbor of in T (with respect to to distance, and excluding itself) for i 1, 2...... h 1. To see why this works, let r; denote p's i-th nearest neighbor in T'. On the one hand, we have that the number of hidden attributes in the optimal solution is at least diste, (p, rk-1). On the other hand, we have that the number of hidden attributes in the solution ,,, is at most ΣX= dist,, (p.T:) S (k- diste, (p))
Lemma 4.2. There is a deterministic algorithm that computes a (I 1) ->pappooximation of the single-pote point k-anonymity problem in time O(nd + n nlggn) n).
8

---

Lower Bound. We next consider lower bounds for the single-poing k-anonymity problem. In [CDKI2], the authors give the following conjecture about the time complexity of the follow- ing DENSE VS RANDOM problem: given graph G, it is hard to distinguish between the following two cases: (1) G = ((n.p) where p = na (and thus the graph has log-density concentrated around a), and (2) G' is adversarially chosen so that the densest f-subgraph has log density /3 where e >> pl (and thus the average degree inside this subgraph is approximately ea).
In [CDM17], the work studies the MAU problem and extends the conjecture to the hypergraph case: Given an r-uniform hypergraph G on n nodes, distinguish between the following two cases: () G G(n, p. where p- (r-(r-1) (and thus the graph has log-density concentrated around a:), and (2) G is adversarially chosen so that the densest f-subhypergraph on vertices and has log density where l >> pl (and thus the average degree inside this subhypergraph is approximately (P).
Conjecture 4.3. For all constant r and 0 < 3 < r - for all sufficiently small > O, and for all e < nll+a)/2, we cannot solve HYPERGRAPH DENSE vs RANDOM with don-density a and planted log-density B in polynomial time (w.h.p.) when 3 S a-
Assuming the above conjecture, we prove the following hardness result. Our construction is based on the lower bound for the minimum k-union problem studied in [CDM17].
Proof of Theorem 1.3. We shall show that, if we have an algorithm for single-point k-anonymity with approximation ratio k² k1-0(//), then it can be used to solve the HYPERGRAPH DENSE vs RANDOM with the specific parameters in Conjecture 4.3.
For sufficiently large constant r, let Given an instance of the input hypergraph in Conjecture 4.3, we construct the input instance to the single-point k-anonymity problem as follows. First, we set the specific record p be d-dimensional zero vector. Next, for the i-th edge in the hypergraph, we set the record r; to be the binary vector where its j-th coordinate is if and only if the j-vertex is included in this edge. Let the table T be the set that contains all ry's and k: Odd-=//VT).
yF- 1 and B VF-
d, and l = d'/vF
Then, consider the hypersubgraph in case two. With high probability it will have ((L++)) = ((ev==e) ((d-=v/VT) edges. Hence, setting h = O(d-=e/VT) and choosing the records that correspond to these edges in the subhypergraph, the number of attributes need to hide is at most f = d'//F nodes in G. We next consider G in case one. We claim that with high probability nodes in G. This means that every records in T will need to have such number of attributes hidden. To prove this, we only need to with high probability for every é subhypergraph in G. this
every edges in will cover at least d/-1///F+1/2r-66
show that when 8 = subhypergraph can only have at most hs - 1 edges. To get this, note that the expectation of the number of edges in each of the subhypergraphs is on the order of nn d2/2-e/vF, Then by Chernoff's
bound we have with failure probability at most 2 2exp(-d) that this subhypergraph has fewer than dl-e//F edge. Taking a union bound on the
subhypergraphs, we get the desired result.
which rules out algorithms The ratio of the two cases will be at least 2/E= = ( for single-point l anonymity with ratio (110/) The constant here can be sufficiently large and in our construction the total number of edges will be O(n" -nf-rr= (ddvr) S kVF. L
5 Experiments
All of our experiments were conducted on a device with a 3.30GHz CPU and 16GB RAM. We will use the following dataset which has been widely used in the study of anonymized privacy protection:
Adult. 3 The Adult data contains 48842 tuples from US Census data. The tuples with missing values are removed. In particular, we choose 8 attributes as quasi-identifier.
We observe that in the dataset we use, most points have several neighbors with small distance. Hence, in our implementation we use MinHash as an instance of LSH for simplification.
As baseline, we consider the clustering- based heuristic algorithms proposed in [ZWL+18] 18], where the authors demonstrate that their approach outperforms other existing heuristic methods, such as Mondrian [LDR06]. Although this algorithm shows strong performance on real-world datasets, it also
The Adult from the UCI Machine Learning Repository.

---

Gasllorde
RMAL-180
Figure 1: Test result for k-anonymity.
exhibits relatively high computational complexity. The core idea of the algorithm can be summarized as follows:
Iteratively selecting new cluster center as the point with the highest average distance from existing centers, and
2. Assigning the k - nearest neighbors of that point to the same cluster. This strategy, while intuitive, results in at least (2n2) time complexity, when disregard other parameters such as d and k.
Motivated by this bottleneck, we investigated whether the core heuristic could be accelerated using ideas from own algorithm. We found that substantial speed-ups upps indeed possible, with minimal impact on performance. particular, we introduce the following modifications:
1. For the center selection step (Step 1), instead of computing the average distance for all points, we randomly sample a fixed number candidate points.
2. Once new center is chosen, we leverage Locality-Sensitiee Hashing (LSH) to efficiently compute its approximate k-nearest neighbors. This process is similar to the procedures in Lemmas 3.5 and 3.6.
In our experiments, these modifications lead to a substantial reduction in runtime while preserving performance comparable to the original heuristic. refer to the improved version of our new algorithm as Ours (Heuristic).
To empirically assess runtime performance, we conducted experiments comparing the algorithms:
Ours (Heuristic) Implemented in C++ for efficiency.
[ZWL*18]] 18]: Since no official implementation was available, we implemented the algorithm ourselves in C++. We applied the same optimization strategies in own implementation.
Results Summary. The experimental results are presented in Figure 1. We vary the value from 5 to 30 and report the number of hidden attributes. As shown in the figure, original approach performs similarly to [ZWL+188 when is small but exhibits worse performance as increases. In contrast, second approach, which incorporates the heuristic, closely matches the performance of [8] across the entire range of k.
We next evaluate the runtime of different algorithms on the Adult dataset for & values ranging from to 30. As shown in Table 2, our algorithmic ideas can be adapted to existing heuristic methods, leading to significant upe while preserving comparable performance.
Table 2: Runtime comparison on Adult dataset (s)
Dataset
7WI.+18
Ours (Heuristic)
Adult 10)
894.216
17.431
Adult (k 15)
394.386
5.914
Adult 20)
222.038
3.368
'In our experiments, we found that because the dataset is relatively small, this step does not significantly improve the runtime for this heuristic. Therefore, current results only incorporate the first modification.
10

---

References
[AFK+055]
Gagan Aggarwal, Tomas Feder, Krishnaram Kenthapadi, Rajeev Motwani, Rina Pani- grahy, Dilys Thomas, and An Zhu. Approximation algorithms for k-anonymity. Journal of Privacy Technology (JOPT), 2005. 3,
[A108] Alexandr Andoni and Piotr Indyk. Near-optimal hashing algorithms for approximate nearest neighbor in high dimensions. Communications of the ACM, 51()):117-12 2008.
[And09] Alexandr Andoni. Nearest neighbor search: the old, the new, and the impossible. PhD thesis, Massachusetts Institute of Technology, 2009. 6
[4NOY14] Alexandr Andoni, Aleksandar Nikolov, Krzysztof Onak, and Grigory Yaroslavtsev. Parallel algorithms for geometric graph problems. In Proceedings of the forty-sixth annual ACM symposium on Theory of computing, pages 374-583, 2014. 20
[ASS* 18] Alexandr Andoni, Zhao Song, Clifford Stein, Zhengyu Wang, and Peilin Zhong. Parallel graph connectivity in log diameter rounds. In 2018 IEEE 59th Annual Symposium on Foundations of Computer Science (FOCS), pages 674-685. IEEE, 2018. 20, 21
[BDVD1I] Paola Bonizzoni, Gianluca Della Vedova, and Riccardo Dondi. Anonymizing binary and small tables is hard to approximate. Journal of combinatorial optimization, 22:97-119, 201 1.
[BDVDPI3] Paola Bonizzoni, Gianluca Della Vedova, Riccardo Dondi, and Yuri Pirola. Parameter- ized complexity of k-anonymity: hardness and tractability. Journal of combinatorial optimization, 26:19-43, 2013.
[BKBL07] Ji- Byun, Ashish Kamra, Elisa Bertino, and Ninghui Li. Efficient k-anonymization using clustering techniques. In International conference database systems for advanced applications, pages 188-200. Springer, 2007. 2
[BKS17] Paul Beame, Paraschos Koutris, and Dan Suciu. Communication steps for parallel query processing. Journal of the ACM (JACM), 64(6))1-58, 2017. 20
(CDK12) Eden Chlamtac, Michael Dinitz, and Robert Krauthgamer. Exerywhere-sparse spanners via dense subgraphs. In 53rd Annual IEEE Symposium Foundations of Computer Science, FOCS 2012, New Brunswick, NJ, USA, October 20-23, 2012, pages 758-767. IEEE Computer Society, 2012. 9
[CDM17] Eden Chlamtáe, Michael Dinitz, and Yury Makarychev. Minimizing the union: Tight approximations for small set bipartite vertex expansion. In Philip N. Klein, editor, Pro- ceedings of the Twenty-Eighh -iihtt Annual ACM-SIAN Symposhum on Discrete Algorithms, SODA 2017, Barcelona, Spain, Hotel Porta Fira, January 16-19, pages 881-899. SIAM, 2017.
[CFL10] James Cheng, Ada Wai-chee Fu, and Jia Liu. K-isomorphism: privacy preserving network publication against structural attacks. Proceedings of the 2010 ACM SIGMOD International Conference on Managemeni of datu, pages 459-470, 2010. 3
[DG08] Jeffrey Dean and Sanjay Ghemawat, Mapreduce: simplified data processing on large clusters. Communications of the ACM, 51(1):107-113, 2008. 20
[DXTKI5] Katerina Doka, Mingqiang Xue, Dimitrios Tsoumakos, and Panagiotis Karras. k- anonymization by freeform generalization. In Feng Bao, Steven Miller, Jianying Zhou, and Gail-Joon Ahn, editors, Proceedings of the 10th ACM Symposium Information, Computer and Communications Security, ASIA CCS '15 Singapore, April 14-17, 2015, pages 519-530. ACM, 2015. 2
[НEMM24] Alessandro Epasto. Hossein Esfandiari, Vahab Mirrokni, and Andrés Muñoz Medina Smooth anonymity for sparse graphs. Tat-Seng Chua, Chong-Was Wah Ngo, Roy Le-Wei Lee, Ravi Kumar, and Hady W. Lauw, editors, Companion Proceedings of the ACM on Web Conference 2024, WWW 2024, Singapore, Singapore, May 13-17, 2024, pages 621-624. ACM, 2024. 3
11

---

[EMMZ22]
Alessandro Epasto, Mohammad Mahdian, Vahab S. Mirrokni, and Peilin Zhong. Mas- sively parallel and dynamic algorithms for minimum size clustering. In Joseph (Seffi) Naor and Niv Buchbinder, editors, Proceedings of the 2022 ACM-SIAM Symposium on Discrete Algorithms, SODA 2022, Virtual Conference / Alexandria, VA, USA, January 9 12, 2022, pages 1613-1660. SIAM, 2022. 5, 20, 21, 22
[FMS+10 10) Jon Feldman, Shanmugavelayuthan Muthukrishnan, Anastasios Sidiropoulos, Cliff Stein, and Zoya Svitkina. On distributing symmetric streaming computations. ACM Transactions on Algorithms (TALG), 6(4):1-19, 2010. 20
[Goo96] Michael Goodrich. Communication--ffiiienn parallel sorting (preliminary version).
In Proceedings of the twenty-eighth annual ACM symposium on Theory of Computing, pages 247-256, 1996. 21
[GSZI1] Michael T Goodrich, Nodari Sitchinava, and Qin Zhang. Sorting, searching, and simulation in the mapreduce framework. In International Symposium on Algorithms and Computation, pages 374-383, Springer, 2011. 20, 21
[1BY+07) Michael Isard, Mihai Budiu, Yuan Yu, Andrew Birrell, and Dennis Fetterly. Dryad: distributed Kata-paraller programs from sequential building blocks. In Proceedings of the 2nd ACM SIGOPS/EuroSys European conference computer systems 2007, pages 59-72, 2007. 20
[JLS86] William B Johnson, Joram Lindenstrauss, and Gideon Schechtman. Extensions of lipschitz maps into banach spaces. Israel Journal of Mathematics, 54(2):129-138, 1986. 5
[KSV10] Howard Karloff, Siddharth Suri, and Sergei Vassilvitskii. A model of computation for mapreduce. In Proceedings of the twenty-first annual ACM-SIAM symposium on Discrete Algorithms, pages 938 948. SIAM, 2010. 20
[KT12] Batya Kenig and Tamir Tassa. A practical approximation algorithm for optimal k- anonymity. Data Mining and Knowledge Discovery, 25:134-168, 2012. 2
[LDR06] Kristen LeFevre, David DeWitt, and Raghu Ramakrishnan. Mondrian multidimen- sional k-anonymity. In 22nd International conference on data engineering (ICDE'06) pages 25-25 IEEE, 2006. 2.9
[LLV06] Ninghui Li, Tiancheng Li, and Suresh Venkatasubramannian t-closeness: Privacy beyond k-anonymity and I-diversity. In 2007 IEEE 23rd international conference on data engineering, pages 106-115. IEEE, 2006.
[MKGV07] Ashwin Machanavajjhala, Daniel Kifer, Johannes Gehrke, and Muthuramakrishnan Venkitasubramaniam. I-diversity: Privacy beyond k-anonymity, Acm transactions knowledge discovery from data (Ikdd), 1(1):3-es, 2007. 3
[MW04] Adam Meyerson and Ryan Williams. On the complexity of optimal k-anonymity. Proceedings of the twenty-thrrd ACM SIGMOD-SIGAA SIGACT-SIGART symposium on Principles of database systems, pages 223-228, 2004. 2
[PS07] Hyoungmin Park and Kyuseok Shim. Approximate algorithms for k-anonymity. In Chee Yong Chan, Beng Chin Ooi, and Aoying Zhou, editors, Proceedings of the ACM SIGMOD International Conference on Management of Data, Beijing, China, June 12-14, 2007, pages 67-78. ACM, 2007. 2
[Swe02] Latanya Sweeney. k-anonymity: A model for protecting privacy. International journal of uncertainty, fuzziness and knowledge- -baled systems, 10(05):557-570 2002.
[Whi12] Tom White. Hadoop: The definitive guide. " O'Reilly Media, Inc.", 2012. 20
[ZCF+10 10] Matei Zaharia, Mosharaf Chowdhury, Michael J Franklin, Scott Shenker, and Ion Stoica. Spark: Cluster computing with working sets. 2nd USENIX workshop on hot topics in cloud computing (HotCloud 10), 2010. 20
12

---

[ZWL+18] Wantong Zheng, Zhongyue Wang. Tongtong Lv. Yong Ma, and Chunfu Jia. K- anonymity algorithm based on improved clustering, In Algorithms and Architectures for Parallel Processing: 18th International Conference, ICA3PP 2018, Guangzhou, China, November 15-17, 2018, Proceedings, Part 18, pages 462-476. Springer, 2018 2, 9, 10
NeurIPS Paper Checklist
Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: Yes, list our main contributions.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: Yes, we clearly state all theoretical assumption
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well vell-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
13

---

3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: Yes, we clearly state all theoretical assumption.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: Yes, we discuss the details about our implementation.
Guidelines:
The answer NA means that the paper does not include experiments. If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (c.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (c.g., to registered users), but it should be possible for other researchers to have some path to reproducing verifying the results.
14

---

5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, described in supplemental material?
Answer: [Yes]
Justification:
Yes, we include the code supplementary materials.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (kttps://nips..
onoollncyy for more details.
While encourage the release of code and data, understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https: / //nips. cc/publicgguice gwwcc//g///////eee/eeeecc (CodeSummissionn
for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Yes, we discuss the experiment details.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer:
[No]
Justification:
We report the errors by average but not report the standard deviation.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi-
dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
15

---

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (c.g. negative emror rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: Yes, we discuss the information about this.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't 't make it into the paper).
9. Code ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https: http///eerrpppeeeeee httpppplic//tiiccuuiddee
Answer: [Yes]
Justification: Yes, we have confirmed.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Yes, we discuss that our algorithm will be beneficial for the privacy preserving.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
16

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification:
We use public dataset.
Guidelines:
The answer NA means that the paper does existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
17

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmoel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question:
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
18

---

Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification:
We only use LLMs to improve the writing.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs any important, original, non-standard components.
Please refer to our LLM policy (https /ttps/////euippp.eeee /00t:///////eeeeeeeee//////////0 for what should or should not be described.
19

---

A Preliminaries
Given graph E), for any u E V, let Ta(e) be the set of the neighbors of in G. A maximal independent set of G is subset I C V such that every vertex in the graph is at distance at most 1 from some vertex in I. A 3-ruling set of a graph is independent set I such that every vertex in the graph is at distance of at most & from some vertex in I. In particular, a maximal independent is 1-ruling set, which can be seen as a special case. Let G2 to be the square graph of G that has the same set of vertices as G, but in which two vertices are connected when their distance in G is at most 2.
A.1 Massivaly Parallel Computing
The MPC model [FMS+ 10, KSV GSZII, 1, BKS17, ANOY14] is an abstract of modern massively parallel computing systems such Map Reduce [DG08], Hadoop [Whi 12], Dryad 07]. Spark [ZCF* 10] and others.
We follow the introduction in [EMMZ22]. In the MPC model, the input data has size N. The system consists of p machines, each with a local memory size of s. Hence, the total space available in the entire system is 8. The space here is measured by words, each of (log((p s)) bits. Specifically, if the total space p- s O(N for some y 2 and the local space O(N²) for some E (0, 1), then the model referred to the (7, 6MMPC model [ASS- 18]. The computation proceeds in synchronized rounds. In each round, every machine processes the data stored in its local memory and sends messages other machines at the end of the round. Although each machine can send messages to any other machine, the total size of the messages sent or received by a machine a single round should be at most s.
Note that the space of each machine is sublinear in the input size. This means that we cannot collect all input data into one machine. An MPC algorithm called fully-scalable, if it can work when the space per-machine is O(N²) for any constant 8 (0, 1). The goal in this work to design fully-scalable MPC algorithms minimizing the number of rounds while using small total space.
B Extending to MPC Model
In this section, we demonstrate that our algorithm can be adapted into a fully scalable MPC algorithm. At high level, [EMMZ22] studied the minimum size constraint clustering problem in the MPC model and give an algorithm that can be efficiently implemented the MPC model. However, since the input of this clustering problem is the binary expansion of each record r; (which is in dimension d|E)) but not the record itself, naively using the algorithm in [EMMZ22] yields a |Σ| factor in time and space, which can be large in practice. Instead, we open the procedure of this algorithm and show that since each input point is d-sparse, is still achievable in the same order of time and space.
We will need the following concept of the C-appoxximate (R, rear neighbor graph. Definition B.1 (C-approximate (R, k) -ner neighbor graph, [EMM722). Consider point set P from a metric space X. Let C, R, k 2 1. If an undirected graph G = (V, E) satisfies
(a) P.
(b) ((p.p') E, (p.) C R.
(c) For every p E P, either [Ta())] 2 or fp' E P distx p') S R} C To(p), then we say G a C-approximate (R, k-e-ear neighbor graph of P.
We will show that given parameters C, R and set S where each p S represents a binary expansion of one record r; in table T. We can efficiently build a C-approximate (R, -nerr neighbor graph G of S under &g distance in O(nd (ind+n'' 1n1d==++11(++aa (111/((+0(())) time in the static setting and in ((1) rounds in the MPC model.
Lemma B.2. Given parameters C', R. and set S where each p E S is binary expansion of a record T; in T. Then, there is an algorithm that with high probability constructs a (pp)-apprxiimate (R, k) -eea neighbor graph of S in time O(nd + n 3411//++0()))))) The size of G at most Ō ( (n1+1/C==o(1) .k).
20

---

Proof. Let & E R'xd[> be JL matrix in Lemma 3.3 with r O m) and for each p E S. we compute p' = op. Let S" = P2 ....... P'... The construction of the graph G is as follows. We draw 8 θ
........ independent LSH in Lemma 3.4 with parameters R and C. Then, for every E [s] and every p' E S', we connect p' to le arbitrary points o' S' in G with h₂(p') = (q'). If there are less than l points with hg4g)) = hz(p"), connect p' to all such q' in G.
Iog Pi
We first prove the correctness of the algorithm. From Lemma 3.3 we have with probability at least 1 1/n, we have for every pair of p' and o' in S", 0.9 0||2 S 11 -4'll2 S 1.11p--9/22- Condition on this event occurs and consider p. q E S with l|p-9112 2 -C.. Then from the assumption we have I|p' - -I'll2 2 1.8c, C- R. this means that for fixed E [s]. (p') = h4 (g') I 1/n by Lemma 3.4. By taking union bound over all such pairs of (p.9) and all E [s). with probability at least
1//n, we have for any ) * h2 h:(g') for all i E [s]- Thus, if an edge (p.q) E E, we have |pp 1 A122 S 2c.. C. R O(C). R. Now consider two points p, P S with ||p- - 1lll I R. From the assumption we have II' - q'll & 1.1. - R. By Lemma 3.4 and Chernoff bound, with probability at least 1- 1/nn,. there exists an E [s] such that h,(p') = h.(g)). By taking union bound over all (p. q) with Ip 1y-gl12 S R. with probability
(p,4) E S with 1p - all2 2 20g C. R. h:(p')
at least 1 - 1/n,, have there an edge (p, q) E for all such pairs q). Combining
these two aspects, we have that for every p E P. either {q E P| llp 4ll2 S R] S (p()) or [p)( ( k.
We next consider the runtime complexity. First, for each p E S, since is d-sparse, we can compute 4 p Old log n) time, which implies we can form the set S" in O(nd log n) time (note that the algorithm does not need to write down p explicitly). Then from Lemma 3.4 we get that algorithm can evaluate h, (p') for every i E [s] and p E S' in time 1(n++1/C4+00) as the dimension of each p' E S is d' (log nt). Finally, to connect edges in graph G, we sort points in S' via their hash values and only consider to connect the points with the same hash values. Since for each hash function, we connect at most r edges from a point, we have this procedure can be done in time Ö (n1+1/0* k) and the size of G is at most δ n (1111/0+001), k))
Lemma B.3. Given parameters R, C, k and point set S. There is an MPC algorithm that builds an ((C))((ppooo approximaate (R, (Rt,)))near neighbor graph of S with high probability in O(1) rounds and Ô nd + +n =1111("+0(()) k) total space.
Proof. We first note that, the Johnson-LLindenstrauss lemma can be implemented in O(1) MPC round and ((adr) space where = O(log nt) in our case (See, e.g., Appendix A in [EMMZ22]). Next, we can handle LSH functions in parallel. According to Lemma 4.1, we use O(1) rounds to compute LSH values for all points in S. To connect edges, we sort points via their LSH values, make copies of some vertices and query indices in parallel. These operations can be done simultaneously in (1)) rounds [Go096, GSZ11, ASS+18) 18). Since we run s independent LSH functions and for each E [s], every each connects to at most r vertices, we have the total space needed is ( + n 1+1/C* k))
Given access to O(C))xapro (R. ---near neighbor graphs with different distance parameters R₂ = 2' for = 1, Olog d). the MPC algorithm presented in [EMMZ22] produces partition P on S' that satisfies the condition outlined in Corollary 3.2.
Lemma B.4 (Essentially Theorem 4.31 in (EMM722D. Let Y, 10, Given the C-approximate ( (Re, -)-n neighbor graph G,'s 's, there is a fully scalable MPC algo- rithm that with high probability outputs partition P {Pi, P2..... Pt) on S such that with high probability, for every P. [P] 2 k and for every p E P,, dist,, (p. c(P.)) <
O 1og2 (1/s1) (x)) The algorithun takes O (log log 1- (n) log log(n)) parallel
time and Ô (m (n1+)+0(1) k)) total space.
The full algorithm of Lemma B.4 is presented in Algorithm 2 for completeness.
21

---

Algorithm 2 Clustering with Pointwise Guarantee
1: Input: A point set P, parameter 1.
2: Let C 2
Initialize family clusters < 0. 4: Let A (6) be an upper bound (a lower bound) of dists, (p.g) for p 4 E.P..
5: Let L [log(A/8)]-
{0, (0, , let Rt +- 8.
L do 7: Compute a C-approximate (Ri, r--n neighbor graph G: = E.) of
for
8: Let P. = P be the vertices with at least & neighbors in G., ic., P. = P 2k)
9: Let P." { E P dista, (p. UOEP 2) >1} 1).
10:
Compute 9-ruling set S: = (s,,1, 812, .S.e of (G))
Compute PM" = =fp- E PP PRUUEP Q dista, (p. S.) S 2 33.
11:
Partition 1." P."" E
4 clusters Qt,1, Q2,, ... Qi,e where the center eQQ.,) is 8i,- For each point S., add p into an arbitrary cluster Qt such that dista, (p. St,) is minimized.
13:
For each E P. \ P." p & UQep Q, find an arbitrary cluster Q E P such that dista, (p. Q) S 1 and update Q by adding into Q. Add Qr,1, Q4,2, Qust into aettet+t
15: end for
16: Output the partition (PI, Pa. PP) and the centers P P.
At high level, the algorithm iteratively processes R = 1,2,4,... A (recall that in the case of our input, the distance of each pair of points is between 1 and O(vi)). For each value R, the algorithm needs to access a C-approximate (R, -near neighbor graph G, and then compute 3-ruling set of subgraph of G2, The algorithm maintains the following invariants at the end of the iteration with respect to the value of R:
(a) Every point p satisfies (k(p) & R must be assigned to some cluster.
(b) The radius of each cluster is at most O(C R))
(c) The size of each cluster is at least k.
For the correctness of Algorithm 2 and more details, refer the readers to Section 3.3 in [EMMZ22].
Combining with Lemma B.3 and Lemma B.4, we can prove the correctness of our Theo- 1.2.
22


Reviews:
[{"review_id": "SWKvQTQpcl", "reviewer": "Reviewer_Urpi", "summary": "Give the first $\\mathbf{O}(\\mathbf{k})$-approximation in nearly-linear time\n$$\n\\widetilde{O}\\left(n d+n(n / k)^{1 / C^2+o(1)}\\right)\n$$\nmatching the best known approximation ratio while improving runtime over  $\\mathrm{O}\\left(\\mathrm{n}^2 \\mathrm{k}\\right)$ algorithms previously.", "questions": "1.) What are the constant factors like in greater detail?\n\n2.) How do you set the JL target dimension ?\n\n3.) What are the specific setups where k-anonymity is better than differential privacy?", "limitations": "Dependence on the hypergraph dense Vs. random conjecture,", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Provides a scalable MPC version and prove hardness of single-point k-anonymity problem under a Dense vs. Random conjecture, ruling out k^{1–o(1/C)}-approximation in polynomial time.\n\nThe O(k)-approximation with nearly-linear runtime is a significant theoretical advance over prior O(n²k) methods.\n\nThe paper is quite well written.\n\nMinor: The authors mention: \"Recently, the work of [EEMM24] studied the smooth $k$-anonymity problem on a binary dataset, where they provide a detailed discussion comparing $k$-anonymity and differential privacy. Their findings suggest that in certain scenarios. $k$-anonvmity can be more suitable than differential privacv (DP)\". That said, in this PNAS paper they have proved that k-anonymity unlike DP does not satisfy the GDPR clause of preventing identifiability: https://www.pnas.org/doi/10.1073/pnas.1914598117 . Thereby it would be good to explain the cases/setups where k-anonymity is better than DP. That helps better motivate the paper as k-anonymity is an older technique.", "was_revised": true, "final_justification": "I uphold my score at 6 and support this paper based on the fact that k-anonymity although not the best method, is still used in practice and is being studied by researchers and the authors have moved the needle on this front.", "rebuttal": "We thank the reviewer for the detailed and constructive feedback. Below we address the specific questions.\n\n---\n\nMotivation for k-anonymity:\n\nWe appreciate the question regarding our motivation for using *k*-anonymity over differential privacy (DP), and we will provide additional explanation in the revised version of the manuscript.\n\nIn [EEMM 24], the authors formally prove the following:\n\n> Let $\\mathcal{M}$ be an arbitrary mechanism that satisfies $\\epsilon$-edge differential privacy. Then, in order to achieve $E[J(\\mathcal{M}(G), G)] \\ge \\alpha$, it must hold that $\\epsilon = \\Omega(\\log (\\alpha^2 n m))$, where $J(\\cdot, \\cdot)$ denotes the Jaccard similarity.\n\nThis result suggests that achieving high utility (i.e., preserving the structure of the original graph) under differential privacy requires a large value of $\\epsilon$. However, when $\\epsilon$ is large, the algorithm likely maintains the graph G unmodified thus exposing users to re-identification risks. Recall that the guarantee provided by $\\epsilon$-DP is: $\\Pr[\\mathcal{M}(G) \\in A] \\le e^{\\epsilon} \\Pr[\\mathcal{M}(G') \\in A],$ which becomes nearly vacuous for large $\\epsilon$.\n\nIn contrast, *k*-anonymity offers a different privacy-utility tradeoff. Prior work shows that if the optimal anonymized graph $E_{opt}$ satisfies $J(E, E_{opt}) \\ge 1 - O(1/\\log k)$, then efficient algorithms can find solutions with comparable utility. Furthermore, in the case of *smooth* k-anonymity, where edge additions and deletions are allowed, the required assumption can be relaxed to $J(E, E_{opt}) \\ge O(1)$. \n\nIn recent years, several notable works on data anonymity have been published at top machine learning venues. Examples include:\n\n- Hossein Esfandiari et al., *Anonymous Bandits for Multi-User Systems* (NeurIPS, 2022)\n- Alessandro Epasto et al., *Smooth Anonymity for Sparse Graphs* (WWW, 2024)\n- Xinyi Zheng et al., *Building K-Anonymous User Cohorts with Consecutive Consistent Weighted Sampling (CCWS)* (SIGIR, 2023)\n- Krzysztof Choromanski et al., *Adaptive Anonymity via b-Matching* (NeurIPS, 2013)\n\nThese works highlight interest in anonymity and privacy-preserving algorithms in machine learning and other communities. \nBeyond foundational and algorithmic work, we observed $k$-anonymity has also been applied in several domains recently. Examples include:\n\n-  Edvinas Kruminis et al., *BB-FLoC: A Blockchain-based Targeted Advertisement Scheme with K-Anonymity* (Distributed Ledger Technologies: Research and Practice, 2024)\n-  Zhaowei Hu et al., *KAIM: A distributed K-anonymity selection mechanism based on dual incentives* (Ad Hoc Networks Journal. 2025)\n- Stylianos Karagiannis et al., *Mastering data privacy: leveraging K-anonymity for robust health data sharing* (International Journal of Information Security, 2024)\n---\n\nConstant factors:\n\nWe agree with the reviewer that our theoretical bounds include several constant factors. However, our goal in this work is not to optimize these constants. Specifically:\n\n- In Lemma 3.1, a factor of 8 appears;\n- In the clustering step, the use of the triangle inequality introduces a factor of 2;\n- Finally, the LSH-based algorithm introduces an additional constant $c_u$.\n\n---\n\nJohnson-Lindenstrauss (JL) target dimension:\n\nHere we need to preserve all pairwise distances within a $(1 \\pm 0.1)$ multiplicative error, a JL projection to $O(\\log n)$ dimensions suffices. \n\n---\n\nMore Experiments: \n\nMotivated by the reviewers’ feedback, we conducted additional experiments comparing our method with the most recent heuristic algorithm proposed in [ZWL+18]. We note that this algorithm performs on real-world data, but also has high computational complexity. The core idea of this algorithm involves:  \n1. Iteratively selecting a new cluster center as the point with the highest average distance from existing centers, and  \n2. Assigning the $k - 1$ nearest neighbors of that point to the same cluster.  \n\nThis strategy, while intuitive, results in at least $\\Omega(n^2)$ time complexity, even when we disregard other parameters such as $d$ and $k$.\n\nTo empirically assess runtime performance, we conducted experiments comparing the following algorithms:\n\n- **Mondrian**: We used the publicly available Python implementation (referenced on page 12 of [EEMM24]).\n\n- **Our algorithm**: Implemented in C++ for efficiency.\n\n- **[ZWL+18]**: Since no official implementation was available, we implemented the algorithm ourselves in C++. We applied the same optimization strategies as in our own implementation, including multi-threading where applicable and pre-processing steps to speed up pairwise distance computations.\n\nThe experimental results confirm our theoretical expectations. On the *Adult* dataset with $k = 10$:\n- **Mondrian** completed in approximately **1 second**,  \n- **Our algorithm** completed in **3.78 seconds**, and  \n- **[ZWL+18]** completed in **689.15 seconds** (here the run time increases a lot as $k$ decreases, see the below table for details).\n\n\nMoreover, motivated by the performance bottleneck of [ZWL+18], we investigated whether the core heuristic could be accelerated using ideas from our own algorithm. We found that substantial speed-ups are indeed possible, with minimal impact on performance.\n\nIn particular, we introduce the following modifications:\n\n1. For the center selection step (Step 1), instead of computing the average distance for all points, we randomly sample a fixed number of candidate points. \n\n2. Once a new center is chosen, we leverage Locality-Sensitive Hashing (LSH) to efficiently compute its approximate $k$-nearest neighbors. This process is similar to Lemmas 3.5 and 3.6 in our submission.\n\nIn our experiments, these modifications lead to a substantial reduction in runtime while preserving performance comparable to the original heuristic. Notably, the improved variant consistently outperforms the results presented in Section 5 of our current submission.\n\nBelow, we report the experimental results. We refer to the improved version of our new algorithm as **Ours (Heuristic)**:\n\n| Dataset       | Algorithm         | Runtime (s) | Number of hidden entries                  |\n|---------------|-------------------|-------------|-------------------------------------------|\n| Adult (k = 10)| Mondrian          | ~1.00       | 116214                                    |\n|               | ZWL+18            | 689.15      | 63617                                     |\n|               | Ours (Heuristic)  | 13.82       | 65209                                     |\n| Adult (k = 15)| Mondrian          | ~1.00       | 126422                                    |\n|               | ZWL+18            | 308.95      | 72284                                     |\n|               | Ours (Heuristic)  | 7.35        | 72956                                     |\n| Adult (k = 20)| Mondrian          | ~1.00       | 133783                                    |\n|               | ZWL+18            | 176.78      | 72856                                     |\n|               | Ours (Heuristic)  | 4.896       | 78724                                     |\n\nIn summary, our algorithm achieves nearly-linear runtime in theory. Empirically, we also demonstrate that our algorithmic ideas can be adapted to existing heuristic methods, leading to significant speed-ups while preserving comparable performance."}, {"review_id": "qvKO3S2RZZ", "reviewer": "Reviewer_ozzy", "summary": "This paper studies the natural optimization version of $k$-anonymity: given a database, what are minimum number of cell suppressions needed in order to make the database satisfy $k$-anonymity?  Previous papers give $O(k)$-approximations with essentially quadratic runtime, or give better $O(\\log k)$-approximations but with extremely large $O(n^{2k})$ runtime.  This paper gives an $O(k)$-approximation that takes nearly linear time, and also gets it to work in the parallel/distributed MPC model using polylogarithmic rounds and an arbitrarily small polynomial amount of extra space.  They also prove that, under a (somewhat nonstandard but reasonable) complexity assumption, if we require our algorithm to have running time that is polynomial in $k$, then we can't get approximations that are significantly better than $\\Omega(k)$.\n\nThe main technique is to first translate the $k$-anonymity problem into a \"minimum size constrained clustering\" problem in the $\\ell_2^2$ distance metric.  This problem has been studied in the MPC model before, but that algorithm does not directly give a fast enough algorithm here.  So the authors show how to cleverly use LSH and random sampling to speed this up.", "questions": "- Can you provide some justification for why this problem is important in an era when DP has become the gold standard for privacy?\n- How does your algorithm perform with respect to running time experimentally?", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n  - This algorithms seems reasonably practical, and getting a quadratic running time down to near-linear is certainly an important goal and achievement.  \n  - The techniques seem to be nontrivial and above the technical bar.\n\nWeaknesses:\n  - My main concern is the motivation for this problem.  $k$-anonymity was an important concept at one point in time, but as far as I can tell has been completely superseded by differential privacy.  This can be seem in the references in this paper, which generally are >10 years old.  As far as I can tell, the only discussion about this is at the end of Section 1.2, where they say \"Recently, the work of [EEMM24] studied the smooth k-anonymity problem on a binary dataset, where they provide a detailed discussion comparing k-anonymity and differential privacy. Their findings suggest that in certain scenarios, k-anonymity can be more suitable than differential privacy.\"  To me, that does not seem like sufficient justification.  What are those scenarios?  Do they correspond to settings where we want to get $k$-anonymity by suppression?  I have no idea, since that discussion is not included in this paper.  They just outsource it to EEMM24.\n  - The experiments are a bit weak.  They show that the theoretical algorithm does not perform particularly well, but a simple variant of it does.  But the main point of this paper is about running time, and I don't see any experiments showing that this new algorithm is actually *faster* than previous algorithms.  Moreover, they do not compare to other heuristics because \"they have runtime at least $O(n^2)$\".  But, of course, a worst-case running time of $O(n^2)$ does not necessarily mean that it will actually be slower in practice.  Since the point of this paper is to give a faster algorithm, I would have expected experiments showing that their algorithm is faster than the previous quadratic time algorithm on realistic datasets, and moreover is at least as fast as previous heuristic approaches on those datasets.", "was_revised": true, "final_justification": "The authors ran some new experiments which seem good, and we have had a discussion about the importance of k-anonymity.  I am still quite skeptical, for the reasons in my rebuttal and responses, but the authors found a few more citations to back them up.  So I've raised my score to 4.  I think this would be a reasonable NeurIPS paper, but I certainly wouldn't push for acceptance.", "rebuttal": "We thank the reviewer for the detailed and constructive feedback. Below we address the specific concerns.\n\n---\n\n**Motivation for k-anonymity**:\n\nWe appreciate the question regarding our motivation for using *k*-anonymity over differential privacy (DP), and we will provide additional explanation in the revised version of the manuscript.\n\nIn [EEMM 24], the authors formally prove the following:\n\n> Let $\\mathcal{M}$ be an arbitrary mechanism that satisfies $\\epsilon$-edge differential privacy. Then, in order to achieve $E[J(\\mathcal{M}(G), G)] \\ge \\alpha$, it must hold that $\\epsilon = \\Omega(\\log (\\alpha^2 n m))$, where $J(\\cdot, \\cdot)$ denotes the Jaccard similarity.\n\nThis result suggests that achieving high utility (i.e., preserving the structure of the original graph) under differential privacy requires a large value of $\\epsilon$. However, when $\\epsilon$ is large, the algorithm likely maintains the graph G unmodified thus exposing users to re-identification risks. Recall that the guarantee provided by $\\epsilon$-DP is: $\\Pr[\\mathcal{M}(G) \\in A] \\le e^{\\epsilon} \\Pr[\\mathcal{M}(G') \\in A],$ which becomes nearly vacuous for large $\\epsilon$.\n\nIn contrast, *k*-anonymity offers a different privacy-utility tradeoff. Prior work shows that if the optimal anonymized graph $E_{opt}$ satisfies $J(E, E_{opt}) \\ge 1 - O(1/\\log k)$, then efficient algorithms can find solutions with comparable utility. Furthermore, in the case of *smooth* k-anonymity, where edge additions and deletions are allowed, the required assumption can be relaxed to $J(E, E_{opt}) \\ge O(1)$. \n\nIn recent years, several notable works on data anonymity have been published at top machine learning venues. Examples include:\n\n- Hossein Esfandiari et al., *Anonymous Bandits for Multi-User Systems* (NeurIPS, 2022)\n- Alessandro Epasto et al., *Smooth Anonymity for Sparse Graphs* (WWW, 2024)\n- Xinyi Zheng et al., *Building K-Anonymous User Cohorts with Consecutive Consistent Weighted Sampling (CCWS)* (SIGIR, 2023)\n- Krzysztof Choromanski et al., *Adaptive Anonymity via b-Matching* (NeurIPS, 2013)\n\nThese works highlight interest in anonymity and privacy-preserving algorithms in machine learning and other communities. Beyond foundational and algorithmic work, we observed  $k$-anonymity has also been applied in several domains recently. Examples include: \n\n-  Edvinas Kruminis et al., *BB-FLoC: A Blockchain-based Targeted Advertisement Scheme with K-Anonymity* (Distributed Ledger Technologies: Research and Practice, 2024)\n-  Zhaowei Hu et al., *KAIM: A distributed K-anonymity selection mechanism based on dual incentives* (Ad Hoc Networks Journal. 2025)\n- Stylianos Karagiannis et al., *Mastering data privacy: leveraging K-anonymity for robust health data sharing* (International Journal of Information Security, 2024)\n---\n---\n\n**Runtime in experiments**:\n\nWe thank the reviewer for raising this important point. We note that the algorithms we mention indeed have a slow runtime on real-world data. For instance, the most recent heuristic algorithm proposed in [ZWL+18] exhibits high computational complexity. The core idea of this algorithm involves:  \n1. Iteratively selecting a new cluster center as the point with the highest average distance from existing centers, and  \n2. Assigning the $k - 1$ nearest neighbors of that point to the same cluster.  \n\nThis strategy, while intuitive, results in at least $\\Omega(n^2)$ time complexity, even when we disregard other parameters such as $d$ and $k$.\n\nTo empirically assess runtime performance, we conducted experiments comparing the following algorithms:\n\n- **Mondrian**: We used the publicly available Python implementation (referenced on page 12 of [EEMM24]).\n\n- **Our algorithm**: Implemented in C++ for efficiency.\n\n- **[ZWL+18]**: Since no official implementation was available, we implemented the algorithm ourselves in C++. We applied the same optimization strategies as in our own implementation, including multi-threading where applicable and pre-processing steps to speed up pairwise distance computations.\n\nThe experimental results confirm our theoretical expectations. On the *Adult* dataset with $k = 10$:\n- **Mondrian** completed in approximately **1 second**,  \n- **Our algorithm** completed in **3.78 seconds**, and  \n- **[ZWL+18]** completed in **689.15 seconds** (here the run time increases a lot as $k$ decreases, see the below table for details).\n\n\nMoreover, motivated by the performance bottleneck of [ZWL+18], we investigated whether the core heuristic could be accelerated using ideas from our own algorithm. We found that substantial speed-ups are indeed possible, with minimal impact on performance.\n\nIn particular, we introduce the following modifications:\n\n1. For the center selection step (Step 1), instead of computing the average distance for all points, we randomly sample a fixed number of candidate points. \n\n2. Once a new center is chosen, we leverage Locality-Sensitive Hashing (LSH) to efficiently compute its approximate $k$-nearest neighbors. This process is similar to Lemmas 3.5 and 3.6 in our submission.\n\nIn our experiments, these modifications lead to a substantial reduction in runtime while preserving performance comparable to the original heuristic. Notably, the improved variant consistently outperforms the results presented in Section 5 of our current submission.\n\nBelow, we report the experimental results. We refer to the improved version of our new algorithm as **Ours (Heuristic)**:\n\n| Dataset       | Algorithm         | Runtime (s) | Number of hidden entries                  |\n|---------------|-------------------|-------------|-------------------------------------------|\n| Adult (k = 10)| Mondrian          | ~1.00       | 116214                                    |\n|               | ZWL+18            | 689.15      | 63617                                     |\n|               | Ours (Heuristic)  | 13.82       | 65209                                     |\n| Adult (k = 15)| Mondrian          | ~1.00       | 126422                                    |\n|               | ZWL+18            | 308.95      | 72284                                     |\n|               | Ours (Heuristic)  | 7.35        | 72956                                     |\n| Adult (k = 20)| Mondrian          | ~1.00       | 133783                                    |\n|               | ZWL+18            | 176.78      | 72856                                     |\n|               | Ours (Heuristic)  | 4.896       | 78724                                     |\n\nIn summary, our algorithm achieves nearly-linear runtime in theory. Empirically, we also demonstrate that our algorithmic ideas can be adapted to existing heuristic methods, leading to significant speed-ups while preserving comparable performance."}, {"review_id": "eoOVa5ude4", "reviewer": "Reviewer_tmta", "summary": "The authors develop approximation guarantees for k-anonymity, with one of the main goals being to provide an O(k) approximation algorithm with running time linear in the size of the input. They also develop an approximation algorithm in the MPC model as well as a lower bound on a related problem (whose connection with k-anonymity is still unclear). Their theoretical results are complemented with an experimental evaluation on some real-world datasets.", "questions": "See my comments above", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "+ the problem studied in the paper is well motivated and relevant to NeurIPS\n+ the paper is fairly well written and organized\n\n- although the most important parts of the paper are clear, there is room for improvement\n- the experimental evaluation is limited in scope\n- the code is not publicly available, as far as I could check\n\n\nmore detailed comments:\n- the experimental evaluation is limited in scope. One way to improve it could be to include an experimental evaluation of their approach against AFK+05 and ideally show that the two approaches have \"similar\" guarantees while their approach is much faster. \n- the code should be made publicly available so as to foster reproducibility \n\nsome comments about the presentation:\n- line 36 report the full running time [MW04] \n- line 48 runs in linear in n time => with running time linear in n\n- line 49 probable approximation guarantees => provable approximation guarantees\n- theorem 1.1. for every C>1?\n- section 3, define the the minimum size constrained clustering problem", "was_revised": true, "final_justification": "I still believe the results are interesting however I also agree with the issues pointed out by Reviewer T5kh.", "rebuttal": "We thank the reviewer for the detailed and constructive feedback. Below we address the specific concerns.\n\n---\n\n**Runtime in experiments**:\n\nWe thank the reviewer for raising this important point. We conducted additional experiments comparing our method with the most recent heuristic algorithm proposed in [ZWL+18]. We note that this algorithm performs on real-world data, but also has high computational complexity.The core idea of this algorithm involves:  \n1. Iteratively selecting a new cluster center as the point with the highest average distance from existing centers, and  \n2. Assigning the $k - 1$ nearest neighbors of that point to the same cluster.  \n\nThis strategy, while intuitive, results in at least $\\Omega(n^2)$ time complexity, even when we disregard other parameters such as $d$ and $k$.\n\nTo empirically assess runtime performance, we conducted experiments comparing the following algorithms:\n\n- **Mondrian**: We used the publicly available Python implementation (referenced on page 12 of [EEMM24]).\n\n- **Our algorithm**: Implemented in C++ for efficiency.\n\n- **[ZWL+18]**: Since no official implementation was available, we implemented the algorithm ourselves in C++. We applied the same optimization strategies as in our own implementation, including multi-threading where applicable and pre-processing steps to speed up pairwise distance computations.\n\nThe experimental results confirm our theoretical expectations. On the *Adult* dataset with $k = 10$:\n- **Mondrian** completed in approximately **1 second**,  \n- **Our algorithm** completed in **3.78 seconds**, and  \n- **[ZWL+18]** completed in **689.15 seconds** (here the run time increases a lot as $k$ decreases, see the below table for details).\n\n\nMoreover, motivated by the performance bottleneck of [ZWL+18], we investigated whether the core heuristic could be accelerated using ideas from our own algorithm. We found that substantial speed-ups are indeed possible, with minimal impact on performance.\n\nIn particular, we introduce the following modifications:\n\n1. For the center selection step (Step 1), instead of computing the average distance for all points, we randomly sample a fixed number of candidate points. \n\n2. Once a new center is chosen, we leverage Locality-Sensitive Hashing (LSH) to efficiently compute its approximate $k$-nearest neighbors. This process is similar to Lemmas 3.5 and 3.6 in our submission.\n\nIn our experiments, these modifications lead to a substantial reduction in runtime while preserving performance comparable to the original heuristic. Notably, the improved variant consistently outperforms the results presented in Section 5 of our current submission.\n\nBelow, we report the experimental results. We refer to the improved version of our new algorithm as **Ours (Heuristic)**:\n\n| Dataset       | Algorithm         | Runtime (s) | Number of hidden entries                  |\n|---------------|-------------------|-------------|-------------------------------------------|\n| Adult (k = 10)| Mondrian          | ~1.00       | 116214                                    |\n|               | ZWL+18            | 689.15      | 63617                                     |\n|               | Ours (Heuristic)  | 13.82       | 65209                                     |\n| Adult (k = 15)| Mondrian          | ~1.00       | 126422                                    |\n|               | ZWL+18            | 308.95      | 72284                                     |\n|               | Ours (Heuristic)  | 7.35        | 72956                                     |\n| Adult (k = 20)| Mondrian          | ~1.00       | 133783                                    |\n|               | ZWL+18            | 176.78      | 72856                                     |\n|               | Ours (Heuristic)  | 4.896       | 78724                                     |\n\nIn summary, our algorithm achieves nearly-linear runtime in theory. Empirically, we also demonstrate that our algorithmic ideas can be adapted to existing heuristic methods, leading to significant speed-ups while preserving comparable performance.\n\n---\n\nCode: As the rebuttal policy does not allow uploading supplementary material or external links, we will release our code publicly with the next version of the paper."}, {"review_id": "f2VTDC9Yze", "reviewer": "Reviewer_T5kh", "summary": "This paper studies the $k$-anonymity problem, which is the task of partitioning a dataset into groups of at least $k$ records each, such that every individual becomes indistinguishable from at least $k-1$ others on quasi-identifiers. The authors propose a new $O(k)$ approximation algorithm with near-linear running time and extend this algorithm to the Massively Parallel Computation model. At a technical level, the author notice that the $O(k)$ approximation for $k$-anonymity can be reduced to the minimum-size constrained clustering problem and apply the r-gather algorithm with pointwise guarantee in [EMMZ22]. They also give a hardness result on the following single-point $k$-anonymity problem, where the goal is to select $k - 1$ additional records to make a given record indistinguishable while minimizing the number of hidden attributes among these $k$ points.", "questions": "**Questions:**\n\n* It would be helpful if the authors could include an explicit analysis of the space complexity. The current algorithm seems to incur an extra $n^{o(1)}$ factor due to the use of LSH and this leads to an extra $n^{o(1)}$ factor in the MPC setting. In addition, it would be valuable to include a comparison with the $O(n^2k)$ space complexity of the algorithm in [AFK+05].\n* Could you clarify the main technical contribution of your result? As mentioned above, the main results and ideas, especially in the MPC part, seem largely drawn from [EMMZ22].\n* Could you include a comparison of the running time in the experimental section?\n* In theorem 1.2, how the total space depends on $\\epsilon$?", "limitations": "Yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths:\n\n* The result improves the sequential algorithm in [EMMZ22], resulting in a better overall running time of \n  $\\tilde O(nd + n·(n/k)^{1/C² + o(1)})$, which is better than $O(n^2k)$ in [AFK+05]. Furthermore, an MPC algorithm for this problem is provided. \n* A lower bound for a related problem, i.e., single-point k-anonymity problem, is given. \n\nWeaknesses:\n\n*  The main weakness in my opinion is the lack of novelty. The algorithms mainly based on a direct implementation of [EMMZ22]. The MPC part also appears to be a straightforward application of the framework from [EMMZ22], without a clear connection to the sequential improvements presented earlier.\n* Though a lower bound for the single-point $k$-anonymity is given, but its connection to the (lower bound of) the original problem is unclear. \n* While the paper’s main contribution lies in improving the time complexity, the experiments only focus on comparing the number of hidden attributes, with no evaluation of runtime performance.\n\n\nTypos:\n\n* On pages 6–7, the use of $O(1)$ seems inaccurate and should likely be $O(C)$.", "was_revised": true, "final_justification": "The reason is given in my previous comment.", "rebuttal": "We thank the reviewer for the detailed and constructive feedback. Below we address the specific questions.\n\n---\n\n**Space complexity**:\n\nWe thank the reviewer for pointing this out. We will include a more detailed space complexity analysis in the next version of the paper. It is correct that the use of LSH introduces additional space overhead. However, we note that in our algorithm, LSH is always computed over a subset of size $|J'| = (n \\log n) / k$ (though multiple times), rather than over the entire dataset. As a result, the overall space complexity of our algorithm is:\n\n$$\nO\\left(nd + n \\cdot \\left(\\frac{n}{k}\\right)^{1/C^2 + o(1)}\\right)\n$$\n\nIn comparison, the algorithm in [AFK+05] does not provide an explicit space complexity discussion, but to the best of our knowledge, its space usage is $O(nd)$.\n\nIn Theorem 1.2, the total space complexity does not depend on $\\epsilon$, as $\\epsilon$ serves as a trade-off parameter between accuracy and parallel runtime.\n\n---\n\n**Technical contributions**:\n\n- We  present a reduction showing that achieving an $O(k)$-approximation for $k$-anonymity can be reduced to solving the *minimum-size constrained clustering* problem with an $O(1)$ pointwise approximation guarantee under squared $\\ell_2$ distance . To our knowledge, this reduction is new to the literature.\n\n- Our algorithm for solving the minimum-size constrained clustering problem is inspired by [EMMZ22], where locality-sensitive hashing (LSH) is used. However, as noted in lines 179–184, directly adapting their algorithm leads to a runtime of $n^{1 + 1/C^2 + o(1)} k$, which can be as large as $n^2$ when $k = \\Theta(n)$. To overcome this, we incorporate a random sampling strategy that reduces $k$-nearest neighbor computations to 1-nearest neighbor computations, which to our knowledge, is generic and could have independent applications.\n\n- Finally, we provide a lower bound result for *single-point* $k$-anonymity (a local version of the original problem), showing that computing an $o(k)$-approximation is hard. Extending this result to a reduction from the global version remains an open and interesting direction for future work.\n\n---\n\n**Runtime in experiments**:\n\nWe thank the reviewer for raising this important point. We conducted additional experiments comparing our method with the most recent heuristic algorithm proposed in [ZWL+18]. We note that this algorithm performs on real-world data, but also has high computational complexity.The core idea of this algorithm involves:  \n1. Iteratively selecting a new cluster center as the point with the highest average distance from existing centers, and  \n2. Assigning the $k - 1$ nearest neighbors of that point to the same cluster.  \n\nThis strategy, while intuitive, results in at least $\\Omega(n^2)$ time complexity, even when we disregard other parameters such as $d$ and $k$.\n\nTo empirically assess runtime performance, we conducted experiments comparing the following algorithms:\n\n- **Mondrian**: We used the publicly available Python implementation (referenced on page 12 of [EEMM24]).\n\n- **Our algorithm**: Implemented in C++ for efficiency.\n\n- **[ZWL+18]**: Since no official implementation was available, we implemented the algorithm ourselves in C++. We applied the same optimization strategies as in our own implementation, including multi-threading where applicable and pre-processing steps to speed up pairwise distance computations.\n\nThe experimental results confirm our theoretical expectations. On the *Adult* dataset with $k = 10$:\n- **Mondrian** completed in approximately **1 second**,  \n- **Our algorithm** completed in **3.78 seconds**, and  \n- **[ZWL+18]** completed in **689.15 seconds** (here the run time increases a lot as $k$ decreases, see the below table for details).\n\n\nMoreover, motivated by the performance bottleneck of [ZWL+18], we investigated whether the core heuristic could be accelerated using ideas from our own algorithm. We found that substantial speed-ups are indeed possible, with minimal impact on performance.\n\nIn particular, we introduce the following modifications:\n\n1. For the center selection step (Step 1), instead of computing the average distance for all points, we randomly sample a fixed number of candidate points. \n\n2. Once a new center is chosen, we leverage Locality-Sensitive Hashing (LSH) to efficiently compute its approximate $k$-nearest neighbors. This process is similar to Lemmas 3.5 and 3.6 in our submission.\n\nIn our experiments, these modifications lead to a substantial reduction in runtime while preserving performance comparable to the original heuristic. Notably, the improved variant consistently outperforms the results presented in Section 5 of our current submission.\n\nBelow, we report the experimental results. We refer to the improved version of our new algorithm as **Ours (Heuristic)**:\n\n| Dataset       | Algorithm         | Runtime (s) | Number of hidden entries                  |\n|---------------|-------------------|-------------|-------------------------------------------|\n| Adult (k = 10)| Mondrian          | ~1.00       | 116214                                    |\n|               | ZWL+18            | 689.15      | 63617                                     |\n|               | Ours (Heuristic)  | 13.82       | 65209                                     |\n| Adult (k = 15)| Mondrian          | ~1.00       | 126422                                    |\n|               | ZWL+18            | 308.95      | 72284                                     |\n|               | Ours (Heuristic)  | 7.35        | 72956                                     |\n| Adult (k = 20)| Mondrian          | ~1.00       | 133783                                    |\n|               | ZWL+18            | 176.78      | 72856                                     |\n|               | Ours (Heuristic)  | 4.896       | 78724                                     |\n\nIn summary, our algorithm achieves nearly-linear runtime in theory. Empirically, we also demonstrate that our algorithmic ideas can be adapted to existing heuristic methods, leading to significant speed-ups while preserving comparable performance."}]

Author rebuttal:

Meta-review: This paper studies an optimization version of k-anonymity: what is the minimum number of cell suppressions needed to make a database k-anonymous? The authors provide an O(k)-approximation algorithm that runs in near-linear time, improving on previous methods that were either much slower or less accurate. They also adapt it to the Massively Parallel Computation (MPC) model and prove a conditional lower bound that matches their algorithm's approximation ratio. The results tell a "complete story" and the algorithm seems reasonably practical. All reviewers support the paper.
Decision: Accept (poster)