## 3 Need for Dynamic Consent of Personal Data
### Linear Model of Sherlock Threat  
By what kind of mechanism can better-trained machine learning be a threat to the privacy of the previously provided personal data? A simple linear model can explain such a phenomenon. It is possible to explain why a trained neural network can extract more personal identity and personal characteristics from previously provided personal data. When we obtain one attribute of the person, we can always identify the person by that attribute if precision is infinite. Therefore, by theoretical information, anonymization can be explained as the limitation of information by obtaining attributes belonging to the record corresponding to the individual. In order to identify an individual in population \(N\), necessary entropy is \(H_{1}\) as expression (1), and where the size of the population is \(N\) and would like to ensure k anonymization, the entropy of the attribute needs to be less than expression (2). If so, the entropy of individual individuals is less than the entropy for distinguishing individuals in groups with granularity smaller than k.  
\[H_{1}=\log_{2}N\ [\text{bit}] \tag{1}\]  
\[H_{2}<\log_{2}N-\log_{2}k\ [\text{bit}] \tag{2}\]  
However, there is a possibility of an unexpected way to obtain the ability to identify an individual by the support of external statistical data. In Figure 1, attribute \(x_{1}\) and attribute \(x_{2}\) are given, and associate attributes \(y_{1}\) and \(y_{2}\) can be calculated by given statistical data, as shown in (a) and (b). In this case, the distribution of (\(y_{1}\), \(y_{2}\)) given by (a) and (b) is broad, and individual \(a\), \(b\), \(c\), and \(d\) (in the graph) cannot be identified. Figure 1: Identification of individuals without Sherlock threat: Attribute \(x_{1}\) and attribute \(x_{2}\) are given, and associate attributes \(y_{1}\) and \(y_{2}\) can be calculated by given statistical data, as shown in (**a**,**b**) and mapped distribution (y1, y2) is shown in (**c**). In this case, the distribution of (y1, y2) given by (**a**,**b**) is broad, and individual p, q, r, and s (in the graph (**c**)) cannot be identified. However, if some external statistics had become available, as shown in Figure 2a,b, the delivery of the statistical distribution of (\(y_{1}\),\(y_{2}\)) would be more narrowed, and the person would be identified in this case. \[ \begin{pmatrix}y_{1}\\ \vdots\\ y_{K}\end{pmatrix} =ABv=AB \begin{pmatrix}x_{1}\\ \vdots\\ x_{L}\\ n_{1}\\ \vdots\\ n_{M}\end{pmatrix}  \tag{3}\]  
We can build a mathematical model of Sherlock threat by analyzing information delivery between the information source and database. Figure 2c explains that entropy H is necessary to identify a person, and identification of a person is possible when entropy H is sufficient. Expression (3) explains the relationship between information source \(x_{1}\) and \(x_{L}\) and derives attribute \(y_{1}\) to \(y_{k}\). The additional noise \(n_{1}\).\(n_{M}\) exists to make it difficult to identify a person by reducing the information available by Abv, where A and B are matrices and v is a vector consisting of information x corresponding to the individual and noise n. By simple observation, information on Bv looks small because Bv includes noise, or, in other words, the signal is covered by noise. Even in such a case, if we know matrix B, we can remove noise by providing appropriate A to derive y. Therefore, in this linear model, we assumed that Bv shows there is no sufficient information available in Bv to identify an individual. Therefore, the entropy of Bv is small enough to satisfy k-anonymization. However, there are possibilities of finding matrix A to remove noise and still identify a person by exploiting the statistical structure of matrix B.