# Analytics on Anonymity for Privacy Retention in Smart Health Data +
## 5 Post Anonymization Analytics  
After an original data table has been anonymized, the table is ready to be released for public or sharing among appropriate parties. However, in case when the data that are privacy critical, further analyzing the anonymized table can be pursued. In this paper, we examine the resulting anonymized table obtained by our technique as described in  
\begin{table}
\begin{tabular}{c c c} \hline \hline  & **Anonymity Requirement** & **\#Rows** & **\#Generalizations** \\ \hline
**Method 1** & & **297** & **563** \\
**Method 2** & \(<\)[Zip, Smoker, Sex, Age], 5\(>\) & **274** & **68** \\
**Ours** & & **297** & **304** \\
**Method 1** & & **303** & **11** \\
**Method 2** & \(<\)[Zip, Smoker, Sex], 5\(>\) & **303** & **6** \\
**Ours** & & **298** & **93** \\
**Method 2** & \(<\)[Zip, smoker, Age], 5\(>\) & **274** & **11** \\
**Ours** & & **298** & **51** \\
**Method 1** & & **298** & **14** \\
**Method 2** & \(<\)[Zip, Age], 5\(>\) & **274** & **12** \\
**Ours** & & **298** & **14** \\ \hline \hline \end{tabular}
\end{table}
Table 7: Experiments with Different Anonymity Requirements.  
Section 3.3. To illustrate, consider the anonymized Cleveland dataset 1 (as obtained in Section 4). By applying the approach described in Section 3.1 using the [PERSON] et al.'s entropy-based measure, on the anonymized Cleveland dataset 1, we can further assess the effectiveness of the anonymization.  
Table 8 shows the overall results of this post anonymization analytics where each row indicates vulnerability to information leakages (i.e., normalized average information loss) given an attacker obtains information on the corresponding attribute in each column.  
As shown in Table 8, the first row gives the vulnerability \"Before Anonymization\". We see that the Zip attribute is most vulnerable as it leaks most information of 0.99. Next is Cholesterol and Age that leaks 0.85 and 0.61, respectively. These results can help partially select potential shield attributes although in practice, they are user-specified.  
Second row shows the vulnerability on anonymized table that is in compliance with the requirement of 5-anonymity on the shield attribute set {Age, Zip}, as denoted by <{Age, Zip}, 5>. This shield attributes agree with the vulnerability assessment for the most part and omit Cholesterol as it may not be acquired easily through binary query. As shown on second row of Algorithm 1, the Age attribute is now not leaking any information. Each record now has the same Age value as a result of anonymization (i.e., generalization).  
Note that only attributes that are on the shield (i.e., Age and Zip) have reduced average leakages (e.g., Age's loss from 0.61 to 0, and Zip's loss from 0.99 to 0.4). This is as expected since the generalization only can be applied to those attributes and causes a value change. The rest of other attribute values stays the same after anonymization. The information disclosure based on that attribute stays the same.  
Similarly, on the third row of Algorithm 1, the anonymization satisfies <{Age, Zip, Smoker, Sex}, 5>. Compared with Row 2, two more attributes (i.e., Smoker and Sex) are added to the anonymity requirement, leakages on Age and Zip remain the same (i.e., they are generalized to the same level as previous case). However, leakages on Smoker reduce to 0 but leakages on Sex remain the same. This means that anonymization process generalizes on Smoker attribute.  
The overall analytics on leakages after post anonymization indicate that the anonymization is effective since all shield attributes either maintain the same or reduced average information loss after the anonymization. Note that the average information loss is reversed from anonymity. When the information loss is high (i.e., an attacker obtains more information), the anonymity is low because the attacker can use the information to better distinguish individuals for re-identification. Therefore, we can use this measure to link to anonymity.