## 2 Related Work  
Extensive studies have been conducted in the area of privacy-preserving data publishing (PPDP). The most popular anonymization algorithm, \(k\)-anonymity, was first formulated in [1]. Various algorithms have been proposed to achieve the \(k\)-anonymity requirement. [PERSON] et al. finds full-domain optimal \(k\)-anonymous generalizations with a bottom-up pruning approach [2]. [PERSON] et al. proposed a bottom-up generalization algorithm to find a minimal \(k\)-anonymization for classification [13]. [PERSON] et al. presented the top-down specialization scheme in which the specialization process terminates if further specialization on quasi-identifier attribute values violates the \(k\)-anonymity requirement [14]. [PERSON] [15]  
Figure 1: System architecture assumed in this paper. is a multidimensional generalization model that anonymizes data by recursively partitioning the space across the dimension. Clustering-based methods have been proposed to effectively find the \(k\)-anonymous table. For example, [16; 17] group \(k\) similar records into a cluster and generalize each cluster to achieve \(k\)-anonymity. Besides \(k\)-anonymity, many privacy metrics have been proposed in the literature. [PERSON] et al. [3] introduced \(l\)-diversity that requires that each equivalence has at least \(l\) well represented values of a sensitive attribute. [PERSON] et al. proposed \(t\)-closeness that requires that the distribution of a sensitive attribute in each equivalence class is similar to the distribution of the entire table [4]. \(p^{+}\)-sensitive \(k\)-anonymity was proposed to prevent similarity attacks, and thus to reduce the potential threat for attribute disclosure [18; 19; 20]. [PERSON] et al. [21] developed a delay-free anonymization method to publish electronic health data streams. In [22], a utility-preserving anonymization method for PPDP, which preserves the utility of health data by inserting counterfeit records and creating a catalog of the counterfeit records in the process of data anonymization, was proposed. [PERSON] et al. [23] introduced the \(\theta\)-sensitive \(k\)-anonymity privacy model, in which the threshold \(\theta\) determines the diversity level of an equivalence class, to prevent the sensitive variance attack when publishing electronic health records. A comprehensive survey of privacy-preserving data publishing can be found in [24; 25; 26; 27; 28; 29]. Differential privacy (DP) [30], which is the strongest scheme for protecting individuals' privacy in released data, has been extensively studied in diverse areas, including data mining and medical analysis. DP guarantees that an attacker with arbitrary background knowledge cannot infer with high confidence whether a particular individual is participating in the query result (or the published data). DP can be used in two different settings. The first one is the offline setting where a statistical summary, such as histograms or a set of synthetic data that mimic the original data, is released for public use [31]. The second one is the online setting, where the user issues a statistical query to the original database, and then a perturbed version of the query result is returned to the user [32]. With its strong privacy guarantees, DP has been used in various application areas and many variants of DP have been proposed in the literature, such as local differential privacy [33; 34; 35; 36] and geo-indistinguishability [37; 38]. DP can be used for publishing location data in a privacy-preserving manner by using a spatial histogram [39; 40]. DP complaint spatial histograms are constructed by first partitioning a spatial domain into several cells and then adding carefully calibrated noise to the true count of objects located within the boundaries of each cell. Unlike anonymization methods, DP is mostly used for the release of aggregated results, such as histograms or cross tabulations. However, several recent attempts have been made to apply DP along with an anonymization algorithm to the publishing of microdata.