guarantee that sanitize() returns a proper non-colliding value for each input