Sanitization models and their limitations
The tracker: a threat to statistical database security