Calibrating Noise to Sensitivity in Private Data Analysis
k-Anonymity: A Model for Protecting Privacy