k-anonymity

k-anonymity is a privacy property in which any individual record is indistinguishable from at least k-1 others, so nothing can be attributed to one person. In threat intelligence, it enables cross-organization sharing: participants can learn that the same (hashed) identifier is being attacked across multiple tenants without any participant learning who the identifier belongs to.

The property degrades in ways that are easy to miss. Combining several k-anonymous releases, or joining one against an external dataset, can reduce the effective group size below k, which is the standard critique of the model.

For shared threat intelligence the useful form is narrow: participants compare keyed digests and learn only that a value is seen by more than one of them, without any participant learning the value or the other participants' subscriber lists.

The property is fragile under composition, which is the standard critique and the one most likely to bite in practice. Two separately k-anonymous releases can identify individuals when joined, and a release that is k-anonymous against the data the publisher holds may not be against an external dataset the publisher has never seen.

It also protects identity rather than attributes. If every member of a group shares the same sensitive value, learning which group someone belongs to reveals that value without ever identifying them individually, which is the gap that later refinements were proposed to address.

For cross-organization threat sharing the useful form is deliberately narrow, which is what makes it defensible. Participants exchange keyed digests and learn only that a value is seen by more than one of them, without learning the value, the other participants' subscriber lists, or anything about the individuals behind it. That narrowness depends on the digests being produced under a shared secret, since keyspace enumeration would otherwise let any participant recover the inputs and the group structure would protect nothing.

Participants are exchanging derived data, so the properties of the derivation decide what the scheme actually protects.