Pith. sign in

REVIEW 1 major objections 4 minor 40 references

Anonymous Public Announcements

T0 review · 1 major / 4 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Safe anonymous public announcements are shown to be exactly public announcements of a new safety modality, with a complete axiomatization and expressivity equivalence among the resulting languages.

desk verdict Worth reading and worth refereeing: the core reduction is clean, but the completeness proof has a small but genuine gap in Lemma 9 that the authors need to fix. read the letter →

arxiv 2504.12546 v2 pith:QSI2OUZH submitted 2025-04-17 cs.LO cs.AIcs.CR

Thomas {AA}gotnes , Rustam Galimullin , Ken Satoh , Satoshi Tojo This is my paper · ORCID
classification cs.LOcs.AIcs.CR
keywords announcementanonymouspubliccaseinformationlogicmightreveal
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Imagine someone in a group writes 'p' on a blackboard without signing it. The group learns more than the fact p: they learn that at least one of them knows p. But they do not necessarily learn which one. The paper formalizes this as a pseudo-anonymous announcement, whose update keeps a copy of the world for each possible announcer who knew p. Within this framework, the authors show these updates can be translated back into ordinary epistemic logic, although no public announcement can reproduce the same information update.

The paper then considers announcements made with the intention to stay anonymous. Now the announcer must be sure enough people could have said the same thing, and those people must in turn know that enough people could have said it, and so on. The authors encode this recursive requirement as a safety operator, written like a diamond, and defined as a greatest fixed point. A safe announcement is then exactly the public announcement of safety: it removes exactly the states where the statement would not have been safe. They prove this equivalence, and also that the safe announcement language, the safety language, and their combination all have the same expressive power.

The final part gives a sound and complete axiom system for the safety modality, using a Mix axiom and an induction rule similar to common knowledge, but adapted to a weaker, non-normal modality. The paper is theoretical throughout; it does not provide tooling or case studies.

Extended reading notes

Core claim

Safe intentional anonymous announcements are exactly public announcements of safety: for any formulas phi and psi, [phi‡]psi is equivalent to [safety(phi)!]psi, and the safety logic L_safety is sound and complete. This is stated as Lemma 3 and its corollary in Section 4, with completeness as Theorem 1.

Load-bearing premise

The equivalence and completeness results rest on the model-theoretic assumption that the event 'someone announced phi' carries no information beyond 'some agent knows phi', and that anonymity is judged against individual agents rather than coalitions. This enters at Definition 8, where the updated accessibility is (s,a) ~_c (t,b) iff s ~_c t and a=c iff b=c, and in the choice of three-agent groups in the fixpoint defining safety. If announcements leak metadata, or if non-announcers pool knowledge via distributed knowledge, safety as defined may fail; the paper itself lists distributed knowledge as future work in Section 5.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

1 major / 4 minor

Summary. The paper formalizes anonymous public announcements in the DEL tradition, distinguishing pseudo-anonymous announcements [ϕ†] (no assumption about the announcer's intention) from intentional safe announcements [ϕ‡] (common knowledge of the intention to stay anonymous). The pseudo-anonymous operator is shown to be reducible to epistemic logic via action models, and L† and L! are shown to be update incomparable. The central contribution is a new safety modality ▲, defined as a greatest fixpoint over triples of agents, together with the results that [ϕ‡]ψ is equivalent to the public announcement of safety [▲ϕ!]ψ (Lemma 3), that the languages L‡▲, L‡, and L▲ are equally expressive (Corollary 2), and that the proof system S▲ is sound and complete for L▲ (Proposition 3 and Theorem 1).

Significance. If the results stand, the paper provides a clean and useful DEL-based account of anonymous communication, a novel non-normal safety modality, and a complete axiomatization via a canonical-model argument adapted from common knowledge. The expressivity hierarchy and the fixpoint characterization are elegant, and the reduction of safe anonymous announcements to public announcements of safety is a particularly appealing simplification. The paper carefully separates pseudo- from intentional anonymity and connects the framework to k-anonymity and the Russian Cards problem. The proofs are mostly standard and the paper is honest about its assumptions, explicitly listing distributed knowledge and self-referential announcements as future work. One load-bearing step in the completeness proof, however, needs repair before Theorem 1 is fully established; this is the basis of my major comment.

major comments (1)
  1. [Section 4.2.2, Lemma 9 and the definition of group assignment function before Lemma 8] In Lemma 9, the candidate group assignment f is defined by 'f(Δ)=G if E_G▲ϕ∈Δ for some G⊆N' (and similarly in the left-to-right direction), with an arbitrary choice among such G. This conflicts with the definition of a group assignment function before Lemma 8, which requires f(Δ)∈N3 or f(Δ)=∅. The conflict is load-bearing in the proof of (2): after establishing 'for every G∈N3 there is i_G∈G such that Δ∧◇K_{i_G}¬χ is consistent', the proof instantiates with G=f(Δ); if the arbitrary choice produced a singleton or pair, that instantiation is invalid. The same problem affects the use of f-consistent paths in the left-to-right direction, where the path argument in Lemma 8 relies on f assigning triples. The gap is local and repairable: from Δ⊢▲ϕ, the Mix axiom gives E_H▲ϕ for some H∈N3, so f(Δ) can be defined to choose such a triple. As printed, however, Theorem 1 is not fully established.
minor comments (4)
  1. [Definition 11] The clause '(s,a)∼′_c (t,b) iff s∼_c b and a=c iff b=c' should read 's∼_c t' instead of 's∼_c b'; as written it compares a state with an agent.
  2. [Lemma 3, proof] In the Back direction, the names c and d are reused both as the case parameter and as members of the triple guaranteed by ▲ϕ, which makes the argument unnecessarily hard to follow; renaming the triple members would improve clarity.
  3. [Lemma 4] The reduction argument is compressed: the claim that the AML reduction axioms remain valid in AML▲− and that the process terminates in L▲ is stated rather than proved. This is standard, but a short explanation of why ▲ never appears in the scope of a dynamic modality during the reduction would help.
  4. [Section 3.2, Proposition 2] In the formula ϕ := r∧ bKa q∧ bKbKa(¬q∧r)∧Kb p, the symbol 'b' before K_a appears to be a rendering of the diamond ◇_b; this should be typeset consistently to avoid confusion.

Circularity Check

1 steps flagged · score 3.0 of 10

The [ϕ‡]/safety equivalence is largely built into Definition 11, but the safety guarantee and completeness proof are independent; the printed completeness proof has a non-circular gap.

  1. self definitional [Section 4, Definition 11; Section 4.1, Lemma 5; Lemma 3]
    "Definition 11: S′ ={(s,a ) :s∈S, M,s|=Ka▲ϕ} ... M,s|= [ϕ‡]ψ⇔∀a∈N, M,s|=Ka▲ϕ⇒Mϕ‡, (s,a )|=ψ. Lemma 5: M,s |=▲ϕ iff M,s|=¬[ϕ‡]⊥."

    The [ϕ‡] operator is introduced with a semantic precondition K_a▲ϕ for each possible announcer a, i.e. [ϕ‡] is defined in terms of ▲ϕ. Therefore ¬[ϕ‡]⊥ is, by definition, 'there is an a with K_a▲ϕ'; Lemma 5 then equates this with ▲ϕ using only the Truth axiom and the fixed-point/Mix property of ▲. The claimed expressibility of ▲ by [ϕ‡], and the related reduction [ϕ‡]ψ ↔ [▲ϕ!]ψ in Lemma 3, are thus restatements of the chosen definition rather than independent derivations. This is not a hidden fit or a statistical prediction; it is a transparent definitional reduction. The paper's independent content lies in Lemma 2, the update-expressivity comparisons, and the axiomatisation.

full rationale

The paper contains one self-definitional reduction: Definition 11 defines [ϕ‡] by the precondition K_a▲ϕ, and Lemma 5 shows ▲ϕ ↔ ¬[ϕ‡]⊥; Lemma 3 shows [ϕ‡]ψ ↔ [▲ϕ!]ψ. These are honest, visible equivalences that follow from the chosen semantics plus the S5/fixed-point properties of the safety operator. They are not fitted predictions and no external data are involved. The safety guarantee in Lemma 2, the update-expressivity results (Proposition 2, Corollary 1), the expressivity collapse (Corollary 2), and the soundness/completeness of S▲ are substantive results that do not reduce to the definition of [ϕ‡]. No load-bearing self-citation is used: the cited prior work of the authors is background or future work (e.g., group announcement logic, quantified announcements), and the standard DEL/canonical-model tools are cited to textbooks. Separately, the completeness proof as printed has a non-circular gap: in Lemma 9, f(Δ) is defined as 'G if E_G▲ϕ ∈ Δ for some G⊆ N', choosing an arbitrary G, but a group assignment function was defined to require f(s)∈N3 or ∅; the subsequent proof of (2) instantiates G = f(Δ) and needs a triple. This is a local, repairable gap (one can pick a triple H∈N3 with E_H▲ϕ via Mix), not a circularity. Overall score 3 reflects that one central equivalence is definitional, while the main technical content is independent.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The paper introduces no physical or empirical entities. Its new formal operators, [phi†], [phi‡], and the safety modality, are syntactic and semantic constructs rather than postulated entities with falsifiable handles. The load-bearing assumptions are the S5 epistemic background, standard DEL reduction facts, the three-agent safety condition, and the sparse event model for anonymous announcements.

assumptions (5)
  • standard math Multi-agent epistemic logic is S5: each agent's accessibility relation is an equivalence relation, with Truth and introspection.
    Definition 1 defines epistemic models with equivalence relations, and the axiomatisation in Table 1 includes Truth, Negative Introspection, and Necessitation for individual knowledge.
  • standard math Standard dynamic epistemic logic facts hold: action model logic is equally expressive as epistemic logic via reduction axioms, and bisimulation invariance applies.
    Invoked in Section 3.1 to reduce pseudo-anonymous announcements to epistemic logic, and in Lemma 3 and Lemma 4 for safe announcements.
  • standard math Common knowledge and the new safety operator are defined as greatest fixed points of monotone operators.
    Used in Section 4 to define the safety modality via the post-fixed point characterization, and in the completeness proof via the finite canonical model technique.
  • domain assumption At least three distinct agents are required for a safe announcement.
    The safety operator quantifies over N3, the set of groups of three different agents, and the text argues that 2-anonymity is insufficient when the adversary is inside the system.
  • domain assumption The anonymous announcement event conveys no information beyond 'some agent who knows phi announced it', with no metadata, timing, or coalitional inference.
    Definition 8 and the action model in Definition 10 encode exactly this. Section 5 acknowledges that distributed knowledge would require further work, confirming this is a modeling boundary.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Anonymous Public Announcements." pith.science (2026). https://pith.science/paper/QSI2OUZH

@misc{pith2026250412546,
  author       = {Pith},
  title        = {Pith review of: Anonymous Public Announcements},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QSI2OUZH}},
  note         = {Machine review of arXiv:2504.12546}
}
abstract

We formalise the notion of an anonymous public announcement in the tradition of public announcement logic. Such announcements can be seen as in-between a public announcement from ``the outside" (an announcement of $\phi$) and a public announcement by one of the agents (an announcement of $K_a\phi$): we get more information than just $\phi$, but not (necessarily) about exactly who made it. Even if such an announcement is prima facie anonymous, depending on the background knowledge of the agents it might reveal the identity of the announcer: if I post something on a message board, the information might reveal who I am even if I don't sign my name. Furthermore, like in the Russian Cards puzzle, if we assume that the announcer's intention was to stay anonymous, that in fact might reveal more information. In this paper we first look at the case when no assumption about intentions are made, in which case the logic with an anonymous public announcement operator is reducible to epistemic logic. We then look at the case when we assume common knowledge of the intention to stay anonymous, which is both more complex and more interesting: in several ways it boils down to the notion of a ``safe" announcement (again, similarly to Russian Cards). Main results include formal expressivity results and axiomatic completeness for key logical languages.

Figures

Figures reproduced from arXiv: 2504.12546 by the authors.

Figure 1
Figure 1. Three-agent epistemic model (middle) and its update after the event [PITH_FULL_IMAGE:figures/full_fig_p008_1.png] view at source ↗
Figure 2
Figure 2. The three-agent pseudo-anonymous action model. [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. Epistemic model M. To see that there is no pseudo-anonymous announcement ϕ† that will result in a model bisimilar to Mp! , it is enough to notice that none of the agents in model M has the ability to remove ¬p-states due to precondition Kiϕ for pseudo-anonymous announcements. To show that there are pseudo-anonymous announcements that cannot be captured by public announcements, we turn back to the model M in the cen￾… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Three-agent epistemic model (top) and its update after a pseudo [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 5
Figure 5. Figure 5: Three-agent epistemic model, with update. Accessibility for agent [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 6
Figure 6. Figure 6: Four-agent epistemic model M, with updated model Mp‡ (black nodes and dotted edges) as well as Mp† (black and white nodes, solid and dotted edges). While ▲ϕ means that ϕ can safely be announced, Ka▲ means that ϕ can safely be announced by a. It is easy to see that: M, …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

40 extracted references · 35 canonical work pages

  1. [1]

    Studia Logica 104(4), 597–640 (2016)

    Ågotnes, T., Ditmarsch, H., French, T.: The undecidability of quantified announcements. Studia Logica 104(4), 597–640 (2016). https://doi.org/10.1007/s11225-016-9657-0, http://dx.doi.org/10. 1007/s11225-016-9657-0 6That also applies to the Russian Cards problem. 25

    work page doi:10.1007/s11225-016-9657-0 2016

  2. [2]

    Journal of Logic, Language and Information 31(2), 141–166 (2022)

    Ågotnes, T., Alechina, N., Galimullin, R.: Logics with group announce- ments and distributed knowledge: Completeness and expressive power. Journal of Logic, Language and Information 31(2), 141–166 (2022). https://doi.org/10.1007/s10849-022-09355-0

    work page doi:10.1007/s10849-022-09355-0 2022

  3. [3]

    Journal of Applied Logic8(1), 62–81 (2010)

    Ågotnes, T., Balbiani, P., van Ditmarsch, H., Seban, P.: Group announce- ment logic. Journal of Applied Logic8(1), 62–81 (2010)

    work page 2010

  4. [4]

    Autonomous Agents and Multi-agent Systems37(19) (2023)

    Ågotnes, T., Galimullin, R.: Quantifying over information change with common knowledge. Autonomous Agents and Multi-agent Systems37(19) (2023)

    work page 2023

  5. [5]

    In: Bienvenu, M., Lake- meyer, G., Erdem, E

    Ågotnes, T., Wáng, Y.N.: Somebody knows. In: Bienvenu, M., Lake- meyer, G., Erdem, E. (eds.) Proceedings of the 18th KR. pp. 2–11 (2021).https://doi.org/10.24963/kr.2021/1, https://doi.org/10.24963/ kr.2021/1

    work page doi:10.24963/kr.2021/1 2021

  6. [6]

    Review of Symbolic Logic 1(3), 305–334 (2008)

    Balbiani, P., Baltag, A., van Ditmarsch, H., Herzig, A., Hoshi, T., Lima, T.D.: ‘Knowable’ as ‘known after an announcement’. Review of Symbolic Logic 1(3), 305–334 (2008)

    work page 2008

  7. [7]

    Journal of Applied Non-Classical Logics25(1), 2–19 (2015)

    Balbiani, P.: Putting right the wording and the proof of the truth lemma for apal. Journal of Applied Non-Classical Logics25(1), 2–19 (2015)

    work page 2015

  8. [8]

    Studies in Logic8, 65–78 (2015)

    Balbiani, P., van Ditmarsch, H.: A simple proof of the completeness of apal. Studies in Logic8, 65–78 (2015)

    work page 2015

Show all 40 references
  1. [9]

    In: Kern-Isberner, G., Lakemeyer, G., Meyer, T

    Baltag, A., Bezhanishvili, N., Fernández-Duque, D.: The topology of sur- prise. In: Kern-Isberner, G., Lakemeyer, G., Meyer, T. (eds.) Proceedings of the 19th KR (2022). https://doi.org/10.24963/kr.2022/4

    2022 doi

  2. [10]

    Synthese139(2), 165–224 (2004)

    Baltag, A., Moss, L.S.: Logics for epistemic programs. Synthese139(2), 165–224 (2004). https://doi.org/10.1023/B:SYNT.0000024912.56773.5E

    2004

  3. [11]

    In: Proceed- ings of the 27th CSF

    Barthe, G., Gaboardi, M., Arias, E.J.G., Hsu, J., Kunz, C., Strub, P.: Proving differential privacy in hoare logic. In: Proceed- ings of the 27th CSF. pp. 411–424. IEEE Computer Society (2014). https://doi.org/10.1109/CSF.2014.36

    2014 doi

  4. [12]

    In: Blackburn, P., Van Ben- them, J., Wolter, F

    Bradfield, J., Stirling, C.: Modal mu-calculi. In: Blackburn, P., Van Ben- them, J., Wolter, F. (eds.) Handbook of Modal Logic, Studies in Logic and Practical Reasoning, vol. 3, pp. 721–756. Elsevier (2007). https://doi.org/10.1016/S1570-2464(07)80015-2

    2007 doi

  5. [13]

    Studia logica75, 31–62 (2003)

    van Ditmarsch, H.: The russian cards problem. Studia logica75, 31–62 (2003). https://doi.org/10.1023/A:1026168632319

    2003 doi

  6. [14]

    van Ditmarsch, H., van der Hoek, W., Kooi, B.: Dynamic Epistemic Logic, Synthese Library, vol. 337. Springer (2007) 26

    2007

  7. [15]

    Information and Computation275, 104544 (2020)

    van Ditmarsch, H., van der Hoek, W., Kooi, B., Kuijer, L.B.: Ar- row update synthesis. Information and Computation275, 104544 (2020). https://doi.org/10.1016/J.IC.2020.104544

    2020

  8. [16]

    Synthesis Lectures on Information Secu- rity, Privacy, & Trust, Morgan & Claypool Publishers (2016)

    Domingo-Ferrer, J., Sánchez, D., Soria-Comas, J.: Database Anonymiza- tion: Privacy Models, Data Utility, and Microaggregation-based Inter-model Connections. Synthesis Lectures on Information Secu- rity, Privacy, & Trust, Morgan & Claypool Publishers (2016). https://doi.org/10...

    2016 doi

  9. [17]

    The MIT Press, Cambridge, Massachusetts (1995)

    Fagin, R., Halpern, J.Y., Moses, Y., Vardi, M.Y.: Reasoning About Knowl- edge. The MIT Press, Cambridge, Massachusetts (1995)

    1995

  10. [18]

    In: Blackburn, P., van Benthem, J., Wolter, F

    Goranko, V., Otto, M.: Model theory of modal logic. In: Blackburn, P., van Benthem, J., Wolter, F. (eds.) Handbook of Modal Logic, Studies in Logic and Practical Reasoning, vol. 3, pp. 249–329. Elsevier (2007)

    2007

  11. [19]

    Journal of Computer Security 13(3), 483–512 (2005)

    Halpern, J.Y., O’Neill, K.R.: Anonymity and information hiding in mul- tiagent systems. Journal of Computer Security 13(3), 483–512 (2005). https://doi.org/10.3233/JCS-2005-13305

    2005 doi

  12. [20]

    ACM Transactions on Information and System Security12(1), 5:1–5:47 (2008)

    Halpern, J.Y., O’Neill, K.R.: Secrecy in multiagent systems. ACM Transactions on Information and System Security12(1), 5:1–5:47 (2008). https://doi.org/10.1145/1410234.1410239

    2008

  13. [21]

    Mathematical Social Sciences 38(2), 215–240 (1999)

    van der Hoek, W., van Linder, B., Meyer, J.J.: Group knowledge is not always distributed (neither is it always im- plicit). Mathematical Social Sciences 38(2), 215–240 (1999). https://doi.org/https://doi.org/10.1016/S0165-4896(99)00013-X

    1999 doi

  14. [22]

    Journal of Computer Security 12(1), 3–36 (2004)

    Hughes, D.J.D., Shmatikov, V.: Information hiding, anonymity and pri- vacy: a modular approach. Journal of Computer Security 12(1), 3–36 (2004). https://doi.org/10.3233/JCS-2004-12102

    2004 doi

  15. [23]

    Journal of Cybersecurity 11(1) (2025)

    Jiang, J., Naumov, P.: De re/de dicto distinction: a logicians’ per- spective on data anonymity. Journal of Cybersecurity 11(1) (2025). https://doi.org/10.1093/CYBSEC/TYAE025

    2025 doi

  16. [24]

    In: Proceedings of the The 6th International Conference on Logic and Argumentation (CLAR 2025)

    Li, Y., Ren, J., Ågotnes, T.: The surprise exam in full modal fixed-point logic. In: Proceedings of the The 6th International Conference on Logic and Argumentation (CLAR 2025). LNCS, Springer (2025), to appear

    2025

  17. [25]

    ACM Trans- actions on Knowledge Discovery from Data 1(1), 3 (2007)

    Machanavajjhala, A., Kifer, D., Gehrke, J., Venkitasubrama- niam, M.: L-diversity: Privacy beyond k-anonymity. ACM Trans- actions on Knowledge Discovery from Data 1(1), 3 (2007). https://doi.org/10.1145/1217299.1217302

    2007

  18. [26]

    Journal of Logic and Computation20(6), 1251–1288 (2010)

    Mano, K., Kawabe, Y., Sakurada, H., Tsukada, Y.: Role interchange for anonymity and privacy of voting. Journal of Logic and Computation20(6), 1251–1288 (2010). https://doi.org/10.1093/LOGCOM/EXQ013 27

    2010 doi

  19. [27]

    41.CUP(1995)

    Meyer, J.C., van der Hoek, W.: Epistemic logic for AI and computer sci- ence, Cambridge tracts in theoretical computer science, vol. 41.CUP(1995)

    1995

  20. [28]

    An- nals of Mathematics and Artificial Intelligence 62(1-2), 79–101 (2011)

    More, S.M., Naumov, P.: Hypergraphs of multiparty secrets. An- nals of Mathematics and Artificial Intelligence 62(1-2), 79–101 (2011). https://doi.org/10.1007/S10472-011-9252-Z

    2011 doi

  21. [29]

    Annals of Pure and Applied Logic 162(12), 959–969 (2011)

    More, S.M., Naumov, P.: Logic of secrets in collaboration net- works. Annals of Pure and Applied Logic 162(12), 959–969 (2011). https://doi.org/10.1016/J.APAL.2011.06.001

    2011 doi

  22. [30]

    In: Proceedings of the 32nd IJCAI

    Naumov, P., Orejola, O.: Shhh! the logic of clandestine operations. In: Proceedings of the 32nd IJCAI. pp. 3304–3311. ijcai.org (2023). https://doi.org/10.24963/IJCAI.2023/368

    2023 doi

  23. [31]

    inf.tu-dresden.de/literatur/Anon_Terminology_v0.34.pdf, v0.34

    Pfitzmann, A., Hansen, M.: A terminology for talking about privacy by data minimization: Anonymity, unlinkability, undetectability, unobserv- ability, pseudonymity, and identity management (Aug 2010),http://dud. inf.tu-dresden.de/literatur/Anon_Terminology_v0.34.pdf, v0.34

    2010

  24. [32]

    In: Proceedings of the 4th ISMIS

    Plaza, J.: Logics of public communications. In: Proceedings of the 4th ISMIS. pp. 201–216. Oak Ridge National Laboratory (1989)

    1989

  25. [33]

    In: Bertino, E., Kurth, H., Martella, G., Montolivo, E

    Schneider, S.A., Sidiropoulos, A.: CSP and anonymity. In: Bertino, E., Kurth, H., Martella, G., Montolivo, E. (eds.) Proceedings of the 4th ESORICS. LNCS, vol. 1146, pp. 198–218. Springer (1996). https://doi.org/10.1007/3-540-61770-1_38

    1996 doi

  26. [34]

    International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems10(5), 557–570 (2002)

    Sweeney, L.: k-anonymity: A model for protecting privacy. International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems10(5), 557–570 (2002). https://doi.org/10.1142/S0218488502001648

    2002 doi

  27. [35]

    In: Wing, J.M., Woodcock, J., Davies, J

    Syverson, P.F., Stubblebine, S.G.: Group principals and the formaliza- tion of anonymity. In: Wing, J.M., Woodcock, J., Davies, J. (eds.) Pro- ceedings of the FM 1999. LNCS, vol. 1708, pp. 814–833. Springer (1999). https://doi.org/10.1007/3-540-48119-2_45

    1999 doi

  28. [36]

    In: Proceed- ings of the 12th CSE

    Tsukada, Y., Mano, K., Sakurada, H., Kawabe, Y.: Anonymity, pri- vacy, onymity, and identity: A modal logic approach. In: Proceed- ings of the 12th CSE. pp. 42–51. IEEE Computer Society (2009). https://doi.org/10.1109/CSE.2009.251

    2009 doi

  29. [37]

    An- nals of Mathematics and Artificial Intelligence 78(2), 101–129 (2016)

    Tsukada, Y., Sakurada, H., Mano, K., Manabe, Y.: On composi- tional reasoning about anonymity and privacy in epistemic logic. An- nals of Mathematics and Artificial Intelligence 78(2), 101–129 (2016). https://doi.org/10.1007/S10472-016-9516-8, https://doi.org/10.1007/ s10472-0...

    2016 doi

  30. [38]

    Elec- tronic Notes in Theoretical Computer Science 168, 159–174 (2007)

    van Eijck, J., Orzan, S.: Epistemic verification of anonymity. Elec- tronic Notes in Theoretical Computer Science 168, 159–174 (2007). https://doi.org/https://doi.org/10.1016/j.entcs.2006.08.026, proceedings of the 2nd VODCA

    2007 doi

  31. [39]

    Annals of Mathematics and Artificial Intelligence91(4), 375–407 (2023)

    Xiong, Z., Ågotnes, T.: The logic of secrets and the interpolation rule. Annals of Mathematics and Artificial Intelligence91(4), 375–407 (2023). https://doi.org/10.1007/S10472-022-09815-0

    2023 doi

  32. [40]

    In: Ramamohanarao, K., Krishna, P.R., Mohania, M.K., Nantajeewarawat, E

    Ye, X., Li, Z., Li, Y.: Capture inference attacks for k-anonymity with privacy inference logic. In: Ramamohanarao, K., Krishna, P.R., Mohania, M.K., Nantajeewarawat, E. (eds.) Proceedings of the 12th DASFAA. LNCS, vol. 4443, pp. 676–687. Springer (2007). https://doi.org/10.100...

    2007 doi

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.