A model-theoretic approach to data anonymity and inference control

In secure data management the inference problem occurs when data classified at a high security level becomes inferrible from data classified at lower levels. We present a model-theoretic approach to this problem that captures the epistemic state of the database user as a set of possible worlds or models. Privacy is enforced by requiring the existence of k > 1 models assigning distinct values to sensitive attributes, and implemented via model counting. We provide an algorithm mechanizing this process and show that it is sound and complete for a large class of queries.