Anonymity’s ARX nemesis

Nathan Kahl — Mon, 20 Oct 2025 15:12:08 +0000

Anonymity’s ARX nemesis Nathan Kahl Mon, 10/20/2025 - 11:12

A team of faculty and students from �鶹��Ƶ recently discovered a vulnerability in a widely used anonymization tool. They presented their findings last week in Taiwan at the Association for Computing Machinery Conference on Computer and Communications Security (ACM CCS), one of the world’s most prestigious computer security conferences, with a very low paper acceptance rate.

The problem they discovered was with ARX, an open-source data anonymization tool, which provides what is referred to as k-anonymity. It is a commonly used tool in clinical settings to maintain data privacy. The discovery is particularly important at a time when more and more private data is being used in a variety settings and systems.

Evgenios Kornaropoulos, an assistant professor in the Department of Computer Science, said, “Sometimes this type of microdata is very valuable. Tools like ARX anonymize the data so it’s compliant with HIPAA, and then that data can be shared with policymakers, engineers, scientists, and others who will make policy decisions and scientific studies based on this information.”

While many people receiving medical care are comfortable with their information being included in larger data sets for purposes of medical discovery, they likely do not want personal, identifiable information released.

Chhillar presented findings at ACM CCS in Taiwan.

“For patients, and especially those from more vulnerable or marginalized communities, data privacy is not an abstract concern, it’s deeply tied to trust in the health care system," said paper co-author Rebecca Sutter, a professor in the School of Nursing, and director of the MAP Clinics. "The integrity of tools like ARX matters because they underpin how we protect patient information while advancing public health research. When anonymization fails, it’s not only a technical vulnerability, it’s a human one."

Computer science PhD student Somiya Chhillar, lead author on the paper, said that the ubiquity of ARX was a reason they chose to study it. “We wanted to see how ARX really operates and how the algorithm works. While we were doing that, we realized that a few of the steps that it takes are very opportunistic, and because of that, it leaks information that we shouldn't be finding out by just looking at the anonymized data.”

Chhillar said that ARX follows a “greedy strategy,” explaining that there is a tension between privacy and utility. When data is shared, it should be useful without leaking information. The best metric for deciding the data usefulness is measured by information loss while the data is being made private. “The algorithm tries to minimize information loss while anonymizing the data, and ideally, we want the least possible information loss. And that's the greedy aspect of it; it's not always going for the most private, it’s just going for the most utility.”

This is what backfires, said Kornaropoulos, because experts (or attackers) can reverse engineer the anonymization steps the algorithm took throughout its execution to maximize utility and figure out properties of the data that were there before and after this anonymization step.

Kornaropoulos praised his student’s dedication to the discovery, noting that Chhillar “worked on this project for a while, and this code base of ARX is an elaborate tool, with thousands of lines of code. She had to go through it to truly internalize understand everything that's going on there,” he said.

The project was supported by a Commonwealth Cyber Initiative (CCI) grant from the program, “Securing Interactions between Humans and Machines,” and as a requirement of the grant, the project crossed different parts of the university. The College of Engineering and Computing collaborated with �鶹��Ƶ and Partners (MAP) Clinics, which provided the data.

In This Story

Evgenios Kornaropoulos

Rebecca Sutter, DNP, APRN, BC-FNP

Learn more about Cybersecurity at George �鶹��Ƶ

Topics

computer science

Cyber Security

Data Mining in Health Care

Commonwealth Cyber Initiative (CCI)

Research

Panagiota Kitsantas, PhD

admin_alpha — Tue, 20 Oct 2015 23:24:01 +0000

Panagiota Kitsantas, PhD admin_alpha Tue, 10/20/2015 - 19:24

Interim chair, HAP

Contact Information

Email: pkitsant@gmu.edu

Phone: 703-993-1980

CV

Download Panagiota Kitsantas curriculum vitae (CV) here.

Personal Websites

ORCID

Biography

Dr. Kitsantas is a Professor of Biostatistics/Epidemiology in the Department of Health Administration and Policy (HAP). She has also served as the PhD Program Director in Health Services Research at HAP. Previously, she was the Chair of the Department of Population Health at the Schmidt College of Medicine, Florida Atlantic University.

Her research focuses on integrating data science with statistical/epidemiological methods to address health issues in vulnerable populations of women and their children. Dr. Kitsantas is the Principal Investigator of an NIH-funded study examining comorbidities in pregnant Women with prenatal alcohol exposure and adverse birth outcomes. She has also received funding from the Consortium for Medical Marijuana Clinical Outcomes Research to study medical cannabis use among pregnant and non-pregnant women of reproductive age. She has authored and co-authored numerous manuscripts on a wide range of topics, including infant feeding practices, childhood obesity, infant mortality, and various other issues related to maternal health.
Dr. Kitsantas teaches courses in health statistics and research methods, with a strong interest in incorporating AI tools into educational practices to enhance student learning.

Research/Scholarship Interests

Substance use and misuse (e.g., e-cigarettes, alcohol, opioids, and cannabis) among pregnant and non-pregnant women of childbearing age and children, particularly among vulnerable populations such as those with disabilities; machine learning applications in population health; artificial intelligence in teaching and learning.

Select Journal Publications

Matarazzo, A.*, Hennekens, C.H., Dunn, J.*, Mejia, M.C., Levine, R.S., & Kitsantas, P. (2025). New clinical and public health challenges: Increasing trends in United States alcohol related mortality. American Journal of Medicine, 138(3), 477-486.

Kitsantas, P., Benson, K.*, Rubenstein, A.*, Mejia, M. C., Levine, R. S., Hennekens, C. H., & Wood, S. K. (2025). Prenatal cannabis use and adverse health outcomes in neonates and early childhood. Pediatrics and neonatology, S1875-9572(24)00229-8. Advance online publication. https://doi.org/10.1016/j.pedneo.2024.11.004

Kitsantas, P., Densley, S.*, Rao, M.*, Sacca, L., Levine, R.S., Hennekens, C.H., & Mejia, M.C. (2024). Increases in drug-related infant mortality in the United States. Journal of Perinatal Medicine, 52(6), 660-664

Kitsantas, P., Aljoudi, S. M.*, & Sacca, L. (2024). Perception of Risk of Harm from Cannabis Use Among Women of Reproductive Age with Disabilities. Cannabis and cannabinoid research, 9(6), e1615–e1622. https://doi.org/10.1089/can.2023.0199

Yang, J.*, Mejia, M.C., Sacca, L., Hennekens, C.H., Kitsantas, P. (Oct 2024). Trends in marijuana use among adolescents in the United States. Pediatric Reports, 16(4):872-879. doi:10.3390/pediatric16040074

Kitsantas, P., & Pursell, S.R. (2024). Are healthcare providers caring for pregnant and postpartum women ready to confront the perinatal cannabis use challenge? American Journal of Perinatology, 41(S 01):e3249-e3254.

Kitsantas, P., Gimm, G., & Aljoudi, S. M*. (2023). Treatment outcomes among pregnant women with cannabis use disorder. Addictive behaviors, 144, 107723. https://doi.org/10.1016/j.addbeh.2023.107723

Honors and Awards

Recipient of the Shirley S. Travis Habit of Excellence Award, 2014
Recipient of the College of Health and Human Services Master Teacher Award, 2014
Recipient of the �鶹��Ƶ Teacher of Distinction Award, 2014

Professional Affiliations/Memberships

Member, American College of Epidemiology
Member, American Public Health Association

Degrees

PhD, Statistics, Florida State University
MS, Statistics, Florida State University
MS, Health Sciences, James Madison University
BA, Biology, Queens College of the City University of New York