fairness
Anonymous, except for everything about you
It is 2006, and a streaming company has published a hundred million "anonymized" movie ratings as a research prize dataset, subscriber identifiers replaced with random numbers. The mistake is treating a fingerprint as if it were a name: a handful of ratings with approximate dates — gleaned from a public review site where some subscribers post under their real names — suffices to re-identify accounts, and with them every rating the person never made public, including the politically and sexually revealing ones. Execute the linkage attack rigorously, quantify how few auxiliary points suffice given the data's sparsity, and state the general lesson: high-dimensional sparse records are unique, so scrubbing identifiers is not anonymization. Get it wrong and every data-sharing agreement in medicine and industry keeps resting on a fiction.
Who this problem belongs to
The two figures whose methods fit it best, out of 30 in contention.
This is the exact failure Dwork spent her career formalizing. Her work at Microsoft Research in the 2000s, culminating in differential privacy (2006, with McSherry, Nissim, and Smith, the same year as the Netflix release), begins from precisely this observation: any output that is a genuine function of a sensitive dataset leaks something, and ad hoc anonymization by identifier removal provides no mathematical guarantee against an auxiliary-information adversary. She would immediately reframe the incident not as a bug but as confirmation of her thesis, and she has the formal apparatus — the impossibility results against auxiliary-information attacks, the privacy-loss budget — to state exactly why scrubbing names is not privacy and to specify what a provable alternative would need to guarantee instead of merely hoping.
Song's research program at Berkeley is built around adversarial reasoning against deployed ML and data systems, and re-identification via auxiliary linkage is squarely inside it: her later work on membership inference and training-data extraction is the direct methodological descendant of the Netflix-style attack, formalizing how an adversary with side information recovers what a system tried to hide. In 2006 she was earlier in her career, focused more on systems and network security than statistical de-anonymization specifically, so she would not have executed the sparsity-based linkage itself, but the adversarial mindset — assume the attacker has auxiliary data, quantify the leakage rigorously — is exactly her toolkit, and she would extend the case study into the extraction attacks that defined the next decade.
In the mind map
The same ideas, as concepts rather than history — in John's ML knowledge map.
30 figures are scored on this problem. Draw it in a battle to see where you land.