> Source: https://upvera.tech/guides/k-anonymity-suppression/
> Before you publish counts about people, hide every cell smaller than a threshold k, often 5, so no number describes a group small enough to point at someone. Then hide at least one more cell in any row or column where a published total would let the hidden one be worked out by subtraction. The tool on this page applies both steps to a table you can edit.

[Guides](/guides/)Tools

Tool · · For developers · Trust Signals

# Hide small groups in a published table (k-anonymity)

Short answer

Before you publish counts about people, hide every cell smaller than a threshold k, often 5, so no number describes a group small enough to point at someone. Then hide at least one more cell in any row or column where a published total would let the hidden one be worked out by subtraction. The tool on this page applies both steps to a table you can edit.

Smallest group you may show (k)Edit any count. The table on the right updates as you type. Example data.

Your counts

|  | Views | Saves | Follows |
| --- | --- | --- | --- |
| Mon |  |  |  |
| Tue |  |  |  |
| Wed |  |  |  |
| Thu |  |  |  |
| Fri |  |  |  |

What you can publish

|  | Views | Saves | Follows | Total |
| --- | --- | --- | --- | --- |
| Mon | 42 | · | <5 | 52 |
| Tue | 38 | <5 | · | 46 |
| Wed | 51 | 9 | 8 | 68 |
| Thu | 12 | <5 | <5 | 17 |
| Fri | 29 | 6 | 5 | 40 |
| Total | 172 | 28 | 23 | 223 |

<5 4 hidden because the group is too small · · 2 hidden so the others can't be worked out from the totals

-   Row Mon: one hidden cell could be recovered from the total, so Mon · Saves is hidden too.
-   Row Tue: one hidden cell could be recovered from the total, so Tue · Follows is hidden too.

## Why a small number can identify someone

"3 people saved this post on Thursday" sounds harmless. But if a viewer knows two of them, the third is no longer anonymous, and the count has published a private action. The smaller a group, the easier it is to fill in from outside knowledge.

The usual protection is a threshold, written k: a count may be published only if it describes at least k people. Statistics offices, health agencies and analytics products use the same idea under names such as minimum cell size or small cell suppression. Values from 5 to 11 are common; the right one depends on how much outside knowledge a reader is likely to have.

## Step 1: primary suppression

Hide every cell whose count is above zero and below k. In the tool, these cells show `<k` instead of the number. Zero is usually safe to show, because it says nobody did the thing, though some publishers hide zeros too when "nobody" would itself be revealing.

## Step 2: complementary suppression

Hiding a cell is not enough when totals are published. If a row shows four of five values and its total, the hidden fifth is simply the total minus the others. So for any row or column with exactly one hidden cell, hide one more cell in that row or column, usually the smallest visible one, so the subtraction no longer works. Repeat until no row or column has a single hidden cell. Totals smaller than k are hidden too.

This stops exact subtraction. It does not always stop a hidden value from being narrowed to a small range, which is why the next section matters.

Change the counts or k in the tool to see how one small number can force a second cell, and sometimes a third, to disappear.

## Beyond one table

Suppression protects a single release. A few more rules keep it working over time:

-   **Differencing across releases.** If Monday's total was 40 and Tuesday's is 41 after one known event, the change itself is a count of one. Publish on a fixed schedule, and consider rounding or delaying small changes.
-   **Overlapping slices.** Two tables that cut the same data differently can be combined to rebuild a hidden cell. Apply suppression to every view you publish, not just the main one.
-   **Delays.** Showing activity days later, rather than live, prevents anyone from timing an action to a person they are watching.
-   **Private kinds of activity.** Some actions, such as views or saves, are better never shown individually at all, only as aggregates.

## Questions

### What value of k should I use?

Five is a common floor for public activity counts. Use a higher value when readers can easily know some members of a group, such as a small team or community.

### Is k-anonymity enough for personal data?

It is a floor, not a complete privacy guarantee. Combine it with delays, coarse time buckets and, where you need formal guarantees, differential privacy.

### Should I show zeros?

Usually yes. Hide them when the absence of activity would itself reveal something about a specific person.

### Why not just round small numbers?

Rounding helps, but rounded cells can still be recovered from exact totals. Suppression combined with consistent totals is easier to reason about.

## How Upvera does it

On Upvera, k is five. Private kinds of activity, such as views and saves, are never shown individually; where they are counted in public, a count covers at least five people, and a smaller group is hidden along with any figure that would reveal it by subtraction. Details are in the [Trust Signals report](/trust/).

## Sources

-   [Sweeney, k-anonymity: a model for protecting privacy (2002)](https://dataprivacylab.org/dataprivacy/projects/kanonymity/kanonymity.pdf)
-   [U.S. Census Bureau, statistical safeguards](https://www.census.gov/about/policies/privacy/statistical_safeguards.html)
-   [NIST SP 800-188, De-Identifying Government Datasets](https://csrc.nist.gov/pubs/sp/800/188/final)

## Related

[UTR-26-05**Trust Signals**Server time, bots that never count, no small groups, one number everywhere.System reportRead](/trust/)[Guide**How to check a startup's claims before you believe them**A checklist with public tools for domain age, site history, store listings, code, packages, team and revenue, plus red flags.Anyone checkingRead](/guides/check-startup-claims/)[UTR-26-03**Day Roots**Sealed every minute. Rooted every day.System reportRead](/roots/)