  Recent work has shown the necessity of considering an attacker's background
knowledge when reasoning about privacy in data publishing. However, in
practice, the data publisher does not know what background knowledge the
attacker possesses. Thus, it is important to consider the worst-case. In this
paper, we initiate a formal study of worst-case background knowledge. We
propose a language that can express any background knowledge about the data. We
provide a polynomial time algorithm to measure the amount of disclosure of
sensitive information in the worst case, given that the attacker has at most a
specified number of pieces of information in this language. We also provide a
method to efficiently sanitize the data so that the amount of disclosure in the
worst case is less than a specified threshold.
