  So far, privacy models follow two paradigms. The first paradigm, termed
inferential privacy in this paper, focuses on the risk due to statistical
inference of sensitive information about a target record from other records in
the database. The second paradigm, known as differential privacy, focuses on
the risk to an individual when included in, versus when not included in, the
database. The contribution of this paper consists of two parts. The first part
presents a critical analysis on differential privacy with two results: (i) the
differential privacy mechanism does not provide inferential privacy, (ii) the
impossibility result about achieving Dalenius's privacy goal [5] is based on an
adversary simulated by a Turing machine, but a human adversary may behave
differently; consequently, the practical implication of the impossibility
result remains unclear. The second part of this work is devoted to a solution
addressing three major drawbacks in previous approaches to inferential privacy:
lack of flexibility for handling variable sensitivity, poor utility, and
vulnerability to auxiliary information.
