What is a homogeneity attack, and why is it considered the most straightforward privacy breach?

If every record in an equivalence class shares the same sensitive value, the attacker learns it with 100% certainty — even though k-anonymity is fully satisfied.

The homogeneity attack exploits the fundamental flaw in basic k-anonymity: when all records in an equivalence class share the same sensitive value, that value is revealed regardless of k. It's the most straightforward breach because it requires no external data and no cleverness.

Stark example: a table that satisfies 5-anonymity where every individual aged 30–35 in ZIP 94103 is HIV-positive. Knowing someone falls in that group reveals their HIV status with zero uncertainty — privacy is completely compromised even though no one is individually identified.

Why it's dangerous: it gives the attacker 100% confidence about a sensitive attribute without identifying anyone; homogeneous groups occur naturally in real data (specialty clinics, demographic clustering); and it sits squarely in k-anonymity's blind spot (identity protection, not attribute protection).

Tip: A crowd is no disguise if everyone in it is wearing the same secret. That's homogeneity — and l-diversity exists to break it.