Sensitive Itemset List (SISL) in Data Privacy

• Sensitive Itemset List (SISL) is a privacy specification structure that identifies frequent itemsets deemed sensitive, guiding the sanitization of transactional data.
• In association-rule hiding, SISL maps sensitive items to derived rule sets, enabling controlled modification of support without changing overall database size.
• In periodic high-utility mining, SISL stores comprehensive records including utility, support, and periodicity, facilitating effective balancing of data utility and confidentiality.

Sensitive Itemset List (SISL) denotes a privacy-specification structure used in pattern hiding problems over transactional data. In the most standard frequent itemset hiding formulation, it is the set of sensitive frequent itemsets $S \subseteq F$ that the data owner wants to render infrequent. In closely related association-rule hiding work, the direct analogue is a set of sensitive items $H$ together with the derived lists of rules that contain them. In privacy-preserving periodic high-utility mining, SISL is an explicit data structure that stores, for each sensitive itemset, the itemset itself, its utility, per-transaction utility contributions, maximum period, and support. Across these settings, SISL determines which patterns are confidential and drives the sanitization process that transforms a database $D$ into a revised database $D'$ while attempting to minimize utility loss and side effects (Kagklis et al., 2018, Jain, 2012, Zhou et al., 19 Sep 2025).

1. Terminological scope and formal meaning

The meaning of SISL is not fully uniform across the literature. In "A Frequent Itemset Hiding Toolbox" (Kagklis et al., 2018), the term corresponds exactly to the set of sensitive (frequent) itemsets $S$, where

$S \subseteq F$

and $F$ is the set of frequent itemsets under a minimum support threshold $\sigma_{\min}$. This is the canonical frequent itemset hiding formulation: the sensitive patterns are itemsets, and the hiding constraint requires that each $X \in S$ become infrequent in the sanitized database.

The paper "Hiding Sensitive Association Rules without Altering the Support of Sensitive Item(s)" (Jain, 2012) does not use the exact expression “Sensitive Itemset List,” but it introduces the directly related structures that fulfill the same role for association-rule hiding. The primary input is a set of sensitive items

$H = \{h_1,h_2,\dots,h_k\},$

and for each $H$0 the algorithm derives a list of rules containing $H$1,

$H$2

It then compresses these rules into representative rules $H$3. In that setting, the privacy specification is item-based rather than arbitrary-itemset-based.

In "Utility-based Privacy Preserving Data Mining" (Zhou et al., 19 Sep 2025), SISL is defined more richly. For each sensitive periodic high-utility itemset $H$4, the Sensitive Itemset List is a five-part record containing the sensitive itemset itself, its total utility $H$5, a $H$6 list over supporting transactions, its largest period $H$7, and its support $H$8. SISL there is not merely a set of targets; it is an operational state structure used during sanitization.

2. SISL in association-rule hiding

In the association-rule framework of (Jain, 2012), let $H$9 be the item universe and let $D$0 be a set of transactions $D$1. An association rule is $D$2 with $D$3. Support and confidence are defined in the usual transaction-count sense: $D$4

$D$5

Sensitivity is defined through the item list $D$6. A rule is sensitive if at least one item from $D$7 appears in its antecedent or consequent: $D$8 The paper therefore uses a SISL-like design in which confidentiality is declared first at the item level and then propagated to the rule level. Only frequent sensitive items are retained: if a sensitive item is not a “large itemset,” it is removed from $D$9, because it cannot generate rules to hide.

The hiding procedure proceeds by constructing $D'$0 for each sensitive item, selecting rules where $D'$1 is alone on the left-hand side, and joining right-hand sides to form representative rules. For example, $D'$2 and $D'$3 are merged into the representative rule $D'$4. The representative rules are sorted in descending order by the number of supported items, so that modifying transactions supporting broader representative rules can affect more sensitive rules at once.

The distinctive constraint in this method is preservation of the support of each sensitive item: $D'$5 The database size also remains unchanged. The algorithm deletes a sensitive item from a transaction that fully supports a representative rule and adds the same item to another transaction that partially supports the rule’s right-hand side but lacks the sensitive item. This delete-then-add cycle changes positions of sensitive items without changing their total support.

The paper reports two illustrative outcomes. In one example with $D'$6, eight rules contain $D'$7, and seven out of eight are hidden after two transaction modifications. In another example with $D'$8, six rules contain $D'$9, and all six are hidden. Comparative tables report that, for one case labeled Table 1, the proposed algorithm needs 4 DB scans and prunes 7 rules when hiding item $S$0, whereas Dasseni et al. require 4 DB scans and prune 0 rules, and Wang’s approach requires 3 DB scans and prunes 2 rules (Jain, 2012).

3. SISL in frequent itemset hiding

The standard frequent itemset hiding formulation in (Kagklis et al., 2018) starts from the item universe

$S$1

a transactional database

$S$2

and a support function

$S$3

Given a minimum support threshold $S$4, the frequent itemsets are

$S$5

Within this model, SISL is the set of sensitive frequent itemsets $S$6. Two derived sets are central. The first is the union of items appearing in sensitive itemsets,

$S$7

The second is the set of sensitive itemsets and all of their supersets in $S$8,

$S$9

with

$S \subseteq F$0

The ideal revised frequent itemset set is then

$S \subseteq F$1

The hiding problem is to produce a sanitized database $S \subseteq F$2 such that

$S \subseteq F$3

and, in the stricter form,

$S \subseteq F$4

A transaction is sanitized if it is modified so that it no longer supports any sensitive itemset $S \subseteq F$5. The formal role of SISL is thus dual: it specifies the privacy constraints and induces the preservation target $S \subseteq F$6, namely the frequent itemsets that should ideally remain frequent.

The toolbox described in (Kagklis et al., 2018) operationalizes this model directly. In the GUI, the file with the sensitive itemsets must be given by using field 3. The user selects Apriori as the mining algorithm, loads a transactional dataset, loads a sensitive itemsets file, specifies $S \subseteq F$7, and selects hiding algorithms. The SISL is therefore treated as a file-based input that is parsed into the set $S \subseteq F$8, assumed to contain itemsets that are frequent in the original database under the specified threshold. The paper explicitly states that these sensitive itemsets need not be closed, maximal, or minimal; in experiments they are “of different, random length” and “randomly selected itemsets.”

4. Algorithmic use of SISL in frequent itemset hiding systems

The toolbox in (Kagklis et al., 2018) includes Max-Min 1, Max-Min 2, WBA, Max-Accuracy, Coefficient-Based Max-Accuracy, Heuristic Coefficient Based Approach, and Inline Algorithm. These methods divide into two main families with respect to SISL.

The first family is border-based and heuristic. Max-Min 1, Max-Min 2, and WBA use border revision theory to manipulate the positive border of maximal frequent itemsets and the negative border of minimal infrequent itemsets. Given SISL $S \subseteq F$9, these methods determine which border elements must move from frequent to infrequent so that all $F$0 become infrequent. WBA assigns weights to itemsets or transactions based on their role in supporting $F$1 versus $F$2, then greedily removes items from high-weight transactions. In these methods, SISL directly shapes the border revision plan and the weighting of candidate modifications.

The second family is optimization-based. Max-Accuracy, coefficient-based variants, and part of Inline formulate hiding as an integer linear program in which the requirement

$F$3

appears as hard constraints, while utility preservation is handled in the objective. The coefficient-based approaches refine the weights so as to reflect contribution to non-sensitive frequent itemsets, contribution to sensitive itemsets, and side-effect penalties. Inline combines border revision theory with an ILP over minimal transversals of a hypergraph whose hyperedges correspond to sensitive itemsets and their supporting transactions.

The toolbox architecture is organized into Presentation, Logic, Core, and Data layers. The Presentation Layer uses Python/Tkinter. The Core Layer includes the hiding algorithms, Apriori frequent itemset miner via PyFIM, Python + Cython infrastructure, and CPLEX for ILP solving. The Logic Layer computes information loss, side effects, changes, and runtime. This architecture makes SISL not only a theoretical object but a shared interface between mining, sanitization, and evaluation modules (Kagklis et al., 2018).

5. SISL in privacy-preserving periodic high-utility mining

The SISL introduced in (Zhou et al., 19 Sep 2025) arises in Privacy-Preserving Periodic High-Utility Itemset Mining. Here the sensitive patterns are not merely frequent itemsets; they are sensitive periodic high-utility itemsets selected from the set of PHUIs. For an itemset $F$4, utility and periodicity are both relevant. Utility is aggregated over supporting transactions, and periodicity is described by the occurrence-ID sequence $F$5, the period set $F$6, and summary statistics such as $F$7, $F$8, and $F$9. An itemset is a PHUI if it satisfies periodicity thresholds and a minimum utility threshold $\sigma_{\min}$0.

The paper defines sensitive PHUIs as

$\sigma_{\min}$1

For each $\sigma_{\min}$2, SISL is

$\sigma_{\min}$3

This record centralizes all sensitive itemset-level information needed for hiding. It is paired with a second structure, the Sensitive Item List (SIL), which stores item-level tuples $\sigma_{\min}$4 for items inside sensitive itemsets. SISL is itemset-level; SIL is item-level.

The two proposed algorithms, MU-MAP and MU-MIP, use SISL and SIL in a fixed division of labor. First, they construct SISL and SIL for each $\sigma_{\min}$5, sort SPIs in descending order of length, and compute

$\sigma_{\min}$6

Then, for each sensitive itemset, they derive

$\sigma_{\min}$7

While

$\sigma_{\min}$8

the algorithm selects a victim transaction using the $\sigma_{\min}$9 list in SISL: $X \in S$0 It then selects a victim item using SIL. MU-MAP chooses the item with maximum maxPer; MU-MIP chooses the item with minimum maxPer. Depending on whether the victim item utility is less than or equal to $X \in S$1, the algorithm either deletes the item from the transaction or decreases its quantity. After each modification, SISL and SIL are updated globally.

The paper analyzes time complexity for MU-MAP and states that MU-MIP is identical in complexity: $X \in S$2 time and

$X \in S$3

space. It also reports that MU-MAP and MU-MIP achieve $X \in S$4 across all six datasets and all tested sensitive percentages, while Table 9 shows that they typically achieve $X \in S$5, often $X \in S$6, across datasets and sep settings. The abstract summarizes this more conservatively by stating that the algorithms maintain Database Utility Similarity of over $X \in S$7 after the sensitive itemsets are hidden (Zhou et al., 19 Sep 2025).

6. Side effects, evaluation criteria, and interpretive issues

Across SISL-based hiding methods, evaluation is organized around privacy success and preservation of non-sensitive structure. In frequent itemset hiding, (Kagklis et al., 2018) defines side effects with

$X \in S$8

where $X \in S$9 is the frequent itemset set in $H = \{h_1,h_2,\dots,h_k\},$0. Information loss is measured by

$H = \{h_1,h_2,\dots,h_k\},$1

The toolbox also reports number of changes and CPU time. Experimental observations show that execution times increase roughly linearly with SISL size, that ILP-based methods achieve better results on the dense mushroom dataset, and that WBA achieves the best results on the sparser retail and kosarak datasets in terms of side effects and information loss, with fairly good time complexity. The paper also notes that very large datasets may cause memory issues when many algorithms are selected simultaneously.

In periodic high-utility hiding, (Zhou et al., 19 Sep 2025) uses Hiding Failure, Missing Cost, and Artificial Cost: $H = \{h_1,h_2,\dots,h_k\},$2 For PPPUM, the goal is $H = \{h_1,h_2,\dots,h_k\},$3 and $H = \{h_1,h_2,\dots,h_k\},$4, while minimizing Missing Cost and preserving database utility. Database Utility Similarity is defined as

$H = \{h_1,h_2,\dots,h_k\},$5

A recurrent interpretive issue is that SISL should not be treated as a single immutable structure across all privacy-preserving data mining tasks. In frequent itemset hiding, it is the set $H = \{h_1,h_2,\dots,h_k\},$6 of sensitive frequent itemsets. In the association-rule setting of (Jain, 2012), the nearest equivalent is the sensitive item list $H = \{h_1,h_2,\dots,h_k\},$7 together with the derived rule lists $H = \{h_1,h_2,\dots,h_k\},$8 and representative rules $H = \{h_1,h_2,\dots,h_k\},$9. In PPPUM, SISL is a metric-rich record designed to track utility, support, and periodicity simultaneously. This suggests that SISL is best understood as a task-dependent privacy specification mechanism whose granularity follows the underlying pattern model: items and rules in association-rule hiding, frequent itemsets in itemset hiding, and periodic high-utility itemsets in PPPUM.