combinatorial anonymity