Auditing consists in logging answered queries and checking, each time that a new query is submitted, that no sensitive information is disclosed by combining responses to answered queries with the response to the current query. Such a method for controlling data disclosure naturally raises the following inference problem: Given a set Q of answered queries and a query q, is the information asked ...