In this paper we propose a formalization of probable innocence, a notion of probabilistic anonymity that is associated to “realistic” protocols such as Crowds. We analyze critically two different definitions of probable innocence from the literature. The first one, corresponding to the property that Reiter and Rubin have proved for Crowds, aims at limiting the probability of detection. The seco...