Achieving Probabilistic Anonymity against One-to-Multiple Linkage Attacks