Guillaume Dufay Amy P. Felty Stan Matwin Privacy-Sensitive Information Flow with JML. 116-130 2005 conf/cade/2005 CADE http://dx.doi.org/10.1007/11532231_9 db/conf/cade/cade2005.html#DufayFM05