This report examines a series of general models that represent the process of merging records from separate files when it becomes essential to inhibit identifiability of records in at least one of the files. Models are illustrated symbolically by flow diagrams, and examples of each variation are taken from the social sciences. These variations cover simple situations such as that of soliciting anonymous data from previously identified respondents as well as more complex merge operations, e.g., merging files from mutally insulated data banks and merging data under code linkage systems. Characteristics of the models are discussed with emphasis on their benefits and disadvantages. (Author)