In fact, there's a long history of people trying to publish anonymized IP logs in ways that preserve the IP address structure (i.e. anonymized ip's from the same subnet end up in the same anonymous subnet). It turns out that leaking that structure frequently ends up identifying the IP addresses.
The bottom line is beware of academics baring leakage functions. Their work often has considerable merit, but one must be very careful about how it's used in practice.
That's me above in Ian's [2]. We're hoping to have something ready to share by the end of the month. I'll post a Show HN when it's available.
In the mean time, here's a paper from some folks in Norway that shows attacks against two prefix-preserving IP address anonymization schemes:
A contrived example to demonstrate this is if you published some kind of database about behavior observed from IP addresses, but using ORE-encrypted IP addresses instead of plaintext ones. If the database explicitly contains all 2³² IPv4 addresses, someone can then perform a series of comparisons to sort the entire database (which is an explicit goal of ORE), which then reveals the plaintext values because they're exactly equal to the positions of the entries in the sorted list!
A subtler case could arise if the database is complete for some range of IP addresses and an attacker happens to know the plaintext values at the bottom and top of that range. Then the attacker can learn the plaintext values of everyone else in the range.
An even subtler case could arise if the attacker simply knows a bunch of specific plaintext values. In that case, the attacker can learn constraints on the numeric values of other database entries, which could mean, for example, learning the first 1-2 bytes of a particular IP address, which could confirm or disconfirm hypotheses about a user's ISP or geographic location.
Edit: I'd like to see some of the more subtle attack ideas that the people you linked to are developing!