From what I can tell, this is the method of creating a temporary ICAO address in the 978Mhz UAT protocol:
Self-Assigned Temporary Address of Transmitting Aircraft An “ADDRESS QUALIFIER” value of ONE (binary 001) shall indicate that the message is an ADS-B Message from an aircraft, and that the “ADDRESS” field holds the transmitting aircraft’s self-assigned ownship temporary address.
The self-assigned temporary address shall be generated as follows:
ADDRP = the ICAO 24-bit address that has been assigned to the aircraft;
ADDRT = the temporary address that is to be generated; M(1) = the 12 least significant bits (LSBs) of the ownship “LATITUDE” field (per §188.8.131.52.2.1) at the time the temporary address option is selected;
M(2) = the 12 least significant bits (LSBs) of the ownship “LONGITUDE” field (per §184.108.40.206.2.1) at the time the temporary address option is selected;
M(3) = 4096 × M(1) + M(2);
TIME = the number of seconds that have elapsed since UTC midnight at the time the temporary address option is selected, represented as a 24-bit number.
Also, let “⊕” denote the modulo 2 bit-by-bit addition(or “exclusive OR”) operation.
a. If the transmitting aircraft’s ICAO 24-bit address ADDRP is available, then the temporary address ADDRT shall be the modulo 2, bit-by-bit summation of the permanent address and M(3), that is:
ADDRT = ADDRP ⊕ M(3).
b. If the aircraft’s 24-bit ICAO address ADDRP is not available, then time of day shall be used as an additional randomizer. In that case, the temporary address ADDRT shall be the modulo 2, bit-by-bit summation of TIME and M(3), that is,
ADDRT = TIME ⊕ M(3).
So the question is if this is deterministic. Could one work their way back to the actual tail number when an aircraft is in anonymous mode?