Topic · DiggingBeagle record
Private testing of combined-attribute identifiability
Two-server threshold testing for rare combinations of personal attributes, with noncollusion and reference-population assumptions.
Definition & limits
People can be identifiable through combinations of ordinary profile facts even when no one attribute is a direct identifier. The November 4 private vulnerability-testing paper studies a narrow question: is the number of reference-population records matching the attributes a user selects below an agreed threshold? It does not attempt to recover the person's true identity or promise anonymity across the internet.
Its proposed system uses two noncolluding servers that hold secret-shared population records. The client's queried attributes are likewise secret-shared, with equality checks and threshold computation arranged so that neither individual server learns the values or precise matching count under the stated semi-honest threat model. Contributors do not need to be online for each query. The paper models about 0.38 seconds online for a million-record 64-bit query under its specified processing setup, rising to about 0.73 seconds with 50 ms network delay. Those numbers are protocol benchmarks, not deployment results on a complete real population.
A threshold response is only as representative as its dataset and its assumptions. False records or missing groups can distort rarity; server collusion breaks the two-server trust boundary; repeated adaptive threshold queries could reveal more than a single result. An AI assistant could offer this as a pre-disclosure warning, but must not autonomously post the tested attributes merely because a result says they are common. This complements agent disclosure authorization, not replaces it.
The temporal membership study is a different privacy attack: it infers when an example was present in successive model-training updates by observing output changes. Attribute rarity and training-history membership use different data, attacker access and success measures. Combining their benchmark percentages would not measure a user's anonymity.