Local tool measures and reduces data inference risks without ai
Reading Is Not Leaking: Local, Auditable Measurement and Reduction of Inference Exposure from Public Footprints
Cryptography and SecurityComputation and LanguageComputers and Society
Summary
People leave public traces online that can reveal private facts without directly stating them, and language models can easily guess these facts. The authors built a system that runs on an owner's own computer to measure how much private information leaks from their public data and to reduce that leakage. This system uses a mix of rules and a special text analyzer to find evidence and prove answers without needing to generate new text. It can protect private facts better than deleting data and does not rely on expensive or external AI at analysis time.
What this means in practice
- •For privacy teams: Measure and reduce private fact leakage from organizational public records without needing external AI services.
- •For individual data managers: Run privacy risk assessments on personal public footprints locally to get proof-backed leakage measurements and defensive rewrites.
- •For security software developers: Develop privacy tools that certify the correctness of inferred answers and minimize data exposure using lightweight local analysis.$Commercial implications: Enables creation of privacy assurance software products that verify and reduce leakage without cloud-based AI, appealing to security-conscious buyers.
Authors
Mahmudul Faisal Al Ameen
Abstract
Anyone with a public footprint leaks facts that were never stated, and language models make the inference cheap. We present a framework for measuring and reducing this inference exposure that runs on the owner's own CPU with no language model at analysis time, instantiated on organisations and on individuals. It starts from a measurement result: scoring an inference system against the target's private truth conflates how well the system reads the record with how much the record leaks. On a 128-question instrument over sixteen synthetic firms, almost half of the questions are never answered correctly by any of six readers, four of them language models, and a majority-class guess accounts for most of every reader's score. We therefore separate reading accuracy from leakage rate and introduce an injection protocol that creates cells with known support. Our analyser combines rules, statistical solvers and a 106M-parameter encoder trained from scratch that marks verbatim evidence and never generates text; every answer carries a graded certificate whose recorded proof replays. Its certified answers are correct in 93% of resolved cases, against 49-73% for the language models' quote-backed answers, whose citations are produced alongside the answer rather than deriving it; with plain-prose articles in the record, 70% of its evidence-bearing answers rest on evidence that establishes them, against 18-56% for the models. A constrained defence that rewrites each fact's carrier as a true but coarser statement hides every single-carrier fact from four language-model adversaries at 40% lower edit cost than deletion. On sixteen synthetic people the guessing term is larger still, and a decoy planner with no language model halves the correct answers of the estimator it targets without transferring to a second.