Skip to content

Metadata Minimization Filter

Egress filter — instantiates Side-Channel Leakage Containment

Strips or coarsens the incidental metadata riding along with an output — timestamps, identifiers, headers, geotags — so what's attached to the payload can't reveal the protected fact.

The payload can pass review while the metadata wrapped around it quietly leaks — an author name in a document's properties, GPS coordinates in a photo, a precise timestamp, a revealing header. Metadata Minimization Filter sits at the egress boundary and removes or coarsens every metadata field the recipient does not actually need, governed by an allowlist of what is permitted to leave. Its defining move is to treat incidental metadata as part of the output that must be governed, not free-riding exhaust: what's attached travels within the same disclosure boundary as the content. Where Broker Visibility Partitioning distributes who can see metadata across parties, this filter deletes it from a single output before it leaves.

Example

An agency releases case PDFs and images whose visible content is cleared, but whose embedded metadata is not: author names and editing software in document properties, GPS geotags and camera serials in image EXIF, precise creation timestamps, and tracked-changes history that can reconstruct redacted passages. The filter strips EXIF and geotags, removes author and software fields, flattens revision history, and coarsens timestamps to the day — passing through only the fields on an allowlist the recipient genuinely needs. It also replaces stripped fields with a constant placeholder rather than deleting them outright, so the absence of a field isn't itself a signal. What ships carries only sanctioned metadata.[1]

How it works

  • Allowlist, not blocklist. Define the small set of metadata fields permitted per output type; everything else is removed by default, so unknown fields fail closed.
  • Strip and coarsen at egress. Remove disallowed fields and reduce high-resolution ones (timestamps, geolocation) to the minimum useful precision.
  • Normalize absence. Replace removed fields with a constant placeholder so a missing field can't itself carry information.
  • Apply uniformly. Run the same filter on every output of a type, so variation in what's stripped doesn't become a new signal.

Tuning parameters

  • Allowlist tightness — minimal vs. permissive; tighter leaks less but strips context downstream consumers may need.
  • Coarsening resolution — how far to round timestamps and locations; coarser is safer, finer is more useful.
  • Strip vs. redact-in-place — delete fields outright vs. replace with a constant so absence isn't a tell.
  • Coverage scope — payload metadata only, or also transport headers, logs, and telemetry where the same fields re-appear.

When it helps, and when it misleads

Its strength is catching the metadata leak that content review misses entirely — the geotag under a cleared photo, the author of a "de-identified" file. Its limitation is that minimization is only as complete as the allowlist: an un-enumerated field slips straight through, the classic "we scrubbed EXIF but not the PDF's XMP block." The related misuse is stripping the visible output while the same metadata persists in server logs, telemetry, or backups. The discipline is to derive the allowlist from the observation-surface map so nothing is missed, and to apply the filter to every place the metadata lives, not just the primary output.[1]

How it implements the components

  • metadata_visibility_policy — the per-field allowlist governing exactly which metadata may leave is this filter's core rule.
  • authorized_disclosure_boundary — the filter enforces that boundary for metadata: only sanctioned fields cross the egress line with the payload.

It removes fields from a single output; distributing metadata visibility across non-colluding parties is Broker Visibility Partitioning's broker_metadata_partition, and enumerating which metadata channels exist in the first place is the Side-Channel Inventory Workshop's map.

Notes

Metadata rarely lives in one place: the same identifying fields recur in logs, telemetry, caches, and backups, so a filter on the primary egress path is necessary but not sufficient. Scope the minimization to every surface the observation map lists, or the leak simply exits by another door.

References

[1] EXIF and document metadata — auxiliary fields embedded in files (camera model, GPS coordinates, author, editing history, timestamps) that can disclose what the visible content does not. Scrubbing them before release is standard practice; replacing rather than deleting them keeps the absence of a field from becoming a signal. ↩