Hidden Information Reconstruction¶
Core Idea¶
Hidden-information reconstruction is the structural pattern by which a holder of some input intends to protect that input by exposing only observable outputs of a system the input drives, while an observer combines those outputs with a prior over possible inputs to reconstruct the protected input to whatever resolution the prior permits. The holder's intended privacy envelope is "outputs only, inputs sealed." The observer's inference exploits two structural facts the holder cannot in general remove: the outputs are informative about the inputs because the system that produces them is not constant in the inputs, and a sharp enough prior over the input space collapses the hypothesis space to where the observable output channel suffices to discriminate among the remaining candidates. The reconstruction quality is bounded by the product of two quantities — the output channel's mutual information with the input, and the sharpness of the observer's prior — and neither factor can be driven to zero without changing the system's utility.
The structural commitments are four: an input the holder wants to protect (a secret key, a training record, a redacted word, a recipe, a tissue density, a private intention); a system the input drives whose outputs the holder discloses (a prediction, a power trace, a layout, an encrypted packet, a CT scan); a channel of informativeness by which output distributions differ across inputs; and a prior available to the observer — from corpus statistics, physical models, expected-input distributions, or partial side knowledge — that narrows the input hypothesis space. The distinctive move the prime supplies is placing the burden of non-reconstruction on the output channel and the prior, not on the disclosure surface alone. The naïve mental model — "I disclose outputs, inputs stay private" — is structurally wrong; the correct model is "I disclose outputs of a known informativeness, an observer with a sharp prior reconstructs to that informativeness, and my defences are to narrow the channel and deny the prior." Privacy is thereby a property of the (system, adversary-with-prior) pair, not of the system in isolation, and a privacy claim that does not name the adversary's prior is structurally incomplete.
How would you explain it like I'm…
Guessing From Shadows
Rebuilding The Secret
Outputs Plus A Prior
Structural Signature¶
the protected input the holder wants sealed — the system the input drives — the disclosed observable outputs — the channel of informativeness by which output distributions differ across inputs — the observer's prior over the input space — the reconstruction fidelity bounded by channel-mutual-information times prior-sharpness — the two defence families (channel narrowing, prior denial)
A configuration exhibits hidden-information reconstruction when each of the following holds:
- A protected input. A holder wants to seal some input: a secret key, a training record, a redacted word, a tissue density, a private intention.
- A driven system with disclosed outputs. The input drives a system whose observable outputs the holder discloses while believing the input stays private: a prediction, a power trace, an encrypted packet, an embedding, a CT projection.
- A channel of informativeness. The output distributions differ across inputs — the system is not constant in the input — so the outputs carry mutual information about the input that the holder cannot remove without changing the system's utility.
- An observer prior. An observer holds a prior over possible inputs — from corpus statistics, physical models, expected-input distributions, or side knowledge — that narrows the input hypothesis space.
- A reconstruction fidelity bound. The achievable reconstruction is bounded by the product of channel mutual information and prior sharpness, so either factor going to zero closes the reconstruction, and neither can be zeroed without cost to utility.
- An adversary-relative privacy property. Privacy is a property of the (system, adversary-with-prior) pair, not of the disclosure surface alone, so a claim that does not name the adversary's prior is structurally incomplete; the two defence families (channel narrowing, prior denial) must be paired to be complete.
The components compose so that the burden of non-reconstruction falls on the output channel and the prior, never on the disclosure surface — and reconstruction quality rises monotonically as adversary models improve, while multiple disclosures compose super-additively under a joint prior.
What It Is Not¶
- Not
information_asymmetry. Asymmetry names a static gap in who knows what; this prime is the active inference process by which an observer closes that gap, combining disclosed outputs with a prior to reconstruct a sealed input. One describes the state, the other the attack. - Not
information_cascade. A cascade is sequential agents copying each other's actions; this prime is a single observer inverting a system's outputs to recover its inputs. No social copying is involved. - Not
inversion. Generic inversion reverses a mapping; this prime is the probabilistic, prior-bounded reconstruction whose fidelity is channel-mutual-information times prior-sharpness — recovery to a resolution, not exact reversal. - Not
compression. Compression removes redundancy to shrink a representation; here the disclosed output is informative about a hidden input and the work is recovering that input, not shrinking the output. - Not
conformity. Conformity is alignment of behaviour to a group; the embedding nearness is spurious. This prime is adversarial inference of a protected input from informative outputs. - Common misclassification. Claiming privacy by sealing the obvious disclosure surface ("the data never leaves the device") while informative outputs (gradients, traces) still leak under a sharp prior. Catch it by asking whether the privacy claim names the adversary's prior — a claim that omits it is structurally incomplete.
Broad Use¶
- Inverse problems in physics and medical imaging: CT, MRI, EEG, and seismic inversion reconstruct an interior distribution from boundary measurements, licensed by a physical prior — the same boundary-output plus prior yields interior-input reconstruction, non-adversarially, showing the bare structure.
- Side-channel cryptanalysis: power, electromagnetic, cache-timing, and timing observations reconstruct secret keys via a prior over key bits and the device's leakage model.
- TEMPEST and acoustic emanation: electromagnetic emanations reconstruct displayed pixels, and keyboard or printer acoustic emanations reconstruct typed or printed content, via a prior over expected text.
- Encrypted-traffic analysis: packet timing and size, with a prior over web pages or applications, reconstruct visited site, video watched, or application identity even when payload is sealed.
- Model, embedding, and gradient inversion: prediction outputs reconstruct training-set faces; vector embeddings reconstruct source text; shared gradients in federated learning reconstruct contributing batches at near-pixel fidelity, defeating the "data never leaves the device" framing.
- Elicitation, redaction reversal, and forensic reconstruction: sequences of small disclosed answers plus a prior over plausible secrets narrow to a protected fact; layout, length, and context plus a corpus prior reconstruct redacted text; trace evidence plus a scenario prior reconstructs hidden sequences of events.
Clarity¶
Naming the pattern clarifies a distinction holders chronically blur: the difference between cryptographic privacy (the output is information-theoretically independent of the input) and operational privacy (the output is informative but not reconstructable to the adversary the holder has in mind). The first is a strong property the holder controls; the second is an empirical claim about the adversary's prior, which the holder cannot in general verify and which is the load-bearing assumption in almost every real-world privacy design. The clarifying force is to expose that load-bearing assumption — most production privacy claims rest silently on a bound on the adversary's prior — and to make it a stated rather than tacit commitment.
The framing also clarifies what counts as defence, which comes in two families whose confusion produces predictable failures. Channel narrowing — quantisation, noise injection, top-k truncation, constant-time or constant-size responses, rate limiting, padding — reduces what the output channel can carry. Prior denial — corpus restriction, synthetic decoys, generative noise, k-anonymity, randomised response — reduces the sharpness of the observer's prior. Differential privacy is structurally a channel-narrowing technology; generative-noise training is a prior-denial technology; each addresses a different leg of the reconstruction, and a defence that addresses neither is theatrical. The two-family decomposition lets any proposed privacy scheme be audited immediately by asking which leg it narrows, and a scheme that narrows only one while the other remains sharp is structurally incomplete.
Manages Complexity¶
The pattern manages complexity by compressing a large family of named adversarial patterns — side-channel attack, TEMPEST, model inversion, membership inference, embedding inversion, gradient inversion, traffic analysis, redaction reversal, Bayesian elicitation, forensic reconstruction — into a single structural diagnostic with a single defence taxonomy. The complexity absorbed is the appearance that each attack is a distinct exploit requiring distinct countermeasures, when each is the same pattern running on a different channel, and each remediation literature is rediscovering members of the same defence catalogue.
A second compression is that the defence catalogue itself is shared: constant-shape outputs (constant-time crypto, constant-size packets, fixed-length redactions, fixed-output-shape APIs); rate limiting (query budgets, scan-rate limiting, interrogation pacing); output noise (differential privacy, image-artefact injection, dither); and prior denial (synthetic cohorts, audit-resistant anonymisation, decoy traffic, generative-noise training). A practitioner facing reconstruction in a new substrate can look at the established defences in any reconstruction substrate and ask which of the four families would apply. The prime also licenses several substrate-neutral inferences that bound the complexity of reasoning about privacy: that reconstruction fidelity is the product of channel informativeness and prior sharpness, so closing either factor closes the reconstruction; that defences must be paired across the two families to be complete; that privacy is adversary-relative, so a claim without a stated adversary prior is incomplete; that reconstruction quality rises monotonically as adversary models improve, so a defence adequate against last decade's adversaries may fail against next decade's; and that multiple disclosures compose worse than the worst single disclosure if the adversary can run a joint prior across them. Each inference reduces an otherwise open-ended privacy analysis to a bounded check.
Abstract Reasoning¶
The prime trains a reasoner to treat privacy as a property of the (system, adversary-with-prior) pair rather than of the disclosure surface, and to ask of any sealed input what its outputs reveal under a sufficiently sharp prior. It licenses several substrate-neutral inferences. The first is the reconstruction-quality bound: fidelity is bounded by output-channel mutual information with the input times prior sharpness, so either factor going to zero closes the reconstruction, and neither factor can be made zero without changing the system's utility. The second is defence-pairing diagnosis: a defence that addresses only channel narrowing without considering the prior, or only prior denial without considering the channel, is structurally incomplete, so the four-quadrant decomposition licenses immediate evaluation of any proposed privacy scheme.
The deeper inferences concern the adversary and time. Adversary-relative privacy recognises that privacy is not a property of a system in isolation but of the pair (system, adversary with prior), so a privacy claim that does not specify the adversary's prior is structurally incomplete — a recognition that differential-privacy theory makes explicit and that most production claims omit. Inversion-resistance under model improvement recognises that as adversary models improve — better generative priors, better corpus statistics, more compute — reconstruction quality rises monotonically, so a defence adequate against last decade's adversaries may fail against next decade's, and the forward-compatibility question must be asked at design time. Finally, composition behaviour recognises that multiple independent disclosures compose worse than the worst single disclosure if the adversary can run a joint prior across them, so the cross-disclosure cost is super-additive. The reasoner is thereby led to audit any privacy design by naming the channel's informativeness, the adversary's prior, the defence family for each leg, and the composition exposure across disclosures, rather than by inspecting the disclosure surface alone.
Knowledge Transfer¶
The transferable content is the input / informative-output-channel / observer-prior / defence-family diagnostic together with the four-family defence catalogue (channel narrowing via noise, channel narrowing via shape constancy, prior denial via decoys, prior denial via corpus restriction) and the bound that reconstruction fidelity equals channel mutual information times prior sharpness. The role mappings are regular and substrate-spanning: the protected input maps to a key, a training record, a redacted word, a tissue density, a private intention; the output channel maps to a power trace, an encrypted packet, a vector embedding, a shared gradient, a CT projection; the prior maps to natural-image statistics, corpus statistics, physical models, expected-text distributions; the defence maps to DP-SGD, padding, decoy traffic, synthetic cohorts.
The transfers are documented reuses of one structure across substrates that look unrelated. Differential privacy moved from theoretical statistics into ML training, medical-imaging release, and census release; constant-time programming moved from cryptographic implementations to side-channel-resistant ML inference; traffic padding moved from anonymity-network design to encrypted-video delivery against streaming fingerprinting. Each is the same channel-narrowing or prior-denial move retuned for a new channel. The deepest transferable recognition is that the same diagnostic — "if you show me what your system does, and I know what your system can do, I can often work out what you put into it" — applies to medical imaging, side-channel cryptanalysis, TEMPEST, traffic analysis, model and embedding and gradient inversion, interrogation, redaction reversal, and forensic reconstruction, and that the defence catalogue (narrow the output channel, deny the prior) transfers across all of them with only substrate-specific tuning. Because the core is information-theoretic and the security framing is optional — physics inverse problems exhibit the bare structure with no adversary at all — the pattern is recognised rather than imported wherever an informative output meets a sharp prior, which is what gives it its wide and substrate-general reach.
Examples¶
Formal/abstract¶
Computed-tomography reconstruction is the prime's cleanest formal instance precisely because it has no adversary — it shows the bare structure that the security framing merely specialises. The protected input the structure operates on is the interior tissue-density distribution of a body, never directly observed. The driven system with disclosed outputs is the scanner: X-rays pass through the body and the outputs are boundary measurements — attenuation projections at many angles. The channel of informativeness is that these projections differ systematically across interior densities (the system is not constant in the input), so they carry mutual information about the interior. The observer prior is the physical model — the Radon transform and known tissue-attenuation statistics — which narrows the space of interiors consistent with the projections. The reconstruction-fidelity bound is explicit: image quality rises with the number and angular coverage of projections (channel mutual information) times the sharpness of the regularising prior, and neither can be driven to zero without destroying diagnostic utility. The adversary-relative framing becomes, non-adversarially, prior-relative: the reconstruction is only as good as the prior, which is why a sparse-angle scan with a strong learned prior can still resolve structure a naive inversion could not. This same boundary-outputs-plus-prior-yields-interior-input structure recurs in MRI, EEG source localisation, and seismic inversion. Mapped back: the tissue density is the protected input, the attenuation projections are the informative output channel, the physics-plus-anatomy model is the prior, and the fidelity bound (projection coverage times prior sharpness) is the prime's reconstruction bound — with no adversary at all, proving the core is information-theoretic and the security framing optional.
Applied/industry¶
Two adversarial instances run the identical structure across unrelated substrates. First, side-channel cryptanalysis: the protected input is a device's secret key; the driven system with disclosed outputs is the cryptographic processor, whose outputs the holder believes are only the ciphertext but in fact include a power-consumption trace; the channel of informativeness is that power draw differs across the key bits being processed (a non-constant leakage model); the observer prior is over key-bit values plus the device's leakage characteristics. The reconstruction succeeds to the degree the trace's mutual information times the prior sharpness allows, and the two defence families apply: channel narrowing (constant-time, constant-power implementations that reduce what the trace can carry) and prior denial (masking, randomised blinding that desharpens the adversary's leakage model). A defence addressing only one leg is structurally incomplete. Second, gradient inversion in federated learning: the protected input is a client's training data; the disclosed output is the gradient update the client shares (believing "the data never leaves the device"); the channel of informativeness is that gradients differ across training batches; the prior is natural-image statistics. With a sharp image prior, shared gradients reconstruct contributing images at near-pixel fidelity — defeating the "data never leaves the device" framing exactly as the prime predicts. The defence catalogue transfers wholesale: differential-privacy noise (channel narrowing) plus decoy or synthetic contributions (prior denial). The deepest portable recognition is one diagnostic — "if you show me what your system does, and I know what it can do, I can often work out what you put in" — applying to imaging, side channels, and gradient inversion alike. Mapped back: the key and the training data are protected inputs; the power trace and the shared gradient are informative output channels; key-bit and natural-image statistics are the priors; and constant-power/DP-noise (channel narrowing) paired with masking/decoys (prior denial) are the two defence families the prime insists must be paired to be complete.
Structural Tensions¶
T1 — Disclosure Surface versus (System, Adversary-Prior) Pair (scopal). The prime's defining correction is that privacy is a property of the (system, adversary-with-prior) pair, not of the disclosure surface alone. The tension is between the naive model ("I disclose outputs, inputs stay sealed") and the structural one ("an observer with a sharp prior reconstructs to the channel's informativeness"). The characteristic failure mode is sealing the obvious surface while the outputs still leak under a sharp prior — "the data never leaves the device" while gradients reconstruct it. The diagnostic: ask whether the privacy claim names the adversary's prior; a claim that inspects only the disclosure surface and omits the adversary is structurally incomplete.
T2 — Channel Informativeness versus Prior Sharpness (coupling). Reconstruction fidelity is bounded by the product of output-channel mutual information and prior sharpness, so closing either factor closes the reconstruction. The tension is that the two factors are independent and a defence touching only one leaves the product non-zero. The failure mode is single-leg defence: narrowing the channel while the adversary's prior stays sharp, or denying the prior while the channel stays informative. The diagnostic: for any scheme, ask which leg it attacks — channel narrowing (noise, shape constancy) or prior denial (decoys, corpus restriction) — and confirm the other leg is also addressed, since a defence that narrows one while the other remains sharp is structurally incomplete.
T3 — Cryptographic Privacy versus Operational Privacy (measurement). Cryptographic privacy means the output is information-theoretically independent of the input; operational privacy means the output is informative but not reconstructable to the adversary the holder has in mind. The tension is that the second is an empirical, unverifiable claim about the adversary's prior masquerading as a guarantee. The failure mode is treating an operational-privacy scheme as if it were cryptographic — trusting a bound on the adversary that was never established. The diagnostic: ask whether the output is genuinely independent of the input or merely hard-to-invert under an assumed prior; the latter rests on a load-bearing assumption about the adversary that must be stated, not left tacit.
T4 — Utility versus Non-Reconstruction (sign/direction). Neither channel informativeness nor utility can be driven to zero without cost: the output is useful because it is informative about the input. The tension is that the same informativeness that makes the system work is what enables reconstruction. The failure mode is over-narrowing into uselessness (a CT scan too noised to diagnose) or under-narrowing into leakage (a prediction API precise enough to invert). The diagnostic: locate the scheme on the utility-vs-reconstruction frontier and ask whether the channel narrowing sacrifices more utility than the privacy it buys — privacy and utility trade against each other along the same informativeness axis, so neither can be maximised independently.
T5 — Static Defence versus Improving Adversary (temporal). Reconstruction quality rises monotonically as adversary models improve — better generative priors, more compute, richer corpus statistics. The tension is between a defence calibrated to today's adversary and one that must hold against tomorrow's. The failure mode is forward-incompatibility: a scheme adequate against last decade's priors that fails once a sharper generative prior arrives, retroactively de-anonymising already-released outputs. The diagnostic: ask whether the defence's adequacy depends on a bound on adversary capability that will erode — disclosed outputs are permanent while priors only sharpen, so a privacy claim must be evaluated against the strongest anticipated future prior, not the current one.
T6 — Single Disclosure versus Composed Disclosures (scalar). Multiple independent disclosures compose worse than the worst single disclosure if the adversary can run a joint prior across them; the cross-disclosure cost is super-additive. The tension is between auditing each release in isolation and auditing the joint exposure. The failure mode is composition blindness: each disclosure is individually below the reconstruction threshold, but together, under a joint prior, they collapse the input hypothesis space. The diagnostic: ask whether the adversary can correlate this disclosure with prior ones under a single prior — if so, the privacy budget must be accounted across the whole sequence, since releases that are each safe alone can reconstruct the input when the adversary fuses them.
Structural–Framed Character¶
Hidden-information reconstruction sits near the structural end of the structural–framed spectrum, with a slight lean — an aggregate of 0.2, driven by partial scores on vocab_travels (0.5) and import_vs_recognize (0.5). The underlying object is an information-theoretic inference pattern: an observer combines a system's disclosed outputs with a prior over inputs to reconstruct a protected input to the resolution the prior permits, with fidelity bounded by channel mutual information times prior sharpness.
Three diagnostics read cleanly structural and anchor the low aggregate. There is no evaluative weight (evaluative_weight 0.0): reconstruction is a value-neutral inference, neither good nor bad — the load-bearing physics inverse-problem case (CT reconstruction) is purely beneficial, the security framing merely one specialisation. There is no institutional origin (institutional_origin 0.0): the bound is definable in pure information-theoretic terms, with no rooting in any formal institution. And it is not human-practice-bound (human_practice_bound 0.0): the CT, MRI, and seismic-inversion cases show the structure operating with no adversary and no institution at all, where "observer" is just an inference procedure and "prior" is a physical model. What lifts the aggregate off zero is twofold. The vocabulary can lean toward security and privacy terms — adversary, leakage, side-channel, protected input (vocab_travels 0.5) — so a reader partly translates when carrying it between the physics and security framings. And invoking the prime in a security context can partly IMPORT an adversarial framing onto what is, at core, neutral inverse inference (import_vs_recognize 0.5). The information-theoretic skeleton is genuine and substrate-general — the physics inverse problems prove it runs with no adversary — which keeps it firmly structural; the optional security vocabulary and the adversarial framing it can import are the modest, still-structural lean the 0.2 aggregate records.
Substrate Independence¶
Hidden information reconstruction is a highly substrate-independent prime — composite 5 / 5 on the substrate-independence scale. Its domain breadth is wide and bridges physics and adversarial inference cleanly: recovering protected inputs from observable outputs plus a prior recurs in physical and medical inverse problems (CT, MRI, EEG, seismic inversion), side-channel cryptanalysis (power, EM, cache-timing leakage), TEMPEST and acoustic emanation, encrypted-traffic analysis, model/embedding/gradient inversion in machine learning, and elicitation, redaction reversal, and forensic reconstruction. The decisive feature is that the non-adversarial physical inverse problem and the adversarial side-channel attack are the same structure — boundary outputs plus a prior reconstruct an interior input — which shows the bare relational skeleton stripped of any attacker. Its structural abstraction is strong but a notch below maximal at 4: the signature (observable outputs + a prior over hidden inputs → reconstruction) is genuinely medium-neutral, but it carries the commitment to there being a "prior" and a "leakage model," slightly richer than a one-line relation. The transfer evidence is heavy at 5: the same reconstruction machinery is literally re-run across imaging, cryptanalysis, and embedding inversion, with concrete named instances (gradient inversion defeating "data never leaves the device," CT reconstruction) carrying across, so a physicist's inverse-problem intuition transfers directly to a cryptanalyst's side-channel. Breadth bridging physical and adversarial substrates plus identical-machinery transfer hold the composite at 5 despite the lightly committed signature.
- Composite substrate independence — 5 / 5
- Domain breadth — 5 / 5
- Structural abstraction — 4 / 5
- Transfer evidence — 5 / 5
Neighborhood in Abstraction Space¶
Hidden Information Reconstruction sits in a moderately populated region (54th percentile for distinctiveness): it has near-neighbors but no dense thicket of synonyms.
Family — Channels, Coding & Transmission (8 primes)
Nearest neighbors
- Information Hiding — 0.72
- Inversion — 0.71
- Distortion — 0.71
- Encoding And Decoding — 0.71
- Side Channel Attack — 0.70
Computed from structural-signature embeddings · 2026-06-14
Not to Be Confused With¶
The nearest neighbour, information_asymmetry (similarity 0.89), is the contrast most worth drawing because the two describe the same situation from opposite ends. Information asymmetry names a static condition: one party knows something another does not — the seller knows the car's defects, the borrower knows their own risk. It is a description of a knowledge gap and its consequences for markets and contracts. Hidden-information reconstruction is the active process by which an observer closes such a gap that was supposed to stay open: combining a system's disclosed outputs with a prior to reconstruct a protected input. The invariants differ at the root. Asymmetry's invariant is the gap itself and the strategic behaviour it induces (adverse selection, signalling, screening); this prime's invariant is the reconstruction-fidelity bound — channel mutual information times prior sharpness — that governs how much of a sealed input an observer can recover. A practitioner who reaches only for information asymmetry will reason about who holds an advantage and how they might exploit or signal it, and miss the prime's question entirely: given the outputs I disclose and a prior I cannot control, how much of what I meant to seal is already recoverable? Asymmetry is the state the holder is trying to maintain; this prime is the mechanism by which that state silently collapses.
A second genuine confusion is with inversion in its general sense. Both involve going backward from outputs to inputs, and the prime is indeed a species of inversion. But generic inversion is the exact reversal of a mapping — given f and y, find the x with f(x) = y — and succeeds or fails as a deterministic matter of whether f is invertible. Hidden-information reconstruction is probabilistic and prior-bounded: the observer recovers the input only to the resolution the prior permits, and the output channel is typically lossy or noisy so that no exact reversal exists. The fidelity is set by the product of channel informativeness and prior sharpness, not by the algebraic invertibility of a function. The distinction matters because it relocates the defence. Against generic inversion one makes the mapping non-invertible (a one-way function); against this prime, non-invertibility of the obvious mapping is insufficient, because a sharp prior plus a merely informative (not invertible) channel still reconstructs to useful resolution — which is exactly why "the gradient is not the data" or "the embedding is not the text" fail as privacy arguments. Treating the prime as plain inversion leads to defending the wrong property.
A third confusion worth separating is with compression, because both concern the relationship between a compact representation and a richer object. But compression removes redundancy to shrink a representation while preserving (lossily or losslessly) the ability to reconstruct the original — reconstruction is the intended function. Hidden-information reconstruction is adversarial: the disclosed output was not designed to encode the input for recovery, and the holder actively wants reconstruction to fail. The output is informative about the input as an unintended side effect of the system being non-constant in the input, and the observer's work is to exploit that incidental informativeness against the holder's wishes. The invariants differ: compression's is the rate-distortion trade-off chosen by a cooperative encoder; this prime's is the involuntary mutual information leaked by a system whose outputs the holder cannot fully de-correlate from its inputs without losing utility. Conflating them obscures the adversarial asymmetry that is the prime's whole point — the holder is not choosing how much to encode, but discovering how much they have unavoidably revealed.
For a practitioner the through-line is to keep four things distinct: the static knowledge gap (information asymmetry), the deterministic reversal of a mapping (inversion), the cooperative encoding of an object for recovery (compression), and — the prime — the adversarial, prior-bounded recovery of a sealed input from a system's informative outputs. Only the last makes privacy a property of the (system, adversary-prior) pair, demands that a privacy claim name the adversary's prior, and prescribes the paired defences of channel narrowing and prior denial. Each neighbour, taken alone, would point the analysis at the wrong invariant and the wrong defence.
Solution Archetypes¶
No catalogued solution archetypes reference this prime yet.