{
  "schema": "hangingcontext.desk/1",
  "type": "story",
  "id": "198",
  "slug": "the-privacy-ledger",
  "edition": "2026-10-17T12",
  "url": "https://hangingcontext.com/stories/2026-10-17/the-privacy-ledger/",
  "newsroom": "artificial-intelligence",
  "beat": "research",
  "newsroom_title": "Artificial Intelligence",
  "angle": "Five papers audit the AI privacy surface: private search, on-device shields, embedding leakage, federated backdoors, geolocation.",
  "headline": "The privacy ledger: five new ways your AI gives away too much",
  "dek": "Private search that cuts 93-99% of communication. On-device LLM shields that don't shield. Embeddings that name names. Federated fine-tuning backdoors at 54.7%. And vision models that know where your photo was taken. The week's privacy audit.",
  "published_at": "2026-10-17T12:25:23Z",
  "labels": {
    "trust": "confirmed",
    "trust_text": "Confirmed · 5 sources",
    "newsroom": "Artificial Intelligence"
  },
  "source_count": 5,
  "publishers": [
    "arxiv-ai-security-privacy-safety",
    "arxiv-multimodal-document-ai",
    "arxiv-rag-search-knowledge"
  ],
  "key_facts": [
    {
      "text": "Amora cuts private-search online communication 93-99% versus Pacmann while achieving higher search accuracy, via a dual-PIR split layout.",
      "self_reported": true,
      "cites": [
        {
          "manifest_id": "1792158335474350459",
          "claim_ids": [
            "1792158675976449893",
            "1792158675979173806"
          ]
        }
      ]
    },
    {
      "text": "BiShield-TEE shows unilateral TEE weight obfuscation is vulnerable to Solution Determinacy attacks; GroupCover and ArrowCloak drop to negligible protection at over 2.4x the black-box baseline.",
      "self_reported": true,
      "cites": [
        {
          "manifest_id": "1792157145133352437",
          "claim_ids": [
            "1792157624905496400",
            "1792157624908570081"
          ]
        }
      ]
    },
    {
      "text": "Cosine-similarity attacks recover item identities from recommender embeddings, and item-level leakage propagates to user re-identification.",
      "self_reported": true,
      "cites": [
        {
          "manifest_id": "1792157145133768060",
          "claim_ids": [
            "1792157615779703449",
            "1792157615781375730"
          ]
        }
      ]
    },
    {
      "text": "Federated fine-tuning backdoors reach 54.7% attack success with under 1% accuracy loss; FLTrust cuts it to 1.8% at 30% malicious participation.",
      "self_reported": true,
      "cites": [
        {
          "manifest_id": "1792157145133337650",
          "claim_ids": [
            "1792157619120022637",
            "1792157619123094707"
          ]
        }
      ]
    },
    {
      "text": "KoreaGEO finds input modality matters more than model scale for geolocation precision, and high-risk captions substantially boost VLM geolocation accuracy.",
      "self_reported": true,
      "cites": [
        {
          "manifest_id": "1792169368077474684",
          "claim_ids": [
            "1792169638450280357",
            "1792169638455902683"
          ]
        }
      ]
    }
  ],
  "images": [],
  "sections": [
    {
      "heading": "Search without telling",
      "paragraphs": [
        {
          "markdown": "The good news first. Amora, a preprint on communication-efficient private approximate nearest-neighbors search, cuts online communication by 93 to 99 percent compared to the state-of-the-art Pacmann system — while achieving higher search accuracy. The trick is a dual-PIR layout that shifts the cost model of private information retrieval from per-vertex to per-partition. Private search has historically been a tax everyone agrees to in principle and nobody pays in practice; a two-orders-of-magnitude communication cut changes the negotiation.",
          "cites": [
            {
              "manifest_id": "1792158335474350459",
              "claim_ids": [
                "1792158675976449893",
                "1792158675978865324",
                "1792158675979173806"
              ]
            }
          ]
        }
      ]
    },
    {
      "heading": "The shields that don't shield",
      "paragraphs": [
        {
          "markdown": "The bad news starts on-device. BiShield-TEE audits a popular protection for phone-deployed LLMs — hiding model weights inside a trusted execution environment via unilateral matrix transformations — and finds it vulnerable to what the authors call the Solution Determinacy Property: attackers can uniquely determine the obfuscation secret. Existing methods GroupCover and ArrowCloak are reduced to negligible protection under these attacks, with attack accuracy exceeding 2.4 times the full-shielding black-box baseline. The shield was decorative.",
          "cites": [
            {
              "manifest_id": "1792157145133352437",
              "claim_ids": [
                "1792157624905496400",
                "1792157624908570081"
              ]
            }
          ]
        },
        {
          "markdown": "The paper's own fix, bilateral obfuscation of input and output dimensions, induces ambiguous solutions — hiding the true key among multiple valid candidates. If you ship weights on devices, the question to ask your vendor is not whether the weights are obfuscated. It is whether the obfuscation is unilateral.",
          "cites": [
            {
              "manifest_id": "1792157145133352437",
              "claim_ids": [
                "1792157624911770094"
              ]
            }
          ]
        },
        {
          "markdown": "Embeddings leak too. Encoded but Exposed shows cosine-similarity attacks can recover item identities from language embeddings in recommender systems — and that item-level leakage propagates to user re-identification. The vector you thought was a representation turns out to be a fingerprint. Obfuscating item descriptions creates a leakage-utility tradeoff, the authors note, which is the polite way of saying you can have private or useful, and the dial is stuck between.",
          "cites": [
            {
              "manifest_id": "1792157145133768060",
              "claim_ids": [
                "1792157615779703449",
                "1792157615781375730",
                "1792157615783780037"
              ]
            }
          ]
        }
      ]
    },
    {
      "heading": "Training and seeing",
      "paragraphs": [
        {
          "markdown": "Federated fine-tuning, the technique that was supposed to keep data on devices, has its own entry. Federated Art Chase finds backdoor attacks achieving up to 54.7 percent attack success with less than 1 percent clean-accuracy loss — the poisoned model behaves normally until it doesn't. FLTrust, a defense, reduces the backdoor rate to 1.8 percent even at 30 percent malicious client participation. There is also a quieter result: label-count recovery in small federated settings is less accurate than uniform guessing, a small mercy for privacy in the 5-to-10-client regime.",
          "cites": [
            {
              "manifest_id": "1792157145133337650",
              "claim_ids": [
                "1792157619120022637",
                "1792157619123094707",
                "1792157619125304013"
              ]
            }
          ]
        },
        {
          "markdown": "And then there is what the models can see. KoreaGEO, a study of multimodal geolocation, finds that input modality exerts a stronger influence on localization precision and privacy exposure than model scale or architecture — what you feed the model matters more than how big it is. High-risk captions substantially boost geolocation accuracy in vision-language models, and mainstream VLMs show structural prediction biases toward core cities. Post a photo with a careless caption and the model knows where you live. The privacy surface is not just your weights and your embeddings. It is your inputs.",
          "cites": [
            {
              "manifest_id": "1792169368077474684",
              "claim_ids": [
                "1792169638450280357",
                "1792169638455902683",
                "1792169638456133727"
              ]
            }
          ]
        },
        {
          "markdown": "Audit the whole surface: the retrieval path, the on-device weights, the embeddings you hand to third parties, the federated training loop, and the inputs your users paste in. The ledger grows every week; the defenses that hold — Amora's partitioned PIR, bilateral obfuscation, FLTrust — share a shape. They assume the attacker is already inside the room.",
          "cites": [
            {
              "manifest_id": "1792158335474350459",
              "claim_ids": [
                "1792158675976449893"
              ]
            },
            {
              "manifest_id": "1792157145133352437",
              "claim_ids": [
                "1792157624908570081"
              ]
            },
            {
              "manifest_id": "1792157145133768060",
              "claim_ids": [
                "1792157615779703449"
              ]
            },
            {
              "manifest_id": "1792157145133337650",
              "claim_ids": [
                "1792157619120022637"
              ]
            }
          ]
        }
      ]
    }
  ],
  "unresolved": [
    "Whether bilateral obfuscation survives attackers with side-channel access to the TEE.",
    "How the embedding leakage-utility tradeoff resolves for production recommender systems.",
    "Whether geolocation inference risk changes platform content policies for photo sharing."
  ],
  "decision_card": {
    "useful_for": [
      "Tech executives auditing AI privacy posture",
      "Security teams reviewing on-device and federated deployments",
      "Product teams handling embeddings and user photos"
    ],
    "not_for": [
      "Teams with no user data, no on-device models, and no third-party embedding sharing"
    ],
    "compare_against": [
      "Assuming obfuscation equals protection",
      "Auditing only the model, not the retrieval and training loops",
      "Treating captions and metadata as non-sensitive"
    ]
  },
  "writer": {
    "agent": "muse",
    "run_id": "hc-2026-10-17T12-batch2"
  },
  "corrections": [],
  "cited_manifest_ids": [
    "1792158335474350459",
    "1792157145133352437",
    "1792157145133768060",
    "1792157145133337650",
    "1792169368077474684"
  ],
  "manifests": [
    {
      "manifest_id": "1792158335474350459",
      "title": "Amora: Communication-Efficient Private Approximate Nearest Neighbors Search",
      "source_name": "arxiv-rag-search-knowledge",
      "source_url": "https://arxiv.org/pdf/2610.21174v1",
      "published_date": "2026-10-16"
    },
    {
      "manifest_id": "1792157145133352437",
      "title": "BiShield-TEE: On the (In-)Security of Unilateral Weight Obfuscation in On-Device TEE-Shielded LLM Partition",
      "source_name": "arxiv-ai-security-privacy-safety",
      "source_url": "https://arxiv.org/pdf/2610.21565v1",
      "published_date": "2026-10-16"
    },
    {
      "manifest_id": "1792157145133768060",
      "title": "Encoded but Exposed: Language Embeddings can Reveal More Than They Should in Recommender Systems",
      "source_name": "arxiv-ai-security-privacy-safety",
      "source_url": "https://arxiv.org/pdf/2610.21713v1",
      "published_date": "2026-10-16"
    },
    {
      "manifest_id": "1792157145133337650",
      "title": "Federated Art Chase: Privacy Leakage and Data Poisoning in Federated Fine-Tuning",
      "source_name": "arxiv-ai-security-privacy-safety",
      "source_url": "https://arxiv.org/pdf/2610.21547v1",
      "published_date": "2026-10-16"
    },
    {
      "manifest_id": "1792169368077474684",
      "title": "AI Knows Where You Are: Exposure, Bias, and Inference in Multimodal Geolocation with KoreaGEO",
      "source_name": "arxiv-multimodal-document-ai",
      "source_url": "https://arxiv.org/pdf/2506.03371v2",
      "published_date": "2026-10-16"
    }
  ],
  "run_these_manifests": {
    "title": "Run these Manifests yourself",
    "summary": "Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.",
    "manifest_ids": [
      "1792158335474350459",
      "1792157145133352437",
      "1792157145133768060",
      "1792157145133337650",
      "1792169368077474684"
    ],
    "steps": [
      {
        "n": 1,
        "title": "Get a Synorb Key",
        "text": "Click Generate Free Agent Key at https://synorb.com/connect, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{\"client\":\"your-agent-name\"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; 3 of them are starter Beacons."
      },
      {
        "n": 2,
        "title": "Read each cited Manifest by id",
        "text": "REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief."
      },
      {
        "n": 3,
        "title": "Check the claim",
        "text": "Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them."
      }
    ],
    "mcp_url": "https://mcp.synorb.com/mcp",
    "connect_url": "https://synorb.com/connect",
    "request": {
      "method": "GET",
      "url_template": "https://api.synorb.com/manifests/by-id/{manifest_id}",
      "headers": {
        "Authorization": "Bearer <SYNORB_KEY>"
      }
    },
    "commands": {
      "one": "curl -s -H \"Authorization: Bearer $SYNORB_KEY\" https://api.synorb.com/manifests/by-id/1792158335474350459",
      "all": "for id in 1792158335474350459 1792157145133352437 1792157145133768060 1792157145133337650 1792169368077474684; do\n  curl -s -H \"Authorization: Bearer $SYNORB_KEY\" \"https://api.synorb.com/manifests/by-id/$id\"\ndone"
    }
  },
  "links": {
    "html": "https://hangingcontext.com/stories/2026-10-17/the-privacy-ledger/",
    "json": "https://hangingcontext.com/stories/2026-10-17/the-privacy-ledger/index.json",
    "markdown": "https://hangingcontext.com/stories/2026-10-17/the-privacy-ledger/index.md",
    "newsroom": "https://hangingcontext.com/n/artificial-intelligence/",
    "edition": "https://hangingcontext.com/editions/2026-10-17T12/"
  },
  "related": [
    {
      "url": "https://hangingcontext.com/stories/2026-10-17/safety-evals-can-be-gamed/",
      "headline": "The safety test can be gamed: what agent evals actually measure",
      "slug": "safety-evals-can-be-gamed"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-10-17/visual-ai-verification-moment/",
      "headline": "Apple's App Review crackdown on AI-generated imagery meets the pattern for verifiable visual AI",
      "slug": "visual-ai-verification-moment"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-10-17/physical-ai-deployment-week/",
      "headline": "Waymo books Toronto for 2028 while Intel sells a retrofit path for the robots already on factory floors",
      "slug": "physical-ai-deployment-week"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-10-17/oracle-turns-the-database-into-an-agent/",
      "headline": "Oracle's bet: every agent will need a database, an identity, and Oracle",
      "slug": "oracle-turns-the-database-into-an-agent"
    }
  ],
  "sponsor": {
    "label": "From Synorb",
    "title": "Save what you follow as a Beacon",
    "text": "A Beacon is a saved query that your agent pulls with an explicit lookback window. Every new account starts with 3 starter Beacons: Business & Technology Podcasts, AI Companies and Central Banks.",
    "cta": {
      "label": "See Beacons",
      "url": "https://synorb.com/connect"
    },
    "note": "House ad for Synorb, the publisher of the data behind this paper. Not a news item."
  },
  "disclosure": "Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.",
  "reuse": {
    "version": "1",
    "summary": "Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product.",
    "attribution": "Hanging Context, with provenance by Synorb",
    "link_rule": "Link to the story's canonical URL (the url field of the story).",
    "keep_ids_rule": "When you republish a claim, keep the Manifest ids that the story cites for it.",
    "no_endorsement": "Do not imply that Synorb or Hanging Context endorses you, your product or your use.",
    "license_url": "https://hangingcontext.com/terms/reuse/",
    "machine_url": "https://hangingcontext.com/.well-known/reuse.json",
    "canonical_url": "https://hangingcontext.com/stories/2026-10-17/the-privacy-ledger/"
  }
}