Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces the concept of Semantic Non-Assembly (SNA), a novel privacy guarantee that shifts the focus from the difficulty of exposing information to the actual information yield when exposure occurs. By ensuring that no coalition of components below a defined threshold can assemble sufficient data to evaluate a designated predicate, SNA provides a structural privacy framework that degrades predictably under component compromise. The authors validate this approach through ProVerif-verified properties and demonstrate its practical applicability using the Birthmark Standard on constrained capture hardware, highlighting its feasibility in scenarios where traditional zero-knowledge methods may be impractical.
Semantic Non-Assembly ensures that even if components are exposed, they yield no actionable data unless a critical mass is compromised, fundamentally redefining privacy guarantees in system architecture.
Existing privacy frameworks emphasize confidentiality, access control, appropriate information flow, or statistical disclosure limitation. We introduce a complementary class of privacy guarantee (Semantic Non-Assembly) in which privacy is characterized not by the difficulty of achieving exposure but by the information yield of exposure when it occurs. SNA prevents evaluation of a designated predicate by preventing any sub-threshold coalition from assembling a sufficient assignment to its input domain. An architecture satisfies Semantic Non-Assembly when no coalition of fewer than a defined threshold of components can assemble such an assignment: complete exposure and decryption of any sub-threshold component yields no actionable data. In the base protocol, the guarantee is structural: it operates through architecture, not policy, and its privacy properties degrade predictably under component compromise rather than collapsing at a single point. The reference instantiation combines this structural guarantee with audited organizational constraints, as characterized in Appendix A. This paper formalizes the guarantee and establishes four ProVerif-verified properties: Device Non-Correlation, Registry Observer Non-Identification, Submission Server Blindness, and Active Defense Gate correctness, the first three through a two-channel provenance architecture. The Birthmark Standard instantiates the guarantee on constrained capture hardware, demonstrating deployability where ZK-based approaches are computationally infeasible. All formal properties and scope limitations are documented in Appendix A.