Follow-up from the GIS count-leak fix (PR #366), which suppresses each registrant count below the k-anonymity threshold independently. That closes the primary "tiny polygon → presence" leak but leaves a differencing residual in the batch endpoint.
Finding
/gis/query/statistics/batch returns a per-geometry total_count for each shape plus a deduplicated summary.total_count. Each is suppressed independently (below k → 0). But an attacker who controls the geometry set can still difference visible (≥k) counts against each other and against the summary to infer a suppressed cell — e.g. cover an area with N tiles where all but one are ≥k and the union summary is ≥k, then infer the suppressed tile by subtraction. Non-overlapping tiles make the arithmetic clean.
Full protection requires complementary suppression across the batch (as spp.metric.privacy._apply_k_anonymity does for fixed breakdown dimensions), which is hard here because the geometries are attacker-chosen rather than a fixed partition.
Options to weigh
- Complementary suppression: if any cell in a batch is suppressed, suppress the next-smallest visible cell(s) and/or the summary.
- Cap batch size / rate-limit, and/or require a minimum geometry area.
- Accept as documented residual for
gis:read/statistics:read (trusted-ish clients) and rely on audit logging.
Needs a design decision. Source: internal/plans/sec-gis-count-kanon-suppression-research.md.
Follow-up from the GIS count-leak fix (PR #366), which suppresses each registrant count below the k-anonymity threshold independently. That closes the primary "tiny polygon → presence" leak but leaves a differencing residual in the batch endpoint.
Finding
/gis/query/statistics/batchreturns a per-geometrytotal_countfor each shape plus a deduplicatedsummary.total_count. Each is suppressed independently (below k → 0). But an attacker who controls the geometry set can still difference visible (≥k) counts against each other and against the summary to infer a suppressed cell — e.g. cover an area with N tiles where all but one are ≥k and the union summary is ≥k, then infer the suppressed tile by subtraction. Non-overlapping tiles make the arithmetic clean.Full protection requires complementary suppression across the batch (as
spp.metric.privacy._apply_k_anonymitydoes for fixed breakdown dimensions), which is hard here because the geometries are attacker-chosen rather than a fixed partition.Options to weigh
gis:read/statistics:read(trusted-ish clients) and rely on audit logging.Needs a design decision. Source:
internal/plans/sec-gis-count-kanon-suppression-research.md.