A new measure for dynamic leakage based on quantitative information flow
Luigi D. C. Soares, Mário S. Alvim, Natasha Fernandes
TL;DR
This work addresses the lack of a principled dynamic leakage measure in QIF by introducing a strategy-based dynamic leakage framework. It distinguishes two states of knowledge—the adversary's belief $q$ and a baseline distribution $p$—and defines leakage as the gain-difference of optimal actions guided by $q$ against the baseline, ensuring non-interference and offering relaxed single-step monotonicity and DPI results. The framework recovers static leakage in expectation/max-case and connects to KL-divergence when using Shannon loss, while providing concrete benefits for evaluating privacy-preserving data releases and leakage-tracker-type systems. It also clarifies when multi-step analyses may violate DPI, outlining the practical implications for system design and privacy guarantees. Overall, the approach unifies dynamic and static leakage analyses under a principled, strategy-centric model that aligns with information-theoretic axioms and supports real-world privacy assessments.
Abstract
Quantitative information flow (QIF) is concerned with assessing the leakage of information in computational systems. In QIF there are two main perspectives for the quantification of leakage. On one hand, the static perspective considers all possible runs of the system in the computation of information flow, and is usually employed when preemptively deciding whether or not to run the system. On the other hand, the dynamic perspective considers only a specific, concrete run of the system that has been realised, while ignoring all other runs. The dynamic perspective is relevant for, e.g., system monitors and trackers, especially when deciding whether to continue or to abort a particular run based on how much leakage has occurred up to a certain point. Although the static perspective of leakage is well-developed in the literature, the dynamic perspective still lacks the same level of theoretical maturity. In this paper we take steps towards bridging this gap with the following key contributions: (i) we provide a novel definition of dynamic leakage that decouples the adversary's belief about the secret value from a baseline distribution on secrets against which the success of the attack is measured; (ii) we demonstrate that our formalisation satisfies relevant information-theoretic axioms, including non-interference and relaxed versions of monotonicity and the data-processing inequality (DPI); (iii) we identify under what kind of analysis strong versions of the axioms of monotonicity and the DPI might not hold, and explain the implications of this (perhaps counter-intuitive) outcome; (iv) we show that our definition of dynamic leakage is compatible with the well-established static perspective; and (v) we exemplify the use of our definition on the formalisation of attacks against privacy-preserving data releases.