💻 computer science

Semantic Non-Assembly: Privacy by Architectural Inertness Under Component Exposure

This paper introduces "Semantic Non-Assembly," a structural privacy framework that ensures no actionable data is revealed by sub-threshold component exposure by preventing the assembly of sufficient input assignments for designated predicates, a guarantee formally verified and instantiated via the Birthmark Standard for constrained hardware environments, and enhanced by a 'Safety Net' mechanism where tripwires on stolen data alert other repositories to purge context before they can be hacked, rendering the targeted data permanently inaccessible.

Original authors: Sam Ryan

Published 2026-06-23

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Sam Ryan

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Idea: Privacy by "Empty Hands"

Imagine you are trying to solve a mystery: Who took this specific photo?

In most privacy systems, the goal is to build a giant, high-security vault (a database) containing all the answers. You then build walls, hire guards, and install alarms to keep thieves out. The problem is, if a thief breaks in, they steal the entire vault, and the game is over.

This paper proposes a completely different strategy called Semantic Non-Assembly (SNA). Instead of building a vault, the system is designed so that no single person or computer ever holds the full answer.

Think of it like a magic trick where the magician never holds the rabbit and the hat at the same time.

The Rabbit is the identity of the camera (e.g., "Camera #123").
The Hat is the photo itself (or its digital fingerprint).

In this system, the "Rabbit" and the "Hat" are always kept in different rooms, by different people, and never allowed to meet unless a very specific, authorized group of people agrees to bring them together.

How It Works: The Two-Channel System

The paper describes a system for verifying that a photo came from a real, registered camera (like a journalist's camera) without revealing which camera it was. It splits the information into two separate "channels" that travel separately:

The Content Channel (The "What"):
- This carries a digital fingerprint (hash) of the photo.
- It goes to a public registry (like a bulletin board).
- Who sees it? Anyone.
- What do they learn? They see that a photo was taken, but they have no idea who took it. It's like seeing a fingerprint on a glass, but not knowing whose hand it belongs to.
The Credential Channel (The "Who"):
- This carries an encrypted ID card for the camera.
- It goes to a "Validator" (a trusted authority).
- Who sees it? Only the Validator.
- What do they learn? They see that the camera is real and registered, but they have no idea what photo it took. It's like a bouncer checking a VIP list, but the bouncer doesn't know which table the VIP is sitting at.

The Magic: The system is built so that the person holding the "Who" (the Validator) never sees the "What" (the photo fingerprint), and the person holding the "What" (the Public Registry) never sees the "Who."

If a hacker breaks into the Registry, they only see a list of fingerprints with no names. If they break into the Validator, they only see a list of camera IDs with no photos. The answer to "Who took this photo?" simply does not exist in any single place.

The "Jigsaw Puzzle" Analogy

Imagine the secret answer is a picture of a cat.

Old Privacy Systems: They put the whole picture of the cat in a safe. If the safe is broken, the cat is stolen.
Semantic Non-Assembly: They cut the picture into four pieces.
- Person A has the ears.
- Person B has the eyes.
- Person C has the nose.
- Person D has the tail.
- Crucially: No single person has a piece big enough to guess what the picture is. Even if a thief steals Person A's piece (the ears), they just have a picture of some ears. They can't see the cat.

To see the cat, you need to steal from all four people at the same time and put the pieces together. The paper calls this "Semantic Non-Assembly" because the meaning (the cat) cannot be assembled by anyone with fewer than the required number of pieces.

What About "Back-Door" Investigations?

The paper acknowledges that sometimes, if a camera is used for something illegal, authorities might need to find out who used it. They added a "Back-Lookup" feature.

This is like a four-person key chain.

To unlock the secret, you need four different keys held by four different organizations (a Governing Server, two Submission Servers, and the Validator).
You can't just ask one person; you have to ask all four in a specific order.
The Safety Net: The system includes "tripwires" on the data. If a thief manages to steal data from one repository, these tripwires instantly alert the other repositories. Before the thief can hack the remaining servers to gather the full picture, those other servers automatically purge the related context. This renders the targeted data permanently inaccessible, ensuring that even if one part is compromised, the full secret remains unsolvable.

Why This Matters for Cameras (The "Birthmark Standard")

The authors tested this on real camera hardware (like the ones in smartphones or DSLRs).

The Problem: Other privacy methods (like Zero-Knowledge Proofs) are too heavy. They are like trying to run a marathon while carrying a heavy backpack; they slow down the camera too much.
The Solution: This new system is lightweight. It's like running with a feather. It works on standard, cheap camera chips without slowing down the photo-taking process.

The Bottom Line

This paper introduces a new way to think about privacy: Don't just try to hide the data; design the system so the data never exists in a complete form in the first place.

If a hacker steals one part of the system: They get nothing useful.
If a hacker steals two parts: They still get nothing useful.
The only way to break privacy: You have to compromise a coordinated group of different organizations simultaneously, which is incredibly difficult.

The system ensures that while we can prove a photo is real, we cannot easily prove who took it, unless a very specific, high-security process is followed. It turns privacy from a "fortress" (which can be breached) into a "scattered puzzle" (which cannot be solved by a single thief).

Technical Summary: Semantic Non-Assembly

1. Problem Statement

Existing privacy frameworks (confidentiality, access control, information flow control, and statistical disclosure limitation) focus on restricting access to sensitive information that exists within a system. These models assume a "store" to protect and a "flow" to restrict. However, in a threat environment where component compromise (credential theft, insider access, infrastructure breach) is probable rather than exceptional, these frameworks fail. If a single component holds sufficient information to perform a target identification function (e.g., linking a specific capture device to specific content), the compromise of that single component collapses the entire privacy guarantee.

The paper identifies a gap: there is no class of system that concedes nothing upon component exposure because there is nothing to concede. The challenge is to architect a system where the complete, authorized exposure and decryption of any single component yields no actionable data regarding the target identification function.

2. Methodology: Semantic Non-Assembly (SNA)

The paper introduces Semantic Non-Assembly (SNA), a class of privacy guarantee defined not by the difficulty of achieving exposure, but by the information yield of exposure when it occurs.

Core Definition

SNA prevents the evaluation of a designated predicate $f$ (e.g., device-to-content attribution) by ensuring that no coalition of fewer than a defined threshold $t+1$ components can assemble a sufficient assignment to $f$ 's input domain.

Semantic: Refers to the meaning level of information (what the data enables with respect to $f$ ), distinct from cryptographic semantic security.
Non-Assembly: The sufficient state (the combination of information fields required to execute $f$ ) is structurally prevented from existing in any single component or any sub-threshold coalition.
Architectural Inertness: The guarantee is structural, not procedural. It is achieved by design, ensuring that co-location of sufficient information is structurally impossible below the compromise threshold, rather than relying on policy or trust.

Distinction from Existing Mechanisms

Vs. Confidentiality: Confidentiality restricts access to data that exists in one place; SNA prevents the sufficient data set from existing in one place.
Vs. Access Control: Access control mediates operations on existing stores; SNA eliminates the store.
Vs. Information Flow Control (IFC): IFC restricts propagation paths for existing data; SNA ensures the target state is architecturally absent, so no flow exists to restrict.
Vs. Statistical Disclosure Limitation: SDL bounds inference from released data; SNA prevents the sufficient information set from existing at any sub-threshold component, leaving no dataset to apply inference to.

Reference Instantiation: Two-Channel Provenance Architecture

The paper instantiates SNA in a media provenance system (the Birthmark Standard) designed to link capture devices to authenticated content without allowing passive attribution. The architecture separates submissions into two independent channels:

Content Channel: Carries a hash of the media content ( $H_{content}$ ) and optional hashed metadata. Routed to a public Registry (consortium blockchain).
Credential Channel: Carries an encrypted device token (encrypted under the Credential Validator's public key) and a key reference. Routed to a Credential Validator.

Operational Flow:

The Submission Server receives both channels but separates them. It routes the encrypted credential to the Validator and the content hash to the Registry.
The Credential Validator decrypts the token, verifies device membership, and returns a signed approval. It never sees the content hash.
The Registry stores the content hash and the approval signature. It never sees the device identity.
Result: No single party holds both a device identifier and a content hash. The sufficient state for attribution is structurally absent.

Forensic Extension (Back-Lookup)

For scenarios requiring device revocation, the paper proposes a four-party forensic path (Governing Server, Submission Server 1, Submission Server 2, Credential Validator). This path requires sequential traversal of all four parties to reconstruct attribution.

Active Defense: Includes a "Kill Switch" (Emergency Blinding Protocol). If a forensic traversal is detected without authorization, the system triggers a window-level purge, destroying all transaction-to-device associations for that rotation window.
Safety Net Mechanism: Tripwires embedded in stolen data alert other repositories to purge contextual data before those repositories can be hacked, rendering the targeted data permanently inaccessible.
Temporal Expiry: All forensic chain data is automatically deleted after three years, permanently severing the attribution chain.

3. Key Contributions

Formalization of Semantic Non-Assembly: A new class of privacy guarantee characterized by the information yield of component exposure, distinct from confidentiality and access control.
Two-Channel Provenance Architecture: A structural instantiation of SNA with executable ProVerif proofs establishing:
- Property A (Device Non-Correlation): The validator learns device identity but not content hash.
- Property B (Registry Observer Non-Identification): Observers see content hashes but cannot identify devices.
- Property C (Submission Server Blindness): The server routes data but cannot decrypt credentials to identify devices.
- Property D (Active Defense Gate): Formal verification of gate correspondence, purge-state secrecy, and chain integrity.
Bounded Privacy Cost of Forensics: A formal characterization showing that adding forensic capability (back-lookup) requires coordinated compromise of four independent organizational boundaries, bounding the privacy cost.
The Birthmark Standard: A reference instantiation demonstrating deployability on constrained capture hardware (e.g., camera ISPs) where Zero-Knowledge (ZK) approaches are computationally infeasible.

4. Results and Verification

Formal Verification: The paper establishes four ProVerif-verified properties. The model uses ECIES (asymmetric IND-CCA2) for credential encryption, with the ProVerif model directly reflecting this deployment.
Computational Feasibility: Device-side operations (ECIES encapsulation, AES-256-GCM, SHA-256) are benchmarked to run within a 100ms capture-path budget on commodity ARM-class embedded processors. This contrasts with ZK-proof approaches, which require seconds to minutes per proof on similar hardware.
Storage Efficiency: Registry records are compact (153 bytes on-chain), enabling low-cost validator operation.
Bounded Disclosure: Table 3 in the paper details that any single-component compromise yields only "attribution-surface fragments." Even with the back-lookup extension, passive bulk attribution is impossible; the worst-case scenario for a coordinated adversary is targeted hypothesis testing on media they already possess.

5. Significance and Claims

The paper claims that Semantic Non-Assembly offers a distinct and necessary approach to privacy in a threat environment where component exposure is inevitable.

Structural vs. Procedural: The primary significance is the shift from policy-based separation (which fails under insider threat) to structural separation (which fails only under coordinated multi-component compromise).
Deployability: The architecture addresses the "deployment gap" where ZK-based approaches are too computationally heavy for real-time capture hardware, yet standard provenance systems (like C2PA) fail when metadata is stripped during distribution.
Predictable Degradation: Unlike systems that collapse entirely upon a single breach, SNA systems degrade predictably. The privacy guarantee holds as long as the adversary does not control the threshold number of components ( $t+1$ ).
Governance as Security: The paper emphasizes that the architecture relies on audited organizational constraints (e.g., validator ownership caps, jurisdictional distribution) to maintain structural independence. The governance layer is treated as a load-bearing security component, not merely an administrative overlay.

The paper concludes that in a world where leaks are inevitable, designing for the consequences of failure (by ensuring there is nothing to concede) is as critical as designing against failure. The Birthmark Standard provides a concrete, verifiable path to achieving this for media provenance.