🤖 AI

Share No More Than the Request Requires: Federated Disclosure for Perspective-Aware AI

This paper introduces Provenance Preserving Chronicles (PPC), a federated protocol that empowers users to maintain data sovereignty by transforming their personal information into temporal knowledge graphs and enforcing a "minimum-necessary disclosure" principle to share only strictly authorized, provenance-linked context with third parties.

Original authors: Sourena Khanzadeh, Daniel Platnick, Marjan Alirezaie, Hossein Rahnama

Published 2026-07-28

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Sourena Khanzadeh, Daniel Platnick, Marjan Alirezaie, Hossein Rahnama

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine your digital life as a massive, ever-growing scrapbook. Every photo you take, every text you send, and every doctor's visit you have gets pasted into this book. Right now, most of the world's big tech companies act like they own the scrapbook. They keep it in a giant, locked vault, and when you want to show a friend a picture of your cat, you have to hand over the whole book—or at least let them peek at the whole thing. This is risky because if the vault gets hacked, or if the company decides to sell your secrets, your entire life is exposed.

To fix this, scientists are building a new kind of digital identity where you hold the scrapbook. In this new world, your data isn't a giant lump; it's broken down into tiny, organized snapshots called "Situation Graphs." Think of these as individual pages in your scrapbook, each capturing a specific moment in time with labels like "at the park," "eating pizza," or "feeling tired." When you stack all these pages together in order, they form a "Chronicle"—a complete, time-traveling story of who you are. The big question this paper tackles is: How do you let someone ask a specific question about your story (like "What medicine are you taking?") without accidentally handing them your entire scrapbook, including your diary entries about your crush or your bank statements?

The authors of this paper, Sourena Khanzadeh and his team, propose a clever solution called Provenance Preserving Chronicles (PPC). They suggest a system that acts like a super-smart, strict librarian who only hands you the exact page you need, nothing more.

Here is how their "librarian" works, using a playful analogy:

Imagine you are a doctor trying to figure out if a patient's new heart medication might clash with their old allergy medicine. You don't need to see the patient's entire life story. You don't need to know what they had for breakfast three years ago, or that they once wrote a sad poem about a broken heart. You just need the specific pages about their current meds and allergies.

In the old way, the patient might have to email you a PDF of their entire medical history. In the PPC system, the patient's "Chronicle" stays safely locked on their own device (their "sovereign" home). When you, the doctor's agent, send a request, it doesn't ask for "everything." It asks for a specific "evidence subgraph."

Think of the Chronicle as a giant, tangled ball of yarn where every knot is a piece of data. The PPC system is a robot that can instantly untangle only the red string (the meds) and the blue string (the allergies) that are connected to your question. It cuts away the green string (the poetry) and the yellow string (the bank records) before it even leaves the patient's house.

The paper introduces a two-step dance to make sure this happens safely:

The Text First: The librarian (the system) sends you a summary written in plain text, like "The patient is taking Warfarin and is allergic to Penicillin." Crucially, this text comes with a "receipt" or a pointer that says, "I got this from the June 2024 visit page."
The Artifact Later: If you really need to see the actual photo of the prescription bottle or the audio recording of the doctor's note, you have to ask for it specifically. The patient then has to give a second, explicit "Yes, I approve this specific file" before it is released. This prevents the system from accidentally dumping a whole folder of files just because you asked one question.

The researchers tested this idea in two very different worlds: medicine and law.

In the medical scenario, they showed how a cardiologist could get a patient's heart medication list without accidentally seeing their psychiatric therapy notes. The system successfully filtered out the "psychiatric" pages because the doctor's request was only about "drug interactions," not mental health.
In the legal scenario, they showed how a lawyer could ask for emails about a specific contract without getting privileged notes between the company and their own lawyers. The system knew to hide the "privileged" pages even if they were attached to the same email chain.

However, the paper is careful not to promise that this is a magic wand that solves every problem. The authors admit that while the system is great at finding the smallest set of facts needed to answer a question, sometimes "smallest" isn't always "most helpful." For example, if a doctor asks about a medication, the system might strip away the reason the medication was prescribed (like a heart rhythm issue) because the question didn't explicitly ask for the diagnosis. The paper suggests that while the system is mathematically efficient at hiding secrets, it might sometimes hide too much context that a human expert actually needs to make a good decision.

The team also warns that this isn't a "blockchain" solution in the traditional sense. They argue that putting this data on a giant, shared public ledger (like Bitcoin) is the wrong approach because it forces everyone to copy everyone else's data. Instead, they propose a "federated" approach where data stays on your own device, and only the tiny, approved snippets travel across the network.

In short, this paper suggests a new way to share our digital lives: Share no more than the request requires. It's like having a conversation where you only answer the specific question asked, rather than telling your whole life story just because someone asked, "How are you?" The authors have built a blueprint for this system, showing it works in theory and in simulated scenarios, but they note that the real challenge remains: figuring out exactly how to define "enough" information so that we stay safe without losing the context we need to be helpful.

Technical Summary: Share No More Than the Request Requires: Federated Disclosure for Perspective-Aware AI

Problem Statement
Modern AI systems rely on centralized aggregation of user data, creating risks of mass surveillance and loss of user autonomy. While user-sovereign identity frameworks (e.g., Solid, Verifiable Credentials) allow individuals to control their data, they lack mechanisms for minimum-necessary disclosure during dynamic, agent-mediated exchanges. Existing solutions either centralize data (blockchains), distribute custody without exchange-time minimization (P2P overlays), or provide coarse-grained access control (allow/deny policies) that fails to compile a compact, task-specific evidence subgraph.

The core problem addressed is: Given a requester, a specific relationship, a stated purpose, and a query, how can a data holder release the smallest authorized subgraph of their personal data sufficient to answer the request, without centralizing data or shipping unnecessary artifacts? This is critical for Perspective-Aware AI (PAi), where identity is modeled as a "Chronicle"—a temporal, predicate-labeled knowledge graph—rather than a static document.

Methodology: Provenance Preserving Chronicles (PPC)
The paper proposes Provenance Preserving Chronicles (PPC), a federated protocol designed to compile authorized evidence subgraphs on-the-fly. The methodology rests on three pillars:

Data Structure (Chronicles):
- User data is structured as Situation Graphs ( $G_{t_i}$ ), which are predicate-labeled knowledge graphs capturing specific moments (entities, attributes, context).
- A Chronicle ( $C_u$ ) is the time-ordered sequence of these Situation Graphs, consolidated into a longitudinal identity graph ( $G^C_u$ ) with provenance pointers to raw artifacts.
The Authorization Function ( $A$ ):
- Access is not based solely on identity but on the relationship ( $r$ ) between requester and holder (e.g., treating physician vs. insurance auditor) and the purpose ( $p$ ) of the query.
- $A$ evaluates nodes and edges against domain-expert ontologies to determine if a specific piece of evidence is permitted for a specific context.
The Compilation Protocol (Two-Phase Flow):
- Phase 1: Authorized Evidence Compilation.
  - The requester's agent sends a query ( $Q$ ) and a verifiable presentation (identity/role).
  - A planner decomposes $Q$ into schema-level information needs ( $I(Q)$ ) using domain ontologies.
  - Holders locally filter their Chronicles via $A$ , retrieve relevant nodes/edges, and perform minimality pruning to extract a compact subgraph ( $S_i$ ) that covers the information needs while removing authorized-but-unnecessary data.
  - A coordinator assembles these fragments, aligns entities across holders, and re-validates sufficiency.
  - Output: The requester receives textual responses linked to provenance references (pointers to specific triples), not raw artifacts.
- Phase 2: Artifact Release.
  - If the requester needs the underlying raw data (e.g., a lab image), they must request it explicitly.
  - This triggers a second, stricter authorization check requiring explicit, per-artifact human approval from the holder.

Key Contributions

Formalization of Minimum-Necessary Disclosure: The paper defines the problem as a minimization objective (Eq. 1) to find the smallest subgraph $S^*$ that is both authorized and structurally sufficient for a query.
Sufficiency Validation: It introduces Algorithm 1, a validator that checks for path coverage, predicate-type completeness, connectivity, and provenance. It distinguishes between structural sufficiency (guaranteed by the protocol) and task/clinical sufficiency (domain-dependent and noted as an open challenge).
Architectural Gap Identification: The authors map existing systems (Blockchain, Solid, P2P) and demonstrate that none jointly support holder sovereignty, ledger-free exchange, and exchange-time minimization of predicate-labeled temporal graphs.
Threat Model: The paper explicitly scopes threats to malicious requesters, consumer inference (e.g., LLMs inferring denied data), and prompt injection, while assuming an honest-but-curious coordinator and sound credentialing.

Results and Domain Instantiations
The paper does not present empirical benchmarks or a deployed prototype but provides theoretical instantiations in two regulated domains to demonstrate the protocol's flexibility:

Medical Domain: A cardiologist querying a patient's Chronicle for drug interactions.
- Result: The protocol successfully filters out psychiatric notes and billing records while retaining prescription chains and allergy data.
- Tension Identified: The paper notes a conflict between "structural minimality" (dropping a diagnosis not explicitly requested) and "clinical utility" (where that diagnosis might be contextually necessary). This highlights that "sufficiency" depends on the quality of the information-need decomposition ( $I(Q)$ ).
Litigation Domain: Opposing counsel requesting evidence for discovery.
- Result: The protocol filters privileged attorney-client communications while releasing non-privileged contract terms and communications.
- Insight: Minimality can be misleading if it isolates a contract clause from its negotiation context, reinforcing that the "smallest sufficient" set is a function of the domain's definition of sufficiency.

Significance and Claims
The paper claims that PPC fills a distinct architectural gap: it is the compilation layer that transforms "what a requester is allowed to see" (access control) into "what the request actually needs" (minimum-necessary disclosure).

Modest Claims: The authors explicitly state they do not resolve the tension between aggressive minimization and utility, nor do they solve the problem of estimating LLM answer distributions over subgraphs (the "distributional tier"). They frame the minimization target as an open question.
Core Value: The protocol enables provenance-first, federated disclosure where data remains under holder sovereignty, and raw artifacts are never transmitted without explicit, secondary approval. It positions itself as complementary to existing sovereign identity stacks (like Solid), adding the necessary logic for dynamic, context-aware subgraph compilation.

In summary, the paper proposes a rigorous framework for federated, perspective-aware AI where data sharing is governed by a "share no more than the request requires" principle, enforced through a two-phase protocol that separates authorized text summaries from raw artifact release.

Technical Summary: Share No More Than the Request Requires: Federated Disclosure for Perspective-Aware AI

More like this