Confidential Pulse: Authorisation-Preserving Conversational Access to Federated Confidential Government Records
Confidential Pulse is a system that enables secure, conversational access to federated government records by reconstructing responses from authorized payloads within Hyperledger Fabric channels, ensuring that while the system prevents out-of-scope data disclosure, it remains vulnerable to information leakage through the model's generated prose.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
In the modern world, governments run on data that flows between different agencies. A single citizen's life touches records held by the tax office, the land registry, the welfare department, and the licensing bureau. Each of these organizations holds sensitive information that cannot be made public, yet they often need to share it to provide services. The traditional ways of handling this are flawed. Putting all the data into one giant central warehouse creates a single, high-value target for hackers and forces every agency to trust one central operator. Alternatively, connecting every agency directly to every other one creates a tangled web of thousands of individual connections, leaving no clear record of who shared what with whom. The challenge is to allow these organizations to share sensitive records strictly on a need-to-know basis, ensuring the data remains confidential, cannot be secretly altered, and that every access can be independently verified.
To solve this, researchers have developed a system called Confidential Pulse. It acts as a secure bridge between government agencies, allowing an authorized official to ask a simple question in plain language and receive an answer that pulls together records from multiple departments without ever exposing data the official is not allowed to see. The system relies on a special type of digital ledger, similar to a shared, unchangeable notebook that all participating organizations can read but no single one can edit alone. This ledger records every time a piece of information is shared, creating a permanent, tamper-evident history. The sensitive details themselves are kept in private vaults that only the specific organizations entitled to see them can access. Above this secure foundation sits a hierarchy of intelligent software agents. These agents act as interpreters, taking a human question, breaking it down, and gathering the relevant facts from the different private vaults. Crucially, the system does not just filter the answers after they are written; it rebuilds the answer from the ground up using only the authorized data, ensuring that no unauthorized information can slip through.
The researchers tested this system with a rigorous series of experiments, including twenty thousand trials where they tried to trick the software into leaking secrets. In the most secure mode of operation, the system was completely successful. Across all twenty thousand attempts, not a single piece of information was disclosed that the asking official was not entitled to see. The system worked by reconstructing the answer directly from the authorized records, meaning the software generating the text could not accidentally or maliciously insert hidden values. However, when the researchers tested a more flexible mode where the software was allowed to write its own sentences and then filter them, the results were different. In this mode, the system failed to catch unauthorized information in 2,068 of the 20,000 trials. The leaks happened mostly when the software tried to make comparisons or use complex ways of writing numbers that the filtering rules did not fully understand. This finding led the researchers to conclude that the strict reconstruction method is the only safe way to handle sensitive government data, while the more conversational, prose-writing mode carries a measurable risk of accidental disclosure.
The study also looked at how the system handles the complex reality of government data, where combining different pieces of information can sometimes reveal more than intended. For example, while a single record about a person's housing might be anonymous, and a separate record about their income might also be anonymous, combining them could identify a specific individual. The researchers found that in a simulated population of ten thousand people, combining three different types of records could identify about 3.31 percent of them. They also discovered a subtle flaw in an earlier version of their design: the digital "receipts" that prove a record existed were not salted with a random secret code. This allowed an attacker to guess the contents of hidden records by trying millions of possibilities in just under two seconds. Once the researchers added this random code to the receipts, the attack failed completely, recovering zero records. This correction highlights that the system's security depends on specific technical details being implemented correctly.
Beyond the code, the system introduces a new way of thinking about trust. Instead of relying on the honesty of the software agents that gather the data, the system forces every agent to prove its work against the shared ledger. If an agent tries to claim it has found a record that the official is allowed to see, the system checks the official ledger to confirm that the record actually exists and that the official truly has permission to view it. If the agent tries to sneak in a value from a record the official cannot see, the system discards the agent's text and rebuilds the sentence using only the raw data from the ledger. This process ensures that even if the software is compromised or tricked by a malicious user, the final answer remains safe. The researchers also measured how fast the system works across different cloud regions. They found that by allowing the system to ask multiple agencies at the same time rather than one after another, they could cut the waiting time for a complex answer nearly in half, even when the agencies were located in different parts of the world.
The work concludes that while the technology is ready for use, it requires a specific governance structure to be effective. The system is designed for a federation of organizations that do not fully trust each other but need to cooperate. It does not replace the need for human oversight; rather, it provides a clear, unchangeable log of every question asked and every record accessed, allowing auditors to verify that the rules were followed. The researchers emphasize that the system is not a magic solution that removes all risk, but it does provide a level of security and transparency that was previously impossible. By binding the answer to the authorized data at the moment of release, rather than trying to filter a finished text, the system creates a barrier that is mathematically difficult to break. The findings suggest that for government agencies to share sensitive data safely in the future, they must move away from central data lakes and toward this kind of distributed, verified approach, accepting that the most secure answers will come from a process that rebuilds the truth from the source rather than polishing a draft.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.