⚡ electrical engineering

Privacy Specifications that do not Compose: Empirical and Formal Auditing of Sequentially Published Energy Data

This paper demonstrates that sequentially published energy data often fails to uphold privacy promises over time, as repeated annual releases allow for the inference of sensitive marginal group information through simple subtraction, necessitating a shift from auditing isolated files to evaluating the entire sequence using new metrics like "specification half-life."

Original authors: Nikolaos Kekatos, Marina Korgiala-Karyda, Alexios Lekidis

Published 2026-07-02

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Nikolaos Kekatos, Marina Korgiala-Karyda, Alexios Lekidis

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a library that publishes a yearly report on how much electricity every neighborhood uses. To protect people's privacy, the library has a strict rule: "We will never write down numbers for a neighborhood unless at least five houses are in it." This is like saying, "We won't name a specific person; we'll only talk about a small group."

For years, the library has followed this rule perfectly. Every single year's report, looked at on its own, is safe. No one can tell who lives in which house just by reading that year's book.

The Problem: The "Math Magic" Trick

This paper argues that while each individual book is safe, the whole series of books is not. The authors discovered a "math magic" trick that anyone can use to break the privacy promise.

Here is the analogy:
Imagine you have two photos of a crowd taken one year apart.

Photo A (Year 1): Shows a crowd of 100 people.
Photo B (Year 2): Shows a crowd of 98 people.

If you look at Photo A alone, you see a big group. If you look at Photo B alone, you see a big group. Both are safe.
But, if you take Photo B and subtract Photo A from it (mathematically), you are left with a picture of exactly 2 people who left the crowd.

The paper found that energy publishers are doing exactly this. By taking the current year's data and subtracting last year's data, they accidentally reveal small groups of people (sometimes just 1 or 2 households) that the "five-house" rule was supposed to hide.

The "Half-Life" of Privacy

The authors came up with a new way to measure how long a privacy rule actually lasts. They call it the "Specification Half-Life."

Think of a privacy promise like a battery.

When the library publishes the first year's report, the battery is 100% full. The promise is strong.
After the second year, the battery drops a bit because the math trick becomes possible.
After the third year, the battery is half-dead. The promise that "we protect everyone" is no longer true for most neighborhoods.

In the UK data they studied, the privacy promise "died" (became useless) after just three years. In the US data they compared it to, the promise lasted longer because the numbers were more stable, but it still wore down over time.

The "Formal" Detective Work

The authors didn't just guess this was happening; they used two types of detective work:

The Empirical Detective (The Math): They actually did the subtraction on real data. They found that in 93% of the small areas they checked, they could spot a change of just 1 to 4 houses between years. This proved the "math magic" trick works in the real world.
The Formal Detective (The Logic): They translated the library's written rules into a computer language (like a logic puzzle). They asked the computer: "Does your written rule actually stop this subtraction trick?" The computer said "No." It pointed out that the library's rule only checked one year at a time and forgot to check what happens when you stack the years together.

The Main Takeaway

The paper's big message is simple: Privacy rules don't work if you only check them one by one.

If you publish data every year, you have to check the entire stack of years, not just the new one. The authors suggest that publishers need a new rule: "Before we publish this year's data, we must check if subtracting it from last year's data reveals any small, secret groups."

They also found that for some datasets (like the UK's small neighborhoods), the numbers change so fast that the privacy rule breaks very quickly. For others (like big power companies), the numbers are stable, so the rule lasts longer. But in all cases, the "single-year" rule is a lie when you look at the whole series.

In short: You can't just lock the door for today and forget about yesterday. If you keep publishing the same kind of data, the "locks" eventually wear out, and the math can pick the lock.

Technical Summary: Privacy Specifications that do not Compose

Problem Statement
Energy data publishers routinely release statistics on electricity consumption, plant registers, and charging logs, often accompanied by a promise that individuals or small groups cannot be identified. These promises are typically verified on a "one-shot" basis, checking each release in isolation against a stated privacy rule (e.g., $k$ -anonymity with $k \ge 5$ ). However, publishers issue these datasets sequentially over years. The paper argues that a release appearing safe in isolation can reveal significantly more information when stacked with previous or subsequent releases. Specifically, the paper identifies that single-release privacy specifications often fail to compose over time, leading to "differencing attacks" where subtracting consecutive releases exposes marginal groups (e.g., a change of 1–4 meters in a neighborhood) that were individually suppressed.

Methodology
The authors propose a two-sided audit pipeline to evaluate public energy data releases both empirically and formally.

Empirical Measurement: The audit measures the re-identification posture of released files using established disclosure-control metrics ( $k$ -anonymity, $\ell$ -diversity, $t$ -closeness) via a custom Python implementation (pyARX-equiv) cross-validated against the reference ARX library. It also employs adversarial games (singling-out, linkability, inference) using the Anonymeter framework and a domain-specific profiler (PENM) as secondary checks.
Formal Verification: The publisher's stated transformation policy is encoded as logical constraints in SMT-LIB format. An automated solver portfolio (Z3 and Yices2) checks whether the encoded policy logically entails the claimed privacy guarantee. If the policy does not entail the guarantee, the solver produces a labelled UNSAT core.
Gap Localisation: When a divergence is detected between the empirical posture and the stated claim, the labelled UNSAT core is mapped to one of five failure families: Missing Quasi-Identifier, Unsafe Release-Window Composition, Order-of-Operations Error, Cross-Release Linkage, or Documentation Omission.
Longitudinal Diagnostics: For sequential releases, the audit introduces two diagnostics: "specification half-life" (the number of releases after which a single-window rule no longer describes more than half the series) and "specification-validity budget" ( $W^*$ ), which quantifies how many releases a single-window rule remains descriptive before decaying.

Key Contributions

Two-Sided Audit Framework: A novel methodology that combines empirical measurement of data with formal verification of the publisher's stated policy, allowing for the identification of missing assumptions rather than just measuring risk.
Formal Refutation of Specifications: The paper demonstrates that formal solvers can disprove a stated privacy rule itself. By treating data counts as unknown variables, the authors show that the documented policy (e.g., per-window $k \ge 5$ ) intrinsically allows for unsafe pairs of releases, independent of specific data values.
Reproducibility Artefact: The authors release the audit code, encoded policies, verbatim publisher claims, and disclosure templates, covering an eleven-release corpus spanning four types of energy data (household traces, EV charging, asset registries, and system transparency).

Results
The audit was applied to eleven public energy datasets (plus a US utility series as a comparator).

Composition Failure (BEIS): In the UK sub-national electricity statistics (BEIS/DESNZ), the stated $k \ge 5$ rule holds for individual annual releases. However, cross-release differencing reveals that 93% of areas undergo a 1–4 meter transition between years, exposing a sub-five-meter group. The "specification half-life" for this series is three annual releases; after this point, the single-window rule no longer describes the series.
Volatility Dependence: A comparison with the US EIA-861 utility series shows that composition risk is not uniform. The US series, characterized by more stable utility totals, decays much slower (never reaching the half-life threshold across 11 releases) compared to the volatile UK household data.
Structural vs. Operational Uniqueness: While nearly all releases exhibit structural uniqueness ( $k=1$ on the published quasi-identifiers), the estimated operational re-identification risk (probability of identifying a real person) is effectively zero for nine of the ten natural-person releases, except for the ACN-Data EV charging release.
Specific Divergences:
- BEIS: Divergence due to "Unsafe Release-Window Composition."
- MaStR (German Plant Register): Divergence due to "Missing Quasi-Identifier" (the published tuple allows singleton plants).
- GoiEner: Divergence due to "Order-of-Operations Error" (suppression applied after hashing).
- OCPP-EV: Documentation omission regarding adversary definitions.
Auxiliary Linkage: Linking the MaStR register against the regulator's own unit table renders 24% of plants uniquely identifiable, highlighting that the publisher's own auxiliary registers are the primary amplification vector.

Significance and Claims
The paper claims that the dominant failure mode in energy data privacy is not the uniqueness of a single release, but the failure of protections to compose across a sequence of releases. The authors assert that:

Single-release audits are insufficient: They cannot detect the "differencing" threat inherent in periodic republication regimes mandated by regulations like ENTSO-E Transparency Platform or DESNZ methodologies.
Formal verification adds value: It moves beyond measuring risk to identifying the specific logical gap in the publisher's policy (e.g., the lack of a cross-window budget operator).
Actionable Remediation: The authors propose a "specification-validity budget" ( $W^*$ ) as a practical audit control. Publishers should declare the keys spanning republications, measure composition erosion before each release, and publish a validity budget to indicate how long their single-window rule remains descriptive.

The paper explicitly states it does not claim to have re-identified specific individuals in the aggregate BEIS data, but rather that the existence and size of small marginal groups can be inferred, which constitutes a disclosure-control failure relative to the publisher's stated logic. The work is positioned as an audit of existing public data, not a proposal for new differential privacy mechanisms, though it notes that legacy protections "degrade poorly under composition" similar to findings in the US Census 2020 redesign.

More like this