Joint Control of Residual State and Deletion Pattern

Develop deletion mechanisms that jointly control both the residual visible state V and the deletion pattern P to bound post-deletion inference about deleted values.

Background

The paper formalizes two observables after a deletion operation: the residual visible state V (what data and derived artifacts remain) and the deletion pattern P (what the deletion operation itself reveals, such as auxiliary deletions or timing). It argues that both channels can leak information about deleted values.

Most existing systems focus on limiting leakage from V (e.g., by cascading deletions or updating views) while leaving P unaddressed, which can itself become a side channel. The authors explicitly mark the joint control of V and P as an open area in their taxonomy.