Correlation-Induced Privacy Leakage (CPL)

• Correlation-Induced Privacy Leakage (CPL) is the phenomenon where statistical dependence among data entries amplifies privacy risks by enabling indirect inferences from sanitized releases.
• Methodologies such as Bayesian differential privacy and correlated sensitivity adjustments explicitly model these dependencies to more accurately measure and mitigate leakage.
• Practical mitigation strategies involve recalibrating privacy budgets, feature selection, and data-dependent mechanisms to counteract leakage in settings like continuous releases and joined datasets.

to=arxiv_search.search 早点加盟 天天中彩票官网്യനം 44 րոպե code ഇല്ല {"query":"all:(correlated privacy leakage differential privacy) OR ti:(Correlation-Induced Privacy Leakage) OR abs:(correlated data privacy leakage)", "max_results": 10, "sort_by": "relevance"} to=arxiv_search.search ฝ่ายขายรายการ րոպե 44 code ഇല്ല {"query":"id:(Saeidian et al., 8 Feb 2025) OR id:(Lange et al., 26 Jun 2025) OR id:(Jayawardana et al., 18 Aug 2025) OR id:(Cao et al., 2016) OR id:(Zhang et al., 2020) OR id:(Maßny et al., 24 Jan 2025) OR id:(Zhang et al., 2020) OR id:(AlKhashti, 7 Dec 2025) OR id:(Zamani et al., 2021) OR id:(Batra et al., 11 Nov 2025)", "max_results": 15, "sort_by": "relevance"} Correlation-Induced Privacy Leakage (CPL) denotes privacy loss that arises when statistical dependence enables inference beyond direct disclosure. In the literature, the dependence may lie among database entries, across time in continuous release, across attributes within a single record, across tables joined through quasi-identifiers, or across parties’ datasets in collaborative learning. The common mechanism is inferential amplification: a release about one object becomes a disclosure channel for another because the two are statistically linked (Saeidian et al., 8 Feb 2025, Lange et al., 26 Jun 2025, Cao et al., 2016).

1. Conceptual scope

CPL is best understood as a shift from release-centric privacy analysis to dependence-centric privacy analysis. In the correlated-database setting, the central concern is that a mechanism may not directly reveal an individual entry, yet correlations among entries allow an adversary to infer that entry from released statistics. One paper states this sharply by proving that, for correlated databases, there exists a pure $\varepsilon$-DP mechanism whose leakage about some individual entry is arbitrarily close to the maximum possible leakage, “essentially as bad as releasing that entry almost directly” (Saeidian et al., 8 Feb 2025).

The same pattern appears in other domains. In joined data, “identity leakage does not stem from individual datasets but emerges from the statistical interactions created only after integration,” so two independently anonymized tables can become identifying after linkage on shared quasi-identifiers such as age and gender (AlKhashti, 7 Dec 2025). In collaborative learning, a model trained on pooled data can leak “population-level properties” of one party’s data because a sensitive attribute is statistically entangled with the rest of the training distribution, even when the sensitive attribute is not included in training (Zhang et al., 2020). In representation learning, preserving utility information can preserve unknown sensitive information as well, because the utility and sensitive attributes are correlated through the observed data (Atashin et al., 2021).

Taken together, these works suggest that CPL is not confined to one threat surface. It is a family of privacy failures in which correlation changes what can be inferred from an otherwise sanitized or partial release.

2. Formalizations and leakage quantities

The literature does not offer a single universal formalization of CPL. Instead, it introduces several leakage quantities tailored to different dependence structures.

Setting	Leakage quantity	Dependence source
Correlated databases	PML, BDPL	tuple dependence
Continuous release	TPL, BPL, FPL	temporal correlation
Local DP on multi-attribute records	CPL, TCPL, TPL	attribute correlation
Local redaction on Markov chains	pointwise-influence, max-influence	correlated neighboring records

For correlated databases, pointwise maximal leakage (PML) is used as an outcome-specific inferential quantity. The paper defines

$$\ell(X \to y) = D_\infty(P_{X \mid Y=y} \Vert P_X),$$

and, for an individual entry,

$$\ell(D_i\to y)=D_\infty(P_{D_i\mid Y=y}\Vert P_{D_i}) = \log \max_{d_i}\frac{P_{D_i\mid Y=y}(d_i)}{P_{D_i}(d_i)} = \log \max_{d_i}\frac{P_{Y\mid D_i=d_i}(y)}{P_Y(y)}.$$

This makes leakage explicitly distribution-dependent and posterior-oriented (Saeidian et al., 8 Feb 2025).

Bayesian Differential Privacy (BDP) formalizes dependence through a prior $\pi$ on the dataset. Its adversary-specific leakage is

$$\mathrm{BDPL}_{(K, i)} = \sup_{x_i, x_i', \mathbf{x}_K, S} \ln \frac{\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i]} {\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i']},$$

and a mechanism is $\varepsilon$-BDP if $\mathrm{BDPL}(\mathcal{M}) \le \varepsilon$ (Lange et al., 26 Jun 2025).

For temporally correlated release, Temporal Privacy Leakage (TPL) is defined as

$$TPL(A_i^\mathcal T,\mathcal M^t) = \sup \log \frac{ \Pr(\mathbf r^1,\ldots,\mathbf r^T \mid l_i^t,D_{\mathcal K}^t) }{ \Pr(\mathbf r^1,\ldots,\mathbf r^T \mid {l_i^t}',D_{\mathcal K}^t) }.$$

The paper decomposes it as

$TPL = BPL + FPL - PL_0,$

where $BPL$ and $$\ell(X \to y) = D_\infty(P_{X \mid Y=y} \Vert P_X),$$0 capture backward and forward privacy leakage induced by temporal correlation (Cao et al., 2016).

In local differential privacy for multi-attribute records, CPL is formalized as leakage from correlated neighboring attributes. For a target attribute $$\ell(X \to y) = D_\infty(P_{X \mid Y=y} \Vert P_X),$$1, a correlated subset $$\ell(X \to y) = D_\infty(P_{X \mid Y=y} \Vert P_X),$$2, and corresponding privatized outputs $$\ell(X \to y) = D_\infty(P_{X \mid Y=y} \Vert P_X),$$3,

$$\ell(X \to y) = D_\infty(P_{X \mid Y=y} \Vert P_X),$$4

The same work defines total correlation-induced privacy leakage as

$$\ell(X \to y) = D_\infty(P_{X \mid Y=y} \Vert P_X),$$5

This makes the dependence channel explicit: the target attribute leaks through other locally privatized attributes, not only through its own randomizer (Jayawardana et al., 18 Aug 2025).

A separate disclosure-theoretic formulation studies the Markov chain $$\ell(X \to y) = D_\infty(P_{X \mid Y=y} \Vert P_X),$$6, where $$\ell(X \to y) = D_\infty(P_{X \mid Y=y} \Vert P_X),$$7 is private, $$\ell(X \to y) = D_\infty(P_{X \mid Y=y} \Vert P_X),$$8 is useful, and $$\ell(X \to y) = D_\infty(P_{X \mid Y=y} \Vert P_X),$$9 is released. The key identity

$$\ell(D_i\to y)=D_\infty(P_{D_i\mid Y=y}\Vert P_{D_i}) = \log \max_{d_i}\frac{P_{D_i\mid Y=y}(d_i)}{P_{D_i}(d_i)} = \log \max_{d_i}\frac{P_{Y\mid D_i=d_i}(y)}{P_Y(y)}.$$0

shows directly how changes in the released posterior over $$\ell(D_i\to y)=D_\infty(P_{D_i\mid Y=y}\Vert P_{D_i}) = \log \max_{d_i}\frac{P_{D_i\mid Y=y}(d_i)}{P_{D_i}(d_i)} = \log \max_{d_i}\frac{P_{Y\mid D_i=d_i}(y)}{P_Y(y)}.$$1 induce posterior shifts about $$\ell(D_i\to y)=D_\infty(P_{D_i\mid Y=y}\Vert P_{D_i}) = \log \max_{d_i}\frac{P_{D_i\mid Y=y}(d_i)}{P_{D_i}(d_i)} = \log \max_{d_i}\frac{P_{Y\mid D_i=d_i}(y)}{P_Y(y)}.$$2 through the leakage matrix $$\ell(D_i\to y)=D_\infty(P_{D_i\mid Y=y}\Vert P_{D_i}) = \log \max_{d_i}\frac{P_{D_i\mid Y=y}(d_i)}{P_{D_i}(d_i)} = \log \max_{d_i}\frac{P_{Y\mid D_i=d_i}(y)}{P_Y(y)}.$$3 (Zamani et al., 2021).

3. Canonical dependence regimes

One major CPL regime is correlation among records in a database. The strongest impossibility result states that for every $$\ell(D_i\to y)=D_\infty(P_{D_i\mid Y=y}\Vert P_{D_i}) = \log \max_{d_i}\frac{P_{D_i\mid Y=y}(d_i)}{P_{D_i}(d_i)} = \log \max_{d_i}\frac{P_{Y\mid D_i=d_i}(y)}{P_Y(y)}.$$4 and $$\ell(D_i\to y)=D_\infty(P_{D_i\mid Y=y}\Vert P_{D_i}) = \log \max_{d_i}\frac{P_{D_i\mid Y=y}(d_i)}{P_{D_i}(d_i)} = \log \max_{d_i}\frac{P_{Y\mid D_i=d_i}(y)}{P_Y(y)}.$$5, there exists a correlated database, an $$\ell(D_i\to y)=D_\infty(P_{D_i\mid Y=y}\Vert P_{D_i}) = \log \max_{d_i}\frac{P_{D_i\mid Y=y}(d_i)}{P_{D_i}(d_i)} = \log \max_{d_i}\frac{P_{Y\mid D_i=d_i}(y)}{P_Y(y)}.$$6-DP mechanism, and an output $$\ell(D_i\to y)=D_\infty(P_{D_i\mid Y=y}\Vert P_{D_i}) = \log \max_{d_i}\frac{P_{D_i\mid Y=y}(d_i)}{P_{D_i}(d_i)} = \log \max_{d_i}\frac{P_{Y\mid D_i=d_i}(y)}{P_Y(y)}.$$7 such that

$$\ell(D_i\to y)=D_\infty(P_{D_i\mid Y=y}\Vert P_{D_i}) = \log \max_{d_i}\frac{P_{D_i\mid Y=y}(d_i)}{P_{D_i}(d_i)} = \log \max_{d_i}\frac{P_{Y\mid D_i=d_i}(y)}{P_Y(y)}.$$8

The construction uses a binary correlated database and the standard Laplace mechanism for empirical frequency, showing that the pathology comes from the data distribution rather than from an exotic mechanism (Saeidian et al., 8 Feb 2025).

A second regime is temporal dependence. In continuous release, the privacy object at time $$\ell(D_i\to y)=D_\infty(P_{D_i\mid Y=y}\Vert P_{D_i}) = \log \max_{d_i}\frac{P_{D_i\mid Y=y}(d_i)}{P_{D_i}(d_i)} = \log \max_{d_i}\frac{P_{Y\mid D_i=d_i}(y)}{P_Y(y)}.$$9 is affected not only by the output at time $\pi$0, but by all past and future outputs once a Markov model is known. The recursive relations

$\pi$1

show that temporal CPL can accumulate over time (Cao et al., 2016). More recent work extends this to cross-sequence dependence in multivariate streams through Correlated-Sequence Differential Privacy (CSDP), where multivariate streams are modeled as a Coupling Markov Chain and privacy leakage is bounded by dependence-aware terms such as

$\pi$2

(Luo et al., 22 Nov 2025).

A third regime is join-induced leakage. When two datasets are linked on shared quasi-identifiers, new cross-table combinations can create uniqueness even if each table was anonymized individually. The paper proposes the uniqueness ratio

$\pi$3

as a pre-join warning signal. Its reported example uses an inner join on age and gender between heart-disease and stroke tables, with uniqueness $\pi$4 in Dataset A, $\pi$5 in Dataset B, and $\pi$6 after the join (AlKhashti, 7 Dec 2025).

A fourth regime is attribute dependence within a single user record under local privacy. The paper on LDP argues that direct privacy leakage from a target attribute’s own local randomizer is not the whole story; correlated neighboring attributes create an additional inference channel through their privatized outputs. It further shows that CPL is often asymmetric, so $\pi$7 need not equal $\pi$8, and that leakage can saturate as $\pi$9 grows (Jayawardana et al., 18 Aug 2025).

A fifth regime is learned dependence in collaborative and representation-learning systems. In multi-party machine learning, an honest-but-curious party can infer the distribution of a sensitive attribute in other parties’ data from black-box access to the jointly trained model. The paper studies four cases,

$$\mathrm{BDPL}_{(K, i)} = \sup_{x_i, x_i', \mathbf{x}_K, S} \ln \frac{\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i]} {\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i']},$$0

and identifies the $$\mathrm{BDPL}_{(K, i)} = \sup_{x_i, x_i', \mathbf{x}_K, S} \ln \frac{\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i]} {\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i']},$$1 case as especially important because leakage can persist even when the sensitive attribute is irrelevant to the task (Zhang et al., 2020). In supervised representation learning, the information bottleneck objective

$$\mathrm{BDPL}_{(K, i)} = \sup_{x_i, x_i', \mathbf{x}_K, S} \ln \frac{\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i]} {\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i']},$$2

is used to study how reducing information complexity can suppress leakage to unknown sensitive attributes, but correlated utility and sensitive attributes still create leakage pressure (Atashin et al., 2021).

4. Differential privacy under correlation

A persistent result across the literature is that standard DP’s neighbor-based guarantee can become badly misaligned with actual inferential privacy under dependence. In the independent-entry case, one theorem states that

$$\mathrm{BDPL}_{(K, i)} = \sup_{x_i, x_i', \mathbf{x}_K, S} \ln \frac{\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i]} {\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i']},$$3

but this equivalence collapses once correlations are allowed (Saeidian et al., 8 Feb 2025).

Bayesian DP repairs this mismatch by making privacy explicitly distribution-dependent. Under arbitrary block dependence with blocks of size at most $$\mathrm{BDPL}_{(K, i)} = \sup_{x_i, x_i', \mathbf{x}_K, S} \ln \frac{\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i]} {\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i']},$$4, any $$\mathrm{BDPL}_{(K, i)} = \sup_{x_i, x_i', \mathbf{x}_K, S} \ln \frac{\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i]} {\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i']},$$5-DP mechanism is $$\mathrm{BDPL}_{(K, i)} = \sup_{x_i, x_i', \mathbf{x}_K, S} \ln \frac{\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i]} {\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i']},$$6-BDP (Lange et al., 26 Jun 2025). Under Gaussian dependence, the amplification factor becomes

$$\mathrm{BDPL}_{(K, i)} = \sup_{x_i, x_i', \mathbf{x}_K, S} \ln \frac{\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i]} {\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i']},$$7

and under finite-state Markov dependence the bound becomes additive,

$$\mathrm{BDPL}_{(K, i)} = \sup_{x_i, x_i', \mathbf{x}_K, S} \ln \frac{\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i]} {\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i']},$$8

These results show that structured dependence can be much less pessimistic than worst-case arbitrary correlation, but it still requires explicit modeling (Lange et al., 26 Jun 2025).

A more engineering-oriented response is correlated sensitivity. In correlated differential privacy for feature selection, the paper defines

$$\mathrm{BDPL}_{(K, i)} = \sup_{x_i, x_i', \mathbf{x}_K, S} \ln \frac{\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i]} {\Pr[Y \in S \mid \mathbf{X}_K = \mathbf{x}_K, X_i = x_i']},$$9

and then perturbs the query with

$\varepsilon$0

This shifts the DP analysis from independent-record sensitivity to dependence-weighted influence (Zhang et al., 2020).

In temporal release, the same theme appears as a correlation-aware reinterpretation of event-level DP. The paper defines $\varepsilon$1-$\varepsilon$2 by requiring $\varepsilon$3, and derives composition results in which the endpoints of a release interval contribute amplified leakage through backward and forward temporal privacy loss (Cao et al., 2016).

In local privacy, the critique is similar but the mechanism surface is different. The LDP paper argues that prevailing analyses have focused on pure $\varepsilon$4 mechanisms and often rely on conventional correlation metrics such as Pearson correlation coefficient or mutual information. It then develops a general algorithmic framework for CPL under arbitrary $\varepsilon$5-LDP mechanisms and proves that CPL can saturate at a correlation-determined ceiling rather than growing indefinitely with $\varepsilon$6 (Jayawardana et al., 18 Aug 2025).

5. Measurement and mitigation

The mitigation literature attacks CPL at different layers: the data representation, the release mechanism, the linkage policy, and the observation channel.

One line of work reduces dependence before private release. The CR-FS pipeline for correlated differential privacy performs correlation reduction by feature selection, using private feature-importance estimation and a final adjustment step that searches for a feature set with lower correlated sensitivity. The paper’s central claim is that the feature subset with the best predictive accuracy need not be the subset with the lowest correlated sensitivity, so feature selection can serve as a privacy tool as well as a utility tool (Zhang et al., 2020).

A second line recalibrates standard mechanisms under explicit dependence models. In BDP, the methodology is to start from a DP mechanism and replace the effective privacy budget $\varepsilon$7 with a smaller $\varepsilon$8 determined by the dependence structure. For example, under arbitrary block dependence of size $\varepsilon$9,

$\mathrm{BDPL}(\mathcal{M}) \le \varepsilon$0

while under Markov dependence,

$\mathrm{BDPL}(\mathcal{M}) \le \varepsilon$1

provided the bound is feasible (Lange et al., 26 Jun 2025). In cross-sequence streams, FRAN combines data aging, correlation-aware sensitivity scaling, and Laplace noise; its release rule is

$\mathrm{BDPL}(\mathcal{M}) \le \varepsilon$2

(Luo et al., 22 Nov 2025).

A third line exploits realization-specific leakage rather than worst-case release decisions. In a stationary Markov chain of binary records, the Three-Region (3R) mechanism partitions positions into $\mathrm{BDPL}(\mathcal{M}) \le \varepsilon$3, $\mathrm{BDPL}(\mathcal{M}) \le \varepsilon$4, and $\mathrm{BDPL}(\mathcal{M}) \le \varepsilon$5 according to pointwise-influence. It then always redacts highly revealing records, always releases safe ones, and releases medium-risk records only for the less revealing value and only with calibrated probability (Maßny et al., 24 Jan 2025). This is a distinctly data-dependent mitigation of CPL.

A fourth line uses lightweight diagnostics before linkage. The uniqueness-ratio paper does not deliver a full defense, but it proposes a pre-join indicator that can warn data engineers before integration. This suggests a practical screening step in settings where linkage itself is the main correlation-creation event (AlKhashti, 7 Dec 2025).

A fifth line limits leakage while still allowing correlation computation. In two-party similarity computation, the exact protocol reveals controlled leakage

$\mathrm{BDPL}(\mathcal{M}) \le \varepsilon$6

while the approximate protocol returns only $\mathrm{BDPL}(\mathcal{M}) \le \varepsilon$7, the fixed-point approximation of the sample correlation (Christensen et al., 2022). A plausible implication is that secure computation can mitigate transcript leakage, but it cannot eliminate the inferential content of the released statistic itself.

6. Empirical patterns, misconceptions, and terminology

Several recurring misconceptions are rejected by the cited work. One is that low conventional correlation implies low privacy risk. A BDP paper constructs a binary example in which the Pearson correlation coefficient tends to zero while $\mathrm{BDPL}(\mathcal{M}) \le \varepsilon$8 approaches $\mathrm{BDPL}(\mathcal{M}) \le \varepsilon$9 (Lange et al., 26 Jun 2025). The LDP CPL paper likewise argues that Pearson correlation coefficient and mutual information are inadequate as direct CPL proxies, because CPL is a worst-case distinguishability quantity and is often asymmetric (Jayawardana et al., 18 Aug 2025).

A second misconception is that independently anonymized releases compose safely under linkage. The join-risk paper shows that linkage can redistribute identifiability rather than simply preserving the source-level anonymity profile: in its example, uniqueness increases slightly relative to Dataset A but decreases sharply relative to Dataset B after the join (AlKhashti, 7 Dec 2025).

A third misconception is that secure training or exclusion of a sensitive attribute removes leakage. In collaborative learning, population-level properties remain inferable even when the sensitive attribute is omitted from training, because the signal is carried by correlated features, labels, text, or graph structure (Zhang et al., 2020). In representation learning, reducing information complexity helps, but correlated utility and sensitive attributes still make leakage persistent (Atashin et al., 2021).

The empirical scope of the literature remains uneven. Some results are theorem-level and worst-case, especially for correlated databases, temporal release, and BDP (Saeidian et al., 8 Feb 2025, Cao et al., 2016, Lange et al., 26 Jun 2025). Other results are proof-of-concept and dataset-specific, especially for join-induced risk and some LDP evaluations (AlKhashti, 7 Dec 2025, Jayawardana et al., 18 Aug 2025). This suggests caution when transferring any one leakage formula across domains.

Finally, the acronym itself is not stable across subfields. One 2025 paper on LLMs uses “Contextual Privacy Leakage (CPL)” to mean the proportion of reasoning traces that disclose private fields judged inappropriate by a scenario-specific appropriateness matrix, which is a different concept from correlation-induced privacy leakage (Batra et al., 11 Nov 2025). The overlap is terminological rather than substantive, but it matters bibliographically.

In aggregate, the literature portrays Correlation-Induced Privacy Leakage as a general inferential phenomenon rather than a single metric. The most defensible synthesis is that CPL arises whenever dependence allows a release, model, or linkage operation to reveal more than its direct disclosure surface would suggest; that dependence can be temporal, relational, attribute-level, or model-mediated; and that meaningful protection typically requires either modeling the dependence explicitly or redesigning the release process to reduce, dilute, or exploit it more carefully than standard independence-based privacy analyses allow.