--- title: Leakage-Abuse via Matching (LAMA) url: https://www.emergentmind.com/topics/leakage-abuse-via-matching-lama type: topic --- # Leakage-Abuse via Matching (LAMA) Searching arXiv for the cited papers to ground the article in the current literature. Leakage-Abuse via Matching (LAMA) denotes a class of inference procedures in which an adversary aligns observed leakage with auxiliary plaintext-side statistics, structural priors, or a ground-truth secret inventory in order to recover hidden queries, documents, substrings, training examples, or memorized entities. In encrypted range search, LAMA is introduced explicitly as a generic framework that uses access-pattern leakage and a known query distribution; related work instantiates the same matching principle in dynamic searchable symmetric encryption (DSSE), substring-SSE, gradient leakage from deep networks, and topology-aware extraction of private information from multi-agent LLM systems [2508.11563] [2309.04697] [2511.00930] [2210.13231] [2512.04668]. | Domain | Leakage matched | Recovery target | |---|---|---| | Encrypted search | access patterns, search patterns, volumes, file-access sets | keywords, documents, database contents | | Gradient leakage | observed gradients, layer-wise linear constraints | training images and labels | | Multi-agent LLMs | attacker outputs against ground-truth PII | memorized PII entities | ## 1. Core abstraction and matching mechanics At its most general, LAMA treats leakage as an observable signal $\ell$ and auxiliary knowledge as a family of candidate feature maps or secret sets. Matching then becomes either a statistical inference problem, a combinatorial consistency problem, or an optimization problem. In searchable encryption, the canonical forms are Bayesian matching, $$ P(k \mid \ell) \propto P(\ell \mid k) P(k), $$ and distance-based matching, $$ S(k; \ell) = - \mathrm{dist}(f(k), \ell), $$ where $f(k)$ encodes expected leakage features such as result sizes, co-occurrence overlaps, or repetition rates for candidate keyword $k$ [2603.07030]. In the encrypted range-search formulation, LAMA is decomposed into a **Selector**, a **Translator**, and a **Solver**. The Selector chooses Boolean expressions over retrieval events derived from access-pattern leakage; the Translator computes empirical frequencies for those expressions and converts frequency matches into logical constraints over plaintext assignments; the Solver returns all satisfying reconstructions consistent with the observed leakage and a tolerance parameter determined by sampling noise [2508.11563]. Other domains realize the same abstraction with different observables. In gradient leakage, the matching variable is the pair $(x,y)$, and the generic objective is $$ \min_{x,y} \; \mathcal{J}(x,y) = \big\| \nabla_{\theta} L\big(f(x;\theta), y\big) - g \big\|_2^2 + R(x,y), $$ with prior works instantiating $R$ as $0$, label-first recovery, or cosine-similarity-plus-TV regularization [2210.13231]. In multi-agent LLM evaluation, the observable is the attacker’s message $A_i^{(t)}$, the secret inventory is $S_i$, and leakage is scored by exact matching, $$ L_i^{(t)} = \frac{|\hat{S}_i^{(t)} \cap S_i|}{|S_i|}, \qquad L_{i,\mathrm{cum}}^{(t)} = \frac{|\hat{S}_i^{(1:t)} \cap S_i|}{|S_i|}, $$ with aggregate $$ \mathrm{LeakRate} = \frac{\sum_{i=1}^{N} |\hat{S}_i|}{\sum_{i=1}^{N} |S_i|}. $$ The commonality is not the surface form of the leakage but the decision rule: infer hidden structure by matching what is observed to what would be expected under candidate hypotheses [2512.04668]. Taken together, these formulations suggest that LAMA is best understood as a matching layer over a leakage model rather than as a single domain-specific algorithm. The leakage may be probabilistic, structural, or optimization-derived; the match may be exact, approximate, or constrained; but the attack logic remains the same. ## 2. Access-pattern frequency analysis and its limits in encrypted range search The most formalized version of LAMA appears in encrypted range search, where the adversary observes only access-pattern leakage $\mathrm{rid}(q)$ for a sequence of encrypted queries, knows the plaintext domain $D \subseteq \mathbb{R}^d$, the query class $\mathcal{Q}$, the query distribution $\mathcal{P}$, and typically the numbers of records and queries. For a plaintext point $x$, the single-record retrieval probability is $$ p(x) = \Pr_{q \sim \mathcal{P}}[x \in q], $$ and for a set $S = \{x_1,\dots,x_t\}$, $$ p_t(S) = \Pr_{q \sim \mathcal{P}}[x_1 \in q, \dots, x_t \in q]. $$ From observed responses, the adversary computes empirical frequencies $$ \widehat{p}(i) = \frac{1}{N}\sum_{j=1}^N \mathbf{1}\{ i \in \mathrm{rsp}_j \}, \qquad \widehat{p}_t(S) = \frac{1}{N}\sum_{j=1}^N \mathbf{1}\{ S \subseteq \mathrm{rsp}_j \}, $$ and controls sampling error via Hoeffding’s inequality. For fixed $i$, $$ \Pr\big[\, |\widehat{p}(i) - p(DB(i))| \ge \varepsilon \,\big] \le 2 e^{-2N\varepsilon^2}, $$ so it suffices to take $$ N \ge \frac{1}{2\varepsilon^2} \log \frac{2n}{\delta} $$ to guarantee uniform $\varepsilon$-accuracy over all $n$ identifiers with probability at least $1-\delta$ [2508.11563]. A central result is that frequency analysis has a precise limit. For axis-aligned rectangles in $d$ dimensions, the parameterization $T_{\cap}$ that uses all intersections up to size $2d$ is sufficient: if two databases agree on all intersection frequencies of size at most $2d$, then they induce the same response distribution $RD$. The proof relies on a covering lemma stating that any finite point set in $\mathbb{R}^d$ has a certificate subset of size at most $2d$ formed by coordinate-wise minima and maxima; any rectangle covering that subset covers the whole set. The bound is tight: using only intersections up to size $2d-1$ can fail to determine $RD$ [2508.11563]. The framework extends beyond rectangles. For Euclidean balls and strictly convex norms, the smallest enclosing ball is determined by at most $d+1$ support points, so intersections up to size $d+1$ suffice under the analogous argument. More generally, the range-search paper frames LAMA for arbitrary convex query classes whenever a bounded-size certificate set exists [2508.11563]. Mitigation is expressed directly at the level of the query distribution. The paper describes singleton flattening by reweighting singleton queries $[v,v]$ to equalize all $p(v)$, and pair flattening by adjusting minimum bounding rectangles so that all pairs at the same $\ell_1$ distance have equal coverage probability. This reduces distinguishability by enlarging frequency-equivalence classes, although full flattening across all pairwise distances is infeasible in expressive rectangle distributions [2508.11563]. The implementation uses CP-SAT as Solver and evaluates on HCUP Nationwide Inpatient Sample (2009) with dimensionalities $d=1$ ($N=1000$), $d=2$ ($N=32$), $d=3$ ($N=10$), and $d=4$ ($N=6$). For $10$ records in $d=3$, the number of reconstructions drops to about $2016$ after $t=2$ under Uniform and remains constant through $t=6$; under Random it stabilizes around $244$ by $t=4$; under Flattened it remains much larger, for example $4320$ after $t=2$. The paper reports plaintext reconstruction from encrypted range queries spanning up to four dimensions [2508.11563]. ## 3. Dynamic SSE, refined volumetric leakage, and system-level amplification In DSSE, LAMA operates over search and update transcripts rather than static query traces. A DSSE scheme is written as $\mathrm{DSSE}=(\mathrm{Setup},\mathrm{Search},\mathrm{Update})$, with core leakage objects $$ \mathrm{TimeDB}(w), \qquad \mathrm{Updates}(w), \qquad \mathrm{DelHist}(w), $$ and with forward privacy and three types of backward privacy controlling what remains linkable across time. Type-I leaks $\mathrm{TimeDB}(w)$ and total update count $u_w$, Type-II leaks $\mathrm{TimeDB}(w)$ and $\mathrm{Updates}(w)$, and Type-III leaks $\mathrm{TimeDB}(w)$ and $\mathrm{DelHist}(w)$ [2309.04697]. The key observation is that refreshed tokens do not eliminate all matchable structure. The paper distinguishes token relations that are **exactly same** $(\equiv)$, **partially same** $(\overset{\mathcal{P}}{=})$, **computationally same** $(\overset{\mathcal{C}}{=})$, or **irrelevant** $(\approx ?)$, and shows that these relations can reveal query equality $qeq$ deterministically or through response similarity. It then refines volumetric leakage into $$ \mathrm{ulen}(w),\; \mathrm{ilen}(w),\; \mathrm{dlen}(w),\; \mathrm{rlen}(w),\; \mathrm{fvol}(w),\; qeq(w_i,w_j), $$ with identities $$ n_w = a_w - d_w, \qquad u_w = a_w + d_w, $$ hence $$ a_w = \frac{u_w + n_w}{2}, \qquad d_w = \frac{u_w - n_w}{2}. $$ The consequence is that Type-I, Type-II, and Type-III backward privacy leak the same volumetric information in essence, because any two of $\{n_w,u_w,a_w,d_w\}$ determine the other two [2309.04697]. On top of this leakage model, the paper realizes two generic attacks. The **Frequency Matching Attack** groups linked queries into equality classes and matches class sizes to dynamic keyword distributions across time intervals, $$ MM^{(i)}[q] = \arg\min_{w \in \mathcal{W}} \big|\, |G| - N_i \cdot p_w^{(i)} \,\big|, $$ then intersects candidate sets across linked intervals. The **Volumetric Inference Attack** uses response and update lengths, inserted-file knowledge, and file-volume differences to recover per-keyword operations and query identities. Empirically, with a single interval $(\tau=1)$ FMA recovery can be as low as $1.8\%$, whereas with $\tau=24$ it rises to $63.5\%$–$93.4\%$; for T1 schemes and $\tau=24$, accuracy commonly lies in the $70\%$–$90\%$ range; with more observed queries, accuracy improves from $64.9\%$ to $90.1\%$ as $\lambda$ increases from $120\mathrm{K}$ to $480\mathrm{K}$; and with noisy auxiliary distributions, Enron-500 with $U[0,10]$ noise still achieves about $58.4\%$ recovery. PVIA reaches up to about $96\%$ at $\alpha=0.9$ and $\gamma=10\%$, and remains substantial even at $\alpha=0.5$ and $\gamma=30\%$ [2309.04697]. A separate line of work strengthens SSE-style LAMA with system-level observability. Using bpftrace on `openat` and `read` in a Dockerized DSSE deployment, the attacker collects $$ L_{\mathrm{fileAccess}}(t_w) = \{f_1,f_2,\dots,f_n\}, $$ the set of ciphertext filenames accessed for query token $t_w$, and combines it with classical leakage in an integrative model $$ P(k \mid \ell_{\mathrm{sse}}, \ell_{\mathrm{sys}}) \propto P(\ell_{\mathrm{sse}} \mid k)\, P(\ell_{\mathrm{sys}} \mid k)\, P(k). $$ A weighted similarity version uses a Jaccard term $$ S_2(k;\ell_{\mathrm{sys}})=J(F(q),F_p(k))=\frac{|F(q)\cap F_p(k)|}{|F(q)\cup F_p(k)|}. $$ On $100$ Enron emails, baseline FMA reaches $77.8\%$ top-1 query recovery accuracy, whereas enhanced eFMA using $rs(q)+L_{\mathrm{fileAccess}}$ reaches $100\%$. Tokens such as T12, T13, T17, and T18 share the same frequency, for example $rs(q)=12$, but become separable once exact file-access sets are observed [2603.07030]. The DSSE and eBPF results jointly show that LAMA is sensitive to any leakage that stabilizes identity across observations: query equality, volumetric evolution, or file-level access sets all convert ambiguous matches into constrained or exact identifications. ## 4. Substring-SSE and matrix-based correlation under partial dataset knowledge In substring-SSE, the outsourced database is a multiset of strings $S=\{s_1,\dots,s_n\}$, and the server-side index is an encrypted suffix tree or array. The leakage model is substantially richer than in keyword SSE. During setup, the server can see the number of strings $n$, per-string length $\ell_j$, the number of distinct tokens $m$, branching-factor distributions, edge-label-length distributions, and two structural matrices: a prefix intersection pattern $L_1$ and a leaf-node intersection pattern $L_2$. The details also introduce a ciphertext incidence matrix $$ B \in \{0,1\}^{m \times n}, \qquad B[i,j]=1 \iff \text{token } t_i \text{ appears in encrypted string } es_j, $$ which is the encrypted analogue of a plaintext character-string incidence matrix $A$ [2511.00930]. The attacker is assumed to know a fraction $p$ of the target dataset. This auxiliary knowledge is encoded as $$ A' \in \{0,1\}^{m' \times n'}, \qquad A'' \in \{0,1\}^{m \times n'}, $$ where $A''$ extends $A'$ to the full alphabet size by padding unknown rows with zeros. The attack then constructs occurrence matrices $$ M = B^T B, \qquad M' = (A'')^T A'', $$ and matches ciphertext-side and plaintext-side structure using column sums, co-occurrence consistency, and unique row or column patterns [2511.00930]. The reported procedure is iterative and deterministic. Step 1 matches unique equal column sums between $B$ and $A''$. Step 2 extends the mapping set $M_c$ through occurrence-matrix consistency between $M$ and $M'$. Step 3 restricts to mapped columns and matches unique row patterns, producing token-character mappings $M_r$. Step 4 reorders rows using $M_r$ and performs refined unique column mapping. Step 5 zeros matched columns, recomputes column sums, and repeats until no new mappings are found. The attack therefore instantiates LAMA as repeated matrix matching between ciphertext-side leakage and plaintext-side partial ground truth, and it requires only setup-phase leakage; no online queries are needed [2511.00930]. The experimental evaluation uses Enron emails with alphabet size $94$, random $3$-digit integers per character, and sampled sets of $5{,}000$ strings. At $p=50\%$, alphabet recovery reaches $97.87\%$, string recovery reaches $98.32\%$, and initial path recovery reaches $94.22\%$. At $p=10\%$, alphabet recovery is $65.96\%$, string recovery is $74.42\%$, and initial path recovery is $49.22\%$. Full recovery is reported at $p=60\%$. Under a robustness protocol with $500$ known strings and target size increasing from $1{,}000$ to $30{,}000$, alphabet recovery declines from $66.41\%$ to $64.24\%$, string recovery from $76.08\%$ to $69.12\%$, and initial path recovery from $50.09\%$ to $45.89\%$. The recovery curves are described as S-shaped, with logistic fits giving midpoint estimates of $7.31\%$ knowledge for $50\%$ alphabet recovery, $4.64\%$ for string recovery, and $12.83\%$ for initial path recovery [2511.00930]. This case broadens the notion of LAMA beyond search traces. The object being matched is not merely a frequency vector or access pattern, but a leakage-induced structural representation of an encrypted suffix tree. A plausible implication is that LAMA becomes stronger as leakage reveals stable algebraic objects—here, incidence and co-occurrence matrices—rather than only scalar summaries. ## 5. Gradient leakage, layer-wise linear systems, and constrained matching In deep learning, LAMA appears as gradient matching against observed one-step gradients of an image-classification model with known architecture, known weights $\theta^\*$, batch size $1$, and cross-entropy loss. The paper studies CNNs with a stack of convolutional layers followed by a fully connected classifier, assumes piecewise invertible and piecewise differentiable nonlinearities, and reconstructs the hidden input by combining analytic inversion with optimization-based gradient matching [2210.13231]. The central formal move is to express reconstruction at each layer as a linear system $$ u^{(i)} x^{(i)} = v^{(i)}, $$ where $u^{(i)}$ stacks forward constraints and gradient constraints. For fully connected layers, $$ \frac{\partial L}{\partial W^{(i)}} = \delta^{(i)} \big(x^{(i)}\big)^\top, $$ so inputs can be recovered in closed form under nondegeneracy. For convolutional layers, im2col or Toeplitz/circulant representations convert weight gradients into a linear map over input patches, but weight sharing and downsampling can make $u^{(i)}$ rank-deficient. The hybrid attack solves each layer first by least squares and then applies a constrained LAMA-style correction, $$ \min_x \; \mu_1 \mathcal{D}\Big[\nabla_{\theta} L^{(i)}(x;\theta^\*), \nabla_{\theta} L^{(i)}(x_{\mathrm{true}};\theta^\*)\Big] + \mu_2 \mathrm{TV}(x) + \mu_3 \big\|u^{(i)}x-v^{(i)}\big\|_2^2, $$ with cosine distance $$ \mathcal{D}(a,b)=1-\frac{\langle a,b\rangle}{\|a\|\|b\|}. $$ Initialization is the least-squares solution, and the experiments use ADAM [2210.13231]. The framework ties leakage directly to solvability. If $\mathrm{rank}(u^{(i)})=n_i$, the layer has a unique solution up to conditioning; if $\mathrm{rank}(u^{(i)}) \text{Location} \ge \text{Contact/Network} \ge \text{Org-IDs} > \text{Names} \gg \text{Regulated-IDs}. $$ The implementation uses synthetic domain-specific documents in the SPIRIT dataset, three seeds per cell, exact string matching with simple normalization, and strict access control at initialization [2512.04668]. These findings shift LAMA from pure reconstruction into leakage measurement. MAMA does not merely infer a hidden keyword or record; it quantifies how graph radius, shortest-path distance, degree, and centrality shape the rate at which memorized secrets diffuse through a communication topology. A plausible implication is that LAMA, in this setting, functions as both an attack methodology and an experimental lens for privacy-risk characterization. Across the domains surveyed here, the recurring design lesson is structural rather than application-specific. Leakage grows when the system exposes stable matching surfaces: unique retrieval frequencies, equality-linked refreshed tokens, file-access sets, suffix-tree incidence patterns, high-rank layer-wise linear systems, or short graph paths to a memory-bearing agent. Conversely, the effective mitigations reported across these works—query-distribution flattening, suppression of equality and volume leakage, ORAM-like hiding of access patterns, opaque storage abstractions, architecture choices that make $c(M)$ more negative, sparse or hierarchical communication topologies, larger graph distance, and topology-aware access control—operate by eroding that matchability [2508.11563] [2309.04697] [2603.07030] [2210.13231] [2512.04668]. Source: https://www.emergentmind.com/topics/leakage-abuse-via-matching-lama