---
title: Leakage-Guessing Proof System
url: https://www.emergentmind.com/topics/leakage-guessing-proof-system
type: topic
---

# Leakage-Guessing Proof System

As an *Editor’s term*, **Leakage-Guessing Proof System** denotes a family of quantitative information-flow frameworks in which leakage is defined operationally by the improvement an adversary obtains in guessing a secret, or an arbitrary function of sensitive data, after observing a release. In the literature summarized here, the canonical form of this idea is the adversarial-guessing formulation of maximal leakage and its generalization to **maximal $\alpha,\beta$-leakage**, where the adversary may choose any finite-alphabet $U$ such that $U\to X\to Y$ and compare optimal guessing performance with and without access to $Y$. This operational backbone recovers maximal $\alpha$-leakage, maximal leakage, local differential privacy, and local Rényi differential privacy, while also supporting extensions to side information, coding-theoretic converse arguments, source-level quantitative information flow, and non-stochastic brute-force models [2211.15453].

## 1. Operational core: leakage as adversarial guessing

The modern leakage-guessing framework begins from the observation that an adversary is not necessarily trying to recover the raw private variable $X$ itself. Instead, the adversary may care about some discrete randomized function $U$ of $X$, with $U-X-Y$, and the release $Y$ should therefore be evaluated by how much it improves the adversary’s best guessing performance on that unknown target. In the finite-alphabet setting, maximal leakage is defined as
\[
\mathcal{L}(X\to Y)
=
\sup_{U-X-Y}
\log
\frac{\sup_{\hat U(\cdot)} \Pr[U=\hat U(Y)]}
{\max_u P_U(u)}.
\]
The denominator is the best prior guessing probability without observing $Y$; the numerator is the best posterior guessing probability after observing $Y$. The role of $U$ is central: maximizing over all such $U$ makes the measure robust to uncertainty about what secret the adversary actually cares about. For discrete alphabets, this yields the closed form
\[
\mathcal{L}(X\to Y)
=
\log \sum_{y\in\mathcal Y}
\max_{\substack{x\in\mathcal X:\\ P_X(x)>0}}
P_{Y|X}(y|x)
=
I_\infty(X;Y),
\]
so maximal leakage is exactly Sibson mutual information of order $\infty$ [1807.07878].

Maximal $\alpha,\beta$-leakage extends this operational picture by replacing the single-guess success probability with a generalized power-mean score. For $\alpha\in(1,\infty)$ and $\beta\in[1,\infty)$,
\[
\mathcal{L}_{\alpha,\beta}(X\to Y):=
\sup_{P_X}\sup_{U\to X\to Y}
\frac{\alpha}{\alpha-1}
\log
\frac{
\displaystyle
\max_{P_{\hat U|Y}}
\left[
\sum_y P_Y(y)
\left(
\sum_u P_{U|Y}(u|y)\,
P_{\hat U|Y}(u|y)^{\frac{\alpha-1}{\alpha}}
\right)^\beta
\right]^{1/\beta}
}{
\displaystyle
\max_{P_{\hat U}}
\left[
\sum_u P_U(u)\,
P_{\hat U}(u)^{\frac{\alpha-1}{\alpha}}
\right]
}.
\]
Here $\hat U$ has the same alphabet as $U$, the adversary may choose any estimator $P_{\hat U|Y}$, and the supremum over $P_X$ is included to enable recovery of worst-case notions. The same work proves a simplified computable expression,
\[
\mathcal{L}_{\alpha,\beta}(X\to Y)
=
\max_{x'}
\sup_{P_{\tilde X}}
\frac{\alpha}{(\alpha-1)\beta}
\log
\sum_y
P_{Y|X}(y|x')^{1-\beta}
\left(
\sum_x
P_{\tilde X}(x)\,
P_{Y|X}(y|x)^\alpha
\right)^{\beta/\alpha},
\]
where $P_{\tilde X}$ ranges over distributions on the support of $P_X$. This reduction is what turns the operational definition into a usable proof framework: the quantity depends only on the channel $P_{Y|X}$ and an auxiliary distribution $P_{\tilde X}$ [2211.15453].

## 2. The parameters $\alpha$ and $\beta$ and the bridge between regimes

The parameter $\alpha$ controls the local guessing loss function, while $\beta$ controls how the contributions from different outputs $y$ are aggregated. In maximal $\alpha$-leakage, $\alpha$ interpolates from log-loss at $\alpha=1$ to the probability-of-error regime at $\alpha=\infty$; equivalently, $L_1^{\max}(X\to Y)=I(X;Y)$ and $L_\infty^{\max}(X\to Y)$ is the classical maximal leakage of Issa et al. [1901.07105]. In maximal $\alpha,\beta$-leakage, $\beta=1$ corresponds to simple averaging over outputs, whereas $\beta\to\infty$ turns the aggregation into a maximum over outputs, shifting the operational semantics from an average-case perspective toward a worst-case, local-privacy flavor [2211.15453].

This interpolation is the precise mechanism by which a guessing-based framework spans multiple privacy notions that are often treated separately.

| Parameters | Recovered measure | Expression or characterization |
|---|---|---|
| $\beta=1$ | maximal $\alpha$-leakage | $\mathcal{L}_{\alpha,1}(X\to Y)$ |
| $\alpha=\infty,\ \beta=1$ | maximal leakage | $\mathcal{L}_{\infty,1}(X\to Y)$ |
| $\alpha=\beta$ | local Rényi differential privacy | $\mathcal{L}_{\beta,\beta}(X\to Y)=\max_{x',x}\frac{1}{\beta-1}\log\sum_y P_{Y|X}(y|x')^{1-\beta}P_{Y|X}(y|x)^\beta$ |
| $\alpha=\beta=\infty$ | local differential privacy | $\mathcal{L}_{\infty,\infty}(X\to Y)=\max_{x,x',y}\log \frac{P_{Y|X}(y|x)}{P_{Y|X}(y|x')}$ |
| $\alpha=\infty,\ \beta$ arbitrary | variant of LRDP | $\mathcal{L}_{\infty,\beta}(X\to Y)=\max_{x'} \frac{1}{\beta}\log \sum_y P_{Y|X}(y|x')^{1-\beta}\max_x P_{Y|X}(y|x)^\beta$ |

A recurrent misconception is that local differential privacy and guessing-based leakage belong to fundamentally different paradigms. The parameterization above shows otherwise: in this family, LDP appears as a corner point of the same operational construction that yields average-case maximal leakage. The paper explicitly interprets $\beta=1$ as the average-case regime and $\beta\to\infty$ as the route to max-over-output worst-case privacy, with $\alpha\to\infty$ recovering the classical maximum-ratio flavor of local privacy [2211.15453].

## 3. Axioms, proof obligations, and proof-theoretic structure

The leakage-guessing literature treats a leakage measure not merely as a scalar quantity, but as an object required to satisfy a recognizable set of operational and axiomatic properties. For maximal $\alpha,\beta$-leakage, the framework establishes non-negativity,
\[
\mathcal{L}_{\alpha,\beta}(X\to Y)\ge 0,
\]
with equality iff $X$ and $Y$ are independent; monotonicity in $\beta$ for fixed $\alpha$,
\[
\beta_2>\beta_1
\implies
\mathcal{L}_{\alpha,\beta_2}(X\to Y)\ge \mathcal{L}_{\alpha,\beta_1}(X\to Y);
\]
data processing inequalities for any Markov chain $X-Y-Z$,
\[
\mathcal{L}_{\alpha,\beta}(X\to Z)\le \mathcal{L}_{\alpha,\beta}(X\to Y),
\qquad
\mathcal{L}_{\alpha,\beta}(X\to Z)\le \mathcal{L}_{\alpha,\beta}(Y\to Z);
\]
and additivity over independent releases,
\[
\mathcal{L}_{\alpha,\beta}(X_1,\ldots,X_n \to Y_1,\ldots,Y_n)
=
\sum_{i=1}^n \mathcal{L}_{\alpha,\beta}(X_i\to Y_i).
\]
The same work also notes a reparameterization $\beta=\frac{\alpha}{1-\tau(1-\alpha)}$ under which the leakage becomes non-increasing in $\tau$ for fixed $\alpha$, and non-decreasing in $\alpha$ for fixed $\tau$ [2211.15453].

The paper frames these results as a general proof template. One first defines an adversary’s gain in guessing an arbitrary hidden function $U$ of $X$; then optimizes over all $U\to X\to Y$; then introduces a tunable power mean in which $\alpha$ governs guess quality and $\beta$ governs output aggregation; and finally proves the resulting quantity satisfies non-negativity, zero iff independence, data processing, and additivity. In this sense, “proof system” refers not only to a formal logic, but also to a reusable operational schema for deriving leakage measures from guessing games [2211.15453].

For classical maximal leakage, several additional properties sharpen the distinction from mutual-information-based reasoning. It is generally asymmetric, convex in $P_{Y|X}$ for fixed support of $P_X$, and depends on $P_X$ only through $\operatorname{supp}(P_X)$. It also satisfies
\[
\mathcal L(X\to Y)\ge I(X;Y),
\]
and no scalar multiple of mutual information can upper-bound it uniformly. These facts explain why maximal leakage is often used when worst-case guessing amplification, rather than average information transmission, is the relevant proof obligation [1807.07878].

## 4. Conditionalization and robustness to side information

A leakage-guessing proof system becomes substantially more realistic once side information is made explicit. Conditional maximal $\alpha$-leakage introduces a third variable $Z$, representing information already available to the adversary, and defines
\[
L_{\alpha}^{\max}(X\to Y|Z)
\triangleq
\sup_{U:\,U-X-Y|Z} L_\alpha(U\to Y|Z),
\]
under the conditional Markov structure
\[
P_{UXY|Z}(u,x,y|z)=P(x|z)P(u|x,z)P(y|x,z),
\qquad\text{equivalently}\qquad
U-(X,Z)-Y.
\]
For $\alpha>1$, the resulting quantity is characterized as
\[
L_{\alpha}^{\max}(X\to Y|Z)
=
\sup_{z\in \mathrm{supp}(Z)}
\sup_{P_{\tilde X|Z=z}\ll P_{X|Z=z}}
I_{\alpha}^{\mathrm S(\tilde X;Y|Z=z)},
\]
while for $\alpha=1$ it reduces to $I(X;Y|Z)$. The paper interprets this as a supremum of conditional Arimoto channel capacities across side-information states [1901.07105].

The central robustness theorem states that if
\[
Z-X-Y,
\]
then
\[
L_{\alpha}^{\max}(X\to Y|Z)\le L_{\alpha}^{\max}(X\to Y).
\]
The condition $Z-X-Y$ means that the side information is conditionally independent of the release given the private data; in operational terms, the release mechanism depends only on $X$ and private randomness, not on $Z$. Under that assumption, arbitrary side information cannot increase leakage beyond the unconditional maximal $\alpha$-leakage already quantified by the mechanism. A common misunderstanding is therefore corrected: side information does not automatically invalidate a leakage guarantee; it does so only when the release model itself breaks the required conditional independence [1901.07105].

## 5. Coding-theoretic and graph-theoretic realizations

The same guessing-based proof system appears in several coding problems, where the operational quantity becomes a leakage rate and the converse machinery becomes combinatorial or type-theoretic.

In zero-error source coding, the source symbols are constrained by a confusion graph $T$, and the leakage to a guessing adversary is measured by the ratio of best post-observation and pre-observation guessing success probabilities. The optimal normalized leakage rate is
\[
\mathcal C=\log \chi_f(T),
\]
where $\chi_f(T)$ is the fractional chromatic number of the confusion graph. The paper further shows that this equals the optimal fixed-length zero-error compression rate,
\[
\mathcal C = R = \log \chi_f(T),
\]
and gives an optimum-achieving scalar stochastic mapping built from a fractional coloring [2102.01908].

In index coding, the adversary knows a subset $X_P$ of the messages, wants to guess $X_Q$ for $Q=[n]\setminus P$, and is allowed at most $c(t)$ guesses at blocklength $t$. The leakage metric is
\[
L=\log\frac{P_s(X_P,Y)}{P_s(X_P)}.
\]
For vanishing-error and zero-error decoding, the paper derives lower and upper bounds controlled by the broadcast rate of the induced subproblem on $Q$; when the messages are independent and uniformly distributed, these bounds match:
\[
\mathcal C=\Lambda=R(Q)=p(Q).
\]
This yields a direct equivalence between leakage minimization and an induced index-coding problem on the messages not already known to the adversary [2205.10821].

A related privacy-utility model, explicitly inspired by index coding, places several legitimate users and one adversary in a single-shot guessing framework. The adversary’s privacy metric is conditional maximal leakage
\[
L_{\max}(X_Q \to Y \mid X_P),
\]
and the utility constraints imply converse lower bounds such as
\[
L_{\max}(X_Q\to Y\mid X_P)\ge \log w\big(\Gamma(X_P)\big),
\]
where $w(\Gamma(X_P))$ is the clique number of the induced confusion graph. A second converse uses a polymatroid rank function
\[
g(S)=H(Y\mid X_{S^c})-H(Y\mid X_{[n]})
\]
to obtain entropy-based lower bounds, and the constructive side of the paper proposes a greedy privacy-enhancing mechanism inspired by agglomerative clustering in the information bottleneck and privacy funnel problems [2001.06828].

In the successive-refinement Shannon cipher system, maximal leakage again supports a guessing-based converse. The eavesdropper observes public messages $(M_1,M_2)$ and tries to infer a hidden random function $U$ of the source. Under joint excess-distortion probability and expected distortion criteria, the paper characterizes inner and outer normalized maximal leakage regions; the achievability proof uses type-based coding, binning, and key masking, while the converse constructs a multi-stage guessing strategy in which Eve first guesses the keys and then applies source-sequence guessing functions derived from type arguments [2308.07203]. This is an especially explicit illustration of the proof-system viewpoint: secrecy bounds are proved by lower-bounding the success of a carefully chosen guessing attack.

## 6. Source-level logics, non-stochastic variants, and empirical manifestations

One branch of the literature turns the leakage-guessing framework into an actual source-level proof system for programs. In quantitative information flow, a program is modeled as a channel from prior distributions to hyper-distributions, and an attacker is specified by a gain function
\[
g : {\cal W} \times S \to \mathbb{R},
\qquad
V_g(\pi)=\max_{w\in{\cal W}} \mathbb{E}_\pi[g(w,-)].
\]
The source-level judgment
\[
\{\,\Exp[preGain]\,\}\; P \;\{\,\Exp[postGain]\,\}
\]
states that the attacker’s best expected post-execution gain is exactly represented by a pre-gain computed by backward transformation rules. The language includes assignment, sequencing, conditionals, while loops, and explicit leakage via `Print`, while also modeling implicit leakage through branch and loop observations. Gain expressions built from $\MAX$, $\PLUS$, and $\AND$ generalize “Guess the secret in one try” to more structured adversarial utilities [2405.13416]. This formalism clarifies another recurrent misconception: explicit output is not the only leakage channel; branch-on-high control flow is itself observable in the semantics.

A different extension removes probability altogether. In the non-stochastic brute-force setting, random variables are replaced by uncertain variables, posterior uncertainty is represented by conditional ranges, and leakage is defined by the reduction in worst-case brute-force search complexity. For a sensitive attribute $U$,
\[
L(U\rightarrow Y)
=
\log\left(
\frac{|{U}|}
{\min_{y\in {Y}} |{U|Y(\omega)=y}|}
\right).
\]
Maximizing over all attributes $U=g(X)$ gives a maximal non-stochastic brute-force guessing leakage
\[
L(X\rightarrow Y)
=
\log\left(|{X}|-\min_{y\in{Y}}|{X|Y(\omega)=y}|+1\right),
\]
with data processing, nonnegativity, zero iff unrelated, and additivity for independent components. The same paper relates this quantity to maximin information and to stochastic maximal leakage, showing that the brute-force measure upper bounds the existing non-stochastic one-shot notion [2107.01113].

The small-leakage regime has also been analyzed directly in terms of guessing moments. For a secret alphabet of size $M$, the guessing advantage is
\[
\Delta G_\rho(X;Y)\triangleq G_\rho(M)-G_\rho(X|Y),
\]
and the leakage side is measured by
\[
\Delta H_\alpha(X;Y)\triangleq \log M - H_\alpha(X|Y).
\]
The resulting non-asymptotic theory gives exact parametric lower envelopes of $G_\rho(X|Y)$ versus $H_\alpha(X|Y)$ and, near the no-leakage point, the square-root law
\[
\Delta G_\rho(X;Y)
\lesssim
\sqrt{
\frac{2\bigl(G_{2\rho}(M)-G_\rho^2(M)\bigr)}{\alpha}
}
\sqrt{\frac{\Delta H_\alpha(X;Y)}{\log e}}.
\]
Operationally, this provides a direct way to upper-bound guessing advantage from a bound on conditional Rényi–Arimoto entropy [2401.17057].

Finally, the framework has concrete side-channel manifestations. The PILOT attack studies password and PIN leakage from videos of masked typing feedback, where the leakage source is inter-keystroke timing inferred from the frames in which masking symbols first appear. The paper reports that, by leveraging inter-keystroke timings, PILOT recovers 8-character alphanumeric passwords in as little as 19 attempts, and guesses about 3% of PINs within 10 attempts, corresponding to a 26-fold improvement compared to random guessing [1904.00188]. This empirical result is fully consistent with the operational definition of leakage used throughout the theory: even when the symbols themselves are obfuscated, the release can still substantially increase an adversary’s ranking or guessing success.

The resulting picture is coherent across probabilistic, program-logical, coding-theoretic, and non-stochastic settings. A leakage-guessing proof system specifies an adversarial objective, measures the improvement caused by observation, proves axiomatic properties such as data processing and additivity, and then uses those properties to derive guarantees or converses. What varies across the literature is the semantic substrate—channels, hyper-distributions, confusion graphs, type classes, or conditional ranges—rather than the underlying operational question of how much easier guessing becomes after the release.

Source: https://www.emergentmind.com/topics/leakage-guessing-proof-system