Leakage Theory Overview

• Leakage Theory is a multidisciplinary framework for analyzing unintended transport or information disclosure across imperfect physical and digital interfaces.
• In physical systems, the theory applies Reynolds approximation and Persson contact mechanics to predict leak rates through critical constrictions and percolation thresholds.
• In information and machine learning contexts, it uses game-theoretic, quantum, and statistical models to quantify vulnerabilities and guide robust system design.

In current research, “leakage theory” denotes several formal traditions for analyzing unintended transport or disclosure across an imperfect interface, channel, or mechanism. In rough-contact sealing, it concerns fluid or gas flow through non-contact constrictions governed by lubrication or kinetic theory and multiscale contact mechanics. In quantitative information flow and cryptography, it concerns posterior vulnerability under observation, protocol composition, and adversarial interaction. In quantum information, it concerns dephasing, gentle measurements, and Rényi-type capacities. In machine learning, it concerns contamination of evaluation protocols, shortcut transmission through concept bottlenecks, reconstruction from model updates, and artifacts detectable from prediction vectors alone (Fischer et al., 2020, Lacerda et al., 2014, Farokhi et al., 2024, Shulman, 1 Jul 2026).

1. Interfacial transport in seals and rough contacts

In metallic-seal theory, two nominally flat but microscopically rough bodies are pressed together under nominal contact pressure $p(x,y)$, while a fluid of viscosity $\eta$ and pressure difference $\Delta P$ attempts to flow through the non-contact channels. In the Reynolds approximation, the local volumetric flux per unit width is

$$J_x(x,y)=-\frac{u^3(x,y)}{12\eta}\frac{\partial p_{\rm fluid}}{\partial x},$$

with $u(x,y)$ the local separation. If a single “critical constriction” of height $u_{\rm c}$ dominates the flow, the leak-rate is approximated by

$$\dot Q \approx \frac{u_{\rm c}^3}{12\eta}\,\frac{\Delta P}{w/L_y},$$

where $w$ is the constriction width and $L_y$ is the transverse length or circumference feeding parallel channels. A more complete treatment replaces the single junction by an effective conductivity $\sigma_{\rm eff}(p(x))$ and yields

$\eta$0

For azimuthally symmetric seals with $\eta$1 and $\eta$2, the leak-rate becomes

$\eta$3

These formulas are coupled to Persson contact mechanics through the pressure-separation relation $\eta$4, with $\eta$5, and through the roughness power spectrum $\eta$6 (Fischer et al., 2020).

A central refinement in metallic seals is asperity-scale plasticity. When plastic yield occurs, the original spectrum $\eta$7 is replaced by a smoothed spectrum

$\eta$8

where $\eta$9 and $\Delta P$0. Substituting $\Delta P$1 into the Persson-Bruggeman calculation reduces the computed $\Delta P$2 by roughly a factor of $\Delta P$3, and because $\Delta P$4, the predicted leak-rate is reduced by about $\Delta P$5. In the reported experiment, a hardened steel ball of radius $\Delta P$6 mm sealed against a conical steel seat with $\Delta P$7; the ball had $\Delta P$8m, the sandblasted seat $\Delta P$9m, $$J_x(x,y)=-\frac{u^3(x,y)}{12\eta}\frac{\partial p_{\rm fluid}}{\partial x},$$0 GPa, and $$J_x(x,y)=-\frac{u^3(x,y)}{12\eta}\frac{\partial p_{\rm fluid}}{\partial x},$$1 GPa. Without plasticity, the theory overestimated leakage by almost an order of magnitude; with plastic smoothing, theory and experiment agreed closely over $$J_x(x,y)=-\frac{u^3(x,y)}{12\eta}\frac{\partial p_{\rm fluid}}{\partial x},$$2–20 bar, including the example $$J_x(x,y)=-\frac{u^3(x,y)}{12\eta}\frac{\partial p_{\rm fluid}}{\partial x},$$3 m$$J_x(x,y)=-\frac{u^3(x,y)}{12\eta}\frac{\partial p_{\rm fluid}}{\partial x},$$4/s at $$J_x(x,y)=-\frac{u^3(x,y)}{12\eta}\frac{\partial p_{\rm fluid}}{\partial x},$$5 bar.

2. Percolation, Knudsen crossover, and critical closure

A recurrent idea in seal leakage is that the decisive event is percolation of the non-contact region. As magnification $$J_x(x,y)=-\frac{u^3(x,y)}{12\eta}\frac{\partial p_{\rm fluid}}{\partial x},$$6 increases, the real contact area $$J_x(x,y)=-\frac{u^3(x,y)}{12\eta}\frac{\partial p_{\rm fluid}}{\partial x},$$7 decreases until non-contact zones percolate at $$J_x(x,y)=-\frac{u^3(x,y)}{12\eta}\frac{\partial p_{\rm fluid}}{\partial x},$$8 for isotropic random roughness. In the effective-medium treatment of elastic contacts, this threshold is encoded by modifying Bruggeman theory: the rigid-contact value $$J_x(x,y)=-\frac{u^3(x,y)}{12\eta}\frac{\partial p_{\rm fluid}}{\partial x},$$9 is shifted by elasticity to $u(x,y)$0, corresponding at threshold to an effective dimension $u(x,y)$1. Near sealing, however, the critical behavior is not universal. Numerical work found

$u(x,y)$2

for the default adhesion-free, no-slip model, but also showed that the exponent is governed by the microscopic geometry of the last open constriction rather than by universal percolation statistics (Dapp et al., 2015, Dapp et al., 2013).

For gases, the local transport law must interpolate between diffusive and ballistic regimes. In syringe and suction-cup leakage, the Knudsen number $u(x,y)$3 separates the continuum limit $u(x,y)$4 from the free-molecular limit $u(x,y)$5. In one formulation, the microscopic current is

$u(x,y)$6

with

$u(x,y)$7

In the slit-constriction model, the diffusive conductance scales as $u(x,y)$8, the ballistic conductance as $u(x,y)$9, and a unified leakage equation bridges the two. For a torus-shaped seal of length $u_{\rm c}$0 and circumference $u_{\rm c}$1, the macroscopic leak-rate is

$u_{\rm c}$2

This framework was validated for a syringe system in which stylus profilometry and AFM supplied $u_{\rm c}$3, FEM supplied $u_{\rm c}$4, and Multiscale Contact Mechanics software supplied the leakage prediction; the paper reports strong sensitivity near $u_{\rm c}$5, and dry tests agreed with prediction without fitting parameters (Xu et al., 13 Jul 2025).

The same physical structure appears in suction cups. There, the unified number-flux law

$u_{\rm c}$6

is combined with Persson theory for $u_{\rm c}$7, with viscoelastic deformation of the cup, and with time evolution of the trapped volume and internal pressure. Experiments on $u_{\rm c}$8 mm soft-PVC cups against sandblasted PMMA matched theory for rms roughness $u_{\rm c}$9m, while smoother surfaces exhibited anomalously long lifetimes attributed to plasticizer diffusion blocking critical constrictions (Tiwari et al., 2019). In Teflon-coated rubber syringe seals, the gas flow was found to be mainly ballistic, the percolation threshold again occurred near $$\dot Q \approx \frac{u_{\rm c}^3}{12\eta}\,\frac{\Delta P}{w/L_y},$$0, and plastic flow in Teflon under rib pressures $$\dot Q \approx \frac{u_{\rm c}^3}{12\eta}\,\frac{\Delta P}{w/L_y},$$1–$$\dot Q \approx \frac{u_{\rm c}^3}{12\eta}\,\frac{\Delta P}{w/L_y},$$2 MPa was reported to reduce $$\dot Q \approx \frac{u_{\rm c}^3}{12\eta}\,\frac{\Delta P}{w/L_y},$$3 by factors up to $$\dot Q \approx \frac{u_{\rm c}^3}{12\eta}\,\frac{\Delta P}{w/L_y},$$4 (Rodriguez et al., 2021).

3. Information leakage as channel vulnerability and strategic interaction

In quantitative information flow, a system is modeled as a channel $$\dot Q \approx \frac{u_{\rm c}^3}{12\eta}\,\frac{\Delta P}{w/L_y},$$5, with prior $$\dot Q \approx \frac{u_{\rm c}^3}{12\eta}\,\frac{\Delta P}{w/L_y},$$6 and a vulnerability functional $$\dot Q \approx \frac{u_{\rm c}^3}{12\eta}\,\frac{\Delta P}{w/L_y},$$7. Posterior vulnerability is

$$\dot Q \approx \frac{u_{\rm c}^3}{12\eta}\,\frac{\Delta P}{w/L_y},$$8

and leakage may be written additively as $$\dot Q \approx \frac{u_{\rm c}^3}{12\eta}\,\frac{\Delta P}{w/L_y},$$9 or multiplicatively as $w$0. The resulting utility is generally non-linear in the defender’s mixed strategy: under hidden choice, the effective channel is the convex mixture

$w$1

and posterior vulnerability is convex in the channel, whereas under visible choice,

$w$2

posterior vulnerability is linear in the mixture (Alvim et al., 2018, Alvim et al., 2020).

This distinction supports a zero-sum game-theoretic theory of leakage. Each attacker-defender action pair $w$3 induces a channel $w$4, and the payoff is $w$5. Simultaneous visible games have expected payoff $w$6; simultaneous hidden games replace this by

$w$7

The literature establishes a hierarchy of equilibrium leakage: $w$8 In the concrete $w$9 example with payoff matrix

$L_y$0

the equilibrium values are $L_y$1, $L_y$2, $L_y$3, $L_y$4, and $L_y$5, in that order. These results formalize two basic facts already present in channel algebra: defender randomization can reduce leakage, and exposing the defender’s randomization can only help the attacker.

Dynamic leakage extends the same program to single realized runs. The traditional dynamic quantity,

$L_y$6

can be negative. The newer strategy-based definition separates the adversary’s belief $L_y$7 from the baseline distribution $L_y$8 against which success is measured. With posterior $L_y$9,

$\sigma_{\rm eff}(p(x))$0

This quantity satisfies non-interference, is non-negative in the single-step setting, obeys a single-step data-processing inequality, and recovers the standard expected-case and max-case static leakages after averaging or maximizing over $\sigma_{\rm eff}(p(x))$1 (Soares et al., 23 Oct 2025).

4. Quantum and cryptographic formulations

A major strand of leakage theory treats leakage as a quantum channel phenomenon. One route starts from a classical leakage model $\sigma_{\rm eff}(p(x))$2 in which an adversary may request $\sigma_{\rm eff}(p(x))$3 and learn $\sigma_{\rm eff}(p(x))$4, where $\sigma_{\rm eff}(p(x))$5 is the vector of wire values. The corresponding quantum phase-noise channel is

$\sigma_{\rm eff}(p(x))$6

with $\sigma_{\rm eff}(p(x))$7. If a fault-tolerant quantum implementation $\sigma_{\rm eff}(p(x))$8 of $\sigma_{\rm eff}(p(x))$9 is $\eta$00-reliable under this phase-noise model, then the induced classical protocol is a $\eta$01-leakage-resilient compiler against $\eta$02. The paper further gives an implementation based on the concatenated Steane $\eta$03 code and quotes an independent phase-error threshold $\eta$04 (Lacerda et al., 2014).

A second route measures leakage under detection threat. For an ensemble $\eta$05, a POVM $\eta$06 is $\eta$07-weakly gentle if, with probability at least $\eta$08, the post-measurement disturbance of every state in the family is at most $\eta$09 in trace distance. The resulting gentle quantum leakage is

$\eta$10

where

$\eta$11

This measure satisfies positivity, independence, and unitary invariance. Under global depolarizing noise $\eta$12, the leakage obeys

$\eta$13

so depolarization monotonically reduces leakage. The same work derives a lower bound via asymmetric approximate cloning and reports that, for BB84 encoding, $\eta$14 bits for any $\eta$15 (Farokhi et al., 2024).

A third route generalizes $\eta$16-leakage to quantum privacy mechanisms. For a cq-state

$\eta$17

the maximal expected $\eta$18-gain is characterized by a measured conditional Rényi entropy $\eta$19, and

$\eta$20

Maximal $\eta$21-leakage is

$\eta$22

where $\eta$23 is the measured Rényi capacity. The framework establishes a data-processing inequality, a composition property, and, for $\eta$24 i.i.d. uses, the additivity relation

$\eta$25

In the i.i.d. limit, the regularized quantities coincide with $\eta$26-tilted sandwiched Rényi information and sandwiched Rényi capacity (Yang et al., 2024).

5. Leakage in machine learning pipelines and model artifacts

In machine learning, “data leakage” often denotes contamination of training or evaluation by information unavailable under the intended deployment protocol. A controlled study of RF drone identification formalizes the optimism of segment-level cross-validation when a small number of continuous recordings are split into many short segments. With $\eta$27 independent recordings per class, segment-level CV can learn the degenerate conditional $\eta$28, where $\eta$29 is the recording index, rather than the intended $\eta$30. Using Cover’s function-counting theorem, the study shows that exact recording memorization can occur when $\eta$31 is less than or approximately equal to $\eta$32, the feature dimension. In synthetic experiments, naive balanced accuracy rose toward $\eta$33 while honest recording-grouped evaluation declined to chance. On DroneRF, AR-versus-Bebop type identification collapsed from naive macro-F1 $\eta$34 to honest macro-F1 $\eta$35, approximately the two-class chance level $\eta$36; the reported ablation attributed essentially all inflation to segment-level leakage (Shulman, 1 Jul 2026).

A different problem is whether leakage can be detected from predictions and outcomes alone. In the decision-theoretic framework based on the joint law of $\eta$37, threshold-weighted expected net benefit is

$\eta$38

The paper proves an impossibility result: if a leaky procedure is recalibrated and marginally matched to an honest predictor, then no function of $\eta$39 can distinguish them. Thus broad calibrated leakage is detectable only against an externally supplied ceiling on achievable discrimination. What remains prior-free detectable is a near-deterministic subgroup, visible as a sustained unit-purity head in the top-$\eta$40 purity curve $\eta$41. In the UK Biobank incident-delirium example, the empirical detection floor was $\eta$42: at $\eta$43 years, $\eta$44 was not detected, while at $\eta$45 years, $\eta$46–$\eta$47 produced a detectable breadth of $\eta$48; the full leak raised concordance to $\eta$49 with breadth $\eta$50 (Jacobs, 9 Jun 2026).

Leakage also appears inside learned representations and distributed training protocols. In concept bottleneck models, unintended leakage is quantified by conditional mutual information,

$\eta$51

where $\eta$52 is the concept embedding and $\eta$53 the intended concept set. The empirical estimator trains one classifier for $\eta$54 and another for $\eta$55; among the tested estimators, XGBoost produced the smoothest monotonic trends. In one synthetic configuration $\eta$56, the estimated leakage dropped from approximately $\eta$57 bits at $\eta$58 to approximately $\eta$59 bits at $\eta$60, and in soft-joint CBMs with $\eta$61, leakage fell from approximately $\eta$62 bits at $\eta$63 to approximately $\eta$64 bits at $\eta$65 (Makonnen et al., 13 Apr 2025). In federated learning, leakage is tied to invertibility of the mapping from batch data to model update. If the Jacobian $\eta$66 satisfies $\eta$67, then distinct batches can generate the same update; a sufficient condition for non-identifiability is $\eta$68. The same work gives an optimization-theoretic upper bound on privacy leakage in terms of batch size, distortion extent, and regret terms (Zhang et al., 2024).

6. Structural themes, impossibility results, and boundary conditions

Across these literatures, leakage is typically governed by a bottleneck observable rather than by the full microscopic state. In seal mechanics this bottleneck is the critical gap $\eta$69 or effective conductivity $\eta$70; in QIF it is posterior vulnerability $\eta$71; in quantum privacy it is a measured Rényi information or capacity; in benchmark auditing it is the law of $\eta$72 or the top-$\eta$73 purity head; and in concept methods it is $\eta$74. This suggests a common architecture: a high-dimensional mechanism is reduced to a small set of transport, inference, or discrimination coordinates that determine the leakage observable.

Thresholds are equally recurrent. Rough-contact leakage changes character near the non-contact percolation point $\eta$75; RF benchmark leakage changes character near the separability threshold $\eta$76; output-only audits become decisive only when a unit-purity head persists over a non-null fraction of ranked predictions; and gas-seal models become highly sensitive when $\eta$77. At the same time, several papers state strict limitations on what can be inferred. Near the sealing point, the exponent and closure law depend on the microscopic details of the last constriction, so statistical surface properties alone do not determine how the leak ceases (Dapp et al., 2015). In prediction auditing, calibrated broad leakage is output-indistinguishable from an honestly stronger predictor unless an exogenous ceiling $\eta$78 is supplied (Jacobs, 9 Jun 2026).

A related impossibility appears in encrypted-traffic analysis, but there it is formulated positively: under mapping non-degeneracy, protocol-layer distinguishability, Lipschitz continuity, observation non-degeneracy, and the propagation condition $\eta$79, the mutual information $\eta$80 is strictly positive and admits an explicit lower bound. The corollary states that, in efficiency-prioritized systems, leakage is inevitable when at least one application pair is distinguishable (Liu et al., 15 Feb 2026). A plausible implication is that “zero leakage” is often not a realistic engineering target. In the physical literature it would require suppressing the final constriction; in encrypted traffic it would require heavy padding or delays, semantic homogenization, or elimination of useful observability; and in ML evaluation it would require grouping and acquisition protocols that remove source identity from the train-test boundary.

Taken together, leakage theory is not a single formalism but a family of mathematically explicit programs for locating, quantifying, and sometimes bounding unintended transport or inference. Its mature forms are characterized by multiscale reduction, explicit threshold phenomena, and equally explicit statements of detectability limits.