Privacy Boundary Theory: Principles & Applications

• Privacy Boundary Theory is a framework that defines and quantifies boundaries separating private from public information using rule-based control, mathematical topology, and information theory.
• It employs rate–distortion–equivocation models and lattice-based topological structures to identify sharp privacy thresholds and elucidate boundary turbulence.
• Empirical studies in smart home contexts reveal that crossing defined transmission and sharing boundaries leads to significant, non-linear escalations in perceived privacy risk.

Privacy Boundary Theory (PBT) presents a unified lens for analyzing, quantifying, and operationalizing the boundaries separating private from public (or shared) information. Originating in interpersonal communication as a framework for rule-based information control, its analytic development spans information theory, mathematical topology, and empirical behavioral studies. Across these domains, a central concern is how privacy boundaries—metaphorical or formal—define permissible flows of information, with loss of privacy emerging at critical crossings or as a consequence of topological or information-theoretic constraints. This article synthesizes major lines of PBT, emphasizing the mathematical structures, empirical regularities, and practical implications for privacy management in both human-human and human-AI contexts.

1. Foundational Principles: Boundaries, Crossing, and Turbulence

Privacy Boundary Theory, as articulated by Petronio and successors, posits three central constructs: privacy boundaries, boundary crossing, and boundary turbulence. Privacy boundaries delimit who may know what, with dimensions of permeability (volume or type of information traversed) and linkage (network or set of recipients). Crossing a boundary occurs when information moves beyond the discloser's intended perimeter, producing new "co-owners" responsible for further control. Turbulence arises when boundary rules are violated or coordination among co-owners fails, resulting in perceived loss of control or increased subjective risk.

In extension to digital ecologies—e.g., smart home systems—boundaries are mapped to technical and social interfaces (e.g., device-local vs. cloud, first-party vs. third-party sharing), with empirical studies demonstrating abrupt increases in perceived risk when such thresholds are crossed (Zhang et al., 24 Jan 2026). PBT rules are shaped by cultural norms, individual goals, data attributes, context, and ongoing risk-benefit analyses.

2. Information-Theoretic Formulation: Privacy–Utility Boundary

A rigorous instantiation of PBT emerges in information theory, where privacy and utility are jointly quantified via rate–distortion–equivocation theory (Sankar et al., 2010). Here, a database is modeled as a random source $\mathbf X = (X_1,\dots,X_K)$ partitioned into public ($\mathbf X_r$) and private ($\mathbf X_h$) attributes, possibly in the presence of adversarial side information $Z$. Sanitization is formalized via (possibly randomized) coding: the encoder maps the raw database to $W \in \{1,\dots,M\}$, while the decoder reconstructs public fields.

• Utility is measured via average per-symbol distortion, $\Delta_\ell \le D_\ell + \epsilon$.
• Privacy is defined by per-row equivocation, $\Delta_p \ge E-\epsilon$.

The core technical result is the identification of the utility–privacy region $\mathcal T$ with the $(D,E)$-projection of the rate–distortion–equivocation region $\mathcal R$:

$\mathcal T = \mathcal R_{D\!-\!E}.$

The "Privacy Boundary" $\Gamma(D)$ is the supremal equivocation $E$ achievable for distortion $D$, optimizing over all possible code designs and side-information distributions:

$$\Gamma(D) = \sup_{p \in \mathcal P(D,E)} H(\mathbf X_h|U,Z),$$

where $\mathcal P(D,E)$ encodes joint and conditional distributions meeting the distortion and equivocation constraints.

This boundary is tight: no mechanism can achieve superior points $(D,E)$, and all classical anonymization and noise-insertion methods are specific realizations along this frontier (Sankar et al., 2010).

3. Topological and Lattice-Theoretic Boundary Characterization

Privacy boundaries admit an independent, combinatorial-topological formalization via lattice theory and Dowker complexes (Erdmann, 2017). In this framework, a relation $R \subseteq X \times Y$ connects individuals and attributes. The associated complexes $\Phi_R$ (attributes) and $\Psi_R$ (individuals) are homotopy-equivalent, with the poset $P_R$ and lattice $L(R)$ encoding the structure of allowable inferences.

• Privacy boundaries are identified with global topological features, notably the presence of a “spherical hole” in the complexes. Attribute privacy requires the absence of free faces in $\Phi_R$; association privacy, the same in $\Psi_R$.
• Spherical-hole condition: Full privacy corresponds to complexes that are spheres (e.g., $\partial(\Delta^{n-1})$).
• Individual-level boundary: The link of an individual in $\Phi_R$, $\mathrm{Lk}_{\Phi_R}(Y_x)$, is a sphere if and only if $x$’s attribute privacy is preserved.

Privacy loss is thus captured by topological collapse (simplicial collapse of free faces), and the ability to defer identification (dynamic privacy boundary) is linked to the homology of the individual's link complex. The Galois lattice supports a dynamic view: gradient flow towards identification as attributes are incrementally revealed, and potential "harmonic flow" for optimization of privacy preservation.

4. Empirical and Behavioral Instantiations: SPA Ecosystem

Recent empirical work operationalizes PBT in smart home personal assistant (SPA) contexts (Zhang et al., 24 Jan 2026). Here, boundaries are mapped to:

• Transmission range (spatial permeability): on-device, within-home, public network.
• Sharing range (relational linkage): no sharing, first-party, third-party.

Quantitative studies reveal non-linear, step-function escalation in perceived privacy risk at two macro-boundaries: when data leaves the home network (public network transmission) and when shared beyond the primary provider (third-party sharing). These effects are robust with large effect sizes (Kendall’s $W > 0.7$) and significant risk increments ($p < .001$). Data attributes (sensitivity, relational content), contextual privacy calculus, and user awareness modulate these effects, with boundary turbulence manifesting as distrust of anonymization and loss of control over inferences.

Boundary Dimension	Category	Risk Jump Observed
Transmission	Within-home $\rightarrow$ Public network	Yes
Sharing	First-party $\rightarrow$ Third-party	Yes

Encryption and first-party anonymization reduce perceived risk only in limited circumstances; third-party anonymization is distrusted and does not restore risk to within-home or on-device levels.

5. Mathematical Illustrations and Examples

The privacy boundary can be elucidated by canonical examples (Sankar et al., 2010, Erdmann, 2017):

• Categorical data (Hamming distortion): “Upside-down waterfilling” in the release mechanism suppresses rare/predictable classes to maximize equivocation. Maximum privacy occurs by mapping highly unique data to the null or majority class.
• Gaussian data (mean-squared error): For joint $(X,Y)$ with correlation $\rho$, revealing $X$ with MSE $\le D$, the privacy boundary for concealed $Y$ is:

$$\Gamma(D) = \sigma_Y^2 \left[(1-\rho^2) + \rho^2 \frac{D}{\sigma_X^2} \right]$$

Achievable privacy tracks both direct variance and the indirect leakage via correlated released data.

• Lattice-based deferral: Chains in $L(R)$ and positive homology in individual links quantify the multiplicity of attribute-release sequences (iars) that delay identification, with lower bounds given by $(k+2)!$ for $k$-dimensional homological features.

6. Practical Implications and Boundary-Aware Mechanism Design

Privacy Boundary Theory yields rigorous design criteria:

• Boundary-aware system architecture: Split-computing models confine sensitive processing within device or home, passing only minimal abstractions externally. Third-party access is sandboxed at boundary crossings.
• Interface and visualization: UI metaphors, dashboards, and AR overlays that explicitly depict spatial and sharing-layer boundaries enable users to make informed, context-sensitive privacy decisions.
• Quantitative benchmarking: Any proposed privacy mechanism can be located with respect to the tight privacy boundary $\Gamma(D)$; if its $(D, E)$ pair falls above the boundary, it violates achievable information-theoretic limits.

The topological framework suggests that interventions to enhance boundary robustness—e.g., adding “disinforming” attributes or remapping equivalence classes—can reinforce structural privacy, and tuning code parameters in the information-theoretic framework traces a Pareto-efficient privacy–utility trajectory.

7. Unifying Perspectives and Future Research Directions

Privacy Boundary Theory establishes that optimal privacy management involves identifying and respecting mathematically sharp transitions—boundaries—between controllable and uncontrollable information flow. Whether formalized as rate–distortion–equivocation curves (Sankar et al., 2010), topological spheres and lattice chains (Erdmann, 2017), or empirically as nonlinear risk escalation (Zhang et al., 24 Jan 2026), the crux of PBT is understanding the invariance and fragility of privacy at those interfaces.

A plausible implication is that the extension of topological and information-theoretic tools—e.g., harmonic flows on privacy lattices—may yield new algorithmic strategies for dynamically reinforcing privacy boundaries in evolving contexts. Integrating empirical measurements of boundary turbulence and model distrust with structural and coding-theoretic analyses remains a fertile area for further research.