An aggregate can hide every row and still reveal one person's value.
Imagine an AI assistant returns payroll total for a six-person team.
The user asks again with one employee excluded.
Subtract the two answers and you have that employee's salary.
Each query is read-only. Each answer is an aggregate. Each cohort may even pass a minimum-size rule. The disclosure exists only across the sequence.
That means aggregate privacy cannot be enforced one SQL statement at a time.
The policy layer needs to evaluate:
- minimum cohort size
- dimensional granularity
- overlap with recent cohorts
- dominance by one or two records
- rare categories
- query history across sessions and clients
- cumulative disclosure budget
Approved aggregate operations should limit dimensions and drill-down paths. Cached answers and conversation memory must participate in the same disclosure history.
And when a result is suppressed, return a typed privacy reason—not zero. Zero is a factual claim, and the model must not infer the hidden value from adjacent cells.
Test query sequences, not isolated prompts.
Full guide: Protect ChatGPT database aggregates from differencing attacks
Top comments (0)