Inferences in sensitive categories need extra constraints

What it is

Health, sexual orientation, religion, race, political opinion, biometrics — wrong or right, the stakes dwarf “jazz versus pop.” Constrained sensitive-attribute inference means the default for these attributes is not “estimate if we can,” but prohibition, a legal exception, or separate explicit consent and purpose limits. The ordinary interest-tag pipeline must not be copied across.

Sensitive is not “users care more.” The harm structure is different: discrimination, medical exposure, risk inside a household.

Why it happens

Loss on sensitive attributes is asymmetric. A correct estimate can be used to exclude or to target; a wrong one can send someone into the wrong medical, hiring, or content pool. If a recommender treats the tag as an ordinary feature, the gradient does not distinguish those losses — it sees short-term clicks. So the constraint cannot be something the model “learns”; it has to be a gate on features, purposes, and retention.

Legal lists of special categories (as in European data-protection special-category data) give a class boundary, not an interaction scheme. Interaction still has to decide: do not collect, collect but do not rank on it, rank but do not display, use for safety detection but not for marketing. Each is an extra constraint. Drop one and the pipeline falls back to ordinary interests.

Studying it

The method is: on a controlled, consented dataset, train an attribute classifier, report error on minority classes and calibration, and report differences in treatment once the feature is added to ranking (exposure, bid, content type). Independent variables: whether the feature is allowed, purpose (marketing / safety / none). Dependent variables: distribution of classification error, ranking treatment gaps, rejection once people are informed.

Do not report “we cannot estimate it well, so it is harmless” without a representative sample. Inaccuracy often hurts most in the tail. Results must be sliced by sensitive class; overall accuracy will hide that.

Where it stops holding

Safety detection (child protection, self-harm crisis) sometimes must use related signals; that is a separate purpose channel and must not feed ad ranking. For sensitive fields the user typed, the constraint shifts from “may we estimate” to “where may we use.” A public creator identity is not inference. Combining non-sensitive acts into a sensitive class is a composition problem that can fail even when each item is “not sensitive”; it is not developed inside this list definition.

Applying it

• Keep a sensitive-attribute inventory. Default: no estimation from behaviour, no write into ranking features. Enabling one requires its own project: purpose, retention, who can see it.
• Scan names in ad and ranking feature tables for health, religion, orientation, including synonyms and proxies (“baby and maternity” as a pregnancy proxy).
• Check: sample production feature stores and hand-label whether each is a sensitive class or a proxy. Unprojectised hits mean the ordinary interest pipeline was copied across.

Related

• Same group: L6.06.1 Behavioural inference can reach information the user never disclosed · L6.06.2 Displaying an inference is itself a disclosure · L6.06.4 Combinations of non-sensitive behaviours can yield sensitive attributes; item-wise compliance is not whole-system compliance · L6.06.5 Inferences on shared devices and shared screens disclose to third parties · L6.06.6 Wrong inferences also harm, and the misclassified often have nowhere to appeal · L6.06.7 Tolerance for inference depends on the setting; the same inference is judged differently across products · L6.06.8 Opting out of inference and opting out of data collection are different controls
• Nearby: L6.10 Turning Personalization Off and Resetting It · L5.05 The Moderation Principle of Transparency · L4.06 Permission Boundaries of Agents
• Search terms: constrained sensitive-attribute inference · special category data · sensitive attributes