Combinations of non-sensitive behaviours can yield sensitive attributes; item-wise compliance is not whole-system compliance

What it is

Taken one by one, buying vitamins, searching for parking, opening a certain kind of video at 2 a.m. can each be labelled an ordinary interest. Together, a classifier can emit a health or sexuality tag. Compositional sensitive inference is a sensitive attribute growing out of the joint distribution of non-sensitive acts. Reviewing each act for compliance does not pass this gate.

Item-wise compliance is checklist thinking. Whole-system compliance asks what the traces show when they are assembled.

Why it happens

A classifier eats a vector, not a per-field policy. Every dimension can sit on the “non-sensitive” list and the decision surface can still separate a sensitive class. Feature engineering will also build crosses (co-occurrence, sequence, place) that gather scattered residue into a proxy. So “we have no health field” and “we are estimating health” can both be true.

If review stops at field names, the whole proxy pack is waved through. A gate that blocks sensitive-class inference by tag name but not by feature combinations that reconstruct the tag is an empty gate. This is composition, not naming.

Studying it

The method is a mosaic test: take behavioural features that are each allowed on their own, train a sensitive-attribute classifier, and measure the lift of the joint over any single feature. Independent variables: whether crosses are allowed, the alignment window, drop in performance after removing any one dimension. Dependent variables: identifiability of the sensitive class, permutation importance of proxy features.

If predictive power stays high after dropping any one dimension, redundant combinations are plentiful and deleting items one by one is not enough. Also measure the gap between “the user thinks these are scattered ordinary clicks” and “the system already has a sensitive score.”

Where it stops holding

In very short sessions with few features, a stable classifier cannot form; the risk lives in long-lived profiles. In systems that already ban plaintext sensitive fields, composition becomes more central — people switch to proxies. This entry does not redefine which classes are sensitive; it says the sensitive can grow from the joint. Displaying that result, or a third party seeing it on a shared screen, is the disclosure layer, not the composition layer.

Applying it

• Review for “can this reconstruct a sensitive class,” not only for field names. Run sensitive-attribute probes on candidate feature packs; reject or demote packs over a threshold.
• Ban automatic cross-features that span sensitive proxies for ranking or ads. Content co-occurrence (screwdriver and screw) can stay.
• Check: train a probe on a pack that contains no sensitive field names. If health, orientation, or politics remain separable, item-wise compliance has already failed. Change the pack, not the names.

Related

• Same group: L6.06.1 Behavioural inference can reach information the user never disclosed · L6.06.2 Displaying an inference is itself a disclosure · L6.06.3 Inferences in sensitive categories need extra constraints · L6.06.5 Inferences on shared devices and shared screens disclose to third parties · L6.06.6 Wrong inferences also harm, and the misclassified often have nowhere to appeal · L6.06.7 Tolerance for inference depends on the setting; the same inference is judged differently across products · L6.06.8 Opting out of inference and opting out of data collection are different controls
• Nearby: L6.08 Filter Bubbles and Diversity · L5.08 Counterfactual Explanations · L4.06 Permission Boundaries of Agents
• Search terms: compositional sensitive inference · mosaic inference · feature combination leakage