A Regularized Inverse-Problem Framework for Assessing Indirect Leakage Risk in Privacy-Preserving Data Enclaves

We study indirect leakage in data enclaves that expose only perturbed aggregates rather than raw microdata. We cast the attacker’s task—predicting a scalar sensitive attribute t from aggregate outputs and public covariates—as a regularized inverse problem. Our procedure couples three elements: (1) variance estimation from replicate queries to calibrate a Morozov-style discrepancy target; (2) RKHS regression via Tikhonov regularization or early stopped Landweber; and (3) a detectability decision based on cross-validated R2CV with a permutation test. Because enclaves perturb inputs, not labels, we formalize a Lipschitz bridge that turns input noise into an effective label-noise magnitude, yielding a stability-bias trade-off and a detectability floor; under a restricted-eigenvalue condition we also obtain a safety-oriented upper bound. We summarize risk by the leakage threshold N*, the smallest query budget for which R2CV exceeds a target and the permutation test is significant. A minimal analytical case study shows that N* increases monotonically with noise and that ablation identifies high-leakage channels. The framework requires only enclave outputs and public covariates, aligns regularization with system perturbations, and translates statistical evidence into concrete controls on query budgets, noise levels, adaptivity, and channel policies.