← Language From First Principles

Private Discovery Between People

Test whether proxies can discover complementary knowledge or interests without exposing full identities and profiles.

Chapter 33’s proxy speaks to known counterparties. But valuable communication usually starts earlier — before either side knows the other exists. Today’s discovery buys that knowledge with disclosure: publish interests, profiles, needs, activity; the platform indexes everything and recommends. Discovery works because privacy already surrendered. This chapter inverts the transaction:

Discovery should reveal the existence of an authorised relationship before it reveals the private states from which that relationship was computed.

PRIVATE STATE A          PRIVATE STATE B
      ↓                         ↓
 authorised                 authorised
 discovery view             discovery view
      \                       /
       privacy-preserving match
                ↓
         MATCH / NO MATCH → mutual reveal policy → introduction

The private state never becomes the discovery index. Communication begins before either human knows whom they want to reach — while withholding the information that made the connection possible.

Authority first: the DiscoveryGrant

No general licence flows from the Personal AI’s knowledge. A dedicated authority object gates every discovery act — purpose, sought/offered relations, eligible counterparties, permitted match predicates, reveal-on-match versus reveal-on-nothing, mutual introduction policy, disclosure budget, expiry, revocation, provenance. The worked pattern (collaborator search with nothing revealed on non-match and dual-approved identity disclosure) keeps Chapters 31–33 doctrine intact: knowledge is not bait, and matching is not permission to reveal — match ≠ permission to reveal beside prediction ≠ authority. Predicate legitimacy gates before cryptography: purpose authorised, predicate authorised, subjects identified — only then private computation, output policy, mutual reveal. A flawless MPC of an illegitimate predicate (employment-exit seekers, say) stays illegitimate; introduction never implies persistent modelling, future reuse, reputation, or linkage rights. Relational subjects get their own fence: facts implicating several people may lack any single sufficient consenter — stated as boundary, with REQUIRE-POLICY/INCONCLUSIVE verdicts where no principal’s grant covers the use.

Contextual integrity (Nissenbaum: sender, recipient, subject, information type, transmission principle — cited as framework reference) bites precisely because the recipient starts unknown: the rule “reveal interest X only to someone satisfying Y after mutual matching” cannot evaluate its recipient until it privately tests them — the circularity this chapter’s machinery exists to resolve. And privacy here is not secrecy-maximalism: the collaborating researcher wants discovery. The goal is making the useful flow possible without unrelated flows necessary — what, to whom, for what purpose, under which transmission condition.

Three technical levels, fenced honestly

Exact private matching (shared identifiers, canonical tags, subscriptions) is PSI’s home ground — Yeo et al. (USENIX Security 2025, verified: third-party PSI with inputless receivers learning only intersections) and the contact-discovery/entity-alignment literature motivate it well. Canonicalised relationship matching (NEEDS/HAS_IMPLEMENTATION, REPLICATION, EVIDENCE tokens matched compatibly) is simpler but leaks through representation itself — a low-entropy LOOKING_FOR_JOB token is guessable however encoded, so cryptography never rescues a bad representation. Private predicate computation (f(private_A, private_B) → MATCH/NO MATCH via MPC-family machinery) is the architectural destination to test, not solved infrastructure — with the fuzzy-PSI literature (active similarity-matching area with deployment challenges, per user-supplied survey reference, full verification pending) reinforcing that private semantic matching is research, not an extension. The chapter law: private equality is not private semantic discovery. RELATE motivates typed relations, PSI/MPC motivate private computation; neither establishes the combined system — the Language hypothesis is that bounded relationship predicates over authorised views can match usefully, tested in EXP-34 rather than claimed.

The output leaks: protect inputs, predicate, and channel

Repeated probing (“matches job-seeking?”, “matches leaving employer?”, “salary > X?”) reconstructs private state from match bits alone — private computation is not private discovery. Controls: query authorisation, rate limits, predicate allow-lists, minimum pools, query budgets, mutuality, coarse outputs, probing bans, receipts — Chapter 27’s disclosure-budget instincts returned at protocol scale. PrivacyLens (Shao et al., NeurIPS 2024 Datasets & Benchmarks, verified via arXiv:2409.00138 — Q&A-vs-action gap, GPT-4 leaking in 25.68% and Llama-3-70B in 38.69% of agent cases despite privacy prompting) supplies the enforcement moral: proxies knowing privacy norms does not stop leakage; limits must sit at the computation and communication boundary, Chapter 27’s enforcement-at-flow doctrine restated for discovery.

Discovery then separates into four non-automatic stages — MATCH (“useful relationship appears to exist”) ≠ IDENTITY REVEAL ≠ INTRODUCTION (“would you like to speak?”) ≠ DISCLOSURE (“why you matched”) — with mutual dual-approval gating identity, SpeechGrants governing introductions, and least-sufficient-reason match explanations (“one seeks implementation evidence; one offers it”) with request-more/decline options. Progressive disclosure applies to people, not just information.

Testing utility against exposure

EXP-34 populates synthetic principals with private attributes, needs, and offerings, comparing A public profiles, B central broker with full uploads, C minimal tags with exact PSI, D authorised typed predicates, E private relationship computation with output controls, mutual introduction, and receipts — same underlying match potential throughout. Utility (useful/false/missed/cross-domain matches, time, computation) and privacy cost (raw/nonmatching-attribute/predicate/identity leakage, repeated-query derivability, unconsented introductions, post-match over-disclosure) score independently; headline: useful counterpart discovery recovered per unit of private information exposed. Each discovery task further declares purpose owner, predicate authority, implicated subjects, allowed output, and post-match reuse rule; adversarial cases add cryptographically-private-but-unauthorised predicates, authorised matches with unauthorised explanations, mutual introductions with unauthorised persistence claims, and single-consent relational subjects — the last two marked REQUIRE-POLICY/INCONCLUSIVE where no grant covers the use. The adversarial battery — dictionary probing, rare-interest identification, colluding counterparties, false predicates, repeated narrowing to individuals, semantic overreach (memory-systems work broadened into memory problems), post-match over-disclosure — exists to stop “we used MPC” becoming a victory lap. Pairwise scope holds throughout: ecosystem norms, reputation, spam, coalitions, and machine conventions belong to Chapter 35, and the chapter ends naming them.

Private discovery lets two proxies determine that a relationship may be worth revealing without either principal broadcasting the private state that created the match. But pairwise privacy says nothing about millions of proxies continuously searching, negotiating, filtering, introducing, and representing people at once.

References

  • Nissenbaum contextual integrity (sender/recipient/subject/type/principle): framework reference; full primary verification at Part IV pass.
  • Yeo et al. (USENIX Security 2025): third-party PSI with inputless receivers. Verified via USENIX listing. Licensed: exact-matching primitive.
  • Fuzzy-PSI survey literature (IEEE): user-supplied; full verification pending. Licensed: similarity-matching-is-research distinction only.
  • Shao et al. (2024). PrivacyLens. NeurIPS 2024 D&B; arXiv:2409.00138. Verified: Q&A/action gap, 25.68%/38.69% leakage despite prompting. Used: boundary-enforcement moral.
  • RELATE Ch-08 architecture; Ch-27 disclosure budgets; Wang PrivacyChecker (Ch-27 READ): reused as discovery machinery.

Proposed experiment EXP-34: discovery utility vs exposure cost

Status: PROPOSED. Per the design above (A–E, synthetic population, dual-family scoring, seven-case adversarial battery, mutual-introduction protocol, minimal explanations).