HOLogram deep dive: the Behavioral Privacy Budget - controlling exposure over time

This is part 2 of "Building HOLogram", a series on the open protocol for behavioral biometrics protection in the browser. Part 0 - introduction | Part 1 - Persona Mixer | Part 2 - Privacy Budget | Part 3 - Input Vault Obfuscating individual behavioral events is necessary. It's not sufficient. A sufficiently patient adversary doesn't need to identify you from a single interaction. They observe you over time - across many events, many sessions - and build a statistical picture that individual obfuscation can't defeat. This is the problem the Behavioral Privacy Budget was designed to address. The core idea The Privacy Budget tracks the cumulative behavioral exposure of a session. Every interaction has a cost. The more behaviorally distinctive an interaction is - the more information it leaks about the real user - the higher its cost. As the session progresses and the budget is consumed, the protocol automatically escalates its obfuscation strategy. When the budget is exhausted, the session is considered fully exposed - and the user is notified via the Exposure HUD. The cost formula The cost of each behavioral event is computed as: cost = w_type × f_freq × g_geom × h_entropy Where: w_type - event type weight Different event types carry different amounts of behavioral information. A typing burst is more identifying than a single scroll event. A precise pointer click is more identifying than a smooth pan. w_type assigns a base weight to each event category. f_freq - frequency factor A single mouse movement reveals little. Ten thousand mouse movements in a session reveal a lot, even if each individual event is obfuscated. f_freq scales the cost based on how many events of this type have occurred in the session - the more frequent, the higher the cost. g_geom - geometric complexity factor A straight pointer path is less identifying than a complex, curved trajectory. g_geom measures the geometric complexity of the event - curvature, directionality, acceleration - and scales the cost accordingly. h_entropy - entropy factor Events with high behavioral entropy - high variability, unpredictability - carry more identifying information than predictable, regular events. h_entropy measures the local entropy of the behavioral signal and scales the cost accordingly. Three escalation thresholds The Privacy Budget operates with three escalation levels: Level 1 - Standard protection Normal operation. The Persona Mixer and DP Engine apply their configured parameters. Cost accumulation is tracked. Level 2 - Enhanced obfuscation When the budget crosses the first threshold, the protocol automatically increases the aggressiveness of the Persona Mixer parameters and the noise magnitude of the DP Engine. The user sees a subtle indicator change in the Exposure HUD. Level 3 - Maximum protection When the budget crosses the second threshold, the protocol applies maximum obfuscation across all modules. The Exposure HUD displays a clear warning that the session has reached high exposure. Budget exhausted When the budget is fully consumed, the user is notified that the session has reached its exposure limit. The protocol continues operating at maximum protection, but the user is informed that further interaction may be identifiable despite obfuscation. Regeneration The budget regenerates over time - during idle periods and across sessions. The regeneration model ensures that: - Short bursts of high-intensity interaction don't permanently exhaust the budget - Sustained, continuous interaction over long sessions correctly accumulates exposure - The budget starts fresh at the beginning of each new session What we don't know yet The Privacy Budget formula is designed but the actual numeric values are not yet defined. Specifically: What are the correct values for w_type , f_freq , g_geom , h_entropy ? These need to be calibrated empirically - against real behavioral data and real classifier performance. Too conservative and the budget is consumed too quickly, degrading usability. Too permissive and the budget fails to catch cumulative exposure. What are the correct threshold values? The three escalation thresholds need to be set based on empirical evidence of what level of cumulative exposure allows successful re-identification. What is the correct regeneration rate? Too fast and the budget doesn't meaningfully track exposure. Too slow and normal browsing sessions hit the limit constantly. These are among the most important open design questions in HOLogram. How to contribute The most impactful contribution for this module is D-02: Design the Behavioral Privacy Budget consumption model - proposing concrete values for all parameters and thresholds, with sensitivity analysis. - 💻 GitHub - 💬 Discussions - 📄 Whitepaper v1.0 Next in the series: [Part 3 - Building HOLogram's Input Vault: browser API survey] Top comments (0)