When is an aggregate really anonymous? Differencing attacks on AI query layers

A developer has built Nowl, a self-hosted semantic access layer that enforces k-anonymity on aggregate queries over sensitive business data, arguing that query-shape rules can be bypassed by filters that shrink a population to a single person. The system adds a group-size condition to grouped query plans and counts the population before executing ungrouped queries, rejecting requests below a per-project k threshold (2 to 10,000) while logging every request including rejections. The tool is in pilot and has been tested only on synthetic data, not yet on a live customer dataset.

A sum is not anonymization. Whether a number over special-category personal data Art. 9 GDPR says something about one person does not depend on its shape but on the population behind it. If fewer than k people stand behind a number, the aggregate is a single-person disclosure in table form. An HR department analyses union membership. The minimum group size is 5. | | Query A | Query B | Difference | |---|---|---|---| | Question | How many in purchasing are organised? | Same question, hired before 2026 | | | Population | 24 employees | 23 employees | 1 person | | Result | 6 | 5 | 1 | Both queries pass the threshold on their own. Their difference says that the one person who joined purchasing in 2026 is a union member. The numbers are synthetic and come from no real system. First, a rule attached to the query shape "grouped queries need at least k rows" can be bypassed with a filter that shrinks the population to one person. A rule attached to the counted population cannot. Second, k-anonymity is a minimum condition, not a solution. Nowl is a self-hosted semantic access layer for existing business software. For grouped queries, the check adds a group-size condition to the query plan automatically. For ungrouped queries, the population is counted before execution and the main query is not run if the count is below k. The rejection reveals nothing about the data, not even a substitute like "fewer than 5". k is set per project 2 to 10,000, k=1 is not accepted , and every request including rejections is logged. Status: in pilot, tested on synthetic data, not yet proven on a live customer dataset. Before an AI returns aggregates over sensitive data: The full article in German, with sources Art. 9 GDPR, Recital 26, WP 216, Sweeney 2002 : k-Anonymität: wann ein Aggregat wirklich anonym ist https://gerling-solutions.de/nowl/k-anonymitaet-aggregate/