Cross-Silo De-Anonymization Under Local Differential Privacy: Threat Model, Phase Transition, and Coordination Necessity

The sharp phase transition finding is the part worth slowing down on: this isn't a gradual privacy erosion as k increases, it's a cliff. Below a threshold number of data sources, re-identification is practically infeasible; above it, it becomes nearly certain. That distinction changes how you set policy, because a 'safe enough' k today can become catastrophically unsafe with one new data-sharing agreement.

This paper lands alongside the federated learning taxonomy piece ('Beyond Weights and Gradients') published the same day, which documented how FL infrastructure is already fragmenting into domain-specific protocols with distinct privacy-utility trade-offs. That taxonomy work identified the architectural choices practitioners face; this paper now quantifies one of the failure modes those choices can trigger. Together they sketch a more complete picture of where federated deployments actually break. The synthetic data auditing paper ('Phantoms and Disclosures') is also adjacent, since both works push toward empirical identifiability as the operative privacy metric rather than theoretical composition bounds.

Watch whether healthcare or financial consortium deployments begin publishing explicit k-threshold analyses in their privacy impact assessments within the next 12 to 18 months. Adoption of that specific framing in regulatory filings would signal this formalism is crossing from academic to operational use.