Attacks¶

Every garden has its pests, and in this one, the attackers are the real troublemakers. These are the techniques they’ll use to actually damage your crops, break down your defences, and make sure all your hard work is for nought. Forget “cute” garden gnomes; these are the ones you’ll want to lock out of your garden.

Data poisoning¶

This is the classic garden sabotage — mix a little poison into your compost and watch everything go bad. Adversaries use data poisoning to make your dataset toxic. They infiltrate by adding fake or misleading data to a supposedly secure pool, causing results to get warped and you to make dodgy decisions.

Imagine trying to grow tomatoes and someone sneaks in a bunch of rogue seeds. The plants look fine at first, but when you go to harvest, they’re full of pests. By then, it’s too late — your entire crop’s compromised.

Re-identification attacks¶

Here’s the one where your privacy gets exposed in the most unseemly way. Re-identification attacks involve taking your supposedly anonymous data and using those carefully curated features to figure out exactly who you are. It’s like saying, “Oh, I thought you were just a pile of leaves — but wait, you’re a daffodil, aren’t you?”

Using auxiliary information or seemingly unrelated data sources, attackers attempt to match your anonymised data to your identity. Once they’ve cracked the code, your lovely garden is no longer private — it’s been sold off to the highest bidder.

Data linkage¶

This one’s like a bad gossip chain. If they can link together your anonymous data from multiple sources, they can get a very detailed picture of who you are. They might start with a few snippets of information (like your postcode or your favourite gardening tools) and stitch them together, bit by bit, from different leaks or open data sets.

Before you know it, your data is scattered across multiple places, all connected by invisible threads. Link it all up, and suddenly your anonymity is as fragile as a spider’s web on a damp morning.

Inference attacks¶

Sometimes, attackers don’t need to know everything. They’re quite happy just making a good guess based on what they know. Inference attacks are when an adversary takes a small amount of data and infers something about you — like deciding that since you’re in a garden centre buying mulch, you must be preparing for a big replant.

They don’t need to know you by name — they just need to know enough about the surrounding patterns to infer the juicy details. It’s a bit like walking through a garden centre and hearing “Aha, we know you’re going to need rose food in six weeks!” And, surprise, they’re right.

Sybil attacks¶

Here’s a classic trick: the attacker’s not trying to get to know you at all — they just want to create fake versions of you. Enter the Sybil attack, where fake identities (or “Sybil nodes”) are planted in your social garden, muddying up the connections. These fake accounts grow like weeds, pretending to be you or someone else, and when the attack’s done, your carefully pruned connections are full of unwanted doppelgängers.

It’s like buying an apple tree and finding out you got a whole bunch of them, all pretending to be one. Now you’ve got an infestation, and there’s no way to pick the real apples from the fake ones.

Collusion attacks¶

Sometimes, even pests need to collaborate. Collusion attacks happen when adversaries work together to crack your anonymisation. Think of it like a team of mischievous gnomes secretly plotting in your garden shed, pooling their knowledge and resources to bypass your security measures.

These attacks often succeed because the attackers can share information, combine data from multiple sources, and then go in for the kill. Suddenly, your once-secure garden is open to any pest with a free pass.

Legal and regulatory attacks¶

Not all attacks come with a shady figure wearing a hoodie. Some attacks are legal, and they happen in broad daylight. When regulations change or someone figures out how to work the law in their favour, they can gain access to your data under the guise of “compliance” or “legitimate interest.”

It’s like being told you can plant your crops, but someone else gets the harvest rights. In this case, the law — rather than any sneaky hacker — is pulling the weeds out of your garden, leaving you with nothing.

Data exfiltration¶

Now we get into the really nefarious stuff. Data exfiltration is the classic “sneak out the back door” move. In a garden, it’s like having a thief quietly take your prize-winning tomatoes, one by one, so you don’t notice until it’s too late.

Exfiltration is where attackers extract data from your securely anonymised set, usually under the radar, and move it somewhere else. The goal is simple: they’ve got your data, and you’re none the wiser until it’s been sold to some shady buyer on the black market.