Can an epidemic alert protect you without exposing your contacts? A private risk score may do both

One meeting can reveal what a contact-tracing app hides

A contact-tracing app can hide who met whom, yet still show something about a stranger. The number shown to each user is an estimate of infection risk, often labeled COVIDSCORE. It is meant to tell a person how likely they are to be infected now. That useful summary also creates a side channel for an attacker. An attacker can install the app and arrange one meeting with a target. If that is their only contact for the day, any change in their own score points strongly to the target. The score moves because the app has combined information from people met recently. With no other contacts to explain the shift, the attacker can infer whether the target carried risk or was infected. The leak comes from the released number itself, not from a broken contact list. This attack works even if standard safeguards for detecting contacts are in place. The same problem appears in many systems that publish numerical risk scores without privacy protection. A single meeting is enough to turn the user’s own dashboard into a sensor for someone else. The attacker does not need to see the target’s phone data or break secure pairing. They only watch their own score before and after the encounter. That makes a hard design choice visible to app builders. A score that helps people decide whether to test must also be hard to reverse engineer from one contact event. If it is easy to read a stranger’s risk from a single meeting, the app can expose health information while appearing private.

Why adding noise to every warning makes the app less useful

A contact app is useful when its warning follows the real danger. If every published risk score gets random noise, that link weakens. A user may see a high number after a quiet day, or a low number after a risky one. The warning still looks official, but it no longer points cleanly to exposure.

The cost shows up in outbreak control. In simulations with imperfect tests, adding privacy noise at a common level raised the peak infection rate from about 0.5 per 1,000 people to about 1.1 per 1,000. That is not a collapse, but it is a real loss of precision. The app still finds some high-risk users, yet it also sends more false alarms and misses more true risks. When testing capacity is limited, those mistakes matter because each wasted test leaves another person untested.

The deeper problem is where the noise enters. If each contact message is noised separately before the app combines them, every piece of evidence arrives blurred. A probability between 0 and 1 can be pushed up or down by chance, so the final score inherits a lot of jitter. People with many contacts have more signal to work with, but independent distortion still clouds the picture. The result is an app that protects privacy while making its own advice harder to trust.

A daily aggregate that hides individual contacts while keeping alerts useful

The calculation does not publish each meeting as its own separate warning signal. Instead, each person’s contacts for one day are folded into a single daily number. That number is the part that gets protected before any risk score appears. The protection multiplies the daily total by random noise, rather than blurring every contact message separately. This keeps the warning tied to overall exposure while making one contact hard to read out. The noise comes from a log-normal shape because it must stay positive and still support a clean privacy proof. People with many contacts need less extra noise for the same guarantee, while people with few contacts need more. Internal scores are clipped to the full range from zero to one, which keeps later calculations valid. After clipping, the noisy daily total is used to estimate infection risk for that day. Only the final score leaves the protected calculation, so individual contact details are not exposed as separate messages. The privacy guarantee says that changing one person’s clipped risk value can shift the noised daily total only a little. When all other contacts sit at their clipping limits and only one contact differs, the worst case occurs. Because protection is applied after combining, alerts remain sharper than they would be if every message were blurred. In simulations, this daily aggregate still produced lower peak infection rates at a common privacy level of epsilon equal to one. The result held across two widely used simulators, including runs with up to a million people. Compared with traditional tracing under realistic testing, the method cut infection rates by factors from two to ten.

What happens when tests are scarce, noisy, or ignored

When test capacity is small, the difference between tracing methods becomes sharp and hard to ignore. In a UK-style simulation, only ten percent of people were asked to test each day. A US-city version used an even tighter budget, with just two percent tested daily. Those limits matter because a positive result starts ten days of isolation. If too few people are checked, the app cannot find enough cases to break chains. The cost analysis showed that test capacity sets the ceiling for control. To keep peak infection below 0.3 percent, traditional tracing needed about ten thousand daily tests. The private method reached the same useful level with only about five hundred. That gap means a scarce testing system can still be steered toward lower peaks. Tests are not perfect, and the simulations included false positives and false negatives. The default case used a one percent false-positive rate and a 0.1 percent false-negative rate. A stress test pushed those errors to the worst-case values cited by European guidance. Those values were twenty-five percent false positives and three percent false negatives. With such bad tests, the private score became less robust than an unprotected version. Under default imperfect tests, peak infection rose from about 0.5 per 1,000 to about 1.1. Under the worst-case noisy tests, the noised method peaked near forty-six point six per 1,000. The unprotected version stayed near zero point six under those same bad conditions. More testing helped: raising daily checks from ten percent to fifteen percent largely restored performance. The main results assumed that people who tested positive would isolate for ten days. A follow-up experiment allowed users to ignore a positive result and keep mixing. Even when up to seventy-five percent of positives failed to follow up, the private method still outperformed traditional tracing. If at most twenty percent ignored a positive test, peak infection stayed below half a percent. That resilience matters because real tracing depends on people acting after an alert. A lower peak also eases hospital pressure and reduces the chance that governments impose lockdowns.

The assumptions that keep the private score from becoming a surveillance tool

A private risk number can stay private only if the parts that see it are limited. The calculation uses just contacts and test results, not location history, identity details, or health records. It runs inside an encrypted or trusted computing environment, so no central server collects a person’s score over time. Contact detection is assumed to be secure; the app already knows who met whom, but that knowledge is treated as given rather than mined for extra inferences.

The privacy promise is also narrow. It protects one released daily score against revealing one person’s status at one step. If a pair of people meet again and again, the small leaks can add up, and the design does not yet use stronger rules to cap that repeated loss. That limit matters because surveillance often comes from repetition: one glance may be harmless, while many glances build a map.

The system also forgets quickly. Data are kept for only 14 days, then deleted. The method is stateless in the sense that it does not store a long personal health record or contact history; once contacts fall outside the window, they no longer affect tomorrow’s score. Extending memory beyond two weeks gives little benefit, so the short window helps keep the tool from becoming a permanent dossier.

Yet these assumptions leave real gaps. Not everyone has a smartphone, and uneven access can create unequal protection. If only some people use the app, many contacts become invisible, weakening both tracing and privacy fairness. Existing biases in who is tested or how risks are estimated may be amplified by the noise added to protect individuals. Until those problems are studied, the private score remains a carefully bounded instrument rather than a finished public health tool.

How a noisy daily number can protect one meeting and still guide testing

A contact tracing app can protect one meeting at a time and still help public health. The privacy protection is built before the final risk score appears, so each day’s combined signal carries enough noise to hide whether any single known contact changed it. That design lets an app keep useful epidemic control while limiting what a determined stranger could learn from one encounter.

The broader lesson is that privacy and usefulness can be engineered together when the threat model is clear. A numerical score is powerful because it ranks who should test next, but it becomes dangerous once someone can watch how their own number moves after meeting a target. Adding calibrated noise to daily contact signals preserves enough signal for testing decisions while making such inference unreliable.

The simulations suggest this balance can reduce infections and use far fewer tests than ordinary tracing, even when some positive results are ignored or tests make mistakes. The obstacles remain serious. Full adoption is assumed in the main results, yet real populations include people without smartphones, people who distrust apps, and groups whose contacts fall outside the network. Repeated meetings with the same person can stretch the privacy guarantee beyond a single contact event, and biased data may be amplified rather than corrected by noise.

The practical question is how many people can join the network, because protection depends on contacts being visible. A score that works in one city or app ecosystem must also survive missing phones, uneven trust, and repeated encounters before it can guide real testing decisions.