ChatGPT database queries: protect aggregates from differencing attacks
An aggregate can hide every row and still reveal one person's value.
Suppose an AI assistant returns payroll total for a six-person team. The user asks again with one employee excluded. Subtracting the two approved answers reveals that employee's salary.
Each query is read-only. Each result is an aggregate. Each cohort may even satisfy a minimum-size rule. The disclosure appears only across the sequence.
Authorize the inference, not only the SQL
A column allow-list and row-level policy evaluate one query at a time. Differencing attacks exploit relationships between answers. The control plane therefore needs the authenticated principal, tenant, purpose, dimensions, filters, cohort, recent query history, and disclosure budget.
The model should not decide whether two aggregates are “close enough” to be safe. A deterministic policy layer should compare the proposed result with prior releases before execution or disclosure.
Minimum cohort size is only the first gate
A minimum group size blocks direct one-person aggregates, but neighboring queries can still isolate individuals. Add controls for:
- minimum cohort size after every filter and grouping;
- maximum allowed dimensional granularity;
- overlap and symmetric-difference with recent cohorts;
- dominance, where one or two records determine most of the value;
- rare categories and sparse time windows;
- query frequency and cumulative disclosure budget;
- rounding, bucketing, suppression, or approved noise where appropriate.
Apply the same policy to exports, charts, follow-up questions, and cached answers.
Use approved aggregate operations
Do not expose arbitrary grouping and filtering for sensitive domains. Define reviewed operations with allowed dimensions, fixed metric semantics, minimum windows, cohort thresholds, and bounded drill-down paths.
An HR tool might permit department and month, but not employee, exact date, manager plus location, or arbitrary exclusion lists. A support tool might show incident counts by service, but suppress customer-level categories below a threshold.
For broader scope controls, see scoped database access for AI agents.
Bind policy to identity and history
Query-history controls must be authorization-aware. Track releases by principal, tenant, purpose, dataset and policy epoch. Do not let users reset the budget by opening a new chat, changing clients, clearing a cache, or asking through another equivalent tool.
At the same time, avoid storing raw sensitive results merely to detect overlap. Preserve canonical cohort identifiers, approved query digests, filter shapes, counts, disclosure decisions, expiries, and protected summaries.
Concrete example: compensation analysis
A manager asks for average compensation by role in one office. The approved operation requires at least ten people per released cell and suppresses rare roles.
The manager then adds a filter that excludes one named employee. Although the remaining cohort is still above ten, the new cohort differs from the previous one by a single person. The policy denies the release or returns a coarser bucket because subtraction would reveal an individual contribution.
The assistant explains that the requested slice is too identifying. It does not invent a privacy-safe approximation on its own.
Handle caches and follow-ups
A cached aggregate is still a disclosure. Cache keys need the principal or authorized cohort, tenant, purpose, policy version, metric version, filters, and source snapshot. Invalidate or reauthorize when membership or policy changes.
Conversation memory must not bypass the rule by combining an old answer with a new one. Treat every final release as part of the same disclosure history, even when the database was not queried again.
Related: authorization-aware caching for PostgreSQL MCP.
Test sequences, not isolated prompts
- Release a safe aggregate, then exclude one member.
- Shift a time window by one event or one day.
- Combine totals, averages, counts, and percentages over the same cohort.
- Repeat through another client, session, cache path, or equivalent tool.
- Create a large cohort dominated by one record.
- Change group membership between two queries.
- Verify denial evidence without logging raw sensitive values.
Keep the result honest
When a cell is suppressed, return a typed reason such as privacy threshold, excessive overlap, rare category, or disclosure budget exhausted. Do not return zero, because zero is a factual claim. Do not let the model infer the hidden value from adjacent cells.
Use the AI database answer completeness contract to distinguish suppressed data from missing or zero values.
Where Conexor fits
Conexor provides MCP infrastructure for connecting ChatGPT and other AI clients to databases through governed tools. Approved aggregate operations, structured scope, bounded results, and audit evidence create the foundation for privacy controls that live outside the prompt.