Worksheet · Library privacy, for iSchools
Worksheet: Patron Shield
- Exhibit
- Patron Shield
- Time
- About 22 minutes of class time; Predict is pre-class reading and Explain is a spoken debrief
- Checked against
- Lab commit
93f3f7226fe7on 2026-09-22
Outcomes this worksheet serves
- Students will be able to identify, for a catalog search, which party learns the requested title and which learns who asked, under a plain search, two-server private retrieval (patron-shield), and a relay-plus-gateway split (blind-relay).
- Students will be able to predict what two cooperating operators can reconstruct by combining what each already holds, and explain why the patron cannot confirm from their own device that the operators are staying apart.
- Students will be able to distinguish what these designs conceal (which record was requested; the link between a patron's address and their request) from what they leave visible (that a query happened, when, how often, and its size or timing).
- Students will be able to evaluate a vendor's or institution's privacy claim by naming the assumption it rests on (operators not combining their records, a trusted holder of the raw data, a budget that is enforced) and the party who must be trusted for it to hold.
Predict
Answer these before you open the exhibit. There are no penalties for wrong predictions; the point is to compare them with what you see. No mathematics is needed for any of them.
- A patron searches an ordinary library catalog for one title. For each of these four facts, say whether the operator of that catalog ends up holding it: the title requested, who asked, when they asked, how often that patron asks.
- Now the same lookup is handled by two services run by two different organisations. Each service is sent a list of catalog positions, combines the records sitting at those positions into a single reply, and sends that reply back; the patron's own device puts the two replies together to get the book. Predict what one of those services, reading only the list it received, could say about which book the patron wanted.
- Predict what those two organisations could work out about that patron if they laid the two lists they received side by side. Which of the four facts in question 1 would they hold between them?
- Name one fact about a patron's catalog use that an arrangement like this cannot hide, and say why a librarian might still care about it.
Do
- Open the exhibit. Before choosing anything, scroll to Naive vs. Private Query. The Naive query view is the one showing. Record its request line, exactly as it reads now, in the first row of the first table.
- Scroll up to Library Catalog. Four of the eight books are shown, and Showing 4 of 8 — show all opens the rest. Click one of the four cards already showing — these steps use The Midnight Library — and read the line that appears under the catalog. Record the title and the index it names in the fourth table.
- Go back to Naive vs. Private Query and record the Naive query request line again. Then press PIR query and record the line that view shows, before any query has run.
- Scroll to Protocol Visualizer and read the note headed Teaching simulation at the top of that section. You will need it for Explain 5.
- Back in Library Catalog, press Query Privately. Four steps run in a few seconds. When the last one finishes, scroll back up to the panel headed Client generates query pair and look at the two grids of eight squares, one under Server 1 receives and one under Server 2 receives: each square stands for one catalog slot, and each server was sent its own grid.
- Scroll down to What each server knew and record, in the second and third tables: the slots listed under Server 1 saw: and the count beneath them, the same two values for Server 2 saw:, the title under Retrieved title:, and the line that appears under that title.
- Press Run again and record those same six values for a second run of the same book.
- Press Simulate the servers colluding, near the end of the privacy analysis. Record in the fourth table the position the page names, the book it names, and how that button reads once you have pressed it.
- Return to Naive vs. Private Query, press PIR query, and record that line as it reads now. Put it beside the Naive query line you recorded in step 3.
Record
Every value below comes from your own run.
| Moment | The request line, exactly as the page shows it |
|---|---|
| Naive query, before a book is chosen | blank for your answer |
| Naive query, after you chose your book | blank for your answer |
| PIR query, before any query has run | blank for your answer |
| PIR query, after your second run | blank for your answer |
| Run | Server 1 saw (slots) | Count under Server 1 | Server 2 saw (slots) | Count under Server 2 |
|---|---|---|---|---|
| First, after Query Privately | blank for your answer | blank for your answer | blank for your answer | blank for your answer |
| Second, after Run again | blank for your answer | blank for your answer | blank for your answer | blank for your answer |
| Run | Retrieved title | The line under the retrieved title |
|---|---|---|
| First | blank for your answer | blank for your answer |
| Second | blank for your answer | blank for your answer |
| What the page showed | Value |
|---|---|
| The book you chose, and the index in the line under the catalog | blank for your answer |
| The position named after the servers colluded | blank for your answer |
| The book named after the servers colluded | blank for your answer |
| How the collusion button reads after you pressed it | blank for your answer |
Explain
- Put two of your recorded request lines side by side: the Naive query line after you chose a book, and the PIR query line after your second run. For each, say what the operator receiving it could write in its log about the title requested, and what a librarian could honestly tell a patron about what that operator holds.
- Compare Server 1 saw: with Server 2 saw: in your first run, then compare your first run with your second. Did the same book produce the same lists twice? The note beneath the two grids calls each square a bit, and says that neither server "can determine which bit differs — or which book you want. Only a party holding both can see it." Using your own recorded lists, say what that sentence means for a log kept by one operator over a term of student searches.
- In your run, neither list on its own named your book, and the page named it exactly once the two were put together. Using what appeared after you pressed the collusion button, explain in your own words what "the servers must not collude" is asking of two organisations, and say which of your recorded values one operator would have had to obtain from the other to do this alone.
- Find the paragraph in the privacy analysis that begins "Scoped precisely". List the facts it says this design does not hide. For each one, name the party in a real library deployment who would be in a position to learn it, and say which of your Predict 1 answers it matches.
- The note headed Teaching simulation says what this page actually is, and what a real deployment would need instead. Using that note and the paragraph beginning "The two masks are not independent", name the assumption the page's privacy claim rests on and every party who has to be trusted for it to hold. Then say what, if anything, a patron at a catalog terminal could check for themselves.
Fix / Extend
- Fix. A vendor tells your library that its catalog search is private because "neither of our two servers can tell which book a patron looked up". Using the paragraph beginning "The two masks are not independent" and the note headed Teaching simulation, write two questions you would put to that vendor before the library repeats the claim to patrons. For each question, name the recorded value or the page sentence that prompted it.
- Fix. A library plans to run both servers itself, on one set of machines, under one administrator's account. The page says the threat model requires the servers to be operated by "independent, non-colluding parties". Say what that plan gives up, which of your recorded values demonstrates it, and how you would word the residual risk in a privacy impact assessment.
- Extend. Press Query a different book, choose a card for a different title, press Query Privately, then press Simulate the servers colluding again. Did the page name the new book? Compare the two Server 1 saw: lists from your two different books and say what an operator holding both lists, and nothing else, could conclude about the two requests.
- Extend. Scroll to How PIR scales — the √N trick and move the Catalog size slider to two of its positions, recording 1-D query (this demo) and √N matrix query at each. The note under those figures says they count "query bits only". Say what it tells you still has to travel back from each server, and why a library with a large catalog would want to know that before costing such a service.
Crypto Lab exhibits are teaching demonstrations, not production libraries. Do not use exhibit code to protect real data.