Netadata

Netadata

Overview

Netadata (lowercase — it’s a category, not a brand) is the aggregate, deidentified shape of a system: its topology, its weight functions, its cluster structure, with the content and the identities stripped away. It keeps the trends. It throws away the why.

The term was coined in the Root Cellar and snapped into focus the morning we pointed graphify at a codebase and watched it render as a galaxy — a couple thousand nodes hanging in a void, pale filaments strung between them. The filaments weren’t decoration. They were the load-bearing connections: the handful of functions every other part of the system leaned on. An error helper and a security gate, doing the work of dark matter.

Here’s what turned the lights on: the clustering never read a single label. Community detection, betweenness, cohesion — all of it ran on the weight matrix alone. The galaxy was just the rendering our eyes could parse. The machine got the identical understanding from the numbers.

Which means the meaning of a system — what clusters with what, what bridges what, what’s central, what’s drifting — lives in its structure, not its contents. And structure can travel without the subject. Swap every label for an opaque hash, keep the edge-types and the weights, and look at what survives: every cluster, every bridge, every hub, every anomaly. What’s gone is what any of it is.

That residue is netadata.

The Fear It Answers

People are right to be uneasy about an AI that reads everything. And metadata is leaky — it has always given up more than people expect; you can reconstruct a life from who-called-whom-and-when without ever hearing a word of the calls. The reflexive fix is to lock the metadata away. But that throws out the signal along with the exposure.

Netadata inverts the move. Instead of shipping the whole sensitive corpus to a model so it can find the interesting parts, you ship only the structure, find the patterns there, and then decide — deliberately, with authorization — to read the actual content, but only at the spot the pattern flagged. The expensive, sensitive read becomes the last step, taken rarely and on purpose, instead of the first step, taken wholesale.

The model never has to ingest the sensitive layer to know where to look. That’s data minimization by construction: the blast radius shrinks to the handful of places a pattern actually pointed, and everything else stays unread.

Implications

Proof without exposure. You can show a system is behaving — that data-objects and people-groups cluster the way the policy says they should, that no access-bridge has formed between two groups that should never touch — without naming a single person or record. Proof of service without the PII blast radius. For an institution that has to demonstrate governance to an auditor without handing over the governed, that’s the whole game.

The bloodhound posture. A bloodhound has no concept of a fugitive. It knows this scent, that way, stronger here. Netadata detection has the same posture — a new bridge, a densifying cluster, a weight off its baseline — the dog points, it doesn’t editorialize. And that’s the safety property, not the limitation: the thing doing the finding cannot leak the why, because it was never handed one.

Where there’s smoke, there’s fire — both ways. The structural signal is enough to act on. You don’t need to see the flames to pull the alarm, and the alarm never has to know what’s burning. But the same inference runs in reverse: the smoke that tells your fire marshal that-a-way tells an arsonist that’s worth burning. Topology is a quasi-identifier — strip every label and a distinctive-enough graph can still re-identify itself (the deanonymizing-social-networks result). Across many subjects the shapes blur and you’re safe. A single small graph can point straight home.

So the work isn’t hiding the smoke — it’s calibrating it. Legible enough that the right nose says “fire, go look,” opaque enough that every other nose says “could be anything, anywhere.” The dial has known notches: an aggregation floor (never emit below k subjects), k-anonymity on the topology itself, a little noise on the weights. Get it right and the bloodhound works for you and nobody else.

Netadata with a clock. The weights over time are an entropy signal — cohesion drifting, bridges forming, coupling spiking. A deidentified pulse. Stable structure runs near-zero entropy and can be sampled slowly; a region in flux runs hot and earns a closer watch. That turns a static map into a heartbeat you can ship as ongoing proof-of-service. (See Decay as Design and Drift — the entropy that ages out as the change-window closes.)

Prior Art

This posture isn’t new to security. A SOC — or a vSOC — has run on it for years: NetFlow and flow analysis read who talked to whom, how much, when without touching packet payloads; UEBA baselines behavior and alerts on the anomaly, not the content; EDR draws the process-and-lateral-movement graph and flags the shape of an intrusion, then an analyst pulls the raw traffic only for the host that lit up. Pattern on metadata, escalate to content on demand. The bones are well worn.

What netadata adds is two things. First, it lifts the posture out of security — the same move works for knowledge graphs, data-governance lattices, research-data stewardship, a codebase, any structured corpus where you want trends without subjects. Second, it makes deidentification a first-class control rather than an afterthought: the calibration dial, the k-anonymity floor, the adversarial re-id gate. A SOC mostly trusts its own analysts with the fire; netadata is built for the case where you must prove the smoke to someone you don’t fully trust with the fire.

The name search, answered. The SOC world and the privacy-engineering world each own half of this. Mainstream security names the pieces but not the bundle — “pivot” is the verb, “alert triage” the front end, “selective decryption” the network-only instance; the deferred-escalation-to-content step is genuinely unnamed there. Privacy engineering, though, formalized the exact pattern decades ago: revocable privacy (Hoepman — “personal data is revealed only if a predefined rule has been violated”), with privacy-respecting intrusion detection as its applied form (monitor pseudonymized data; re-identify only past a suspicion threshold), and break-glass access as the operational name for the unlock itself.

So netadata isn’t an invention — it’s a unification. Revocable privacy owns the escalation discipline; UEBA and flow analysis own the structure-first detection; graph/provenance detection owns the topology surface. Nobody fused them under one operator-friendly name, and the closest existing term is buried in academic privacy literature most practitioners have never read. The claim is unification and accessibility, standing on revocable privacy as prior art — not novelty.

Two distinctions worth keeping sharp:

  • Not UEBA. UEBA stops at the alert, and at least one regulator (the Spanish DPA) frames it as violating data minimization — collect everything in case it’s useful later. Netadata’s posture is the opposite.
  • Not provenance-graph detection. That escalates to a reduced summary, deliberately keeping the analyst away from content. Netadata opens the payload, on purpose, only at the flagged spot. The inverse move.

Prior art, cited: revocable privacy · “Revocable Privacy: Principles, Use Cases, and Technologies” (Lueks, Everts, Hoepman) · PEEPLL — pseudonymized event logs, re-identify on incident · break-glass access (healthcare / IAM).

Open Questions

  • What’s the right default k for the aggregation floor — and does it differ for code graphs vs. governance graphs vs. behavioral graphs?
  • Can the calibration dial be adversarially tested — run a re-identification attack against our own netadata stream as a CI gate before it’s allowed to ship?
  • The ontology mapping is doing real work. Where’s the clean line between “edge-types + weights” (emit freely) and a schema that itself leaks semantics?
  • Does netadata compose? Merge two deidentified streams and does the union re-identify what neither half could alone?
  • How does this sit next to differential privacy — a structural cousin, or a different axis entirely?
  • Does the security world (SOC / UEBA / flow analysis) already have a name for the generalized, cross-domain pattern — or only domain-specific instances of it?

See Also