Herd Privacy

Herd privacy is the idea that your privacy, in a lot of systems, isn't really about hiding, it's about blending in. If you're the only person a statement could possibly be about, that statement identifies you completely. If the same statement is equally true of ten thousand indistinguishable people, an observer who learns it has narrowed you down to one of ten thousand suspects, not one. You're private to the extent your "herd", the group of others you're indistinguishable from, is large. This is sometimes called an anonymity set: the set of people a given piece of information could plausibly refer to.

A simple, non-technical version: a getaway driver is much harder to identify wearing a common outfit in a crowd of a thousand people dressed the same way than wearing something unique in a crowd of ten. Nothing about the driver individually changed, only the size and uniformity of the crowd they're hiding in.

Where it comes from

David Chaum's 1981 paper on untraceable electronic mail introduced the cryptographic version of this: to hide who sent a message, batch it together with a bunch of other messages and shuffle them (a "mix"), so that an observer watching messages go in and out can't tell which outgoing message corresponds to which incoming one. The privacy guarantee is entirely a function of how many messages are in the batch, a mix of one message hides nothing.

Latanya Sweeney turned the same intuition into precise mathematics in 2002 with k-anonymity: a dataset is k-anonymous if every record is indistinguishable, on the attributes an attacker could use to narrow someone down, from at least k−1 other records. k is the herd size, made exact and measurable instead of just gestured at.

The specific phrase "herd privacy" doesn't trace to one documented coiner clearly enough for this Lexicon to credit a single person, it's informal shorthand that circulates broadly across privacy-preserving cryptocurrency design (mixing services, shielded transaction pools) and anonymous-credential engineering, all pointing at the same Chaum/Sweeney-rooted idea. Solidus didn't originate the concept under any name.

Why this matters beyond the definition

This is the reason "unlinkability" claims (see that entry) are incomplete without it. A credential format can be cryptographically flawless, genuinely unlinkable in the sense that no two presentations share any bit of identifying data, and still provide weak real-world privacy if almost nobody else uses an identical-looking credential. An unlinkable presentation from a credential type only three other people in the world hold is, in practice, not very anonymous: the herd is too small. Unlinkability is a property of the cryptography; herd privacy is what determines whether that property actually buys you anything in practice.

How this shows up in Solidus

Solidus's BBS+ credential header is deliberately built to be cohort-constant: every holder issued a credential in the same epoch gets an identical header, carrying nothing per-holder that would single them out from the rest of that epoch's cohort. That cohort, everyone issued under the same epoch key, is the herd a given holder's presentation blends into.

What's honestly missing: Solidus has not published how large a typical epoch cohort actually is. A cohort of ten thousand and a cohort of ten provide very different real-world privacy, even though both would look identical from the cryptography's point of view. This entry names that as an open, unverified question rather than assuming the herd is large just because the mechanism exists. Separately, the underlying BBS+ implementation is unaudited (an external audit is targeted for H2 2026 via NLnet NGI Zero) and everything here runs on Solidus's public testnet only.

Check it yourself

npm i @solidus-network/auth @solidus-network/bbs, then run the bundled demo/unlinkability-demo.mjs: it shows the cohort-constant header structure directly. There is no public number today to check the actual cohort size against.