Privacy Implications of Cross-Origin Caching

[mmccool]

We would like to use this issue to document and discuss privacy risks of the proposal, in particular cross-origin node/graph caching, and discuss possible mitigations. Note that the presence or not of an item in the cache can allow 1 bit of information to be shared across origins.

Follow up to: https://www.w3.org/2024/04/04-webmachinelearning-minutes.html#t02 and comments by @inexorabletash

This may also be related to the previous discussion in WebML of storage APIs, and also to the data minimization privacy principle. On the other hand, we want to consider the tradeoff between this 1-bit privacy risk and the privacy advantages of running models locally.

Do people have any thoughts on reasonable ways to mitigate the 1-bit shared information problem?