When randomness makes it worse

The amounts came from a ladder: a spread around the average, widest at one end and narrowest at the other, computed from exactly two inputs — the total and the number of legs. Nothing else went into it.

Which means two people splitting the same amount the same number of ways produced byte-identical legs, and anybody who had read the function could rebuild the entire ladder from a single observed amount. The first leg was always the largest, so even the order carried information. A shape that can be recomputed is not hiding anything; it is just a shape.

The fix is to add noise: jitter each rung of the ladder, then shuffle the result so position says nothing either. A dozen lines.

The linkability score on this site rates the shape of a split partly on its coefficient of variation — the spread of the leg sizes relative to their mean — and awards full marks for amount shape above 0.3. The un-jittered ladder cleared that comfortably at 0.3305 in its worst case.

With jitter, measured across twelve thousand draws:

Noise flattens a spread as readily as it sharpens one. Roughly one draw in some hundreds came out less varied than the deterministic version it replaced — so a change made entirely for privacy was, on those draws, spending it. Not catastrophically, and not visibly: every split still worked, still summed, still looked fine.

The quickest repair is to widen the ladder. A bigger spread absorbs the jitter and the floor stops being reachable. Two characters.

It was rejected because a wider ladder means a smaller smallest leg, and small legs stop being quotable. At around thirty dollars only a minority of providers will price a swap at all — so widening the spread to protect a score would have produced the most private shape available and made it the one that cannot run. There is a comment in that function from months earlier saying exactly this, left by the same problem in a different disguise.

What shipped instead: draw the jittered ladder, measure it, and if it falls below the floor, throw it away and draw again. The un-jittered ladder — known to clear the line — is the fallback if several attempts fail.

The property that buys is worth stating plainly: randomising can no longer leave a split worse than not randomising at all. That is not what a source of randomness gives you by default. Noise is symmetric; it does not know which direction you wanted.

Verified over sixteen thousand draws across leg counts from two to twenty-five: every split sums to its total exactly, no leg is zero or negative, the worst coefficient of variation is 0.3200, and no two draws of the same plan matched.

Adding entropy to a privacy mechanism feels self-evidently good, and it is the step where a measurement is least likely to be taken, precisely because the direction seems obvious.

It was only caught here because the figure it affects is already computed and published — the shape of a split is scored on screen, so the number was there to check against. Had that score not existed, the jitter would have shipped, looked fine, and quietly made a minority of transfers slightly easier to reassemble for as long as nobody thought to measure it.