{"id":"bdf28a44-44ab-4416-864f-632c0f5fa1da","arxiv_id":"2606.06354","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":5.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"User survey finds ~20% overshare official IDs to news sites in EUDI Wallet context; Credential Assistant cuts disclosure mistakes from ~15% to ~7%.","lead":"The paper surveys users and experts on sharing digital credentials in the upcoming EU EUDI Wallet and tests a Credential Assistant tool that shows recommendations to reduce oversharing. A smart generalist might read it to understand real privacy risks when official IDs move to phones and how simple interfaces can limit mistakes.","discovery_kind":"new_application","skeptic_critique":{"model":"grok-4.3","headline":"Survey self-reports of disclosure intentions lack validation against actual behavior in a deployed wallet setting","rationale":"The reader's weakest_assumption correctly isolates the single point that must hold for the quantitative claims to support the paper's conclusions about real-world privacy risks and mitigation effectiveness. All other elements (expert recommendations, UI design) are secondary to whether the measured quantities reflect deployment behavior.","tokens_in":1695,"tokens_out":275,"duration_ms":11515,"concrete_test":"Run a within-subjects lab or field study with a functional EUDI Wallet prototype: first collect the same survey responses, then log actual attribute disclosures to simulated relying parties; compute the correlation between stated and observed disclosure rates. If the correlation is below 0.4 or the error rate shift is not reproduced, the central claims do not transfer.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The headline quantitative results (~20% oversharing of official ID to news sites; reduction of mistakes from ~15% to ~7%) are derived entirely from stated intentions in a survey. The paper provides no direct measurement or correlation study showing that these intentions predict real credential disclosure decisions once the EUDI Wallet is in users' hands. This is the load-bearing assumption for both the risk assessment and the effectiveness claim of the Credential Assistant.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper reports results from a large-scale survey of users and experts on credential disclosure decisions for the forthcoming EU Digital Identity (EUDI) Wallet. It claims that users are prone to oversharing (e.g., ~20% would disclose official ID to news websites) and that the authors' Credential Assistant intervention, which shows expert recommendations and user opinions, reduces disclosure mistakes from ~15% to ~7%. The work concludes that stronger interventions may still be needed for sensitive attributes.","tokens_in":1781,"tokens_out":423,"duration_ms":21882,"significance":"If the survey-based findings hold, the paper provides timely empirical evidence of privacy risks in the EUDI Wallet rollout and demonstrates a feasible UI-based mitigation. The dual user/expert survey design and the before/after evaluation of the Credential Assistant are strengths that could inform both policy and wallet implementations across the EU.","major_comments":[{"comment":"Abstract and survey results section: The headline quantitative claims (~20% oversharing of official ID; reduction of mistakes from ~15% to ~7%) are derived solely from stated disclosure intentions. No validation, correlation study, or behavioral measurement is reported that links these intentions to actual credential disclosure decisions once users hold an EUDI Wallet. This assumption is load-bearing for both the risk assessment and the effectiveness claim of the Credential Assistant.","section":"Abstract and § on survey methodology"},{"comment":"Abstract: Concrete percentages are presented without sample size, recruitment method, statistical tests, confidence intervals, or error bars. This omission prevents assessment of the reliability and generalizability of the central empirical results.","section":"Abstract"}],"minor_comments":[{"comment":"Results section: The presentation of the Credential Assistant evaluation would be clearer if the exact survey items, response scales, and how 'mistakes' were coded were shown in a table or appendix.","section":"Results"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive feedback highlighting important aspects of our survey methodology and presentation. We address both major comments below and will revise the manuscript to improve clarity and transparency while preserving the core contribution of the pre-deployment study.","responses":[{"response":"We agree that the results reflect stated intentions rather than observed behavior in a deployed system. The EUDI Wallet is not yet available for real-world deployment studies, so behavioral validation is not feasible at this stage. We will add an explicit 'Limitations' section that discusses the intention-behavior gap, notes that the expert survey provides complementary grounding for the recommendations shown in the Credential Assistant, and frames the findings as indicative of potential privacy risks ahead of rollout. This revision will make the load-bearing assumption transparent without altering the reported survey results.","revision_made":"yes","referee_comment":"[Abstract and § on survey methodology] Abstract and survey results section: The headline quantitative claims (~20% oversharing of official ID; reduction of mistakes from ~15% to ~7%) are derived solely from stated disclosure intentions. No validation, correlation study, or behavioral measurement is reported that links these intentions to actual credential disclosure decisions once users hold an EUDI Wallet. This assumption is load-bearing for both the risk assessment and the effectiveness claim of the Credential Assistant."},{"response":"We accept that the abstract should convey basic reliability information. In the revised version we will add the overall sample sizes for the user and expert surveys, the recruitment approach (online panel), and a brief statement that differences were evaluated with appropriate statistical tests (full details, including any confidence intervals or effect sizes, remain in the methods and results sections). Abstract length limits preclude full error bars, but the added context will allow readers to assess generalizability.","revision_made":"yes","referee_comment":"[Abstract] Abstract: Concrete percentages are presented without sample size, recruitment method, statistical tests, confidence intervals, or error bars. This omission prevents assessment of the reliability and generalizability of the central empirical results."}],"tokens_in":1340,"tokens_out":444,"duration_ms":16782,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The paper's main point is that a survey of users and experts on the upcoming EU digital identity wallet shows substantial oversharing risk—around 20% would disclose official ID to news sites—and that their Credential Assistant tool reduces reported disclosure mistakes from 15% to 7%. It does not eliminate the problem entirely.\n\nThe work is new in its direct focus on EUDI Wallet attributes and in running a controlled test of the assistant interface with expert recommendations and user opinions. The topic is timely given the 2026 rollout timeline and the scale of the system. The empirical approach gives concrete percentages rather than just general warnings about privacy risks.\n\nThe soft spot is exactly what the stress-test note flags: the results come entirely from stated intentions in a survey, with no measurement of actual disclosure behavior once a real wallet is in use. That assumption carries the risk assessment and the effectiveness claim. The abstract also omits sample size, recruitment, and statistical details, so the full methods section will need close checking to judge how reliable the numbers are. If the participant pool is narrow or the questions are hypothetical, the practical implications shrink.\n\nThis paper is for researchers and developers working on usable security for digital identity systems, especially those following EU policy. A reader who needs data on oversharing rates for this specific wallet would find it useful. It is coherent and engages the literature honestly, so it deserves peer review even with the limitations on behavioral validation.","headline":"Survey finds users would overshare EUDI credentials and an assistant tool cuts stated mistakes in half, but all data is self-reported intentions with no real-world validation.","tokens_in":2268,"tokens_out":373,"would_cite":false,"duration_ms":12042,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Users of the EU digital identity wallet are likely to overshare official IDs with inappropriate websites.","keywords":["credential disclosure","digital identity wallet","privacy risks","user study","EUDI Wallet","oversharing","mitigation tool"],"falsifier":"A deployment study that logs actual attribute disclosures made by real EUDI Wallet users when visiting websites and compares those logs against the survey predictions.","tokens_in":2626,"feed_emoji":"🔒","tokens_out":601,"duration_ms":14469,"temperature":0.7,"pith_summary":"The paper surveys users and experts about how they would disclose digital credentials held in the upcoming EU digital identity wallet. It reports that roughly one in five users would share an official ID with news websites and similar sites. The authors introduce and test a Credential Assistant that shows expert recommendations along with other users' opinions. This tool cuts the rate of mistaken disclosures from about 15 percent to 7 percent. The findings indicate that disclosure errors will reduce wallet usability and create privacy and security problems unless better guidance is provided.","feed_headline":"Users likely to overshare IDs with news sites in EU wallet","feed_subtitle":"Survey finds 20 percent error rate; assistant halves mistakes but does not remove them","key_machinery":"The Credential Assistant, an interface that displays expert recommendations and user opinions to guide which identity attributes to disclose.","core_discovery":"The paper establishes that users are likely to overshare credentials from the EUDI Wallet, for example by disclosing official IDs to news websites at a rate of around 20 percent, and that this stems from difficulty judging appropriate disclosure. The Credential Assistant, which presents expert recommendations and aggregated user opinions, lowers the rate of such disclosure mistakes from around 15 percent to 7 percent, though it leaves a residual error rate that the authors say may require stronger interventions for sensitive attributes.","pith_inferences":["The same disclosure difficulties could appear in any digital credential system that lets users choose which attributes to release.","Wallet software could embed the assistant by default to lower error rates without requiring separate user action.","Long-term monitoring of live wallet traffic would be needed to check whether the survey numbers hold once the system launches."],"forward_implications":["Oversharing will reduce the usability of the EUDI Wallet.","Oversharing will produce privacy violations, identity theft, and other abuses of leaked credentials.","The Credential Assistant cuts disclosure mistakes from roughly 15 percent to 7 percent.","Stronger interventions may still be needed, especially when sensitive attributes are involved."],"fun_headline_variants":["20 percent of EUDI users share IDs with news sites","EUDI Credential Assistant halves disclosure mistakes","Users overshare EUDI Wallet credentials to news sites","Expert tool cuts EUDI errors from 15 to 7 percent"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"Survey participants' stated disclosure intentions accurately reflect the real-world behavior of future EUDI Wallet users across the EU population.","fun_headline_variants_meta":{"raw":{"variants":["20 percent of EUDI users share IDs with news sites","EUDI Credential Assistant halves disclosure mistakes","Users overshare EUDI Wallet credentials to news sites","Expert tool cuts EUDI errors from 15 to 7 percent"]},"model":"grok-4.3","cost_usd":0.004312,"raw_usage":{"total_tokens":2166,"prompt_tokens":667,"num_sources_used":0,"completion_tokens":66,"cost_in_usd_ticks":43124500,"prompt_tokens_details":{"text_tokens":667,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":1433,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":667,"tokens_out":66,"duration_ms":10014,"temperature":1.0,"reasoning_tokens":1433,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-28T00:25:31.945857+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"A deployment study that logs actual attribute disclosures made by real EUDI Wallet users when visiting websites and compares those logs against the survey predictions.","supporting_citations":[],"review_version":1}