Adaptive Privacy-Preserving SSD

Dong Hoon Lee; Na Young Ahn

REVIEW 3 major objections 4 minor 15 references

Adaptive Privacy-Preserving SSD

T0 review · 3 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A four-level adaptive deletion ladder can make SSD privacy protection a tunable cost, not a fixed feature.

desk verdict A sensible taxonomy and privacy-level framing undermined by hand-assigned scores and no experiments. read the letter →

arxiv 2506.02030 v1 pith:FJTHKHI7 submitted 2025-05-30 cs.CR

Na Young Ahn , Dong Hoon Lee This is my paper

classification cs.CR

keywords securedeletionNANDflashsolidstatedriveprivacylevelsdataremanenceIoTstorageECCmodulationadaptive

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that complete deletion on NAND-flash SSDs cannot be a one-size-fits-all operation, because block erase is slow and wears the drive, while weaker methods leave recoverable remnants. It proposes an adaptive SSD architecture with four privacy levels—block erase, page scrubbing, parity/ECC destruction, and controller-level block map-out—and claims this graduated menu balances deletion efficacy, latency, endurance, verification, and cost. The paper also sketches how machine learning could pick the right level automatically, though the quantitative case rests on the architectural and method comparison rather than on an implemented ML controller. A sympathetic reader takes away that privacy-preserving storage in resource-constrained IoT devices is a tunable cost problem rather than a single built-in security feature.

What carries the argument

The load-bearing mechanism is the privacy-level ladder PL0–PL3 mapped to specific deletion techniques, together with the parity-management trick of making a page unreadable by corrupting its ECC parity or locking it with a flag-cell bit in the spare area. These parity techniques let an SSD invalidate a single page on-chip without an immediate block erase, which is what makes low-latency, low-wear deletion possible while still blocking normal readout. The second mechanism is the three-way classification of deletion methods—address management, data management, and parity management—which gives the paper a uniform set of performance axes for comparing methods that operate at very different layers of the storage stack.

What would settle it

On a test SSD with 3D NAND flash, repeatedly delete the same set of pages using scrubbing (PL1) and ECC modulation (PL2), measuring endurance loss and delete latency. If PL2 does not show clearly lower wear and latency than PL1, or if the ECC-poisoned pages' data can be recovered with commodity NAND readers without a full block erase, then the Table 2 ordering that carries the framework collapses.

Watch

Extended reading notes

Core claim

The paper's central claim is an escalation ladder for secure deletion: PL0 uses a full block erase; PL1 destroys target data at page level through scrubbing, overwriting, deletion pulses, or down-level programming; PL2 renders a page unreadable by corrupting its ECC parity or setting a flag cell in the spare area; and PL3 permanently invalidates the physical region through bad-block map-out, paying usable capacity instead of deletion latency. The authors classify all existing deletion methods into address management, data management, and parity management, then score eight techniques on six axes—efficacy, speed, durability, overhead, verifiability, and cost—in Table 2. Their conclusion is that no single technique dominates on all axes, so an adaptive policy that matches deletion strength to data sensitivity and context can outperform uniform deletion policies. The claim is presented as a design guideline for IoT storage rather than as a measured benchmark.

Load-bearing premise

The load-bearing premise is that the 1-to-5 scores in Table 2—for efficacy, speed, durability, overhead, verifiability, and cost of eight deletion techniques—are meaningful and correct; the paper presents them without measurements, sources, or methodology, and every privacy-versus-performance conclusion in the paper derives from that matrix.

Editorial extensions

If this is right

An SSD exposing PL0–PL3 could serve both privacy-critical and performance-critical workloads on the same device, running routine deletions at PL1 or PL2 and reserving block erase and block map-out for high-sensitivity data.
The three-way classification gives designers a selection rule: choose address management when cost dominates, page-level destruction when endurance can be sacrificed, and parity management when low latency, low wear, and verifiability are wanted.
Because PL2 leaves the raw charge in the cells, the paper's own scheme implies that parity-based deletion should be paired with encryption or with eventual full block erase to resist chip-off forensics.
If the Table 2 ordering holds, adaptive level selection should outperform any fixed deletion policy on total cost, since no single method wins on all six axes.
Flag-cell and ECC-modulation methods give verifiable deletion instantly: a failed read or a flipped flag bit serves as immediate confirmation that the page is inaccessible through normal means.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The same privacy-level ladder could transfer to managed-flash devices such as eMMC and UFS, which share block-erase granularity and spare-area metadata; the paper's cost axes would need re-scoring for those controllers, but the PL0–PL3 structure likely carries over.
A concrete testable extension is to implement PL1 and PL2 in an FPGA-based flash controller emulator and measure read-fail rate, wear, and latency over tens of thousands of delete cycles; that experiment would turn Table 2's assigned scores into measured curves.
The ML-based level selection could likely be driven by file metadata alone—type, size, and access recency—without environmental sensors, which would make the adaptive controller simpler to deploy on existing IoT hardware than the paper's sensor-oriented sketch suggests.
The verifiability scores hint at a compliance use the paper does not develop: PL2's instant read-fail confirmation could serve as machine-checkable proof of deletion for regulatory or audit purposes, a property slower block erase does not offer.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

This is a position paper dressed as a research result. The adaptive privacy-level framing (PL0–PL3) is a clean way to organize secure-deletion techniques for NAND flash, and the three-way taxonomy (address, data, parity) is sensible. The authors clearly know the literature, including their own prior work on ECC modulation and deletion pulses. That part is worth something.

But there is no implementation, no measurement, no simulation. The quantitative centerpiece, Table 2, is a set of hand-assigned 1–5 scores with no methodology, no source, and no sensitivity analysis. Worse, several scores contradict the paper's own text. ECC modulation and flag locking receive Efficacy=5, yet Section 4.2 admits raw bytes remain physically recoverable and the methods are "anti-forensic rather than cryptographically final." If a determined attacker with chip-off access can still extract the data, an efficacy score of 5 is indefensible. The claimed privacy advantage of PL2 collapses.

The ML-based automatic level selection is described only in general terms; the abstract's claim of "negligible performance overhead and complexity" is unsupported by any experiment or derivation. Section 6 concedes that empirical validation is future work, so the paper's "quantitative analysis" is really an opinionated sketch.

What's genuinely useful is the framing: privacy level as a tunable cost metric, and the comparison of deletion targets. That could inform a more rigorous empirical study. But as submitted, the paper does not establish its central claims. I agree with the reader's REJECT. It is not a desk-reject because the topic is relevant and the taxonomy has merit, but it would need major revision and real measurements to be acceptable.

If you have a workshop that accepts vision papers, this might be worth a look as a position statement. Otherwise, I'd advise against spending referee time on it in its current form.

Referee Report

3 major / 4 minor

Summary. The paper proposes an adaptive SSD architecture with four privacy levels (PL0–PL3) that select among address, data, and parity deletion techniques for NAND flash storage in IoT devices. It claims a quantitative analysis balancing efficacy, latency, endurance, and cost, and an ML-based automatic adjustment of privacy levels with negligible performance overhead. The manuscript presents a taxonomy of secure deletion techniques, a four-level architecture, and a performance comparison in Table 2 with hand-assigned scores. No implementation, measurements, formal derivations, or empirical validation are provided; Section 6 explicitly defers validation to future work.

Significance. If the claims were substantiated, the framework would provide a useful design guideline and taxonomy for privacy-preserving NAND flash storage, organizing techniques into address, data, and parity management and articulating a graduated privacy-level model. The paper's strength lies in its systematic classification and its explicit statement of open problems. However, the central quantitative claim is unsupported: the evidentiary basis is an unverified score matrix, and the ML adaptation claim lacks any algorithmic or experimental grounding. As a conceptual position paper it could stimulate discussion, but in its current form it does not meet the evidentiary bar for a research contribution.

major comments (3)

[§5, Table 2] The quantitative foundation of the paper is unsupported. The 1–5 scores in Table 2 for efficacy, speed, durability, overhead, verifiability, and cost are presented without any methodology, measurements, or citations. The text states that scores were assigned and rated as High, Medium, or Low, but the table uses numeric values with no defined scale orientation (e.g., for 'Overhead' and 'Cost', it is not stated whether 1 or 5 is better). All subsequent trade-off conclusions, including the claimed advantage of parity-management techniques (PL2) and the rationale for ML-based adaptation, derive from this matrix. Section 6 admits that 'Empirical validation of various deletion mechanisms remains a priority for future work,' confirming that the scores are not evidence-based. Without a principled or empirical basis for these numbers, the paper's quantitative balancing claim collapses.
[§4.2 vs. Table 2] The paper's own descriptions of ECC modulation and flag locking directly contradict their Table 2 scores. For ECC modulation, Section 4.2 states that 'A determined attacker with direct flash access could still extract the underlying bytes, so the method is anti-forensic rather than cryptographically final,' yet Table 2 assigns Efficacy=5. For flag locking, the text says 'the raw bytes still exist' and 'highly sensitive data still needs stronger sanitization,' yet Table 2 assigns Efficacy=5 and Verification=5, and the text also says flag cells require dedicated hardware and redundant SLC copies, which conflicts with a low-cost/low-overhead rating. These contradictions undermine the claimed PL2 privacy advantage and show that the score matrix is not merely unverified but internally inconsistent with the described security properties.
[Abstract and §4.1, §6] The abstract claims that machine learning adjusts privacy levels contextually, 'boosting privacy with negligible performance overhead and complexity.' This claim is not supported by any algorithm description, training methodology, dataset, implementation, or experiment. Section 4.1 describes the AI-based adaptation only in general terms, and Section 6 states that a prototype and empirical measurements remain future work. The 'negligible performance overhead and complexity' assertion is therefore a conjecture presented as a result, and it is load-bearing for the paper's overarching contribution of an adaptive, ML-driven privacy architecture.

minor comments (4)

[§2.2] The heading 'Trad-off between block erase cost and privacy exposure' contains a typo; it should be 'Trade-off'.
[§4.1] The text describing the flowchart says 'P Data Destruction'; this should be clarified as 'Page Data Destruction' or a similar term for consistency with the Level 2 description.
[§5, Table 2] The scale semantics for the numeric scores are undefined; the text mentions ratings of High, Medium, or Low, but the table uses numbers without a mapping, and the direction for 'Overhead' and 'Cost' is ambiguous.
[Introduction] The phrase 'file-aqbd1yjbourpdqkdsbs3vm' appears in the introduction and appears to be an artifact of document preparation; it should be removed.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: the paper's trade-off conclusions are author-assigned rubric scores, not outputs derived from fitted inputs or self-citation chains.

full rationale

The paper does not derive quantitative predictions from equations or fitted parameters. Its central claim is an architectural proposal: four privacy levels are defined and mapped to existing deletion techniques, and Table 2 assigns 1-5 performance scores to those techniques. The later conclusion that parity-management methods balance security and performance is a restatement of those assigned scores, but the scores are inputs to the comparison, not empirical predictions. Section 5 states that 'scores were assigned for efficiency, processing speed, durability, overhead, verifiability, and operational cost,' and Section 6 explicitly defers validation: 'Empirical validation of various deletion mechanisms remains a priority for future work.' That makes the quantitative support weak, but it is an evidence-quality problem, not a circular reduction. The self-citations to prior work by the same authors ([2], [9], [12], [13]) supply the underlying sanitization techniques, but no load-bearing argument reduces to an unverified self-citation chain or a uniqueness theorem. Overall, no significant circularity is present.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

The paper's central claims rest on a hand-assigned comparison table and on prior secure-deletion work, not on new measured quantities or postulated entities.

free parameters (1)

Table 2 performance score matrix = 1-5 ratings for 8 techniques across 6 metrics
The quantitative comparison and all PL0-PL3 trade-off conclusions are derived from these hand-assigned scores; no measurement, error analysis, or cited source is provided (Section 5, Table 2).

assumptions (4)

domain assumption NAND flash data remanence cannot be fully eliminated without block-level erase or equivalent physical invalidation.
Stated in Section 2.2 and Section 2.3 as the reason why address unmap alone is insufficient.
ad hoc to paper The 1-5 performance scores in Table 2 accurately reflect real-world efficacy, speed, durability, overhead, verifiability, and cost of each deletion technique.
The scores are introduced for this paper's comparison and are not justified by experiments or references.
ad hoc to paper A machine-learning controller can evaluate data sensitivity and context in real time with negligible performance overhead and complexity.
Asserted in the abstract and Section 4.1, with no algorithm, training data, or measurements.
domain assumption ECC modulation and flag-cell deletion work as described on real 3D NAND hardware.
The paper adopts these from prior publications [9, 15] and does not replicate or evaluate them.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Adaptive Privacy-Preserving SSD." pith.science (2026). https://pith.science/paper/FJTHKHI7

@misc{pith2026250602030,
  author       = {Pith},
  title        = {Pith review of: Adaptive Privacy-Preserving SSD},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FJTHKHI7}},
  note         = {Machine review of arXiv:2506.02030}
}

read the original abstract

Data remanence in NAND flash complicates complete deletion on IoT SSDs. We design an adaptive architecture offering four privacy levels (PL0-PL3) that select among address, data, and parity deletion techniques. Quantitative analysis balances efficacy, latency, endurance, and cost. Machine-learning adjusts levels contextually, boosting privacy with negligible performance overhead and complexity.

Figures

Figures reproduced from arXiv: 2506.02030 by the authors.

**Figure 2.** This conceptually illustrates the operation of the proposed storage device supporting Adaptive Privacy Levels. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** This presents a diagram distinguishing the various deletion techniques employed in storage devices. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗

**Figure 4.** This conceptually illustrates the Parity Management techniques: (a) ECC Modulation method and (b) Flag Cell Read me [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

15 extracted references · 11 canonical work pages

[1]

Investigation of the Internet of Things (IoT) Security and Privacy Issues ,

K. K. S. Gautam, R. Kumar, R. Yadav and P. Sharma, "Investigation of the Internet of Things (IoT) Security and Privacy Issues ," 2023 5th International Conference on Inventive Research in Computing Applications (ICIRCA), Coimbatore, India, 2023, pp. 1489 -1494, doi: 10.1109/ICIRCA57980.2023.10220814

work page arXiv 2023
[2]

Forensics and Anti-Forensics of a NAND Flash Memory: From a Copy-Back Program Perspective,

N. Y. Ahn and D. H. Lee, "Forensics and Anti-Forensics of a NAND Flash Memory: From a Copy-Back Program Perspective," in IEEE Access, vol. 9, pp. 14130- 14137, 2021, doi: 10.1109/ACCESS.2021.3052353

arXiv 2021
[3]

A Post -Mortem Forensic Approach for the Kik Messenger on Android,

A. M. Al-Rawashdeh, Z. A. Al -Sharif, M. I. Al -Saleh and A. S. Shatnawi, "A Post -Mortem Forensic Approach for the Kik Messenger on Android," 2020 11th International Conference on Information and Communication Systems (ICICS), Irbid, Jordan, 2020, pp. 079 -084, doi: 10.1109/ICICS49469.2020.239559

arXiv 2020
[4]

Experimental Evaluation of e.MMC Data Recovery,

A. Fukami, S. Sheremetov, F. Regazzoni, Z. Geradts and C. De Laat, "Experimental Evaluation of e.MMC Data Recovery," in IEEE Transactions on Information Forensics and Security, vol. 17, pp. 2074-2083, 2022, doi: 10.1109/TIFS.2022.3176187

arXiv 2022
[5]

Secondhand Smart IoT Devices Data Recovery and Digital Investigation,

T. Ojo, H. Chi, J. Elliston and K. Roy, "Secondhand Smart IoT Devices Data Recovery and Digital Investigation," SoutheastCon 2022, Mobile, AL, USA, 2022, pp. 640-648, doi: 10.1109/SoutheastCon48659.2022.9763996

work page arXiv 2022
[6]

Data Privacy Threat Modelling for Autonomous Systems: A Survey From the GDP R's Perspective,

N. Azam, L. Michala, S. Ansari and N. B. Truong, "Data Privacy Threat Modelling for Autonomous Systems: A Survey From the GDP R's Perspective," in IEEE Transactions on Big Data, vol. 9, no. 2, pp. 388-414, 1 April 2023, doi: 10.1109/TBDATA.2022.3227336

work page arXiv 2023
[7]

3D NAND Scaling in the next decade,

R. Meyer, Y. Fukuzumi and Y. Dong, "3D NAND Scaling in the next decade," 2022 International Electron Devices Meeting (IEDM), San Francisco, CA, USA, 2022, pp. 26.1.1-26.1.4, doi: 10.1109/IEDM45625.2022.10019570

arXiv 2022
[8]

Accelerating Sub -Block Erase in 3D NAND Flash Memory,

H. Gong, Z. Shen and J. Shu, "Accelerating Sub -Block Erase in 3D NAND Flash Memory," 2021 IEEE 39th International Conference on Computer Design (ICCD), Storrs, CT, USA, 2021, pp. 228-235, doi: 10.1109/ICCD53106.2021.00045

work page arXiv 2021

Show all 15 references

[9]

IoT security: On -chip secure deletion scheme using ECC modulation in IoT appliances

N.Y. Ahn and D.H. Lee, “IoT security: On -chip secure deletion scheme using ECC modulation in IoT appliances”, Computers & Security, Vol. 133, 2023, 103422, doi:10.1016/j.cose.2023.103422

2023
[10]

What’s on the Horizon? An In -Depth Forensic Analysis of Android and iOS Applications,

F. E. Salamh, M. M. Mirza, S. Hutchinson, Y. H. Yoon and U. Karabiyik, "What’s on the Horizon? An In -Depth Forensic Analysis of Android and iOS Applications," in IEEE Access, vol. 9, pp. 99421-99454, 2021, doi: 10.1109/ACCESS.2021.3095562

2021
[11]

Experimental Analysis of Data Storage and Integrity Management over Cloud Environment using Integrated Data Security Strategy,

L. M. Leo, S. Yogalakshmi, A. Veeramuthu, V. Kalist and A. A. Frank Joe, "Experimental Analysis of Data Storage and Integrity Management over Cloud Environment using Integrated Data Security Strategy," 2022 International Conference on Electronics and Rene wable Systems (ICEARS...

2022
[12]

Forensic Issues and Techniques to Improve Security in SSD With Flex Capacity Feature,

N. Y. Ahn and D. H. Lee, "Forensic Issues and Techniques to Improve Security in SSD With Flex Capacity Feature," in IEEE Access, vol. 9, pp. 167067-167075, 2021, doi: 10.1109/ACCESS.2021.3136483

2021
[13]

Schemes for Privacy Data Destruction in a NAND Flash Memory,

N. -Y. Ahn and D. H. Lee, "Schemes for Privacy Data Destruction in a NAND Flash Memory," in IEEE Access, vol. 7, pp. 181305 -181313, 2019, doi: 10.1109/ACCESS.2019.2958628

2019
[14]

Per-File Secure Deletion for Flash-Based Solid State Drives,

T. Xiao, W. Tong, X. Lei, J. Liu and B. Liu, "Per-File Secure Deletion for Flash-Based Solid State Drives," 2019 IEEE International Conference on Networking, Architecture and Storage (NAS), EnShi, China, 2019, pp. 1 -8, doi: 10.1109/NAS.2019.8834725

2019
[15]

Evanesco: Architectural support for efficient data sanitiz ation in modern flash-based storage systems

M. Kim, J. Park, G. Cho, Y. Kim, L. Orosa, O. Mutlu, and J. Kim., "Evanesco: Architectural support for efficient data sanitiz ation in modern flash-based storage systems", Proc. Int. Conf. Archit. Support Program. Lang. Oper. Syst. (ASPLOS), pp. 1311 -1326, 2020

2020

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

Investigation of the Internet of Things (IoT) Security and Privacy Issues ,

K. K. S. Gautam, R. Kumar, R. Yadav and P. Sharma, "Investigation of the Internet of Things (IoT) Security and Privacy Issues ," 2023 5th International Conference on Inventive Research in Computing Applications (ICIRCA), Coimbatore, India, 2023, pp. 1489 -1494, doi: 10.1109/ICIRCA57980.2023.10220814

work page arXiv 2023

[2] [2]

Forensics and Anti-Forensics of a NAND Flash Memory: From a Copy-Back Program Perspective,

N. Y. Ahn and D. H. Lee, "Forensics and Anti-Forensics of a NAND Flash Memory: From a Copy-Back Program Perspective," in IEEE Access, vol. 9, pp. 14130- 14137, 2021, doi: 10.1109/ACCESS.2021.3052353

arXiv 2021

[3] [3]

A Post -Mortem Forensic Approach for the Kik Messenger on Android,

A. M. Al-Rawashdeh, Z. A. Al -Sharif, M. I. Al -Saleh and A. S. Shatnawi, "A Post -Mortem Forensic Approach for the Kik Messenger on Android," 2020 11th International Conference on Information and Communication Systems (ICICS), Irbid, Jordan, 2020, pp. 079 -084, doi: 10.1109/ICICS49469.2020.239559

arXiv 2020

[4] [4]

Experimental Evaluation of e.MMC Data Recovery,

A. Fukami, S. Sheremetov, F. Regazzoni, Z. Geradts and C. De Laat, "Experimental Evaluation of e.MMC Data Recovery," in IEEE Transactions on Information Forensics and Security, vol. 17, pp. 2074-2083, 2022, doi: 10.1109/TIFS.2022.3176187

arXiv 2022

[5] [5]

Secondhand Smart IoT Devices Data Recovery and Digital Investigation,

T. Ojo, H. Chi, J. Elliston and K. Roy, "Secondhand Smart IoT Devices Data Recovery and Digital Investigation," SoutheastCon 2022, Mobile, AL, USA, 2022, pp. 640-648, doi: 10.1109/SoutheastCon48659.2022.9763996

work page arXiv 2022

[6] [6]

Data Privacy Threat Modelling for Autonomous Systems: A Survey From the GDP R's Perspective,

N. Azam, L. Michala, S. Ansari and N. B. Truong, "Data Privacy Threat Modelling for Autonomous Systems: A Survey From the GDP R's Perspective," in IEEE Transactions on Big Data, vol. 9, no. 2, pp. 388-414, 1 April 2023, doi: 10.1109/TBDATA.2022.3227336

work page arXiv 2023

[7] [7]

3D NAND Scaling in the next decade,

R. Meyer, Y. Fukuzumi and Y. Dong, "3D NAND Scaling in the next decade," 2022 International Electron Devices Meeting (IEDM), San Francisco, CA, USA, 2022, pp. 26.1.1-26.1.4, doi: 10.1109/IEDM45625.2022.10019570

arXiv 2022

[8] [8]

Accelerating Sub -Block Erase in 3D NAND Flash Memory,

H. Gong, Z. Shen and J. Shu, "Accelerating Sub -Block Erase in 3D NAND Flash Memory," 2021 IEEE 39th International Conference on Computer Design (ICCD), Storrs, CT, USA, 2021, pp. 228-235, doi: 10.1109/ICCD53106.2021.00045

work page arXiv 2021