Minimum Viable Exposure (MVE)

Three numbers for every AI call

AI pipelines now assemble their own context: retrieval, memory and tools decide what reaches the model. MVE turns data minimisation into something you can measure per call, compare across releases and report to an auditor.

Exposure Ratio

What you send ÷ what the task needed, weighted by sensitivity. 1 is the goal.

ER = e(x_sent) / MVE(τ)

MVE Score

100 ÷ Exposure Ratio. 100 means you send exactly what the task needs.

Score = 100 / ER ∈ [0, 100]

Excess Exposure

The absolute weighted exposure sent above the minimum. Additive across tasks, defined even when the minimum is zero.

ΔE = e(x_sent) − MVE(τ)

Exposure is a sensitivity-weighted token count. Weights follow a monotone class table (paper, Table 1): non-personal content weighs 0, pseudonymised units 1, and the weight rises with the regulatory cost of the data, up to special-category data under GDPR Art. 9. Weights are policy; reports always state the table, tokenizer and unit partition used.

Worked example (illustrative)

A customer asks a bank's assistant: “What is my current account balance?” All numbers are produced by the script published with the paper.

Unit in the context	Tokens	Weight	Exposure	Needed
Full name and date of birth	20	5	100
Home address and phone number	30	5	150
Five years of transaction history	1,800	10	18,000
Current balance	8	10	80	✓
Account identifier (disambiguation)	7	5	35	✓
Health-insurance policy and claims summary	80	25	2,000
Employment and income history	300	10	3,000
System prompt and task description	155	0	0	✓
Sent vs needed	2,400 → 170		23,365 → 115

92.9% fewer tokens, but an Exposure Ratio of 203.2 (MVE Score 0.49). Pseudonymising the identifiers alone barely moves it (ER 201.2): most of the exposure sat in a transaction history the task never needed. Token counts hide the risk. Weighted exposure shows it.

Where it is enforced: Context Customs

Every prompt clears customs before it leaves your company: declared, inspected, transformed, recorded, restored.

Declare the task and the destination model.
Inspect what is sensitive, duplicated or unused by the task.
Transform with the smallest change that keeps the task working.
Record the Exposure Ratio of every call, never the sensitive values.
Restore real values on the way back, inside your perimeter, for authorised people only.

The pattern is implementation-independent. Any team can apply and measure it with any model.

Cite

Lapid, A. (2026). Minimum Viable Exposure: A Data-Minimisation Standard for What AI Models
Should See (Version 1.0). Zenodo. https://doi.org/10.5281/zenodo.23457060

@misc{lapid2026mve,
  author    = {Lapid, Alan},
  title     = {Minimum Viable Exposure: A Data-Minimisation Standard for What AI Models Should See},
  year      = {2026},
  version   = {1.0},
  publisher = {Zenodo},
  doi       = {10.5281/zenodo.23457060}
}

Disclosure: Geometrical builds a privacy layer that implements Context Customs (patent application P202631047 covers specific mechanisms that are neither described nor required by this standard). The definitions and metrics are open under CC BY 4.0.