As explainable artificial intelligence (XAI) becomes more prevalent, concerns arise about the unintended privacy risks associated with model explanations. In this paper, we study the antagonism between explainability and privacy by evaluating the extent to which post-hoc explanations can leak sensitive data. We perform a comparative analysis of three popular XAI methods (SHAP, LIME, and DiCE) applied to Decision Trees, Random Forests, and Neural Networks. We focus on two types of privacy attacks: Membership Inference Attacks and Training Data Extraction. Using datasets of varying complexity, we measure attack success rates and information leakage from explanations. Our results shows that each proposed membership inference attack and training data extraction attack are feasible. These findings highlight the urgent need to design privacy-preserving explainability tools that balance interpretability with user data protection.

Centinela is an intelligent academic information platform that facilitates the exploration of Ecuadorian scientific knowledge by providing structured access to a national corpus derived from Scopus. This study introduces agency capabilities into Centinela through a Retrieval Augmented Generation (RAG) framework to overcome the limitations of static query-answering systems. The proposed architecture integrates autonomous agents capable of iterative query refinement, hybrid sparse-dense retrieval, contextual curation, and multi-agent collaboration before deploying a domain-adapted language model. The evaluation of the agency RAG was performed on a dataset of 100 academic questions using standard text generation metrics. The results show BLEU (0.1588), METEOR (0.2525), ROUGE-2 (0.2066), and a high BERTScore F1 (0.8035), with a precision and recall of 0.8423 and 0.7745, respectively. These scores reflect a solid balance between lexical diversity and semantic fidelity. The findings confirm the system's ability to generate coherent and contextually relevant responses and highlight its potential to support knowledge discovery, thematic analysis, and evidence-based decision-making in the Ecuadorian academic ecosystem.

Protecting personal data has become a critical concern in an increasingly digitized world. Consequently, governments have proposed regulations to protect the privacy of their citizens. Organizations that handle personal information must adhere to these regulations. However, achieving compliance with these regulations is not straightforward, and a structured approach is needed to interpret, implement, and maintain adherence to them, given their complexity. To overcome these challenges, we introduce OntoPriv, a legal ontology designed to facilitate compliance with data protection regulations. OntoPriv provides a structured representation of legal knowledge, enabling organizations to better understand regulatory requirements, identify relevant obligations, and establish adequate data protection practices. This article discusses the development, implementation, and evaluation of OntoPriv and explores its potential impact on enhancing compliance and promoting a culture of privacy and accountability within organizations.

Abstract Database outsourcing is a challenge concerning data secrecy. Even if an adversary, including the service provider, accesses the data, she should not be able to learn any information from the accessed data. In this paper, we address this problem for graph-structured data. First, we define a secrecy notion for graph-structured data based on the concepts of indistinguishability and searchable encryption. To address this problem, we propose an approach based on bucketization. Next to bucketization, it makes use of obfuscated indexes and encryption. We show that finding an optimal bucketization tailored to graph-structured data is NP-hard; therefore, we come up with a heuristic. We prove that the proposed bucketization approach fulfills our secrecy notion. In addition, we present a performance model for scale-free networks which consists of (1) a number-of-buckets model that estimates the number of buckets obtained after applying our bucketization approach and (2) a query-cost model. Finally, we demonstrate with a set of experiments the accuracy of our number-of-buckets model and the efficiency of our approach with respect to query processing.

Location-based services are one of the most important services offered by mobile social networks. Offering this kind of service requires accessing the physical position of users together with the access authorizations, i.e., who is authorized to access what information. However, these physical positions and authorizations are sensitive information that have to be kept secret from any adversary, including the service providers. As far as we know, the problem of offering location-based services in mobile social networks with a revocation feature under collusion assumption, i.e., an adversary colludes with the service provider, has not been studied. In this article, we show how to solve this problem in the example of range queries. Specifically, we guarantee any adversary, including the service provider, is not able to learn (1) the physical position of the users, (2) the distance between his position and that of the users, and (3) whether two users are allowed to learn the distance between them. We propose two approaches, namely, two-layer symmetric encryption and two-layer attribute-based encryption. The main difference between them is that they use, among other encryption schemes, symmetric and attribute-based encryption, respectively. Next, we prove the secrecy guarantees of both approaches, analyze their complexity, and provide experiments to evaluate their performance in practice.

Studies in fields like psychology and sociology have revealed that reciprocity is a powerful determinant of human behavior. None of the existing access control models however captures this reciprocity phenomenon. In this paper, we introduce a new kind of grant, which we call mutual, to express authorizations that actually do this, i.e., users grant access to their resources only to users who allow them access to theirs. We define the syntax and semantics of mutual authorizations and show how this new grant can be included in the Role-Based Access Control model, i.e., extend RBAC with it.