  In the inference attacks studied in Quantitative Information Flow (QIF), the
attacker typically tries to interfere with the system in the attempt to
increase its leakage of secret information. The defender, on the other hand,
typically tries to decrease leakage by introducing some controlled noise. This
noise introduction can be modeled as a type of protocol composition, i.e., a
probabilistic choice among different protocols, and its effect on the amount of
leakage depends heavily on whether or not this choice is visible to the
attacker. In this work, we consider operators for modeling visible and hidden
choice in protocol composition, and we study their algebraic properties. We
then formalize the interplay between defender and attacker in a game-theoretic
framework adapted to the specific issues of QIF, where the payoff is
information leakage. We consider various kinds of leakage games, depending on
whether players act simultaneously or sequentially, and on whether or not the
choices of the defender are visible to the attacker. In the case of sequential
games, the choice of the second player is generally a function of the choice of
the first player, and his/her probabilistic choice can be either over the
possible functions (mixed strategy) or it can be on the result of the function
(behavioral strategy). We show that when the attacker moves first in a
sequential game with a hidden choice, then behavioral strategies are more
advantageous for the defender than mixed strategies. This contrasts with the
standard game theory, where the two types of strategies are equivalent.
Finally, we establish a hierarchy of these games in terms of their information
leakage and provide methods for finding optimal strategies (at the points of
equilibrium) for both attacker and defender in the various cases.
