  Fuzzy Message Detection (FMD) is a recent cryptographic primitive invented by
Beck et al. (CCS'21) where an untrusted server performs coarse message
filtering for its clients in a recipient-anonymous way. In FMD - besides the
true positive messages - the clients download from the server their cover
messages determined by their false-positive detection rates. What is more,
within FMD, the server cannot distinguish between genuine and cover traffic. In
this paper, we formally analyze the privacy guarantees of FMD from three
different angles. First, we analyze three privacy provisions offered by FMD:
recipient unlinkability, relationship anonymity, and temporal detection
ambiguity. Second, we perform a differential privacy analysis and coin a
relaxed definition to capture the privacy guarantees FMD yields. Finally, we
simulate FMD on real-world communication data. Our theoretical and empirical
results assist FMD users in adequately selecting their false-positive detection
rates for various applications with given privacy requirements.
