Implied by IND-CPA/IND-CCA with a loss in the number of users (and bits, in the case of free-bit). Several formalizations possible: * Single-bit * Multi-bit * Free-bit * With or without corruptions