Beyond Anonymity Sets: A Security Model for Distributed Shuffling in Adversarial Environments | AIChainDay