{"id":"9fa3e39f-a290-449d-b2c8-c37252d1c3ee","arxiv_id":"1908.04947","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Risk-limiting tallies determine the winner from a random sample of ballots with a chosen confidence level, leaving unrevealed ballots as cover against coercion.","lead":"This paper proposes counting only a random sample of encrypted ballots until the winner is statistically certain, leaving the rest hidden to make coerced voting harder. It applies this risk-limiting tally idea to the Selene voting scheme and extends it to hide verification trackers from coercers.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The RLT risk guarantee rests on Eq. (1), whose martingale property and integral recursion are deferred to an unpublished companion paper; the printed formula is ambiguous and cannot be independently checked.","rationale":"Good-faith reading: the paper identifies a real problem (tally leaks privacy/coercibility) and a plausible remedy (sequential risk-limiting tally leaving some ballots shrouded), with a sensible extension to Selene trackers. The statistical core, however, is not self-evident. The text assigns the most delicate part—the martingale inequality and the computational recursion—to an unpublished reference authored by one of the current authors. The reader's weakest_assumption points to exactly this, and I agree: it is the single load-bearing assumption. Everything else (certified randomness, fallback for narrow margins, formal coercion-resistance arguments) is presented as a sketch or delegated to future/known techniques; those are material but would not by themselves invalidate the core idea. The unpublished martingale theorem is different: if Eq. (1) does not in fact yield a valid level-α test for every μ ≤ 1/2, then no risk limit, Table 1, or stopping guarantee follows. Proposition 1's union bound is fine given valid level-α tests, so the issue is upstream. The paper is a constructive proposal with a plausible mechanism, not a completed proof; the reader's CONDITIONAL verdict is appropriate. I would keep the verdict unchanged, conditional on the Evans-Stark results being supplied and the test being independently verified.","tokens_in":13142,"tokens_out":18072,"duration_ms":192741,"concrete_test":"Obtain the Evans-Stark manuscript or independently re-derive Eq. (1). Implement the recursive integral and enumerate every sampling order for all small finite populations with mean t (e.g., N=2..6, labels in {0,1/2,1}), verifying Y_n ≥ 0, E[Y_N] = 1 under μ=t, and Pr(max_{j≤N} Y_j ≥ 1/α) ≤ α for a grid of α. Then repeat with composite nulls μ ≤ t to confirm the test controls error. If any check fails, or if the derivation cannot be reproduced without [11], the risk limits in Sections 4.2–4.3 do not follow.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 4.1 states that Y_n in Eq. (1) is a nonnegative closed martingale with expectation 1 when μ=t, citing reference [11] (Evans and Stark, 'in preparation,' co-authored by one of this paper's authors), and the recursive integral algorithm is also delegated to [11]. This is the engine for every subsequent claim: Proposition 1's error bound k(C−k)α, Table 1's sample sizes, and the RLT stopping guarantee all require a valid level-α test of μ_{wℓ} ≤ 1/2. The paper does not state the proof or give the algorithm, and the formula as typeset is not self-contained: depending on where the denominator ends, the integrand is either not a martingale in elementary finite-population checks (N=2, t=1/2) or can have a zero/negative denominator on some sample paths, with no stated convention. It is also asserted without support that the point-null martingale at t=1/2 can test the composite null μ_{wℓ} ≤ 1/2. Until [11] is available or Eq. (1) is independently re-derived, the central statistical guarantee of RLT is not established.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Risk-Limiting Tallies (RLT), a mechanism for partially tallying encrypted ballots in end-to-end verifiable voting systems: ballots are revealed in a random order until a sequential statistical test achieves a pre-specified risk limit α for the set of winners, leaving the remaining ballots unrevealed. The authors argue that this enhances coercion resistance and mitigates Italian-style attacks by allowing coerced voters to claim that the demanded ballot is among the unrevealed ones. They also propose Risk-Limiting Verification (RLV) for Selene, in which only a random subset of trackers is revealed. The statistical engine is a new ballot-polling sequential test based on a nonnegative martingale for the mean of a nonnegative population (Eq. (1)), whose validity is delegated to an unpublished companion paper. The paper states a Bonferroni-based bound k(C−k)α on the probability of misidentifying the winners, tabulates minimum sample sizes for two-candidate and ten-candidate plurality contests, and sketches protocol and security considerations.","tokens_in":13344,"tokens_out":4670,"duration_ms":48489,"significance":"If the underlying sequential test is valid, the RLT idea is a genuinely useful bridge between risk-limiting audits and tally-hiding cryptography: it provides a practical way to balance statistical confidence against information leakage, and it gives voters a concrete form of plausible deniability in extreme-tally scenarios. The paper also introduces a new type of statistical test whose operating characteristics do not depend on a reported outcome, which is of independent interest. However, the central statistical result is not self-contained and the sample-size claims are unsubstantiated; these points are load-bearing for every downstream guarantee (Proposition 1, Table 1, and the stopping rule). The security analysis is largely informal. For these reasons, the contribution is promising but not yet established.","major_comments":[{"comment":"The entire RLT risk guarantee rests on the claim, stated in Section 4.1, that the process (Y_j) defined by Eq. (1) is a nonnegative closed martingale with expectation 1 when μ = t. This claim is cited to reference [11] (Evans and Stark, in preparation), which is co-authored by one of the present authors, and the recursive algorithm for computing the integral is also delegated to [11]. As printed, the formula is ambiguous: the typesetting does not make clear whether the denominator in the integrand is (\\tilde{j} t − \\tilde{S}_{j−1}) or some other grouping, and no convention is given for sample paths on which the denominator is zero or negative. Because this martingale property is the engine for Proposition 1, Table 1, and the sequential stopping guarantee, the paper is not self-contained at its most critical point. The authors should either include a proof of the martingale property and the recursive algorithm in the paper, or make [11] available and restate Eq. (1) unambiguously.","section":"Section 4.1, Eq. (1)"},{"comment":"The test described in Section 4.1 is presented as a test of the point null hypothesis μ = t, but the RLT procedure uses it to test the composite null hypothesis μ_{wℓ} ≤ 1/2 for each pair (w, ℓ). The paper does not prove that the sequential test controls the type I error uniformly over the composite null. A level-α test of a point null does not automatically yield a level-α test of a one-sided composite null unless monotonicity of the rejection probability in μ is established (for example, via stochastic dominance of the test statistic under larger μ). This monotonicity is asserted only obliquely in the proof sketch of Proposition 2 and is not referenced to a specific theorem. Since Proposition 1's error bound k(C−k)α presupposes that each individual hypothesis is tested at level α under the composite null, this gap must be closed.","section":"Section 4.2"},{"comment":"The minimum sample sizes in Table 1 are asserted without derivation. It is not explained how the numbers 5, 9, 13, ... for α = 10^{-1}, 10^{-2}, ... are computed from Eq. (1), nor what assumptions are made about the label distribution beyond unanimity. The accompanying claims that the sample size is stochastically larger when more than one candidate receives votes, and that an invalid-ballot fraction u multiplies the expected sample size by 1/(1−u), are stated without proof. These sample-size statements are presented as concrete guarantees and are experimentally falsifiable; they need either a derivation, a reference to a public implementation, or a citation to a result that provides them.","section":"Section 4.3, Table 1"},{"comment":"The paper's central motivation is enhanced coercion resistance via plausible deniability, but Section 5.1 concedes that in close contests the RLT may reveal all or almost all ballots, and the fallback strategies (PET testing, tally hiding, secret tally computation) are only sketched. The security analysis in Section 6 is informal: it does not state a precise adversary model, does not define the coercion-resistance property being claimed, and does not connect the statistical risk limit to the security definition. As a result, the paper does not fully substantiate the contribution item 'strategies to ensure plausible deniability whatever the vote distribution'. The authors should either provide a more rigorous treatment of the fallback mechanisms and the security reduction, or explicitly narrow the claim to scenarios where the RLT terminates with a bounded proportion of unrevealed ballots.","section":"Sections 5.1 and 6"}],"minor_comments":[{"comment":"There is a typo: 'undemocractic' should be 'undemocratic'.","section":"Introduction"},{"comment":"The notation mixes raw labels X_j with normalized quantities: X_j is not divided by N, while \\tilde{S}_{j−1} = S_{j−1}/N and \\tilde{j} = 1 − (j−1)/N. The units in the denominator of Eq. (1) are therefore unclear; the authors should state explicitly that X_j is also normalized, or introduce a normalized label.","section":"Section 4.1"},{"comment":"The sentence 'the protection a RLT offers is greatest when the risk is greatest' is confusing; presumably it means when the margin is largest (so the risk of coercion is smallest, but the number of unrevealed ballots is largest). Please rephrase.","section":"Section 4.3"},{"comment":"The protocol description does not fully pin down the generation of the certified random sampling order. The text lists options (stock-market prices, NIST beacon, etc.) but does not specify one as part of the protocol; this is acceptable for a high-level paper, but a concrete instantiation or a reference to a standard RLA randomness-generation procedure would strengthen the exposition.","section":"Section 5"},{"comment":"The phrase 'some of the approaches to linearising the JCJ-style checks' is vague; please give a specific example or reference.","section":"Section 7.1"}],"recommendation":"major_revision","confidential_remarks":"The central statistical engine is cited to an in-preparation companion paper co-authored by one of the present authors. I would encourage the editor to require that the companion paper be made available (or that the proof be included in an appendix) before publication, and to verify that the sample sizes in Table 1 are reproducible. The security claims in Sections 5 and 6 are quite informal; if the journal's scope emphasizes rigorous security definitions, the authors should be asked to tighten this aspect or clearly label the contribution as a design proposal rather than a proven security result."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core idea here is real and worth taking seriously: instead of tallying all votes, the election authority opens a random sequence of encrypted ballots and stops when the winner is determined with a pre-specified risk limit, leaving the rest shrouded. That gives voters plausible deniability against coercion, especially in extreme or Italian-style attacks. The test statistic does not depend on reported vote shares, which distinguishes it from classic RLAs, and the extension to Selene trackers (Risk-Limiting Verification) is a nice addition. The paper is well situated against related work, and the Bonferroni argument in Proposition 1 is sensible as far as it goes.\n\nThe soft spots are real, and they matter. The entire statistical foundation is Eq. (1), which is asserted to be a nonnegative martingale with expectation 1 under the null, citing Evans and Stark (in preparation). One of this paper's authors is a co-author of that companion. The formula as typeset is not self-contained—the integral is ambiguous, the recursive algorithm is also deferred, and the claim that testing the point-null martingale at t=1/2 controls the composite null µ_wℓ ≤ 1/2 is not justified in the text. Table 1's sample sizes are asserted without derivation. The security arguments in Section 6 are informal, and the fallback strategies in Section 5.1 are sketches rather than fully specified protocols. None of this is a fundamental refutation of the idea, but it does mean the risk guarantees cannot be audited from this manuscript alone, which is a significant burden on the reader.\n\nThe paper is honest about what it does and does not prove, and the concept is coherent and likely sound. I would not desk-reject it. It deserves a serious referee who can press for the companion paper to be made available and for the statistical and security arguments to be tightened. If the companion results hold up, this could become a useful tool for coercion-resistant voting schemes. I would cite the concept in future work and would bring it to a reading group focused on voting or coercion resistance.","headline":"A genuinely new idea for coercion-resistant tallying whose statistical engine is currently unverifiable—it deserves a serious referee, but only if the companion proof becomes available.","tokens_in":13876,"tokens_out":2362,"would_cite":true,"duration_ms":26832,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Risk-limiting tallies reveal only enough ballots to call the race.","keywords":["risk-limiting audits","end-to-end verifiability","coercion resistance","plausible deniability","sequential testing","martingale inequality","Selene","voting security"],"falsifier":"Compute Eq. (1) exactly for a tiny population, say $N=3$ with two 0s and one 1, over all sampling orders; if the expected value is not 1 under the null mean $1/2$, or if the maximal exceedance probability exceeds the claimed bound, the risk limit is false.","tokens_in":12942,"feed_emoji":"🗳️","tokens_out":8451,"duration_ms":71564,"temperature":0.7,"pith_summary":"The paper proposes that end-to-end verifiable elections need not reveal every vote. Instead, the election authority opens a random sequence of encrypted ballots and stops as soon as the evidence identifies the winner with a pre-specified risk limit, leaving the remaining ballots shrouded. This gives a coerced voter a truthful claim: her ballot could be among the unrevealed ones, so she can deny having followed the coercer's instructions. The same machinery is extended to Selene's verification trackers, so not all trackers are revealed either.","feed_headline":"Risk-limiting tallies reveal only enough ballots to call the race","feed_subtitle":"Coerced voters can claim their ballot stayed hidden while the result stays within any chosen risk limit.","key_machinery":"The engine is Eq. (1), an integral over a mixing parameter $\\gamma$ of products of terms built from the sampled labels; reference [11] proves that under the null $\\mu = t$ this sequence is a nonnegative closed martingale with expectation 1. A martingale maximal inequality then gives $\\Pr(\\max_{1\\le j\\le J} Y_j(t) > 1/p) \\le p$, turning the integral into a sequential p-value. For RLT, ballots are relabeled per candidate pair as 1, 0, or $1/2$, making '$w$ beats $\\ell$' equivalent to the population mean exceeding $1/2$; testing all $C(C-1)$ pairwise hypotheses yields the winner set.","core_discovery":"For plurality contests, a risk-limiting tally (RLT) recasts each pairwise contest between candidates $w$ and $\\ell$ as a test of whether the population mean of relabeled ballots exceeds $1/2$: a vote for $w$ counts as 1, a vote for $\\ell$ as 0, and any other ballot as $1/2$. Sampling without replacement and using the martingale-based test of reference [11], the protocol rejects the null hypothesis $\\mu_{w\\ell} \\le 1/2$ at level $\\alpha$. It stops when one set of $k$ candidates has beaten every outsider, and Proposition 1 bounds the chance of misidentifying the winners by $k(C-k)\\alpha$. The paper reports minimum sample sizes for unanimity: at $\\alpha = 10^{-9}$, 35 ballots suffice for two candidates and 38 for ten.","pith_inferences":["If the bound $k(C-k)\\alpha$ is conservative, as the paper hints, the true risk may be lower than $\\alpha$ for many margins; a sharper analysis might allow stopping even earlier for close races, but this is not established here.","The RLT idea transfers naturally to any setting where a population mean must be certified from sequential samples, such as audit or quality-control tests; the paper does not develop these applications.","A practical deployment would need to settle the source of public randomness and the trust model for the random sampling authority; the paper leaves those choices to stakeholders, so the realized guarantee depends on that external setup.","The security improvement is about plausible deniability rather than cryptographic coercion resistance: a coercer who watches the revealed ballots still knows unrevealed ballots exist, so the voter's claim is only as strong as the fraction of shrouded ballots."],"forward_implications":["If the election is lopsided, very few ballots need be opened: with unanimous support, 35 ballots give error probability below $10^{-9}$ in a two-candidate race.","The risk of misidentifying winners grows with the number of candidates through the factor $k(C-k)$; the paper's table shows the multiplicity penalty adds only a few ballots under near-unanimity.","For close races the sample may consume all ballots, so the paper proposes fallback strategies: plaintext equivalence tests on unrevealed ballots, tally hiding by multiparty computation, or a secretly computed tally to guide sampling.","Applying the same idea to Selene, revealing only a random subset of vote trackers lets a coerced voter claim her tracker was never published."],"supporting_citations":[{"why":"supplies the martingale theorem for the mean of a non-negative population and the recursive algorithm to compute the integral in Eq. (1).","marker":"[11]"},{"why":"defines risk-limiting audits, the framework RLT adapts from checking a reported outcome to determining the outcome.","marker":"[16]"},{"why":"presents the Selene scheme, the running example that RLT and Risk-Limiting Verification extend.","marker":"[20]"},{"why":"gives the risk-limiting audit framework and its generalization to majority and super-majority contests.","marker":"[24]"},{"why":"describes a prior ballot-polling RLA whose reliance on reported results motivates the new test.","marker":"[15]"},{"why":"supplies the coercion-resistance definition used to argue RLT provides plausible deniability.","marker":"[12]"}],"fun_headline_variants":["Risk-limiting tallies resist coercion by hiding votes","New tally method shields ballots from coercers","Counting votes without revealing all: a coercion defense","Privacy-preserving vote tallying with risk limits"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The risk guarantee depends on the theorem in reference [11] that the integral in Eq. (1) is a nonnegative closed martingale under the null hypothesis, and on the bulletin board containing the correct, complete set of cast votes; if either fails, the stated bounds do not follow.","fun_headline_variants_meta":{"raw":{"variants":["Risk-limiting tallies resist coercion by hiding votes","New tally method shields ballots from coercers","Counting votes without revealing all: a coercion defense","Privacy-preserving vote tallying with risk limits"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000634,"raw_usage":{"total_tokens":2946,"prompt_tokens":986,"completion_tokens":1960,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":602,"completion_tokens_details":{"reasoning_tokens":1902}},"tokens_in":602,"tokens_out":1960,"duration_ms":16309,"temperature":1.0,"reasoning_tokens":1902,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T13:28:24.039117+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute Eq. (1) exactly for a tiny population, say $N=3$ with two 0s and one 1, over all sampling orders; if the expected value is not 1 under the null mean $1/2$, or if the maximal exceedance probability exceeds the claimed bound, the risk limit is false.","supporting_citations":[{"cited_title":"Evans and P.B","cited_arxiv_id":null,"evidence_quote":"supplies the martingale theorem for the mean of a non-negative population and the recursive algorithm to compute the integral in Eq. (1)."},{"cited_title":"Lindeman and P.B","cited_arxiv_id":null,"evidence_quote":"defines risk-limiting audits, the framework RLT adapts from checking a reported outcome to determining the outcome."},{"cited_title":"Ryan, P.B","cited_arxiv_id":null,"evidence_quote":"presents the Selene scheme, the running example that RLT and Risk-Limiting Verification extend."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"gives the risk-limiting audit framework and its generalization to majority and super-majority contests."},{"cited_title":"Lindeman, P.B","cited_arxiv_id":null,"evidence_quote":"describes a prior ballot-polling RLA whose reliance on reported results motivates the new test."},{"cited_title":"Juels, D","cited_arxiv_id":null,"evidence_quote":"supplies the coercion-resistance definition used to argue RLT provides plausible deniability."}],"review_version":1}