{"id":"fb896fa1-a8ec-4975-8d8b-6bd6d539b0c0","arxiv_id":"1908.05385","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"SC3 combines fountain-coded computation with light and heavy homomorphic-hash checks to detect and recover from Byzantine workers, reducing task completion delay relative to a hash-only baseline.","lead":"The paper proposes SC3, a mechanism that uses homomorphic hashes and fountain-coded computation so edge devices can detect and discard Byzantine-corrupted results from untrusted workers. Simulations suggest SC3 completes tasks faster than a baseline that discards all work from suspected workers.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 1's hash check is only valid when q divides the computation-field size ψ; the paper never states this, so as written even honest workers can fail verification.","rationale":"The reader's verdict is CONDITIONAL, and I agree that the paper should not be accepted as written. However, the most load-bearing gap is slightly different from the one the reader emphasized. The reader questioned whether an adversary could add a multiple of q to evade the hash. That is one symptom of a deeper issue: the hash is defined over integers, while the computed values are elements of F_ψ. For the verification equations (2)-(3) to be correct even for honest workers, the hash modulus q must divide the field size ψ (in the prime-field case, q = ψ). The paper never states this, and as a result Theorem 1 is false for generic choices of q and ψ. This is not merely a security caveat; it breaks the basic correctness of the SC3 detection module. The detection probability lemmas and the delay analysis all assume this module works, so the gap propagates to the central delay claim. The concern is concrete and testable: a small finite-field instance with ψ=5 and q=3 makes an honest worker fail verification, while the same instance with q=ψ passes. The fix is likely simple—state that the computation field is F_q and choose q accordingly—but it is nontrivial because it changes the claimed flexibility of selecting q freely and affects the security probabilities in Lemmas 2, 5, and Theorem 7. I therefore keep the verdict conditional: the paper's framework may be salvageable, but the stated argument does not yet support the claims. I also note that the reader's weaker assumption about q being larger than the field size is not sufficient by itself; even q > ψ fails when q ∤ ψ, as the example shows. Credit is due for the novel combination of light/heavy checks and coded computation, but the missing compatibility condition is a correctness-level issue, not just a missing error bar or code artifact.","tokens_in":16616,"tokens_out":13587,"duration_ms":155096,"concrete_test":"Instantiate the model with ψ=5, q=3, r=7, g=2, one coded packet p=(2,2), x=(2,2), and coefficient c=1. Compute the check: y = p·x mod 5 = 3, α = h(3) = 2^{3 mod 3} mod 7 = 1, and β = h(2)^{2}·h(2)^{2} = 4^4 mod 7 = 4. If α ≠ β, then Theorem 1 rejects an honest worker whenever q ∤ ψ. Then rerun the same instance with q = ψ = 5 (choosing r = 11, g = 3): the check should pass, confirming that the missing condition is exactly q | ψ. This single experiment distinguishes the proposed fix from the current text and settles whether the verification equations are consistent with finite-field arithmetic.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing step is Theorem 1 (Section III-A), which asserts that an honest worker's result always satisfies α_n = β_n. The hash h(a) = g^{a mod q} is homomorphic over integer addition, but y = p·x is computed in F_ψ, so y = (Σ_j p_j x_j) mod ψ. Therefore α_n uses exponent (Σ_i c_i y_i) mod q, while β_n uses exponent Σ_i c_i (Σ_j p_{i,j} x_j) mod q. These exponents differ by ψ·(Σ_i c_i t_i) for integers t_i, so the equality holds for all honest workers only if q | ψ (equivalently q = ψ when ψ is prime). The paper defines q as a prime 'selected randomly from the field F_φ' and never relates q to ψ. Without q | ψ, Eq. (3) is not a valid integrity check. Concretely, take ψ=5, q=3, r=7, g=2, one packet p=(2,2), x=(2,2), and c=1. Then S = 8, y = 3 in F_5, so α = h(3) = 2^{3 mod 3} = 1, while β = h(2)^{2}·h(2)^{2} = 4^4 mod 7 = 4; an honest worker fails. The detection-probability claims (Lemma 2, Proposition 3, Lemma 5) are consequently not well-founded as stated. If the intended fix is q = ψ, the related 'add a multiple of q' attack disappears for field-valued outputs, but the paper must state this relation and re-derive the claims. As written, the central security/efficiency claim rests on an unstated and nontrivial compatibility condition.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SC3, a secure coded cooperative computation mechanism for heterogeneous edge computing with Byzantine workers. The master encodes matrix rows with Fountain codes, offloads coded packets to workers dynamically, and verifies returned linear computations using a homomorphic hash function. Two verification tools are introduced: a light-weight (LW) check using coefficients in {-1,1} and a heavy-weight (HW) check using coefficients in a larger field F_q, together with a binary-search attack recovery module. The paper claims detection-probability guarantees for these checks, a delay upper bound and a delay-gap lower bound relative to a HW-only baseline, and simulation results showing significant task-completion-delay improvement. The core security analysis rests on the homomorphic hash in Eq. (1), and the delay analysis imports the dynamic packet-offloading result from the authors' prior work [1].","tokens_in":16954,"tokens_out":5013,"duration_ms":54521,"significance":"If the security conditions are stated and the proofs corrected, SC3 would be a practically motivated and useful combination of lightweight and heavyweight integrity checks with coded computation. The problem is well chosen, the algorithm is clearly structured, and the simulation comparison against HW-only and an unsecured lower bound gives a useful first evaluation. The paper does not provide machine-checked proofs or reproducible code, but the main contribution is the proposed mechanism and its analysis. However, as written, the load-bearing security claims rest on unstated modular-arithmetic compatibility conditions and several detection-probability statements are not valid without additional assumptions. The delay bounds also contain a non-integer factorial expression. These issues are fixable but require substantial revision of the theorems and proofs.","major_comments":[{"comment":"The hash function h(a) = g^{a mod q} mod r is homomorphic over integer addition, but the computation y = p·x is performed in F_ψ, so honest workers return y = (Σ_j p_j x_j) mod ψ. Consequently, the exponent in α_n is (Σ_i c_i y_i) mod q, while β_n uses (Σ_i c_i Σ_j p_{i,j} x_j) mod q. These exponents differ by a multiple of ψ, so the equality α_n = β_n for all honest workers holds only if q divides ψ (equivalently q = ψ when ψ is prime). The manuscript never states this compatibility condition; as written, even honest workers can fail the integrity check. For example, with ψ=5, q=3, r=7, g=2, p=(2,2), x=(2,2), and c=1, one obtains y=3 in F_5, so α = h(3) = 2^{3 mod 3} = 1, while β = h(2)^2·h(2)^2 = 4^4 mod 7 = 4. The theorem and all detection-probability lemmas that rely on it (Lemma 2, Proposition 3, Lemma 5) therefore need a stated q-ψ relation and a re-derivation under that condition.","section":"Section II, Eq. (1) and Section III-A, Theorem 1"},{"comment":"The proof of P_HW = 1 - 1/q assumes that for every corrupted packet the difference y_{n,i} - \\tilde{y}_{n,i} is nonzero modulo q, so that Eq. (31) has a unique solution for c_j. If a Byzantine worker alters a result by a multiple of q, that difference is zero modulo q and Eq. (30) holds for every choice of coefficients, making the attack undetectable. The manuscript does not state that the adversary cannot produce such differences, nor does it relate q to the computation field size. Lemma 5 as stated is therefore false without an additional assumption, such as q = ψ with ψ prime and corrupted packets differing from honest values by nonzero field elements. This is a load-bearing issue because Lemma 5 underlies the claimed HW detection probability and the SC3 design.","section":"Appendix D, Lemma 5"},{"comment":"The universal lower bound P_LW ≥ 0.5 is not valid for attacks in which the added/subtracted amount δ is a multiple of q. In that case the hash is unchanged and the detection probability is 0, not 0.5, regardless of coefficient selection. The proof's argument that the symmetric pairwise attack is the hardest case ignores this modulo-q zero-difference scenario. The proposition needs to be qualified (for example, under q=ψ with all corruptions nonzero in F_q) and the proof revised accordingly. This matters because the lower bound is used in the multi-round LW analysis of Theorem 7.","section":"Proposition 3 and Appendix C"},{"comment":"The statement that log_2(q) rounds of LW function have attack detection probability equal to that of HW function is only an approximation, not an equality. The proof says the per-round failure probability 'can be approximated as 1/2^K when Z_n >> log_2 K' and replaces a product of the form ∏ (2^{Z_n}-1-k)/(2^{Z_n}-k) by 2^{-K}. This product is not evaluated exactly, and the approximation requires unstated largeness conditions on Z_n. Moreover, the argument inherits the unsupported 0.5 lower bound from Proposition 3. The claimed equivalence and the complexity condition in Eq. (6) are therefore not established as stated.","section":"Theorem 7 and Appendix E"},{"comment":"The upper bound in Eq. (8) and the definition of P in Lemma 10 use expressions such as (z_n ρ_c)! / (2^{z_n ρ_c} ((z_n ρ_c/2)!)^2), which involve factorials of non-integer quantities because z_n ρ_c is generally not an integer. This formula is imported from Lemma 2, which applies only to an even integer number of corrupted packets. The theorem also relies on the dynamic packet-offloading delay formula from [1] and on expected values of E[β_{n,i}] without stating the required distributional assumptions. The delay analysis needs to define P with appropriate integer rounding or an expectation over the number of corrupted packets, and the worst-case bound needs to be justified under those definitions.","section":"Theorem 8 and Lemma 10"}],"minor_comments":[{"comment":"The notation h(a) ≜ mod(g mod (a,q), r) is nonstandard and can be misread; it should be written as h(a) = g^{a mod q} mod r, which is what the proofs use.","section":"Section II, Eq. (1)"},{"comment":"The parameter φ is used to define the field F_φ from which q is selected, but φ is never formally defined; the relation between q, φ, and the computation-field size ψ should be stated explicitly.","section":"Section II, Eq. (1)"},{"comment":"The quotient q' in Eqs. (15)-(16) is denoted with a symbol that is visually nearly identical to the prime q; using a different symbol, such as m, would improve readability.","section":"Appendix A, proof of Theorem 1"},{"comment":"The proof refers to 'Lemma 3' when it means Proposition 3; the reference should be corrected.","section":"Appendix E, proof of Theorem 7"},{"comment":"The caption says 'SC3P' instead of 'SC3' in the phrase 'the gap between HW-only and SC3P'.","section":"Section VI, Fig. 3(c)"}],"recommendation":"major_revision","confidential_remarks":"The paper's central security analysis has a correctable but nontrivial gap: the homomorphic hash is applied to field elements computed in F_ψ, and the proofs never state that q must be compatible with ψ. The detection-probability lemmas also assume away the modulo-q zero-difference attack. These are load-bearing issues rather than presentation issues, so major revision is appropriate. The delay analysis imports the dynamic offloading model from the authors' own [1], which is acceptable if clearly attributed, but the factorial-of-non-integer expression in Theorem 8 should be fixed. I would ask the authors to state explicitly the q-ψ relation, re-derive Lemmas 2, 5 and Proposition 3 under that relation, and either prove or clearly qualify the approximation in Theorem 7 and the delay bounds."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Thanks for sending this my way. The bottom line: the paper has a genuinely useful mechanism—light vs. heavy homomorphic-hash checks, binary-search recovery, fountain-coded offloading—but the central verification theorem is missing a necessary condition. As written, Theorem 1 requires q to divide the field size ψ, and the paper never states this. The stress-test example is correct: with ψ=5, q=3, an honest worker's α ≠ β. So the detection-probability results in Lemma 2, Proposition 3, and Lemma 5 are not well-founded for arbitrary field sizes.\n\nThe fix is straightforward: set q = ψ (or explicitly require q to divide ψ) and re-state the hash over field elements. Then the \"add a multiple of q\" attack disappears because the only multiple of q in F_ψ is zero. I'd expect the rest of the structure to survive intact. The LW/HW distinction and binary-search recovery are the real contribution; I haven't seen that in the network-coding hash papers they cite. The complexity analysis (Theorem 4 and 6) looks right, and the delay bounds are a reasonable extension of their prior C3P work, though I'd want the factorial floor issue in Theorem 8 fixed—z_n ρ_c isn't an integer in general.\n\nMinor points: the simulations have no error bars and no code, so the \"significant improvement\" claim is only suggestive. The related-work coverage is fine. Self-citation of [1] is justified since C3P is the dynamic offloading building block.\n\nI'd give this a conditional at best, but the condition is genuinely correctable. The paper is a solid new application rather than a new framework, and the theoretical core is fixable in a few lines. It deserves a serious referee; I'd send it out, but flag the q|ψ issue immediately. If the authors fix that and clean up the factorial notation, it could be accepted. For my own work, I wouldn't cite it until the fix is in; the current version's security claims are not reliable.","headline":"A genuinely useful mechanism, but the central verification theorem is missing a compatibility condition (q | ψ) and is false as stated; the fix is simple, but the current security claims do not hold.","tokens_in":17509,"tokens_out":4013,"would_cite":false,"duration_ms":40032,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"SC3 combines homomorphic hash verification with fountain-coded offloading so Byzantine workers cannot silently corrupt edge matrix computations, and does so with much lower task completion delay than a heavy-check-only baseline.","keywords":["Byzantine attacks","edge computing","coded computation","homomorphic hash","fountain codes","integrity verification","task completion delay","heterogeneous workers"],"falsifier":"Have one malicious worker return $y_i + q$ instead of $y_i$ for a single packet while all other packets are honest. Since $h(y_i+q)=h(y_i)$, both the light-weight and heavy-weight checks compute $\\alpha_n=\\beta_n$ and declare the packet verified, so the claimed detection-probability bounds fail for this attack.","tokens_in":16383,"feed_emoji":"🛡️","tokens_out":7653,"duration_ms":67312,"temperature":0.7,"pith_summary":"The paper develops SC3, a master/worker scheme for edge computing that keeps Byzantine workers from corrupting offloaded linear-algebra tasks while still exploiting heterogeneous, time-varying workers. It combines fountain-coded cooperative computation with a homomorphic hash that lets the master verify linear combinations of returned results cheaply. The paper introduces a light-weight check and a heavy-weight check, and shows that repeating the light check for $\\log_2 q$ rounds matches the heavy check's detection probability at lower complexity under a stated condition. It proves upper and lower bounds on task completion delay and reports simulations in which SC3's delay is much lower than a heavy-check-only baseline. The intended value is a tunable security-versus-efficiency trade-off for edge computation under Byzantine faults.","feed_headline":"Fountain codes plus hash checks beat Byzantine edge workers","feed_subtitle":"A two-tier hash verifier salvages good results from bad workers, cutting task delay far below full re-checking.","key_machinery":"The load-bearing object is the homomorphic hash $h(a)=\\mathrm{mod}(g^{\\mathrm{mod}(a,q)},r)$, with $q$ and $r$ primes such that $q$ divides $r-1$ and $g=b^{(r-1)/q}$; it satisfies $h(\\sum_i c_i a_i)=\\prod_i h(a_i)^{c_i}$, so a hash of a linear combination of results can be assembled from hashes of the inputs. The paper combines this with fountain-coded task offloading and a two-phase verification: the light-weight check with $c_i\\in\\{-1,1\\}$ filters grossly corrupted workers cheaply, and the heavy-weight check with $c_i\\in F_q$, or $\\log_2 q$ rounds of the light check, pins down residual corruption. The binary-search recovery module then verifies packets finely enough to keep non-corrupted packets from malicious workers. The hash's homomorphism is what makes verification possible without recomputation, and the coefficient choice is what sets detection probability.","core_discovery":"The central claim is that Byzantine corruption in coded cooperative computation can be detected and localized without recomputing tasks or discarding every packet from a suspected worker. Using the homomorphic hash $h(a)=\\mathrm{mod}(g^{\\mathrm{mod}(a,q)},r)$, the master can obtain the hash of a linear combination of returned results from the hashes of the input vector and the coding coefficients, so a mismatch with the locally computed value signals corruption. The light-weight check chooses coefficients from $\\{-1,1\\}$ and detects any attack pattern with probability at least $1/2$, while the heavy-weight check chooses coefficients in $F_q$ and detects any attack with probability $1-1/q$. Running the light check for $\\log_2 q$ rounds matches the heavy check's detection probability and, when the worker's packet count is large enough, costs less. SC3 uses phase one to discard heavily corrupted workers and phase two with binary search to salvage uncorrupted packets from mildly corrupted workers; its completion delay is bounded above, and simulations place it well below an HW-only baseline.","pith_inferences":["The detection guarantees are conditional on adversarial alterations not being multiples of $q$: if a Byzantine worker changes a returned value by $q$ or any multiple of $q$, the hash in Eq. (1) is unchanged and neither check flags it. Choosing $q$ larger than any feasible corruption magnitude, or keeping $q$ secret, would close this hole, but the paper does not state such a requirement.","Because the hash is homomorphic only over linear combinations, the same verification technique applies to any linear computation over a field, such as matrix-vector products, but not directly to nonlinear functions like neural-network activations.","The $q$ parameter is a tunable security knob: an edge deployment could choose it per worker or per task based on the tolerated corruption risk and the worker's measured speed, interpolating between cheap weak checks and expensive strong checks.","A direct testable extension would measure false-negative rates when an adversary deliberately corrupts by multiples of $q$, and compare them with the claimed $1-1/q$ bound in a real device-to-device edge testbed."],"forward_implications":["A master can detect Byzantine corruption in offloaded matrix-vector products with probability at least $1/2$ using the light-weight check, and with probability $1-1/q$ using coefficients from $F_q$.","Repeating the light-weight check $\\log_2 q$ times achieves the same detection probability as the heavy-weight check, with lower computational cost whenever the per-worker packet count satisfies $Z_n \\geq \\frac{M(r)}{M(\\psi)}(\\log_2 q)^2$.","SC3 can keep using non-corrupted packets returned by a malicious worker, so its task completion delay improves over schemes that discard all packets from any detected worker.","The task completion delay of SC3 has a worst-case upper bound, and the delay gap over the HW-only baseline has a lower bound that grows with matrix size and with lower packet corruption probability.","In simulations with 150 workers, tens of Byzantine workers, and packet corruption probability $\\rho_c=0.3$, SC3's completion delay stays well below HW-only and close to the unsecured lower bound."],"supporting_citations":[{"why":"Supplies the dynamic heterogeneity-aware packet offloading policy and the unsecured C3P baseline used as SC3's lower bound.","marker":"[1]"},{"why":"Supplies the collision-resistant homomorphic hash function on which the integrity checks are built.","marker":"[14]"},{"why":"Shows how the homomorphic hash applies to random linear combinations, the basis for verifying coded computations.","marker":"[15]"},{"why":"Provides LT/fountain codes, the rateless coding used to generate coded packets on the fly.","marker":"[16]"},{"why":"Documents fountain code overhead behavior, justifying the small overhead $\\epsilon$ in the delay analysis.","marker":"[18]"}],"fun_headline_variants":["Hash checks flush Byzantine edge workers fast","Salvage good packets from corrupt edge nodes","Light hash probes detect Byzantine attacks cheaply","Binary search rescues edge computations from saboteurs","SC3 cuts delay by weeding out Byzantine workers"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The scheme's detection probabilities assume that a Byzantine corruption changes a computed value by an amount that is not a multiple of the hash parameter $q$; if an adversary alters a result by $q$ or a multiple of $q$, every hash check passes and the attack is invisible.","fun_headline_variants_meta":{"raw":{"variants":["Hash checks flush Byzantine edge workers fast","Salvage good packets from corrupt edge nodes","Light hash probes detect Byzantine attacks cheaply","Binary search rescues edge computations from saboteurs","SC3 cuts delay by weeding out Byzantine workers"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000435,"raw_usage":{"total_tokens":2203,"prompt_tokens":923,"completion_tokens":1280,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":539,"completion_tokens_details":{"reasoning_tokens":1210}},"tokens_in":539,"tokens_out":1280,"duration_ms":10704,"temperature":1.0,"reasoning_tokens":1210,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T13:16:33.945170+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Have one malicious worker return $y_i + q$ instead of $y_i$ for a single packet while all other packets are honest. Since $h(y_i+q)=h(y_i)$, both the light-weight and heavy-weight checks compute $\\alpha_n=\\beta_n$ and declare the packet verified, so the claimed detection-probability bounds fail for this attack.","supporting_citations":[{"cited_title":"Dynamic heterogeneity- aware coded cooperative computation at the edge,","cited_arxiv_id":null,"evidence_quote":"Supplies the dynamic heterogeneity-aware packet offloading policy and the unsecured C3P baseline used as SC3's lower bound."},{"cited_title":"On-the-fly verification of rateless erasure codes for efficient content distributio n,","cited_arxiv_id":null,"evidence_quote":"Supplies the collision-resistant homomorphic hash function on which the integrity checks are built."},{"cited_title":"Cooperative security for network coding file distribution","cited_arxiv_id":null,"evidence_quote":"Shows how the homomorphic hash applies to random linear combinations, the basis for verifying coded computations."},{"cited_title":"Lt codes,","cited_arxiv_id":null,"evidence_quote":"Provides LT/fountain codes, the rateless coding used to generate coded packets on the fly."},{"cited_title":"Fountain codes,","cited_arxiv_id":null,"evidence_quote":"Documents fountain code overhead behavior, justifying the small overhead $\\epsilon$ in the delay analysis."}],"review_version":1}