{"id":"4b5f5efa-be6b-4374-8021-857780c9425e","arxiv_id":"1908.07581","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Rational secret sharing has cooperative equilibria when the secret gives access to a non-rivalrous, non-excludable common good, because participants care about the outcome, not about excluding others.","lead":"Secret sharing games can end in cooperation when the secret unlocks a good that everyone can enjoy, like a public service, instead of a private prize. The paper shows this with a simple game-theoretic model and contrasts it with the classic result that rational parties never share secrets.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 3's classification is false as stated: in a 2-out-of-2 game with N=(1,1), c=2 the zero vector is an all-essential Nash equilibrium but no vX qualifies; zero must be an explicit disjunct.","rationale":"The reader's weakest assumption is the V1-V2 utility model, a modeling assumption that is indeed load-bearing for the paper's economic interpretation. My concern is different and more narrowly formal: Theorem 3, the paper's main theorem, is false as stated because the zero vector can be a Nash equilibrium with every player essential while no vector vX satisfies the stated condition. This is a concrete internal inconsistency, not a dispute about modeling choices. The counterexample is simple and the fix is equally simple: add the zero vector as an explicit disjunct when no self-sufficient participant with Ni > c exists. Because the paper's proof already derives the zero vector as an equilibrium, the intended theorem is recoverable, so the appropriate verdict remains CONDITIONAL rather than REJECT. The reader's CONDITIONAL verdict therefore stands unchanged; the manuscript needs a corrected theorem statement, but the constructive existence of cooperative equilibria is not undermined. I chose 'disagree' for agreement_with_reader because the reader's weakest_assumption did not identify this classification gap, even though both point to the need for revision.","tokens_in":9507,"tokens_out":19357,"duration_ms":181662,"concrete_test":"Instantly test the counterexample: instantiate the game with n = 2, access structure { {1,2} }, N1 = N2 = 1, c = 2. Compute best responses from the zero vector: if player i alone switches to participate, the participating coalition is {i}, which is not authorised, so the secret is not recovered and player i's payoff is -2 < 0. Hence (0,0) is a Nash equilibrium. Check essentiality: each player's payoff differs between 0 and -2 depending on her own action, so every player is essential. Then check whether (0,0) appears in the theorem's set {vX : X in Gamma_min, Ni > c for all i in X}; it does not, because Gamma_min = {{1,2}} and N_i = 1 < c = 2. This single instance falsifies Theorem 3 as stated; the theorem must be revised to include the zero vector as a separate outcome in the classification.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Theorem 3 claims that every Nash equilibrium in which every player is essential is one of the vectors vX, where X is a minimal authorised coalition with Ni > c for all i in X. This is false as written. Consider the 2-out-of-2 access structure with N1 = N2 = 1 and c = 2. There is no self-sufficient participant, and the only minimal authorised coalition is {1,2}, for which Ni = 1 < c, so no vX exists. The zero vector (nobody participates) is a Nash equilibrium: if player 1 deviates and participates while player 2 abstains, the coalition {1} is unauthorised, the secret is not recovered, and player 1's payoff is -2 instead of 0; the same holds for player 2. Every player is essential, since each player's payoff changes from 0 to -2 when she switches from abstain to participate. Thus the equilibrium (0,0) satisfies the theorem's hypotheses but is not one of the vectors vX. The proof's final paragraph does identify the zero vector as an additional equilibrium, so the intended statement is probably 'vX or the zero vector when no self-sufficient participant with Ni > c exists,' but the theorem as printed omits this disjunct. This is an internal inconsistency in the paper's main formal claim, not merely an issue with the economic interpretation of V1 and V2.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper revisits rational secret sharing by embedding the reconstruction stage in a larger economic game in which the secret is a 'common good'. The authors argue that Halpern and Teague's negative result corresponds to a rivalrous and excludable good, and they introduce two utility conditions, V1 and V2, representing a non-rivalrous and non-excludable good: if the secret is recovered every participant i receives value N_i, and each participant who actively participates pays cost c. Their central formal claim, Theorem 3, states that every Nash equilibrium in which all players are essential is one of the characteristic vectors v_X of a minimal authorized coalition X with N_i > c for all i in X, with an extra zero-vector equilibrium when no self-sufficient participant with N_i > c exists, and that all Nash equilibria survive deletion of weakly dominated strategies. The paper also states an asynchronous impossibility theorem (Theorem 2) under Halpern-Teague utilities and discusses applications to threshold cryptography, MPC, and power-sharing arrangements.","tokens_in":9749,"tokens_out":6207,"duration_ms":222171,"significance":"If the formal claims were correct, the paper would provide a genuinely useful reframing: it identifies a class of realistic secret-sharing scenarios in which participation in reconstruction is rational and non-reconstruction can be socially beneficial, and it derives the equilibria from explicit utility axioms rather than fitting parameters. The modeling distinction between rivalrous/excludable and non-rivalrous/non-excludable secrets is thought-provoking and the examples are relevant. However, the central classification theorem is not correct as stated, and one of its auxiliary claims is demonstrably false. The underlying insight—that minimal authorized coalitions with net positive benefit are Nash equilibria—is defensible, but the manuscript currently overstates and under-proves its main theorem, so a substantial revision is required before the results can be relied upon.","major_comments":[{"comment":"The first sentence of Theorem 3 is false as stated. In a 2-out-of-2 access structure with N_1 = N_2 = 1 and c = 2, the zero vector is a Nash equilibrium: if either player deviates to participate while the other abstains, the coalition is unauthorized, the secret is not recovered, and the deviator receives -2 instead of 0. Every player is essential in this equilibrium because each player's payoff changes from 0 to -2 when she switches from abstain to participate. Yet no vector v_X exists, because the only minimal authorized coalition is {1,2}, for which N_i = 1 < c. The theorem must include the zero vector as an explicit disjunct; moreover, the condition 'no self-sufficient participant with N_i > c' is sufficient but not necessary, since a self-sufficient participant with N_i <= c does not make a unilateral deviation to participation profitable.","section":"Section 5, Theorem 3"},{"comment":"The claim 'All Nash equilibria survive deletion of weakly dominated strategies' is false. In the same 2-out-of-2 example with N_1 = N_2 = 1 and c = 2, abstaining strictly dominates participating for each player: if the other participates, participating gives -1 and abstaining gives 1; if the other abstains, participating gives -2 and abstaining gives 0. Therefore the zero vector is a Nash equilibrium that is eliminated by iterated deletion of weakly dominated strategies. No proof of the survival claim is given in the proof of Theorem 3, and the claim as written contradicts the example. This sentence should either be removed or replaced with a carefully qualified statement with proof.","section":"Section 5, Theorem 3, final sentence"},{"comment":"The proof of Theorem 3 is only a sketch and does not establish the stated classification. Lemma 1 allows mixed strategies for inessential players, but the proof does not rule out a mixed Nash equilibrium in which every player is essential; the theorem's hypothesis 'every player is essential' is never used in the proof in a way that excludes mixed equilibria. The proof also ignores the indifference case N_i = c, where participation yields the same payoff as abstention and the vector v_X remains a Nash equilibrium under the definitions of Section 5. The sentence 'If X is not in authorised and somebody is playing a non-zero strategy...' does not handle all cases, such as authorized but non-minimal coalitions with N_i = c. A complete, step-by-step proof of the corrected statement is needed.","section":"Section 5, proof of Theorem 3"},{"comment":"The proof of Theorem 2 is not rigorous. The argument asserts that the player who makes the last move cannot learn the secret and therefore receives a negative payoff, and that disclosing nothing prevents the game from ending; however, it does not compute the payoff of the deviation in the subgame that would result, because the asynchronous game may continue and the deviating player might later learn the secret or influence future moves. The theorem may be true, but the proof as written does not establish it, and the statement that the game 'gets into a non-terminal node' does not by itself show that the deviation is profitable in the subgame-perfect sense. This result needs a complete proof or should be presented as a conjecture.","section":"Section 4, Theorem 2"}],"minor_comments":[{"comment":"There are several typos: 'Burried treasure' in Section 4, 'sucg' in Section 1, 'responce' in the proof of Lemma 1, and 'an d' in the abstract. These should be corrected.","section":"General"},{"comment":"The phrase 'the minimal authorised coalition' should be 'a minimal authorised coalition', since an access structure may have several minimal authorized coalitions; the current phrasing suggests uniqueness.","section":"Section 5, Theorem 3"},{"comment":"The term 'self-sufficient participant' is used in Theorem 3 without a formal definition. It appears to mean a participant i such that {i} is an authorized coalition, but this should be stated explicitly.","section":"Section 5"},{"comment":"The proof of Lemma 1 refers to 'best responce' and uses functions f_Gamma and g_Gamma without defining their domains; a precise definition of these functions would improve readability.","section":"Section 5, Lemma 1"}],"recommendation":"major_revision","confidential_remarks":"The formal errors in Theorem 3 are substantial and affect the paper's main claim, but they appear fixable by restating the theorem with the zero-vector disjunct, handling N_i = c, and either proving or removing the weak-dominance survival claim. The modeling insight is worthwhile, so a major revision seems appropriate. I would also ask the authors to clarify the status of Theorem 2, whose proof is currently too terse to verify."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe paper is worth a look if you care about rational secret sharing or threshold crypto, but treat its main theorem as a draft. What's new is the economic framing: secret reconstruction games differ depending on whether the secret unlocks a rivalrous/excludable good (Halpern-Teague's treasure) or a non-rivalrous/non-excludable one (a public good). Under their V1/V2 utilities, they show that minimal authorized coalitions where each participant's value Ni exceeds the participation cost c are Nash equilibria, and that non-participation can be socially beneficial. That's a real conceptual contribution, and the applications to threshold signatures and MPC are sensible: sometimes you don't want the secret recovered, just used.\n\nThe formal part is thinner. Lemma 1 is fine: with linear expected utility, a mixed strategy only appears when the player is indifferent. But Theorem 3 as printed is false. The stress-test example is right: for a 2-out-of-2 scheme with N1=N2=1 and c=2, the zero vector is a Nash equilibrium in which every player is essential, yet no vX exists because no player has Ni > c. The proof's last paragraph does mention the zero vector, so the intended statement probably is 'every all-essential equilibrium is either a vX or the zero vector when no self-sufficient player exists,' but that disjunct is missing from the theorem. That's a fixable error, but it is an error in the central claim.\n\nThere are two more soft spots. The assertion that all Nash equilibria survive deletion of weakly dominated strategies is not proved; it's plausible for Ni>c players (neither pure strategy dominates the other), but the paper just states it. And the V1/V2 utility model is load-bearing and introduced as a modeling choice, not derived from anything deeper—fine for a conceptual paper, but it means the results are conditional on that specification. No code, no machine-checked proofs, no data, and the proof of Theorem 2 is also sketchy.\n\nWho is this for? Game-theoretic cryptographers and protocol designers who want an alternative to Halpern-Teague's pessimistic conclusion. The taxonomy of secrets by rivalrousness/excludability is the most valuable part. I'd send it to a serious referee, but with a clear request to fix the statement of Theorem 3 and prove the survival claim. If those land, the paper becomes a solid short contribution.","headline":"A conceptually nice economic reframing of secret sharing, but the main theorem as stated has a counterexample that needs a fix before the paper can be trusted.","tokens_in":10296,"tokens_out":5001,"would_cite":false,"duration_ms":480606,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["91A10","94A62"],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper argues that rational secret sharing changes character completely when the secret unlocks a non-rivalrous, non-excludable common good: instead of universal abstention, the stable outcome is exactly a minimal authorized coalition…","keywords":["secret sharing","rational secret sharing","common good","non-rivalrous goods","Nash equilibrium","game theory","threshold cryptography","access structure"],"falsifier":"In a three-player, two-out-of-three reconstruction game with utilities V1 and V2, compute all Nash equilibria directly. The theorem predicts, up to permutation, only profiles with exactly two players revealing when all $N_i>c$, plus possibly the zero vector when no player is self-sufficient; finding any other pure equilibrium, or a mixed essential equilibrium, would falsify the theorem.","tokens_in":9273,"feed_emoji":"🤝","tokens_out":9407,"duration_ms":91960,"temperature":0.7,"pith_summary":"This paper argues that Halpern and Teague's pessimistic conclusion about rational secret sharing — that rational players refuse to reveal their shares — is a consequence of modelling the secret as a rivalrous and excludable good, such as a treasure map. The authors propose a utility model for secrets that open access to a non-rivalrous and non-excludable common good, such as authorizing a council project or signing on behalf of an organization. In that model, the reconstruction game has natural pure-strategy Nash equilibria: exactly a minimal authorized coalition whose members each value the secret more than the participation cost reveals its shares, and everyone else free-rides. If no participant values the secret above the cost, nobody reveals. The paper concludes that in many realistic applications the secret should be used rather than recovered, and that non-reconstruction can be socially beneficial.","feed_headline":"When the secret is a shared good, rational players reveal it","feed_subtitle":"When the secret unlocks a shared good, exactly the minimal authorized coalition reveals it and the rest free-ride.","key_machinery":"The load-bearing object is the pair of utility axioms V1 and V2, which encode the secret as a non-rivalrous, non-excludable common good, together with the access structure $\\Gamma$ and its minimal authorized coalitions. A characteristic vector $v_X$ records which players reveal their shares, with 1 for members of $X$. The proof works because a player's expected utility is linear in her own probability of participating, so in any equilibrium where her action matters she plays a pure strategy; once all strategies are pure, a non-minimal authorized coalition is unstable because a redundant participant can drop out and save $c$, and an unauthorized coalition cannot recover anything. The condition $N_i>c$ ensures that the revealed participants gain from the recovery despite the cost.","core_discovery":"The paper's central result, Theorem 3, classifies all Nash equilibria of the reconstruction game under utility axioms V1 and V2. These axioms say that if the secret is recovered, participant $i$ receives a fixed value $N_i$ no matter who else learns the secret, and pays participation cost $c>0$ only if she took part; if the secret is not recovered, she pays $c$ only in the case of participation. For an arbitrary access structure $\\Gamma$, every Nash equilibrium in which all players are essential is the characteristic vector $v_X$ of a minimal authorized coalition $X$ with $N_i>c$ for every $i\\in X$. If no single participant is self-sufficient, the zero vector is also a Nash equilibrium, so the game may fail to recover the secret even when recovery would be collectively profitable. All these equilibria survive deletion of weakly dominated strategies. The theorem replaces Halpern and Teague's global no-reveal conclusion with a precise positive result for non-rivalrous, non-excludable secrets.","pith_inferences":["Editorial extension: the model's clean prediction — exactly a minimal authorized coalition reveals and all outsiders free-ride — is observable in a laboratory game that sets $N_i$, $c$, and a threshold access structure; observing all players reveal or all abstain as the unique outcome would contradict the theorem.","Editorial extension: the paper assumes $N_i$ and $c$ are common knowledge. If valuations are private, the equilibrium characterization would likely need a Bayesian analogue; this is not addressed in the paper.","Editorial extension: making participation costly is what creates the free-riding structure; a mechanism that reimburses costs or makes abstention observable could shift the equilibrium set toward larger coalitions, a design consequence the paper leaves implicit.","Editorial extension: when the common good is experienced as a bad — equivalently when $N_i$ is below the participation cost — non-recovery is the stable outcome, which gives a game-theoretic rationale for authorized officers refusing to approve harmful actions."],"forward_implications":["For threshold signatures and secure multiparty computation, the message is concrete: parties should use their shares to produce the output, never reconstruct the secret; the pure-strategy equilibria give a stability argument for that design.","The zero-vector equilibrium shows that when participation costs exceed each participant's valuation, non-recovery is an equilibrium and may be socially preferable; privacy of who participated matters.","The equilibria survive deletion of weakly dominated strategies, so the classification does not depend on a delicate refinement.","For arbitrary access structures, the natural stable outcome is exactly one minimal authorized coalition, which matches power-sharing arrangements like two-of-three approval."],"supporting_citations":[{"why":"Supplies the rivalrous and excludable utility axioms U1–U3 and the no-reveal impossibility theorem that this paper contrasts.","marker":"[16]"},{"why":"Supplies the taxonomy of goods by rivalry and excludability that motivates the new utility model.","marker":"[24]"},{"why":"Completes the Samuelson taxonomy of public goods that the paper applies to secrets as common goods.","marker":"[25]"},{"why":"Provides the polynomial secret sharing scheme and the k-out-of-n access structures used in the examples.","marker":"[26]"},{"why":"Names the U2 and U3 conditions as correctness and exclusivity, characterizing the greedy utilities of the earlier model.","marker":"[27]"},{"why":"Describes threshold cryptography in which a signing key is used through shares rather than reconstructed, a motivating application of the paper's conclusion.","marker":"[8]"},{"why":"Provides the secret-sharing-based multiparty computation setting where the final output should be used, not reconstructed.","marker":"[2]"}],"fun_headline_variants":["Public-good secrets flip rational secret sharing's no-reveal result","When secrets are public goods, rational players form minimal coalitions","Non-rivalrous secrets turn secret sharing into a free-riding game","Rational secret sharing works when secrets are non-excludable goods","Secret sharing's rational puzzle solved when secret is a public good"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Everything rests on the utility axioms V1 and V2, which assume that once the secret is recovered every participant receives the same fixed value $N_i$ regardless of who else learns the secret, and that a participant pays cost $c$ only if she actively took part. If the good is instead rivalrous or excludable, the conditions fail and Halpern and Teague's negative result returns.","fun_headline_variants_meta":{"raw":{"variants":["Public-good secrets flip rational secret sharing's no-reveal result","When secrets are public goods, rational players form minimal coalitions","Non-rivalrous secrets turn secret sharing into a free-riding game","Rational secret sharing works when secrets are non-excludable goods","Secret sharing's rational puzzle solved when secret is a public good"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001113,"raw_usage":{"total_tokens":4631,"prompt_tokens":938,"completion_tokens":3693,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":554,"completion_tokens_details":{"reasoning_tokens":3604}},"tokens_in":554,"tokens_out":3693,"duration_ms":26453,"temperature":1.0,"reasoning_tokens":3604,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T12:02:37.126242+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"In a three-player, two-out-of-three reconstruction game with utilities V1 and V2, compute all Nash equilibria directly. The theorem predicts, up to permutation, only profiles with exactly two players revealing when all $N_i>c$, plus possibly the zero vector when no player is self-sufficient; finding any other pure equilibrium, or a mixed essential equilibrium, would falsify the theorem.","supporting_citations":[{"cited_title":"Rational secret sharing and multiparty computation: Extended abstract","cited_arxiv_id":null,"evidence_quote":"Supplies the rivalrous and excludable utility axioms U1–U3 and the no-reveal impossibility theorem that this paper contrasts."},{"cited_title":"Samuelson","cited_arxiv_id":null,"evidence_quote":"Supplies the taxonomy of goods by rivalry and excludability that motivates the new utility model."},{"cited_title":"Samuelson","cited_arxiv_id":null,"evidence_quote":"Completes the Samuelson taxonomy of public goods that the paper applies to secrets as common goods."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the polynomial secret sharing scheme and the k-out-of-n access structures used in the examples."},{"cited_title":"Non-cooperative compu tation: Boolean functions with correctness and exclusivity","cited_arxiv_id":null,"evidence_quote":"Names the U2 and U3 conditions as correctness and exclusivity, characterizing the greedy utilities of the earlier model."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Describes threshold cryptography in which a signing key is used through shares rather than reconstructed, a motivating application of the paper's conclusion."},{"cited_title":"Ben-Or, S","cited_arxiv_id":null,"evidence_quote":"Provides the secret-sharing-based multiparty computation setting where the final output should be used, not reconstructed."}],"review_version":1}