{"id":"513d560a-e8d0-49fa-819b-f4441ebbced5","arxiv_id":"2411.17758","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"PP-LEM shows that a Paillier homomorphic encryption scheme with a special squaring step can clear a local energy market for 200 users in about half a second while hiding buyer and seller data.","lead":"This paper proposes PP-LEM, a privacy-preserving market clearing mechanism for local energy markets that uses a Stackelberg game and homomorphic encryption to settle trades among up to 200 households without revealing bids or demands. It claims to be several times faster than the authors' earlier PFET system while keeping aggregate user balances unchanged.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The encrypted market protocol is undefined for real-valued inputs: Paillier operates on integers, but prices, lambda_i, and scalars 1/theta_i and 0.5 in Algorithms 4–5 are real; without a stated fixed-point encoding, the claimed welfare equivalence is unproven.","rationale":"The reader's weakest_assumption identifies precisely the same load-bearing concern: the absence of an integer encoding for real-valued market inputs under Paillier. My analysis confirms this is the most critical issue because it conditions the correctness of the entire privacy-preserving construction. Every other weakness (convergence proof, welfare metric being a definitional identity, missing runtime units) would weaken the evidence for the central claim but would not, by itself, invalidate the protocol's ability to compute welfare correctly. The encoding gap, however, means Algorithms 4 and 5 do not define a computable function for the values used in the experiments (lambda_i = 40.1, prices in cents, theta_i = 25, scalars 0.5 and 1/25). Without a scale factor and rounding rule, the homomorphic operations lack well-defined plaintext semantics, so the claimed equivalence with the plaintext welfare mechanism is not merely unproven; it is meaningless as written. This is a fixable issue (a scale factor of 100 makes the specific simulation parameters integral), so it does not warrant rejection; it does warrant a conditional verdict requiring the authors to specify the encoding, prove that all encrypted operations stay within Z_n without wraparound, and show that the decrypted, rescaled welfare exactly matches Eq. (10). Since the reader already reached CONDITIONAL, I recommend no change to the verdict. I agree fully with the reader's identification of the weakest assumption.","tokens_in":49729,"tokens_out":6915,"duration_ms":67593,"concrete_test":"Re-implement Algorithm 5 with an explicit fixed-point encoding (e.g., scale all monetary values, lambda_i, theta_i, 0.5, and 1/theta_i by a common factor s, choosing s = 100 so that 40.1 becomes 4010 and 1/25 becomes 4) and run the April 21 dataset with 200 users; compare the decrypted W_Tot and the final allocation D_j against the plaintext Algorithm 3. If the relative difference in W_Tot is nonzero or any modular reduction wraps around for the parameter ranges used (prices in [8,40] cents, lambda_i <= 40.1, demands bounded by the 200-user supply), the social-welfare claim fails. If exact equality is obtained, the paper must still publish the encoding and the bounds proof; without that, the protocol as written remains non-implementable and the equivalence claim is vacuous.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires Algorithm 5 to compute exactly the same W_BJ and W_Tot as Algorithm 3 (Eq. 10) from encrypted data. But Paillier encryption is defined over plaintexts in Z_n, and every input and intermediate value in the welfare computation is real: prices are given in euro cents (e.g., 28), lambda_n = 40.1 in Section 5.5.1, theta_i = 25, and the scalars 0.5 and theta_INV_i = 1/25 are applied as plaintext scalar multiplications in Algorithm 5 lines 5, 12, and 13. Paillier scalar multiplication is defined only for integer scalars, and the Squaring theorem in Section 3.4.2 is proved only for integer X. Sections 4.2–4.4 give no fixed-point encoding, scaling factor, rounding rule, or modular-bound analysis. Consequently, the homomorphic computation does not provably compute Eq. (10); a naive integer rounding of X_ji = (40.1 − 28)/25 = 0.484 to 0 would make W_BJ zero instead of roughly 2.93, a total welfare collapse. The paper's assertion in Section 4.2 that the encrypted outcome is 'consistent with what would have been achieved without any encryption' is therefore unsupported, and the 'without compromising social welfare' claim built on this equivalence is not established. This is a load-bearing correctness gap, not a stylistic omission: it determines whether the privacy-preserving mechanism computes the market outcome it claims to compute.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"PP-LEM proposes a Stackelberg-game-based market-clearing mechanism for local energy markets, together with a Paillier-homomorphic-encryption variant (Algorithms 4 and 5) that is intended to compute buyer welfare over encrypted prices while keeping prices, demands, and buyer profile variables private. The paper claims improved computational efficiency relative to the authors' earlier PFET mechanism, market clearing for 200 users in the order of seconds, and no loss in social welfare or user balances. The evaluation includes a Nash-equilibrium existence argument, computational complexity and communication analysis, privacy proofs, and simulations on German household consumption and PVGIS solar data with and without batteries.","tokens_in":63,"tokens_out":16228,"duration_ms":219792,"significance":"The design goal—competitive P2P clearance using only partially homomorphic operations plus an encrypted squaring gadget—is relevant and, if the encrypted computation were correct, would be a useful step toward scalable privacy-preserving local energy markets. The paper has concrete strengths: the data-generation pipeline is documented with a public repository, the simulations cover multiple seasons, battery configurations, and user counts, and the authors explicitly disclose limitations such as the omission of network costs. However, the correctness of the encrypted welfare computation is not established and, in the version under review, contains a concrete algebraic error. The welfare-preservation evidence is indirect, the Nash-equilibrium proof is incomplete, and the runtime tables do not support the abstract's 'order of seconds' claim for 200 users. These issues bear directly on all three parts of the central claim.","major_comments":[{"comment":"The reconstruction of W_BJ is algebraically wrong. Theorem 1 reconstructs X^2 from Square({X}) as Dec(α)+Dec(ω)^2. In Algorithm 5, line 12 stores Enc(0.5·θ_i·α_ij) in AB_j and line 13 stores Enc(0.5·θ_i·ω_ij) in Ω_Bj; Algorithm 4, lines 21–24, then computes Dec(AB_j) + Σ_i Dec(0.5·θ_i·ω_ij)^2. With c = θ_i/2 this yields Σ_i [c(−r_i^2+2r_iX_ji) + c^2(X_ji−r_i)^2] = Σ_i [cX_ji^2 + c(c−1)(X_ji−r_i)^2], not Σ_i cX_ji^2. For θ=25, c=12.5, so the spurious second term is 143.75·(X_ji−r_i)^2 per buyer. Thus W_BJ, and consequently the demand D_j computed in Algorithm 4 line 31, is not the welfare defined in Eq. (10).","section":"§4.3–4.4, Algorithms 4 and 5"},{"comment":"Paillier encryption is defined over plaintexts in Z_n, but the protocol supplies real-valued inputs: λ_i=40.1, θ_i=25, the scalar θ_INV_i=1/25, the scalar 0.5, and real-valued prices. No fixed-point encoding, scaling factor, rounding rule, or modular-bound analysis is given. Paillier scalar multiplication is defined only for integer scalars, and Theorem 1 is proved only for integer X. Consequently, the statement in §4.2 that the decrypted outcome is 'consistent with what would have been achieved without any encryption' is unsupported. A concrete encoding with precision and overflow analysis is required; without it, the encrypted protocol does not provably compute Eq. (10) or the demand allocation in Algorithm 4.","section":"§4.2–4.4, Algorithm 5 lines 3–6, 12–13"},{"comment":"The claim that social welfare is uncompromised is not supported by the reported balances. Aggregate user balance cancels P2P payments between buyers and sellers, and the text itself notes that P2P transfers 'neutralise any differences when calculating overall balances.' Moreover, the balance tables do not report the welfare quantities W_Bj or W_Tot from Eq. (10). Equality of aggregate balances across PFET and PP-LEM is therefore at best a necessary condition; it cannot certify that the encrypted mechanism reproduces the plaintext allocation, prices, or buyer utilities. The authors should directly compare the encrypted and plaintext algorithms' outputs (W_Bj, W_Tot, allocations, prices) or provide a formal equivalence proof.","section":"§5.5.2, Table 5 and accompanying text"},{"comment":"The Nash-equilibrium existence proof is incomplete. It verifies only that the buyer's utility U_i is strictly concave in X_ji (Eq. (11)), but it does not define the sellers' payoff functions or verify their continuity and concavity in π_j over the compact interval [ρ_FiT, ρ_Sup]. The proof also asserts boundedness of X_ji without deriving explicit bounds; §4.1.2 gives only a lower-bound assumption on λ_i. Finally, the iterative price-update rule in Algorithm 2 lines 21–22, with clamping and fixed step η_1, is not connected to the best-response correspondence of a static game. The existence claim needs either a full fixed-point argument for both player types or a precise statement that only the buyers' subgame equilibrium is being established.","section":"§5.2, Eq. (11)"},{"comment":"The abstract states that PP-LEM can clear the market for 200 users 'within the order of seconds.' Table 6 reports PP-LEM total runtimes of 519.95 s (25% prosumers), 1599.35 s (50% prosumers), and 1965.98 s (75% prosumers) at 200 users. The reported PFET/PP-LEM Cost ratios are computed from per-iteration averages, not from total clearance time. The units, the definition of clearance time, and the abstract's claim must be reconciled; as presented, the headline efficiency claim is not supported by the reported data.","section":"§5.5.2, Table 6, and Abstract"}],"minor_comments":[{"comment":"The complexity statement is loose: it refers to 'dual nested loops' and O(n^2) without defining n. Algorithm 5 has O(N_S·N_B) work plus O(N_S·N_B) aggregation; please state per-iteration and total complexity explicitly in terms of N_S and N_B.","section":"§5.3"},{"comment":"The privacy proofs are informal. For example, §5.1.3 says that tracing buyer variables from an aggregate result is 'as hard as breaking the underlying encryption scheme' without a formal reduction. A simulation-based or IND-CPA-based argument would be more convincing.","section":"§5.1"},{"comment":"Theorem 1 assumes exact integer arithmetic, but Paillier decryption returns values modulo n. The proof should state bounds on r and X (or on their encoded representations) that prevent modular wrap-around, since the reconstruction formula fails if intermediate values are reduced modulo n.","section":"§3.4.2, Theorem 1"},{"comment":"The caption should clarify that 'Total' and 'Average' are in seconds and should state explicitly which phases are parallelized; the current text says sellers and buyers run in parallel, but the 'Total' row appears to include sequential aggregation, which affects interpretation of the efficiency comparison.","section":"§5.5.2, Table 6"}],"recommendation":"major_revision","confidential_remarks":"The algebraic error in Algorithms 4–5 is decisive and easy for the authors to verify; any revision must fix it before the efficiency and welfare claims can be assessed. The abstract's 'order of seconds' runtime claim should also be reconciled with Table 6. If the authors can provide a corrected protocol and supporting numerical analysis, the paper may be salvageable; in its current form, the central correctness claim is not established."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. First, the core design is genuinely new: instead of translating the earlier PFET game into encrypted form, the authors redesign the buyer reaction so welfare is computed with Paillier additions, scalar multiplications, and a Catalano-Fiore style squaring gadget, avoiding FHE. Second, the central correctness claim does not yet hold: the encrypted algorithm is not defined on real-valued inputs. Paillier plaintexts are integers, yet prices (e.g. 28 euro cents), lambda_i = 40.1, theta_i = 25, and the scalars 0.5 and 1/theta_i go straight into Algorithms 4 and 5. The paper never gives a fixed-point encoding, rounding rule, or modular-bound analysis. A naive rounding of X_ji = (40.1 - 28)/25 = 0.484 to 0 would wipe out buyer welfare. So the Section 4.2 claim that the encrypted outcome is consistent with the non-encrypted outcome is unsupported, and the headline 'without compromising social welfare' rests on that unsupported equivalence.\n\nWhat is good: the Stackelberg redesign is clean, the squaring protocol is appropriate for the task, the privacy analysis is standard CPA-based and matches the threat model, and the communication-overhead accounting is explicit. The runtime comparison against PFET is believable in direction, showing 3-5x speedups; that part is useful even though Table 6 has no units and only single runs.\n\nThe other soft spots are real but smaller. Equal aggregate user balances between PFET and PP-LEM is a weak basis for claiming no welfare loss, because P2P price transfers cancel to zero in net balances, making the metric partly definitionally insensitive. The Nash equilibrium proof gives existence via concavity but does not prove the iterative price update converges, and seller utility is never formally defined. The linked repository contains data generation only, not the market simulator, so the main experimental result is not reproducible from the public artifacts.\n\nNet: this is a credible, clearly written applied paper with one load-bearing gap and two moderate evidential gaps. All are fixable. A serious referee should ask for a fixed-point encoding with precision and overflow bounds, a direct welfare comparison instead of balance equality, and convergence or reproducibility statements. If those land, this is a solid contribution to privacy-preserving local energy markets. I would send it to peer review with a conditional verdict.","headline":"Neat Paillier-compatible Stackelberg redesign, but the encrypted protocol is undefined for real-valued inputs, so the central welfare-preservation claim needs a fixed-point encoding and a referee.","tokens_in":50592,"tokens_out":3117,"would_cite":true,"duration_ms":33676,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A local energy market can be cleared in seconds with encrypted bids, prices, and profiles while preserving plaintext social welfare.","keywords":["Privacy","Game theory","Peer-to-peer energy trading","Stackelberg game","Homomorphic encryption","Local energy markets","Computational efficiency","Social welfare"],"falsifier":"Take one seller and two buyers with concrete values, for instance $\\pi_j = 25$ euro cents, $\\lambda_i = 40.1$, $\\theta_i = 25$, run Algorithm 5 on encrypted prices and Algorithm 3 on plaintext prices, and compare the decrypted $W_{B_j}$ and $W_{Tot}$; if they differ beyond a stated rounding allowance, the encrypted market clears at different demands than the plaintext market, and the welfare-preservation claim fails.","tokens_in":49415,"feed_emoji":"⚡","tokens_out":10368,"duration_ms":93231,"temperature":0.7,"pith_summary":"PP-LEM sets out to show that a local peer-to-peer electricity market can be cleared in the order of seconds for 200 households while keeping sellers' prices, buyers' demand amounts, and buyer profile parameters encrypted. The clearance mechanism is a competitive Stackelberg game in which sellers propose prices, buyers compute how much they would buy at those prices, and both sides iterate until supply matches demand. All buyer-side reaction and welfare calculations are carried out over encrypted data, using Paillier partial homomorphic encryption together with a square operation that avoids the cost of fully homomorphic encryption. The paper reports a 3.13 to 5.99 times runtime improvement over the authors' earlier PFET mechanism, with the aggregate financial balances of users unchanged. If the claim holds, privacy would no longer force a trade-off against settlement speed in local energy markets.","feed_headline":"Privacy-preserving energy market clears 200 users in seconds","feed_subtitle":"Paillier encryption plus a square operation matches plaintext welfare while hiding prices and demand profiles.","key_machinery":"The load-bearing mechanism is the homomorphic evaluation of the quadratic welfare function without ever multiplying two ciphertexts. Paillier supports only addition and scalar multiplication, so the paper uses a square protocol adapted from a degree-2 evaluation scheme: for a secret $X$, the buyer produces $\\alpha = \\{-r^2 + 2rX\\}$ and $\\omega = \\{X - r\\}$ with a random $r$, and the seller reconstructs $X^2$ as $\\mathsf{Dec}(\\alpha) + \\mathsf{Dec}(\\omega)^2$. This lets buyers hide $X_{ji}$, $\\lambda_i$, and $\\theta_i$ while giving sellers exactly the welfare values the price-update rule needs. The square protocol carries the whole privacy-efficiency trade-off: all aggregation happens over ciphertexts, yet no fully homomorphic encryption is required.","core_discovery":"The central claim is that a competitive local energy market can be cleared privately and quickly without losing social welfare. The paper models the market as a single-leader multi-follower Stackelberg game: sellers choose prices, each buyer reacts with a linear demand $X_{ji} = (\\lambda_i - \\pi_j)/\\theta_i$, and the welfare contributed by all buyers to seller $s_j$ is $W_{Bj} = \\frac{1}{2}\\sum_i \\theta_i X_{ji}^2$. In the privacy-preserving variant, sellers encrypt their prices with a Paillier public key, buyers evaluate the demand and welfare formulas on ciphertexts, and the sellers decrypt only aggregated welfare values to update prices. The paper argues that because the encrypted pipeline performs the same operations as the plaintext algorithm, the equilibrium and the total user balances match those of PFET. The experiments back this with runtime measurements up to 200 users and profit-cost tables showing identical aggregate balances across PP-LEM and PFET.","pith_inferences":["If the paper supplied an explicit integer encoding for real-valued prices and profile parameters, the same square-protocol design would transfer to other quadratic utility markets, such as electric-vehicle charging or demand-flexibility auctions, without switching to fully homomorphic encryption.","The reported speedups assume parallel seller and buyer loops; at 200 users the per-iteration communication volume (one alpha and one omega ciphertext per buyer per seller) may become the practical bottleneck in a field deployment with real network latency.","The welfare-equality argument is stated for aggregate balances; the protocol makes sellers decrypt one omega value per buyer, so whether an individual buyer's welfare contribution can be inferred from those values is a separate privacy question the paper does not examine.","A natural next experiment is to vary $\\lambda_i$ across buyers in the encrypted market and check whether the decrypted welfare still matches the plaintext formula when $\\theta_i$ is not identical for everyone; the current simulations appear to use a single fixed $\\theta$."],"forward_implications":["A local energy market with 200 participants can be cleared in seconds, comfortably inside the one-hour settlement cycle the model assumes.","Sellers' prices, buyers' per-seller demand volumes, and buyer profile parameters stay encrypted during the reaction computation, so a curious aggregator or seller does not see plaintext offers and bids.","Aggregate user balances under PP-LEM equal those under PFET, so moving to the privacy-preserving clearance mechanism does not reduce total social welfare.","Because the encrypted and plaintext algorithms have the same structure, the Nash-equilibrium existence argument for the plaintext game carries over to the encrypted market.","Quadratic welfare terms can be evaluated with partial homomorphic encryption plus a plaintext square after decryption, avoiding the overhead of fully homomorphic encryption."],"supporting_citations":[{"why":"The earlier competitive Stackelberg clearance mechanism (PFET) that PP-LEM extends and the baseline for runtime and welfare comparisons.","marker":"[8]"},{"why":"The Paillier cryptosystem that provides the partially homomorphic addition and scalar multiplication used throughout the encrypted algorithms.","marker":"[65]"},{"why":"The degree-2 evaluation technique behind the square operation that lets buyers compute quadratic welfare terms over encrypted data without full homomorphic encryption.","marker":"[67]"},{"why":"Supplies the buyer utility parameters and the consumption utility model used in the reaction functions.","marker":"[66]"},{"why":"The prior privacy-preserving Stackelberg clearance mechanism that is non-competitive; the paper positions PP-LEM as adding an incentive-competitive mechanism while staying scalable.","marker":"[25]"}],"fun_headline_variants":["Private energy auction: 200 users in seconds with Paillier","Stackelberg market clears privately: speed meets social welfare","Encrypted bids, instant clearing: PP-LEM scales to 200","Homomorphic energy market: privacy without welfare loss","200 users, private bids, fair prices: PP-LEM delivers"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The claim stands on the encrypted market producing exactly the same welfare numbers as the plaintext market, which requires a precise integer encoding for real-valued prices and profile parameters and correct handling of scaling when the square is reconstructed; the paper states neither of these explicitly.","fun_headline_variants_meta":{"raw":{"variants":["Private energy auction: 200 users in seconds with Paillier","Stackelberg market clears privately: speed meets social welfare","Encrypted bids, instant clearing: PP-LEM scales to 200","Homomorphic energy market: privacy without welfare loss","200 users, private bids, fair prices: PP-LEM delivers"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000125,"raw_usage":{"total_tokens":1079,"prompt_tokens":890,"completion_tokens":189,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":506,"completion_tokens_details":{"reasoning_tokens":101}},"tokens_in":506,"tokens_out":189,"duration_ms":2883,"temperature":1.0,"reasoning_tokens":101,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T12:37:55.652644+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take one seller and two buyers with concrete values, for instance $\\pi_j = 25$ euro cents, $\\lambda_i = 40.1$, $\\theta_i = 25$, run Algorithm 5 on encrypted prices and Algorithm 3 on plaintext prices, and compare the decrypted $W_{B_j}$ and $W_{Tot}$; if they differ beyond a stated rounding allowance, the encrypted market clears at different demands than the plaintext market, and the welfare-preservation claim fails.","supporting_citations":[{"cited_title":"Privacy-Friendly Peer-to-Peer Energy Trading: A Game Theoretical Approach","cited_arxiv_id":"2201.01810","evidence_quote":"The earlier competitive Stackelberg clearance mechanism (PFET) that PP-LEM extends and the baseline for runtime and welfare comparisons."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The Paillier cryptosystem that provides the partially homomorphic addition and scalar multiplication used throughout the encrypted algorithms."},{"cited_title":"Catalano, D","cited_arxiv_id":null,"evidence_quote":"The degree-2 evaluation technique behind the square operation that lets buyers compute quadratic welfare terms over encrypted data without full homomorphic encryption."},{"cited_title":"Paudel, K","cited_arxiv_id":null,"evidence_quote":"Supplies the buyer utility parameters and the consumption utility model used in the reaction functions."},{"cited_title":"Privacy Preserving Distributed Energy Trading","cited_arxiv_id":"2004.12216","evidence_quote":"The prior privacy-preserving Stackelberg clearance mechanism that is non-competitive; the paper positions PP-LEM as adding an incentive-competitive mechanism while staying scalable."}],"review_version":1}