{"id":"c2dfe07b-62db-4a39-98b0-2bd13d926aa6","arxiv_id":"2412.16648","paper_version":3,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":5,"one_line_summary":"Secret Quorums hide which validators approve a transaction, and StealthDust uses them to cut payment latency and settlement message complexity in fractional-spending payment systems.","lead":"This paper introduces Secret Quorums, a way to pick small groups of validators anonymously so that adaptive attackers cannot corrupt them in time. The authors use the idea to build StealthDust, a payment protocol that settles fractional payments faster and with fewer messages than prior work.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Gossip plus batching does not hide validator identity from an adversary that observes message source/target/size; the quorum can be identified and corrupted before settlement, so the central adaptive-security claim is unsupported.","rationale":"The reader identified the same weakest assumption. I do not find a separate flaw; this one is decisive. The paper says the quorum is hidden until settlement, but its own model gives the adversary metadata. Ring signatures are not anonymous channels. The phrase 'gossiping' plus 'batching' is not a mechanism; it is an assumption, and it is in tension with the adversary model. Since the secret-quorum size is below f, once the quorum is known the adversary can corrupt all members before settlement and erase payment proofs, breaking safety. This is exactly the attack the abstraction is meant to prevent. The rest of the construction (VRF selection, parameter choices, complexity table) is interesting but cannot be assessed as secure without resolving this. Therefore the reader's REJECT is appropriate; no verdict change.","tokens_in":16042,"tokens_out":4675,"duration_ms":44701,"concrete_test":"Formalize or simulate the gossip step under the §3 adversary: for a single transaction d, compute the deterministic candidate set, have the client send (d,N) to all candidates, and let only VRF-selected validators emit ring-signature-sized messages through the specified gossip. Record the set of first-hop sources observable by the adversary; if that set equals the selected quorum (or if source/target/size correlation identifies the quorum), the anonymity claim is false. A second, cheaper analytical check: inspect whether the paper provides any primitive that hides source/target/size; if none, the proof of Lemma 4 cannot establish the required property.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central security claim is that StealthDust tolerates a rushing-adaptive adversary because secret-quorum members stay anonymous until settlement (Abstract; §6.1). The implementation relies on ring signatures plus the statement in §6.1 that 'validators send confirmation to the seller using gossiping' and that batching multiple transactions prevents the adversary from telling which contacted validators validate which transactions. This conflates cryptographic signer anonymity with network-layer sender anonymity. Under the stated model (§3), the adversary 'can learn the source, target, and size of each message' even though content is private. In the validate protocol (Algorithms 1–2), the client sends (d,N) to all candidates; candidates are a deterministic public set (Algorithm 6). Only the VRF-selected validators respond with a ring signature. If a selected validator sends its response through gossip, the adversary still observes the first-hop source, target, and size of that message. The set of validators that send messages after receiving (d,N) is exactly the secret quorum. Batching over multiple transactions merely hides which transaction each sender validated; it does not hide the set of senders, and the adversary can corrupt that set (size m < f) before settlement, erasing the validation proofs and violating no-double-spending. No anonymous broadcast/mixnet primitive is modeled or proved, and Lemma 4 only invokes rVRF.Sign's ring-anonymity, which protects the signer inside a ring from the verifier, not the origin of a network message from a metadata-observing adversary. This is the load-bearing unproven assumption; if it fails, the headline latency/complexity improvements do not come with the claimed security.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces Secret Quorums, an abstraction meant to hide the composition of small validator quorums from adaptive adversaries, and proposes an instantiation based on ring verifiable random functions (rVRF). It then presents StealthDust, a fractional-spending protocol that replaces the blind-signature and secret-sharing protections of the prior protocol by Bazzi and Tucci-Piergiovanni [4], claiming a reduction in payment latency from five to three communication steps and in settlement message complexity from O(n^3) to O(n^2), while tolerating a rushing-adaptive adversary. The security argument rests on five lemma sketches for the secret-quorum abstraction and on the assertion that ring signatures plus gossip hide which validators form a quorum until settlement. No end-to-end correctness proof for StealthDust is provided.","tokens_in":16361,"tokens_out":7209,"duration_ms":64996,"significance":"If the central claim were established, Secret Quorums would be a clean and useful abstraction, and StealthDust would be a meaningful efficiency improvement over [4]: it removes the interactive blind-signature step and replaces secret sharing with simpler broadcasts, reducing message complexity. The rVRF-based construction is a natural instantiation, and the paper is clearly organized. However, the advertised adaptive-security property depends on an unmodeled network-layer anonymity assumption, and the protocol-level claims are asserted rather than proved. The contribution is therefore an interesting abstraction with a significant open gap, not a demonstrated secure protocol.","major_comments":[{"comment":"The central adaptive-security claim is unsupported because the protocol has no mechanism that hides the quorum at the network layer. The model explicitly gives the adversary the source, target, and size of each message (Section 3). In the validate protocol the client sends (d, N) to all candidates (Algorithm 1), and each selected validator responds with a ring signature (Algorithm 2, 'send (anonymously via gossip) r to c'). The candidate set is a deterministic public function of d (Algorithm 6), so the adversary can compute it; it then observes which candidates transmit a message after receiving (d, N), and that set is exactly the secret quorum. Batching at the seller hides which transaction a sender validated, but it does not hide which validators send messages. No anonymous broadcast, mixnet, or other anonymous communication primitive is modeled or proved, and Lemma 4 only invokes the cryptographic anonymity of rVRF.Sign. An adversary that observes the responding set (size m < f) can corrupt all of its members before settlement, erase the validation proofs, and break the no-double-spending property. This gap affects the abstract's central claim and the claimed improvement over [4].","section":"§3 model; §6.1, Algorithms 1–2; Lemma 4"},{"comment":"The parameterization V ∈ [m, n] allows V to be close to m, and m < f. Because SelectCandidates(d) is a deterministic public function of the data d, the entire candidate set is known to the adversary in advance. If V ≤ f, the adversary can corrupt all candidates before the VRF selection is even evaluated, so the secret-quorum abstraction provides no protection in that parameter range. The paper neither rules out V ≤ f nor proves security for V close to m; it only notes heuristically that 'security is low' in that regime. Given that the advertised complexity improvement O(V) is what makes small V attractive, this is a load-bearing parameterization issue.","section":"§6.1, parameter V; Algorithm 6"},{"comment":"The correctness of StealthDust is asserted rather than proved: Section 6.2 says 'The correctness of StealthDust is straightforward from the one of secret quorums,' but no theorem connects the four fractional-spending properties of Section 4 to the concrete algorithms in Appendix B. The settlement and redeem protocols replace the secret-sharing steps of [4] with simple broadcasts/gossip of ring-signature proofs, and it is not argued why this substitution preserves safety and liveness under the rushing-adaptive adversary, especially once the quorum can be identified and corrupted as described above. A formal proof or a precise reduction to the properties of Secret Quorums and the (k1,k2)-quorum bounds is needed to support the claimed O(n^2) and O(n) complexity improvements.","section":"§6.2, Appendix B, Algorithms 9–12"}],"minor_comments":[{"comment":"The table contains a typo: 'settlment' should be 'settlement'; the O(·) expressions also have inconsistent spacing and should be typeset uniformly.","section":"Table 1"},{"comment":"The recipient of the ring-signature response is called 'c' (the client) in Algorithm 2, while the surrounding text and Algorithm 8 refer to the seller; the terminology should be aligned to avoid confusion.","section":"§6.1, Algorithms 1–2 and 8"},{"comment":"The expression 'γ(f/n)m' is used in the proof sketch of Lemma 2 without defining γ and m at that point; all parameters should be defined at first use.","section":"§6.1, Lemma 2 proof"},{"comment":"The parenthetical 'minus corrupted but selected validators' in Lemma 4 is not quantified; if V < f, the candidate set minus corrupted validators may be empty, in which case the anonymity statement is vacuous.","section":"§6.1, Lemma 4 proof"}],"recommendation":"reject","confidential_remarks":"The manuscript leans heavily on [4] for the model, the (k1,k2)-quorum bounds, and one of the lemmas; this is self-citation rather than circularity, but it means the independent contribution is the secret-quorum abstraction and its rVRF instantiation. The metadata-leak concern is central and, as written, appears fatal: the protocol gives the adversary a direct way to identify the quorum from observed message sources, and no anonymous communication layer is specified. A resubmission that adds a rigorous network-layer anonymity model and full proofs could be reconsidered."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear Colleague,\n\nRead the Secret Quorums paper. The core abstraction—hiding the validating quorum behind ring signatures from an rVRF sortition—is a genuine extension of secret leader election, and the complexity improvement for fractional spending is meaningful if the security argument holds. The paper is clearly written and honest about the V tradeoff between message complexity and anonymity.\n\nThe problem is that the security argument does not hold under the paper's own network model. Lemma 4 proves ring-signature anonymity within the ring, but the ring is the candidate set of size V, not all validators. When V is smaller than n, the signer is known to be in that smaller set, which violates the abstraction's own anonymity property (\"among Π\"). More seriously, the protocol sends validation responses via gossip, while the model gives the adversary the source, target, and size of every message. Batching transactions does not hide which validators responded; it only hides which response belongs to which transaction. The adversary can corrupt the set of responding validators (size m < f) before settlement, erasing the proofs. No anonymous communication primitive is modeled, and no proof connects ring-signature anonymity to message-source anonymity. This is a load-bearing gap.\n\nCorrectness of StealthDust is also asserted rather than proven; the lemmas are sketches, and there is no end-to-end proof of the fractional-spending properties. On its own that might be acceptable for a conference draft, but combined with the network gap, the headline latency and complexity claims are not yet supported.\n\nWho this is for: people working on committee-based protocols or fair-selection primitives will find the abstraction and the rVRF instantiation worth studying, even if the protocol in its current form needs work.\n\nMy recommendation: reject in current form, but do send it to serious referees. The core idea is salvageable—add an anonymous communication layer or revise the adversary model, then prove anonymity end-to-end. A complete proof of the protocol properties would also be needed. This is a paper that should be pushed toward correctness rather than dismissed.","headline":"Secret quorums is a good abstraction with real complexity wins, but the network-anonymity gap breaks the adaptive-security claim as written.","tokens_in":16938,"tokens_out":5571,"would_cite":false,"duration_ms":50446,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper proposes secret quorums, validator sets whose membership stays hidden until settlement, and uses them to build StealthDust, a fractional-spending protocol that reduces payment latency from five to three communication steps and…","keywords":["distributed systems","blockchain","quorums","fault tolerance","fractional spending","secret quorums","ring verifiable random functions","adaptive adversary"],"falsifier":"Run a traffic-analysis experiment on a realistic gossip network under the paper's stated adversary model: let the adversary observe message metadata (source, target, size, timing) during the payment phase and attempt to match each ring signature to the validator that first forwarded it. If the adversary can link a validator to its signature with probability noticeably above random guessing, the anonymity property in Lemma 4 fails and a small quorum could be identified and corrupted before settlement, breaking no-double-spending.","tokens_in":15839,"feed_emoji":"⚡","tokens_out":8299,"duration_ms":65231,"temperature":0.7,"pith_summary":"This paper argues that committee-based payment protocols can keep small, fast quorums even against adaptive adversaries, provided the quorum's membership stays hidden until settlement succeeds. To that end it introduces secret quorums, an abstraction in which selected validators prove membership through ring signatures that do not reveal which validator signed. The paper shows how to build secret quorums from ring verifiable random functions and presents StealthDust, a fractional-spending protocol that validates a payment in three communication steps instead of five and settles with O($n^{2}$) messages instead of O($n^{3}$). If the construction holds, StealthDust gives the same no-double-spending and liveness guarantees as the original fractional-spending protocol at lower latency and cost.","feed_headline":"Secret quorums cut payment latency from five steps to three","feed_subtitle":"StealthDust hides which validators sign, shrinking settlement cost from O(n^3) to O(n^2) without breaking no-double-spending","key_machinery":"The central object is the secret quorum, a set of expected size k selected from n validators so that selection is unpredictable, each validator is equally likely to be chosen, and a proof of membership reveals nothing about the signer. The machinery that carries the argument is the ring verifiable random function (rVRF), which combines a VRF's unique, verifiable pseudo-random output with a ring signature's anonymity; it does the work of both selecting validators and producing anonymous validation proofs. In StealthDust each candidate validator evaluates the rVRF on a seed derived from the transaction and a client-chosen nonce, and signs with the entire candidate set as the ring, so anyone can verify a proof without knowing who produced it, while the same VRF output value prevents one validator from flooding the proof with duplicate signatures.","core_discovery":"The paper's central claim is that the composition of a validating quorum can be kept secret during payment validation and revealed only after settlement, and that this secrecy is sufficient to resist a rushing-adaptive adversary even when the quorum is smaller than the corruption bound f. It further claims that ring verifiable random functions provide a practical, non-interactive way to implement such secretly selected quorums: a validator uses the VRF to check whether it is selected, and proves membership with a ring signature over the whole candidate set, so no one but the signer learns who was selected. The resulting protocol, StealthDust, is claimed to preserve the safety and liveness properties of the original (k1,k2)-quorum protocol while cutting payment latency from five to three communication steps and settlement message complexity from O($n^{3}$) to O($n^{2}$), and redeem complexity from O($n^{2}$) to O(n).","pith_inferences":["My inference: the batching-plus-gossip anonymity step is the practical bottleneck; a deployment that does not guarantee batched messages would need an explicit anonymous communication mechanism—such as mixnets or onion routing—to preserve the paper's guarantees against a metadata-observing adversary.","My inference: secret quorums are a general tool for any quorum-based protocol; applying them to sharded blockchains or Byzantine reliable broadcast would transfer the same adaptive-adversary resilience at the cost of the V-versus-security trade-off.","My inference: the V parameter creates a tunable anonymity-efficiency frontier; choosing V close to n maximizes anonymity but makes payment cost O(n), while V close to m minimizes cost but shrinks the set a validator hides in, so deployments face a concrete engineering trade-off.","My inference: the no-consensus result for shared funds is tied to fixed-fraction payments; the same argument would not hold for protocols that allow variable payment amounts from a shared account, where the consensus-number bound would re-enter."],"forward_implications":["A payment in StealthDust completes in three communication steps—buyer to seller, seller to candidate validators, and confidential gossip replies back—instead of the five steps of the original protocol.","Settlement drops from O(n^3) to O(n^2) messages and redeem from O(n^2) to O(n), because ring signatures replace the secret-sharing broadcasts that dominated the original cost.","Selection randomness comes from a client-chosen nonce rather than a consensus-based common coin, so StealthDust needs no total order and remains fully asynchronous.","The same secret-quorum abstraction can be attached to any quorum-based validation, not just fractional spending, giving other protocols a defence against adaptive corruption.","Shared multi-owner funds can be handled without consensus because every fractional payment spends the same fraction of the balance, so no owner can infer from the remaining balance which concurrent payment won."],"supporting_citations":[{"why":"defines the fractional spending problem, the (k1,k2)-quorum system, and the five-step protocol with O(n^3) settlement that StealthDust improves.","marker":"[4]"},{"why":"supplies the ring verifiable random function construction used to implement secret quorum selection and anonymous validation proofs.","marker":"[8]"},{"why":"introduces single secret leader election, the concept that secret quorums extend from a single secret winner to a secret set.","marker":"[6]"},{"why":"establishes the consensus number of a cryptocurrency and the asset-transfer model, used to argue StealthDust avoids consensus for shared funds.","marker":"[13]"},{"why":"introduces ring signatures, the anonymity primitive at the core of rVRF signatures.","marker":"[20]"},{"why":"secret sharing, the mechanism in the original protocol that StealthDust replaces with ring signatures to cut settlement complexity.","marker":"[21]"},{"why":"provides the Chernoff bound used to prove that the VRF threshold selects at least k validators with high probability.","marker":"[16]"}],"fun_headline_variants":["Secret Quorums hide validator IDs to foil adaptive attacks","Anonymized quorums cut payment latency by 40%","Secret Quorum selection stops adaptive bribery in blockchains","StealthDust: Secret quorums slash settlement cost","Ring VRF keeps quorum membership secret from adversaries"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The construction assumes that gossiping, together with sellers batching many transaction messages, hides which validator produced which ring signature, even though the adversary is allowed to observe the source, target, and size of every message in the network.","fun_headline_variants_meta":{"raw":{"variants":["Secret Quorums hide validator IDs to foil adaptive attacks","Anonymized quorums cut payment latency by 40%","Secret Quorum selection stops adaptive bribery in blockchains","StealthDust: Secret quorums slash settlement cost","Ring VRF keeps quorum membership secret from adversaries"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000202,"raw_usage":{"total_tokens":1383,"prompt_tokens":945,"completion_tokens":438,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":561,"completion_tokens_details":{"reasoning_tokens":355}},"tokens_in":561,"tokens_out":438,"duration_ms":4195,"temperature":1.0,"reasoning_tokens":355,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T10:23:24.232735+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a traffic-analysis experiment on a realistic gossip network under the paper's stated adversary model: let the adversary observe message metadata (source, target, size, timing) during the payment phase and attempt to match each ring signature to the validator that first forwarded it. If the adversary can link a validator to its signature with probability noticeably above random guessing, the anonymity property in Lemma 4 fails and a small quorum could be identified and corrupted before settlement, breaking no-double-spending.","supporting_citations":[{"cited_title":"In: Gelles, R., Olivetti, D., Kuznetsov, P","cited_arxiv_id":null,"evidence_quote":"defines the fractional spending problem, the (k1,k2)-quorum system, and the five-step protocol with O(n^3) settlement that StealthDust improves."},{"cited_title":"Cryptology ePrint Archive, Paper 2023/002 (2023),https://eprint.iacr.org/2023/002,https://eprint","cited_arxiv_id":null,"evidence_quote":"supplies the ring verifiable random function construction used to implement secret quorum selection and anonymous validation proofs."},{"cited_title":"In: Proceedings of the 2nd ACM Conference on Advances in Financial Technolo- gies","cited_arxiv_id":null,"evidence_quote":"introduces single secret leader election, the concept that secret quorums extend from a single secret winner to a secret set."},{"cited_title":"In: Robinson, P., Ellen, F","cited_arxiv_id":null,"evidence_quote":"establishes the consensus number of a cryptocurrency and the asset-transfer model, used to argue StealthDust avoids consensus for shared funds."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"secret sharing, the mechanism in the original protocol that StealthDust replaces with ring signatures to cut settlement complexity."},{"cited_title":"Cambridge University Press, USA (2005)","cited_arxiv_id":null,"evidence_quote":"provides the Chernoff bound used to prove that the VRF threshold selects at least k validators with high probability."}],"review_version":1}