{"id":"17d1d54f-0ce6-46bd-a62c-e40ee26fcfba","arxiv_id":"2501.05053","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"TAPFed introduces a threshold functional encryption scheme that lets federated learning aggregate encrypted model updates across multiple independent aggregators while tolerating up to t-1 malicious ones.","lead":"TAPFed is a privacy tool for federated learning: it encrypts each participant's model update so that no single aggregator, or small group of colluding aggregators, can read the intermediate model. If correct, it would cut communication cost while defending against recently demonstrated inference attacks.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Section 5.1's SEL-SIM proof simulates over Z_L, never uses DDH, and does not address the actual group ciphertexts; threshold security is therefore unproven.","rationale":"The paper's central claim is that TAPFed prevents any set of fewer than t malicious aggregators from learning intermediate aggregated models. This rests entirely on Theorem 1 (Section 5.1), which asserts SEL-SIM security for the tMCFE scheme under DDH. The proof as written does not engage with the scheme's actual ciphertexts: for case (i) it builds a simulator over Z_L (uuu_i ←$ Z_L, ct_i ← uuu_i mod L) and concludes Adv=0, an information-theoretic statement. The real ciphertexts live in G and contain terms g^{xxx_i+H(l)UUU_i} ∘ (g^{ααα^⊺WWW_i})^{r_i} and g^{ααα r_i}; the proof never shows these are indistinguishable from simulated values, and DDH is never used. The case (ii) argument is a bare appeal to Shamir's secret sharing without verifying that the DKGenerate key shares are valid Shamir shares of a consistent master key. Thus the security guarantee that differentiates TAPFed from prior work is unsupported. The CombineDecrypt discrete-log concern raised by the reader is real but secondary: it is a feasibility/implementation gap that could be fixed by specifying a plaintext bound and using Pollard's lambda, whereas the security proof would require a complete rewrite. The experimental results and the DDH-based construction are plausible, but the formal security analysis—a stated contribution—does not hold up as written.","tokens_in":21993,"tokens_out":10072,"duration_ms":99443,"concrete_test":"Re-derive Theorem 1 by writing the real encryption distributions from Section 3.4 (cti,0 = g^{xxx_i+H(l)UUU_i} ∘ (g^{ααα^⊺WWW_i})^{r_i}, cti,1 = ∏(g^{ααα})^{r_i}) and the claimed simulator's outputs side by side in the same group G, then identify explicitly where the DDH assumption is used to transition from real to simulated ciphertexts. If, as in the paper, the simulator only samples uuu_i ←$ Z_L and the proof never maps to G or invokes DDH, the reduction fails and Theorem 1 is unproven.","verdict_should_be":"REJECT","load_bearing_attack":"The paper's central claim—that fewer than t malicious aggregators cannot learn intermediate aggregated models—rests entirely on Theorem 1 (Section 5.1), which asserts selective simulation-based security for the tMCFE scheme under DDH. The proof for encrypted data defines a simulator over Z_L (uuu_i ←$ Z_L, cti ← uuu_i mod L) and concludes Adv=0, an information-theoretic statement. It never constructs a simulator for the actual group elements cti,0 = g^{xxx_i+H(l)UUU_i} ∘ (g^{ααα^⊺WWW_i})^{r_i}, cti,1 = ∏(g^{ααα})^{r_i} from Section 3.4, and DDH is never invoked. The argument for threshold functionality is a bare appeal to Shamir's secret sharing without showing that the DKGenerate key shares are valid Shamir shares of a consistent master key. Since the paper's privacy guarantees against gradient, disaggregation, isolation, replay, and collusion attacks all rely on this theorem, the headline contribution is unsupported as written.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes TAPFed, a privacy-preserving federated learning framework that uses a threshold multi-client functional encryption (tMCFE) scheme to allow multiple independent aggregators to perform secure aggregation without any aggregator learning the intermediate aggregated model. The authors claim DDH-based selective simulation security for the cryptographic scheme, defense against gradient, disaggregation, isolation, replay, and collusion attacks, and experimental results showing model quality comparable to baselines with 29%-45% lower transmission overhead. The presentation includes the scheme construction, a security proof in Section 5.1, and an evaluation with several baselines in simulated and cloud settings.","tokens_in":22189,"tokens_out":6087,"duration_ms":59985,"significance":"If the central security claim were valid, TAPFed would be a notable step: it removes the need for peer-to-peer aggregator communication, tolerates up to t-1 malicious aggregators, and directly addresses disaggregation attacks that affect single-aggregator secure aggregation. The experimental evaluation is broad, covering multiple baselines and two deployment settings, and the paper is explicit about its scope (cross-silo FL, excluding poisoning and backdoor attacks). However, the core cryptographic proof does not establish security for the scheme as constructed, and the decryption procedure is not shown to be efficient for the intended model-update magnitudes. The contribution is therefore not established as presented.","major_comments":[{"comment":"The proof for encrypted data simulates ciphertexts as uuui selected uniformly from Z_L and concludes Adv=0, an information-theoretic statement. The actual scheme in Section 3.4 encrypts in a group G of prime order p, with ciphertexts cti,0 = g^{xxxi+H(l)UUU_i} ∘ (g^{ααα^⊺WWW_i})^{r_i} and cti,1 = ∏(g^{ααα})^{r_i}. The proof never constructs a simulator for these group elements, never invokes DDH, and gives no reduction from the real ciphertext distribution to the simulated one. Consequently, the claimed SEL-SIM security of the tMCFE scheme is unproven, and the attack-resistance claims in Section 5.2 rest on an unproven theorem.","section":"Section 5.1, Theorem 1"},{"comment":"The algorithm recovers fMCIP({xxxi}, yyy) by computing 1/2 log(D), where D is an element of G. No bound is given on the magnitude of the inner product ⟨{xxxi}, yyy⟩, and no discrete-log algorithm (e.g., Pollard's lambda or baby-step giant-step) is specified. For a group of order p with λ=256, recovering the exponent is computationally infeasible unless the exponent is known to lie in a small, enumerable range. The paper's encoding precision pr and the dimension of the model updates are not used to justify such a bound, so the protocol's ability to recover the global model in practice is not established.","section":"Section 3.4, CombineDecrypt"},{"comment":"The argument that threshold security follows from Shamir's secret sharing is a bare assertion. The DKGenerate algorithm defines polynomials f^(0)(x) = Σ a_k x^k and f^(i)(x) = Σ b_{i,k} x^k, and the key shares are evaluations of these polynomials at the aggregator indices. The proof does not show that the joint distribution of any t-1 shares is independent of the master secret, nor does it account for the additional terms H(l)Σ⟨yyy_i,UUU_i⟩ and ⟨yyy_i,WWW_i⟩. No formal reduction to the security of Shamir's scheme is provided, so the claim that no set of fewer than t aggregators can learn the intermediate aggregated model is unsupported.","section":"Section 5.1, Security for Functionality Result"},{"comment":"The proof conflates 'corrupted participants' with 'sharing decryptors' and 'combining decryptors', while the TAPFed threat model in Section 4.1 allows up to t-1 malicious aggregators. The mapping between these roles and the aggregators/parties in the FL framework is not made explicit, and the proof never analyzes the actual adversary in TAPFed (an aggregator with a functional decryption key share who observes ciphertexts from parties). This disconnect further weakens the relevance of the proof to the framework's privacy claims.","section":"Section 5.1"}],"minor_comments":[{"comment":"The notation g^{xxxi+H(l)UUU_i} applies exponentiation to a vector, and the operation ∘ is described as 'element-wise multiplication'. Please clarify that the group is G^η with component-wise operations, and define H as a hash function with values in Z_p (or G) explicitly; the current description says H is 'onto G' but then uses H(l) in the exponent.","section":"Section 3.4"},{"comment":"The correctness derivation shows D = g^{2 fMCFE(...)}; the final step '1/2 log(D)' should state explicitly that the logarithm is taken to base g, and the fact that g^2 is the effective generator should be noted.","section":"Section 3.4.1"},{"comment":"The abstract reports 'reducing transmission overhead by 29%-45%', but Section 6.2.1 also reports a 70.8% reduction against HybridOne. Please reconcile the claimed range with the reported numbers.","section":"Abstract and Section 6.2.1"},{"comment":"The input description contains a typo: 'traingin' should be 'training'.","section":"Algorithm 1"},{"comment":"The paper does not state the concrete security parameter λ used in the experiments, only that the group size is 256 bits. For reproducibility, please report λ and the concrete group generation algorithm.","section":"Section 6.1"},{"comment":"The y-axis label 'payload/party(one attempt)' is unclear; please specify whether this is cumulative over training rounds or per round, and define 'one attempt'.","section":"Figure 7"}],"recommendation":"reject","confidential_remarks":"The manuscript has already appeared in IEEE TDSC. My assessment of this arXiv version is that the security proof does not address the actual construction and the decryption efficiency is not established; these are load-bearing issues that would require a substantially rewritten proof and scheme analysis to resolve. I recommend rejection for this version."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is an incremental but genuinely useful construction—inner-product multi-client FE with a Shamir threshold layer to support multiple independent aggregators without peer-to-peer links—but the central security theorem is not proven in the text. The gap is not stylistic; the simulator in Section 5.1 works over Z_L and never touches the group elements the scheme actually uses, so DDH is never invoked. You can't fix that with wording.\n\nWhat's good: the problem is real. Disaggregation attacks against single-aggregator FE-based FL have been shown, and spreading trust over t-of-s aggregators without requiring pairwise channels is a sensible design target. The tMCFE construction is a natural extension of Abdalla et al. and the authors' own HybridAlpha/DeTrust-FL line, and the experiments compare against five baselines in both simulated and cloud settings, with three runs; the 29-45% transmission reduction is plausible given the ciphertexts are group elements rather than paired encryptions. The dropout handling and fusion-weight compliance module are also thoughtful engineering.\n\nWhere it falls down: two load-bearing issues. (1) Theorem 1's proof simulates over Z_L, sets cti = uu_i mod L, and claims advantage zero because the distributions are identical. That's an information-theoretic statement in the wrong group. The actual ciphertexts are group elements; the simulator never constructs them, and the reduction to DDH is absent. Security for encrypted data against t-1 corrupt aggregators is therefore unestablished. The threshold part is just an appeal to Shamir without showing the DKGenerate shares are valid Shamir shares of a consistent secret. (2) CombineDecrypt recovers the inner product as 1/2 log_g(D). That is feasible only if the summed inner product is in a small range; the paper gives no bound on model updates times fusion weights, and no algorithm beyond logging. With 1.2M parameters and precision 4, the exponent is enormous. This is a practical blocking issue, not a nitpick.\n\nAlso worth noting: the paper claims SEL-SIM security but the proof doesn't match the definition.\n\nBottom line: the system and experiments are worth reading, but the privacy claim that drives the whole paper is unverified as written. This deserves a serious referee if it were resubmitted, but I would not cite the security result until the proof is repaired. For a reading group, it's a good case study in spotting a simulator that proves the wrong game.","headline":"A real construction undermined by a security proof that simulates in the wrong group and a missing discrete-log feasibility condition.","tokens_in":22728,"tokens_out":3095,"would_cite":false,"duration_ms":27698,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["94A60","68P25"],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper proposes TAPFed, a threshold functional encryption scheme for inner products that lets federated learning aggregate encrypted model updates across independent aggregators with no peer-to-peer communication, tolerating up to t−1…","keywords":["threshold functional encryption","secure aggregation","privacy-preserving federated learning","inner product functional encryption","DDH assumption","malicious aggregators","disaggregation attack","multi-client functional encryption"],"falsifier":"Run a single TAPFed aggregation round with the paper's own CNN-MNIST setting (1,199,882 parameters, five parties, encoding precision 4) and measure the time CombineDecrypt takes to recover the inner product from $D$; if recovery requires searching a range comparable to the 256-bit group order rather than a small polynomial-time range, the claimed correctness and practicality of TAPFed collapse. Concretely, an implementation that only applies the stated $\\frac{1}{2}\\log_g(D)$ formula without an additional small-range discrete-log algorithm would fail to complete on realistic model magnitudes.","tokens_in":21780,"feed_emoji":"🔐","tokens_out":5783,"duration_ms":57124,"temperature":0.7,"pith_summary":"TAPFed aims to close a gap in privacy-preserving federated learning: existing secure aggregation schemes either rely on a single honest-but-curious aggregator and leak intermediate aggregated models to inference attacks, or they require multiple aggregators to communicate peer-to-peer, creating scalability and single-point-of-failure problems. The paper's central claim is that a threshold variant of multi-client functional encryption can give each aggregator only a partial decryption capability, so no single aggregator or colluding group below a threshold can recover the intermediate global model. A party that collects enough partial results can reconstruct the exact aggregated inner product, making the scheme practical for cross-silo FL. If correct, TAPFed provides a communication-light, hardware-free secure aggregation primitive that resists gradient inference, disaggregation, isolation, replay, and collusion attacks while offering comparable accuracy and training time to existing crypto-based baselines.","feed_headline":"New encryption cuts federated learning data traffic by 29-45%","feed_subtitle":"TAPFed's threshold encryption hides intermediate models from aggregators without peer-to-peer links.","key_machinery":"The load-bearing object is the threshold multi-client functional encryption (tMCFE) scheme for the inner-product functionality fMCIP. It works by having each party encrypt its model update under a round label, having each independent aggregator apply its Shamir-shared functional decryption key to produce a partially decrypted ciphertext, and having a party combine any t partial results to obtain a value $D = g^{2 f_{\\text{MCIP}}(\\{x_i\\}, y)}$, from which the inner product is recovered as $\\frac{1}{2}\\log_g(D)$. The DDH instantiation keeps the ciphertexts compact, the label mechanism prevents cross-round replay, and the threshold property guarantees that no group of fewer than t aggregators can reconstruct an intermediate aggregated model.","core_discovery":"TAPFed introduces a t-of-s threshold multi-client functional encryption (tMCFE) scheme, built on the Decisional Diffie-Hellman assumption, that securely computes an inner product over encrypted model updates. The scheme distributes functional decryption keys via Shamir secret sharing: each of s independent aggregators receives a key share and performs a partial decryption on the set of encrypted updates, outputting an encrypted aggregated fragment without ever seeing it in plaintext. A party combines the fragments from any t aggregators using Lagrange interpolation and recovers the global model update as an inner product of the encoded updates with a fusion weight vector. Because ciphertexts carry a per-round cryptographic label and the combined output remains hidden from aggregators below the threshold, TAPFed blocks the intermediate-model disclosure that enables recent inference attacks. The paper reports equivalent model quality to state-of-the-art baselines while reducing per-party transmission payload by 29%–45% across MNIST and CIFAR10 experiments, and argues formally that the scheme achieves selective simulation-based security under DDH.","pith_inferences":["The same tMCFE inner-product primitive could be reused outside federated learning, for example for privacy-preserving similarity search, statistical analysis, or secure evaluation of linear functions over data held by multiple parties, with the label serving as a query or session identifier.","The practicality of the scheme hinges on the discrete-logarithm step in CombineDecrypt: the paper does not specify an algorithm such as Pollard's lambda or baby-step giant-step, nor does it bound how large the encoded inner product can grow; for very large models or many clients, this step could become computationally infeasible.","The threat model explicitly covers malicious aggregators, but not collusion between parties and aggregators; since parties legitimately learn the global model, a party that colludes with t−1 aggregators could combine its own knowledge with partial results to bypass the threshold guarantee, an edge case the paper leaves unexamined.","TAPFed's 29–45% overhead reduction is measured against single-aggregator FE/HE baselines; in a distributed deployment the communication topology change (no P2P links between aggregators) may yield additional latency improvements that the simulation-based experiments do not fully capture."],"forward_implications":["No single aggregator can ever see an intermediate aggregated model in plaintext, so gradient inference, disaggregation, isolation, and replay attacks launched by a curious or malicious aggregator are blocked by design.","Any coalition of fewer than t colluding aggregators still cannot recover the aggregated model, giving a tunable trust threshold rather than assuming honest-but-curious behavior.","Both average and weighted fusion (including FedAvg-style sample-size weighting) are supported, and personalized federated learning can be realized by using per-party labels and fusion weight vectors.","The scheme naturally handles party dropout and aggregator dropout (up to t stragglers), without requiring aggregator-to-aggregator communication, removing a single point of failure.","The reduced ciphertext payload size, combined with DP integration for final-model privacy, makes the approach suitable for cross-silo deployments where communication is the bottleneck."],"supporting_citations":[{"why":"Provides the multi-client functional encryption construction and the selective simulation-based security definition that the threshold scheme builds on.","marker":"[43]"},{"why":"Supplies the decentralized multi-client FE approach with labels, which the paper adapts to the threshold setting.","marker":"[44]"},{"why":"Shamir's secret sharing is used to split the functional decryption key into t-of-s shares, giving the threshold property.","marker":"[49]"},{"why":"Demonstrates the disaggregation, isolation, and replay attacks that TAPFed explicitly claims to defend against.","marker":"[18]"},{"why":"HybridAlpha is the MIFE-based baseline whose intermediate-model leakage motivates the threshold design and whose overhead is compared in the evaluation.","marker":"[10]"},{"why":"BatchCrypt, a Paillier HE baseline, is used as a comparison point for transmission overhead and training time.","marker":"[17]"},{"why":"HybridOne, a threshold Paillier baseline, provides an additional comparison for overhead and attack resistance.","marker":"[11]"},{"why":"Defines the functional encryption functionality and scheme semantics used in the paper's formal definitions.","marker":"[48]"}],"fun_headline_variants":["Federated learning traffic drops up to 45% with threshold encryption","TAPFed cuts transmission overhead 29-45% while keeping model quality","Threshold encryption defends federated learning from inference attacks, cuts traffic","Secure aggregation with 45% less data: TAPFed's threshold scheme","Federated learning's privacy fix: threshold encryption, 45% less traffic"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The correctness of TAPFed depends on the final step, computing $\\frac{1}{2}\\log_g(D)$, being computationally feasible, which holds only when the encoded inner-product sum stays in a small, enumerable range; the paper never bounds how large this sum grows as model sizes and client counts increase.","fun_headline_variants_meta":{"raw":{"variants":["Federated learning traffic drops up to 45% with threshold encryption","TAPFed cuts transmission overhead 29-45% while keeping model quality","Threshold encryption defends federated learning from inference attacks, cuts traffic","Secure aggregation with 45% less data: TAPFed's threshold scheme","Federated learning's privacy fix: threshold encryption, 45% less traffic"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000674,"raw_usage":{"total_tokens":3075,"prompt_tokens":961,"completion_tokens":2114,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":577,"completion_tokens_details":{"reasoning_tokens":2016}},"tokens_in":577,"tokens_out":2114,"duration_ms":14375,"temperature":1.0,"reasoning_tokens":2016,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T21:20:21.705056+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a single TAPFed aggregation round with the paper's own CNN-MNIST setting (1,199,882 parameters, five parties, encoding precision 4) and measure the time CombineDecrypt takes to recover the inner product from $D$; if recovery requires searching a range comparable to the 256-bit group order rather than a small polynomial-time range, the claimed correctness and practicality of TAPFed collapse. Concretely, an implementation that only applies the stated $\\frac{1}{2}\\log_g(D)$ formula without an additional small-range discrete-log algorithm would fail to complete on realistic model magnitudes.","supporting_citations":[{"cited_title":"Multi- input functional encryption for inner products: function-hiding realizations and constructions without pairings,","cited_arxiv_id":null,"evidence_quote":"Provides the multi-client functional encryption construction and the selective simulation-based security definition that the threshold scheme builds on."},{"cited_title":"Decentralized multi-client functional encryption for inner prod- uct,","cited_arxiv_id":null,"evidence_quote":"Supplies the decentralized multi-client FE approach with labels, which the paper adapts to the threshold setting."},{"cited_title":"How to share a secret,","cited_arxiv_id":null,"evidence_quote":"Shamir's secret sharing is used to split the functional decryption key into t-of-s shares, giving the threshold property."},{"cited_title":"Detrust-fl: Privacy-preserving federated learning in decentral- ized trust setting,","cited_arxiv_id":null,"evidence_quote":"Demonstrates the disaggregation, isolation, and replay attacks that TAPFed explicitly claims to defend against."},{"cited_title":"Hy- bridalpha: An efficient approach for privacy-preserving federated learning,","cited_arxiv_id":null,"evidence_quote":"HybridAlpha is the MIFE-based baseline whose intermediate-model leakage motivates the threshold design and whose overhead is compared in the evaluation."},{"cited_title":"Batchcrypt: Ef- ficient homomorphic encryption for cross-silo federated learning,","cited_arxiv_id":null,"evidence_quote":"BatchCrypt, a Paillier HE baseline, is used as a comparison point for transmission overhead and training time."},{"cited_title":"A hybrid approach to privacy-preserving federated learning,","cited_arxiv_id":null,"evidence_quote":"HybridOne, a threshold Paillier baseline, provides an additional comparison for overhead and attack resistance."},{"cited_title":"Functional encryption: Defini- tions and challenges,","cited_arxiv_id":null,"evidence_quote":"Defines the functional encryption functionality and scheme semantics used in the paper's formal definitions."}],"review_version":1}