{"id":"8cf35efd-4dcf-4532-881a-e650882f0deb","arxiv_id":"2505.05751","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Beskar combines one-round post-quantum secure aggregation with precomputed signatures and masks, plus differential privacy at multiple stages, to protect gradients, intermediate models, and deployed models in federated learning.","lead":"This paper presents Beskar, a federated learning protocol that uses post-quantum cryptography and differential privacy to protect user data during training. A generalist might read it to see how private AI can be made practical under future quantum threats.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Modified Dilithium variant in Algorithm 5 lacks a specified Verify and an EU-CMA proof, yet the entire post-quantum security claim depends on it.","rationale":"The reader's weakest_assumption identifies exactly the point on which the paper's central claim turns. Beskar's headline contribution is post-quantum secure aggregation in one round. The masking scheme protects individual updates only if the adversary cannot forge or replay the signed messages that determine which masks are included in the aggregate; this is the role of the digital signature in the Theorem 1 hybrid argument. The paper replaces standard Dilithium with Algorithm 5, a message-independent precomputation variant, but supplies no security proof for this variant and no matching verification algorithm. This is not merely a question of outside consensus: the protocol as written may be internally inconsistent because Algorithm 4's Verify checks c = H(mu||w1') while Algorithm 5's precomputation path signs with c = H(m||u||w1). If the released code's Verify is also modified, the modified scheme still lacks an EU-CMA reduction. The concern can be settled by inspecting the verification code and by attempting a forking-lemma reduction for the modified hash input. Other issues, such as the sketchy hybrid proof, missing error bars, and lack of a commit hash, are secondary and affect confidence but not the logical core. I therefore agree with the reader's CONDITIONAL verdict and recommend no change.","tokens_in":26537,"tokens_out":11601,"duration_ms":125333,"concrete_test":"Inspect the released implementation at github.com/kydahe/Beskar and determine which verification routine is used with Algorithm 5 signatures. First, generate a signature from the precomputation path and run the code's Verify: if it fails, the protocol as specified does not function. Second, if verification passes, attempt to adapt the standard Dilithium EU-CMA reduction (Forking Lemma) to the variant with c = H(m||u||w1) and message-independent y; if the reduction cannot be completed and no standalone security proof is provided, the post-quantum security claim in Theorem 1 is unsupported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central security claim reduces to the EU-CMA security of the modified Dilithium scheme in Algorithm 5. In this variant, the signer precomputes u = CRH(tr) and generates the masking vector y from ExpandMask(K||u||kappa) independently of the message, then sets c = H(m||u||w1). Standard Dilithium instead sets mu = CRH(tr||m) and uses c = H(mu||w1). The paper gives no proof that this variant preserves EU-CMA against a quantum adversary, and the Theorem 1 proof invokes only generic EU-CMA (Definition 8) without addressing the modification. Furthermore, Algorithm 4's Verify uses the standard check c = H(mu||w1'), and no modified verification algorithm is specified, so it is unclear how signatures from the precomputation path are accepted at all. If the implementation's Verify still uses mu, the precomputation path is functionally broken; if Verify is modified to use u, its security is unproven. Since these signatures authenticate the masking terms on which the one-round aggregation depends, a forgery against this variant would break the hybrid argument and the claimed post-quantum privacy of Beskar.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes Beskar, a federated learning framework that combines a one-round post-quantum secure aggregation protocol (based on Kyber KEM, Dilithium signatures, precomputed masks, and assisting nodes) with differential privacy applied at the client (LDP) and server (CDP) levels. It defines three threat models (TM1-TM3) and claims high dropout resilience, post-quantum security, and large efficiency gains from two precomputation strategies. The paper includes an analytical comparison, an implementation, and experiments on efficiency and model accuracy under various DP settings.","tokens_in":26799,"tokens_out":10841,"duration_ms":108778,"significance":"The protocol structure has clear practical motivation: one-round secure aggregation with only k assisting nodes, precomputed masks to avoid per-iteration PRF computation, and precomputed Dilithium parameters to reduce signing cost are sensible engineering ideas. The evaluation against Flamingo, PQSA, e-SeaFL, and MicroFedML provides a useful comparison, and the reproduction of DP trade-offs across five datasets is a helpful reference for practitioners. If the security proof were complete, the paper would be a solid systems contribution to post-quantum FL. The main obstacle is that the security of the actual, optimized signature scheme is not established.","major_comments":[{"comment":"The precomputation signing path in Algorithm 5 computes u = CRH(tr) and c = H(m||u||w1), whereas the fallback path and the standard Dilithium verification in Algorithm 4 are based on mu = CRH(tr||m) (in the fallback) or on H(m||w1') (in the printed Verify). No verification algorithm is specified for signatures generated by the precomputation path, so it is unclear how they pass verification in Algorithm 2. If verification is modified to accept the u-based challenge, the modified scheme is not covered by the EU-CMA security of Dilithium; if it is not modified, the precomputation path is functionally unusable. The proof of Theorem 1 invokes generic EU-CMA (Definition 8) and uses Pi.Sign, not the PSgn routine with LS actually executed by the protocol. The authors must either prove EU-CMA for the u-based variant (or design the optimization so that the standard Fiat-Shamir transform is preserved) and provide a matching, secure verification procedure.","section":"Appendix A, Algorithm 5; Section IV-F"},{"comment":"The contribution states that the optimizations yield '134x, 1.1x, and 1233x' improvements in the aggregation phase with 1,000 clients. Table III for N=1000 gives client times 134 ms (without) and 2 ms (with), i.e., a 67x speedup, not 134x; the 134x figure appears to be the absolute precomputation-free time rather than a ratio. The server ratio is 417/377 about 1.1x and the assisting node ratio is 43144/35 about 1233x, so the client number should be corrected.","section":"Section I-A; Section V-B, Table III"},{"comment":"The high dropout resilience claimed in Table I is only fully specified for client dropouts. For assisting-node dropout, the paper says a simple secret-sharing scheme can be used to distribute a node's secret among other assisting nodes, but no protocol, threshold, or security analysis is given. Since the aggregation server requires the aggregated masking terms from the assisting nodes, a dropout or compromise pattern not covered by this sketch could affect the one-round and privacy guarantees. Please specify the mechanism and account for it in the security analysis, or soften the claim.","section":"Section IV-C"}],"minor_comments":[{"comment":"Definitions 6 and 7 in the main text are renumbered as Definitions 8 and 9 in the appendix and in the proof of Theorem 1; align the numbering to avoid confusion.","section":"Section III-C vs Appendix B"},{"comment":"The practice of reporting the highest accuracy across five training runs, without mean or variance, makes it difficult to assess whether the differences in Table IV are significant; please report error bars or standard deviations.","section":"Section V-B"},{"comment":"The efficiency experiments use a gradient vector size of 16,000 while the deep models in Table IV have far more parameters; please note that the timing results are for synthetic gradients and may not translate directly to the evaluated models.","section":"Section V-D"},{"comment":"The sentence 'checks if |LS,t| = |L1,t| = ... = |Lk,t|, does not hold it aborts' should be rewritten as 'aborts if the equality does not hold.'","section":"Algorithm 2, step 4"},{"comment":"There is a stray 's' in the acknowledgment after the first sentence, and the word 'clinets' appears in Section V-B instead of 'clients.'","section":"Acknowledgment and Section V-B"},{"comment":"The expression 'P j e QL xj' is garbled; the intended summation over the subset should be written clearly.","section":"Definition 3"}],"recommendation":"major_revision","confidential_remarks":"The paper is a realistic systems contribution, and the main theoretical gap is fixable: the authors can prove the u-based Dilithium variant or redesign the precomputation so the standard Fiat-Shamir transform is retained. The misreported speedup and the assisting-node dropout sketch are also addressable in revision. I recommend major revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The headline is the modified Dilithium inside the one-round aggregation. Algorithm 5 precomputes c = H(m||u||w1) with u = CRH(tr), while standard Dilithium checks c = H(CRH(tr||m)||w1'). No matching Verify is given for the precomputed path. As written, the protocol's own verification algorithm rejects signatures from the precomputation path, and if the authors implemented a modified verifier, its EU-CMA security is never argued. The Theorem 1 proof invokes only the generic signature notion, so the gap is load-bearing: the masking authenticity that the whole one-round aggregation depends on is unproven. This is the main thing to fix in a revision.\n\nWhat is actually new and good: the instantiation of e-SeaFL with Kyber and Dilithium, two precomputation strategies that cut client and assisting-node cost dramatically, and a careful comparison of CDP vs. LDP under three threat models. The efficiency numbers in Table III are striking, and the DP trade-off study is a useful addition even if LDP accuracy on CIFAR-100 is near zero. The paper ships code, which earns credit.\n\nSoft spots beyond the verification issue: the reported \"134x\" speedup is the best case across client counts and mostly reflects the assisting-node gain, not the client; the client-side gain is about 67x at n=1000, still good but not as advertised. Accuracy numbers are best-of-five runs with no error bars, which overstates the DP utility results. The novelty is incremental relative to e-SeaFL, and the \"first comprehensive threat model\" claim is a bit strong.\n\nI disagree with the reader only in emphasis: the stress-test concern is real and should block acceptance as-is, but the rest of the protocol structure is plausible and the precomputation work is sound enough to warrant a serious referee. The paper is for people building private FL under post-quantum mandates and wanting a one-round, high-dropout-resilience protocol; they should be told to read it carefully around the signature scheme.\n\nVerdict: send it to peer review, but expect the security analysis to be redone for the precomputed Dilithium variant and the verification algorithm to be specified precisely. With that revision, it becomes a solid systems contribution.","headline":"Useful post-quantum upgrade of e-SeaFL with real efficiency gains, but the modified Dilithium variant lacks a specified Verify and a proof, leaving the core security claim unsubstantiated.","tokens_in":27310,"tokens_out":3577,"would_cite":true,"duration_ms":36089,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that Beskar is the first federated learning framework to combine one-round, high-dropout-resilient secure aggregation with post-quantum cryptography and differential privacy, protecting user data during training and…","keywords":["post-quantum cryptography","secure aggregation","federated learning","differential privacy","Dilithium precomputation","Kyber key encapsulation","dropout resilience"],"falsifier":"Run the protocol with two honest clients, two assisting nodes, and a malicious server plus one malicious assisting node; if the server can recover either honest client's plaintext gradient from the masked updates and the honest node's mask sum, Theorem 1's privacy claim fails. A second check is to feed the modified signing algorithm a long sequence of messages and test whether any two published signatures reuse the same commitment value w1 or masking vector y; a reuse would immediately undermine unforgeability, which the paper's claims rule out.","tokens_in":26369,"feed_emoji":"🔐","tokens_out":7317,"duration_ms":84118,"temperature":0.7,"pith_summary":"Beskar sets out to show that a federated learning system can have post-quantum secure aggregation, differential privacy, and one-round communication at the same time, rather than trading one against the other. The protocol masks every client gradient with precomputed shared-secret masks, so the aggregation server only ever sees the sum, and it adds DP noise on the client side (LDP) or the server side (CDP) depending on which adversary must be stopped. The paper argues this combination is the first to handle high user dropout rates without extra communication rounds while keeping security against quantum attackers. If the claims hold, an organization could deploy privacy-preserving FL with minimal client computation and choose the DP placement to match whether it distrusts the server, the clients, or both. A sympathetic reader would care because existing secure-aggregation schemes are usually classical and multi-round, while DP-only defenses leave individual updates exposed.","feed_headline":"One-round post-quantum private federated learning","feed_subtitle":"A single aggregation round keeps gradients masked with post-quantum crypto and differential privacy.","key_machinery":"The load-bearing mechanism is the precomputed mask table: each client and each assisting node evaluate a pseudorandom function on the shared secrets and iteration number T times during setup, so the runtime aggregation needs only table lookups, additions, and signature operations. The second mechanism is a precomputation strategy for Dilithium (Algorithm 5) that stores candidate masking vectors y and their commitments w1; signing then computes c=H(m||u||w1) from stored values and only runs the original signing loop when the precomputed list is exhausted. These two mechanisms are what make the one-round protocol efficient, and the whole privacy argument depends on them: the masks must be unpredictable to the server, and the signatures must be unforgeable.","core_discovery":"The central claim is that masking can be moved almost entirely offline: in a one-time setup, each client derives T mask vectors from PRF evaluations on secrets shared with k assisting nodes, and the assisting nodes precompute the corresponding sums, so at every training iteration a client sends only one masked update and a signed participation message. The server verifies signatures, checks that all participant lists match, sums the masked updates, and subtracts the assisting nodes' mask sums to obtain the global model exactly as in plain FL. The paper further claims this design, instantiated with the Kyber key-encapsulation mechanism and an optimized Dilithium signature, is the only one among compared schemes that combines a single aggregation round, high dropout resilience, post-quantum security, and protection of user data during and after training. Differential privacy is layered on top according to three threat models: LDP when the server is the adversary, CDP when clients are the adversary, and both when full-stack privacy is required.","pith_inferences":["The proof's black-box EU-CMA assumption leaves the modified Dilithium variant in Algorithm 5 unanalyzed; a natural next step is either a direct security proof for the precomputed hash chain or a return to the standard signing hash.","Because masks are derived from PRF outputs over shared secrets, the same design could trade the precomputed mask table for on-the-fly PRF evaluation on devices with more CPU than memory, shifting the paper's efficiency profile without changing its privacy argument.","The DP results suggest a deployment heuristic the paper does not state: for a fixed privacy budget on a hard dataset, CDP should be preferred when the server is trusted, while LDP's accuracy cost should be budgeted explicitly when the server is not.","The reported accuracy gap between LDP and CDP on CIFAR-100 hints that local noise scales poorly with input complexity, which a practitioner would need to verify on their own data before committing to an untrusted-server deployment."],"forward_implications":["A client's runtime work stays constant as the number of clients grows, since the client only masks, signs, and sends; all per-client verification falls on the server and assisting nodes.","Dropouts stop adding protocol rounds: as long as the fraction of online clients stays above alpha, aggregation proceeds by simply ignoring the dropped clients' masks.","Deployments can choose DP placement by threat model: LDP protects gradients from a malicious server, CDP protects intermediate and final models from malicious clients, and both together cover the full stack.","Post-quantum confidentiality and authenticity are inherited from the lattice-based KEM and signature schemes, so the protocol's privacy guarantees are aimed at adversaries with quantum computers."],"supporting_citations":[{"why":"Defines the practical secure aggregation setting and dropout handling that Beskar builds on.","marker":"[4]"},{"why":"Introduces the alpha-summation ideal functionality that supplies the privacy definition and dropout-threshold logic.","marker":"[36]"},{"why":"Multi-round single-server secure aggregation baseline that Beskar compares against on rounds, dropout resilience, and post-quantum security.","marker":"[26]"},{"why":"Malicious-secure aggregation baseline with linear per-client operations, used for the efficiency comparison.","marker":"[27]"},{"why":"Efficient secure aggregation with assisting nodes, the structural predecessor of Beskar's masking and unmasking design.","marker":"[6]"},{"why":"Kyber lattice key-encapsulation mechanism whose IND-CCA security backs the post-quantum confidentiality of shared secrets.","marker":"[29]"},{"why":"Dilithium lattice signature scheme whose hardness assumptions back the authentication and integrity of the protocol.","marker":"[28]"},{"why":"DP-SGD, the differentially private training method that Beskar adapts to the federated setting.","marker":"[18]"},{"why":"Defines (epsilon, delta)-differential privacy, which underlies the LDP and CDP guarantees.","marker":"[37]"}],"fun_headline_variants":["Post-quantum privacy in one FL round","Quantum-safe FL with offline masking","Beskar: full-stack privacy, post-quantum ready","Efficient quantum-safe FL with DP layers","One-round post-quantum FL with DP"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the altered signature routine that precomputes part of the hash still prevents an attacker from forging a signature on a new message; the proof treats signing as a black box and never analyzes this altered routine.","fun_headline_variants_meta":{"raw":{"variants":["Post-quantum privacy in one FL round","Quantum-safe FL with offline masking","Beskar: full-stack privacy, post-quantum ready","Efficient quantum-safe FL with DP layers","One-round post-quantum FL with DP"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000491,"raw_usage":{"total_tokens":2411,"prompt_tokens":939,"completion_tokens":1472,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":555,"completion_tokens_details":{"reasoning_tokens":1401}},"tokens_in":555,"tokens_out":1472,"duration_ms":12491,"temperature":1.0,"reasoning_tokens":1401,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T22:57:44.241421+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the protocol with two honest clients, two assisting nodes, and a malicious server plus one malicious assisting node; if the server can recover either honest client's plaintext gradient from the masked updates and the honest node's mask sum, Theorem 1's privacy claim fails. A second check is to feed the modified signing algorithm a long sequence of messages and test whether any two published signatures reuse the same commitment value w1 or masking vector y; a reuse would immediately undermine unforgeability, which the paper's claims rule out.","supporting_citations":[{"cited_title":"Practical secure aggregation for privacy-preserving machine learning,","cited_arxiv_id":null,"evidence_quote":"Defines the practical secure aggregation setting and dropout handling that Beskar builds on."},{"cited_title":"Flamingo: Multi-round single-server secure aggregation with applications to private federated learning,","cited_arxiv_id":null,"evidence_quote":"Multi-round single-server secure aggregation baseline that Beskar compares against on rounds, dropout resilience, and post-quantum security."},{"cited_title":"Microfedml: Privacy preserving federated learning for small weights,","cited_arxiv_id":null,"evidence_quote":"Malicious-secure aggregation baseline with linear per-client operations, used for the efficiency comparison."},{"cited_title":"Efficient Secure Aggregation for Privacy-Preserving Federated Machine Learning","cited_arxiv_id":"2304.03841","evidence_quote":"Efficient secure aggregation with assisting nodes, the structural predecessor of Beskar's masking and unmasking design."},{"cited_title":"Crystals-kyber: a cca-secure module-lattice- based kem,","cited_arxiv_id":null,"evidence_quote":"Kyber lattice key-encapsulation mechanism whose IND-CCA security backs the post-quantum confidentiality of shared secrets."}],"review_version":1}