{"id":"fd1007f7-9e2f-4ff9-bbe1-f32da77d382d","arxiv_id":"2505.05843","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"The authors define dynamic noisy multi-client functional encryption, present the PRF-based inner-product scheme DyNo, and use it to train a differentially private logistic regression with claimed millisecond-level performance.","lead":"This paper extends noisy functional encryption to a dynamic multi-client setting with labels, and builds a fast inner-product scheme called DyNo that supports differentially private machine learning. It demonstrates the scheme by training a logistic regression on encrypted health data, claiming large speedups over prior pairing-based noisy FE schemes.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Sensitivity bound Eq (7) is false: an admissible adjacent pair gives true l2-sensitivity about 2.54 vs the claimed 1.96, so the DP guarantee of the logistic regression protocol is unsupported as written.","rationale":"The paper makes two separable claims: DyNo is an efficient, PRF-based one-time IND-secure DyNMCFE scheme, and the protocol built on it trains a logistic regression under global differential privacy. The first claim is supported by a standard reduction to an information-theoretically secure base scheme plus a PRF; I did not find a load-bearing flaw there. The second claim depends on Eq (7), the per-iteration l2-sensitivity bound, which determines the Gaussian noise scale. The reader identified this as the weakest assumption. My independent check confirms the concern is real and concrete: for m=1, theta=(0,8), alpha=n=1, and the adjacent records described, the exact l2-sensitivity of one gradient update is about 2.54, while Eq (7) predicts 1.96. The underestimate is not a negligible constant; it is a 30% error in the noise standard deviation, which is enough to invalidate the claimed (epsilon,delta)-DP guarantee. This does not necessarily sink the cryptographic construction, but the privacy-preserving ML application as written is not correct. The reader's CONDITIONAL verdict already requires a corrected sensitivity analysis and reproducibility artifacts, so my finding strengthens the rationale without moving the verdict. I therefore keep the reader's verdict unchanged.","tokens_in":32008,"tokens_out":14868,"duration_ms":143854,"concrete_test":"Evaluate Eq (7) for m=1, alpha=n=1, theta=(0,8), with adjacent records x=(x0=1,x1=0.7,y=1) and x'=(1,1,0). Compute g(5.6)=0.5-a1*5.6^3+a2*5.6≈-0.0609, g(8)=0.5-a1*8^3+a2*8≈0.8853, A=1-g(5.6)≈1.0609, A'=-g(8)≈-0.8853. The exact sensitivity is sqrt((A-A')^2 + (A*0.7 - A')^2) ≈ sqrt(1.9463^2 + 1.6280^2) ≈ 2.54, while Eq (7) gives sqrt(2)*(1+|a1*8^3 - a2*8|) ≈ 1.96. If the exact value exceeds the RHS, the bound is invalid, so the Gaussian noise is miscalibrated and the claimed DP guarantee fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The DP claim of Section 7.2 rests entirely on Eq (7), the per-iteration l2-sensitivity bound used to calibrate the analytic Gaussian mechanism. This bound is not just underived; it is false. Take m=1, alpha=n=1, theta=(0,8), so Theta=8 and the inputs lie inside the stated approximation domain [-8,8]. Consider adjacent records x=(x0=1, x1=0.7, y=1) and x'=(1,1,0). With g(z)=0.5-a1 z^3+a2 z, we get z=5.6, g(z)≈-0.0609, and z'=8, g(z')≈0.8853. Let A=1-g(z)≈1.0609 and A'=0-g(z')≈-0.8853. The gradient difference for the two output coordinates is (A-A', A*x1 - A'*x'1) = (1.9463, 1.6280), whose l2-norm is approx 2.54. Eq (7) instead gives sqrt(2)(1+|a1*8^3-a2*8|) = 1.414*(1.385) ≈ 1.96. Thus the asserted sensitivity bound underestimates the true sensitivity by roughly 30% in an admissible configuration. Since the noise variance in the analytic Gaussian mechanism is computed from Eq (7), the claimed (epsilon,delta)-DP guarantee does not follow for the protocol as presented. This is the central privacy claim of the paper, so the application-level contribution is currently unsupported, even though the DyNo construction and its cryptographic security reduction may be sound.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper extends noisy multi-input functional encryption (NMIFE) to a dynamic multi-client setting (DyNMCFE) with labels, client corruptions, and dynamic registration. The authors propose DyNo, an inner-product DyNMCFE scheme based on a PRF and one-time-pad masking, prove one-time IND-security via a reduction to a static variant and to the one-time NMIFE scheme, and instantiate a privacy-preserving logistic regression protocol with global differential privacy using the analytic Gaussian mechanism. The paper reports substantial efficiency improvements over prior noisy FE schemes in key and ciphertext sizes and in runtimes, and includes benchmarks and utility experiments on medical datasets.","tokens_in":32342,"tokens_out":29413,"duration_ms":275238,"significance":"If the claims hold, the construction is a significant practical step: it removes pairing-based operations from noisy FE, provides a stronger corruption model than prior NMIFE, and demonstrates the first inner-product-FE-based logistic regression. The cryptographic core is standard and the reduction to an information-theoretically secure one-time scheme is plausible, giving confidence in the IND-security claim. The efficiency numbers are compelling. However, the DP guarantee of the logistic regression protocol rests on a sensitivity bound that is not derived and is in fact false (major comment 1), so the application-level privacy claim, which is the paper's main new application contribution, is currently unsupported. The security proof also contains hybrid-index inconsistencies that must be fixed before the security claim can be fully verified.","major_comments":[{"comment":"The asserted l2-sensitivity bound is not proven and is in fact false. Consider m=3, n=1, alpha=1, theta=(0,8,0,0) so that Theta=8, and adjacent single-record datasets X={x} and X'={x'} with x=(1,0.7,1,1) (y=0) and x'=(1,0,1,1) (y'=1); both records lie in the stated domain [0,1]^4. With the paper's constants a1=0.81562/8^3 and a2=1.20096/8, we have z=theta·x=5.6 and z'=0, hence A=y-g(z)=-1.0611 and A'=y'-g(0)=0.5. The per-record gradient difference is (A-A', A·0.7 - A'·0, A·1 - A'·1, A·1 - A'·1) = (-1.5611, -0.7428, -1.5611, -1.5611), whose l2-norm is sqrt(3·1.5611^2 + 0.7428^2) ≈ sqrt(7.863) ≈ 2.804. Eq. (7) gives sqrt(4)·(1 + |a1·8^3 - a2·8|) = 2·1.3853 ≈ 2.771, which is strictly smaller than the true sensitivity. Thus the bound underestimates the l2-sensitivity for an admissible configuration, so the Gaussian noise calibrated from Eq. (7) is too small and the claimed (epsilon,delta)-DP guarantee for the logistic regression protocol does not follow as written.","section":"Section 7.2, Eq. (7)"},{"comment":"The hybrid argument as written is internally inconsistent. Lemma 2 claims to bound |P(A,G0)-P(A,G1)| by h·AdvPRF, and Lemma 3 also claims to bound |P(A,G0)-P(A,G1)|, this time by Advsta-nh-one-IND_NMIFEot. Since the intended sequence is G0->G1 (PRF to random function) and G1->G2 (switch of the challenge bit), one of the two statements must refer to a different pair of games; as printed, the two lemmas cannot both bound the same gap and the proof of Theorem 5 cannot be followed. The same inconsistent indexing appears when the proof later refers back to Lemma 2 and Lemma 3. This needs to be corrected before the security claim can be considered verifiable.","section":"Appendix B.2, Lemma 3 and proof of Theorem 5"}],"minor_comments":[{"comment":"In the Initialization step, \"C runs (pp, ) <- Setup\" is missing the master secret key output; it should read (pp, msk) <- Setup.","section":"Section 4.2, Definition 7"},{"comment":"There is a typo: \"teh analyst\" should be \"the analyst\".","section":"Section 5"},{"comment":"The sentence \"Without loss of generality, we may assume xi in [0,1]^{m+2}\" is actually a normalization assumption that affects the sensitivity analysis; it should be stated explicitly as an assumption and linked to the preprocessing step (the mapping M).","section":"Section 7.2"},{"comment":"The sensitivity is denoted Delta(F_theta) in Eq. (7) but Definition 3 uses Delta_2(·); please unify the notation.","section":"Section 7.2, Eq. (7)"},{"comment":"The security notion for MIFEot is given as \"ad-mh-one-IND\" in the first sentence and \"ad-nh-one-IND\" in the second; the intended abbreviation should be fixed.","section":"Appendix B.1, Theorem 3"},{"comment":"For DiffPIPE at N=10^6, the table entries are \"-\" without a caption note; please add a note that the experiment was aborted after several days due to memory exhaustion.","section":"Table 2"}],"recommendation":"major_revision","confidential_remarks":"The core DyNo construction passes a plausibility check and the efficiency results are interesting, but the application section cannot be accepted in its present form because the sensitivity bound in Eq. (7) is not merely underived but demonstrably false. The authors should be asked to provide a correct, fully derived sensitivity bound and to re-evaluate whether the utility experiments remain meaningful with the corrected noise calibration. The security proof in Appendix B.2 also needs a careful rewrite to fix the hybrid-index inconsistencies."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here is my honest read. The paper has two very different halves. The cryptographic half—DyNo, a pairing-free inner-product DyNMCFE built from a PRF and the one-time MIFE idea—is credible. The definitions are a natural amalgam of known notions, but cleanly written, the security reduction to NMIFEot is plausible, and the benchmarks show an order-of-magnitude improvement over DiffPIPE and RIPFE. That part deserves attention.\n\nThe second half, the privacy-preserving logistic regression, does not hold up. The claimed (epsilon,delta)-DP guarantee rests entirely on the sensitivity bound in Eq (7), and that bound is false. With m=1, alpha=n=1, theta=(0,8), the adjacent records x=(1,0.7,1) and x'=(1,1,0) give true l2-sensitivity about 2.54, while Eq (7) gives about 1.96. The mistake is that the paper bounds the maximum of the polynomial deviation by its value at the endpoint z=Theta, but the deviation over [-Theta,Theta] can be larger in the interior. Since the analytic Gaussian noise is calibrated from Eq (7), the noise is too small and the DP claim does not follow. This is not a minor typo; it is the load-bearing wall of the application section.\n\nThere are smaller issues: no code or data is released, and the benchmarks have no error bars, so the headline numbers are indicative rather than reproducible. The appendix also has a typo in Lemma 3 (the bound is stated with G0/G1 twice instead of G1/G2), which makes that proof harder to check.\n\nIf I were the editor, I would not desk reject this. The DyNo construction and the performance story are worth refereeing, and the sensitivity bound may be repairable—it looks like a fixable over-approximation if taken over the full interval. But as submitted, the central privacy claim of the logistic regression protocol is unsupported, so acceptance should be conditional on correcting Eq (7) and rerunning the utility evaluation with corrected noise. The implementation should also be made available.\n\nFor you: read the DyNo sections if you care about efficient FE for inner products; skip or heavily caveat the DP/ML part.","headline":"Solid PRF-based DyNMCFE construction with impressive speedups, but the logistic regression DP claim rests on a false sensitivity bound and is unsupported as written.","tokens_in":32887,"tokens_out":2714,"would_cite":false,"duration_ms":28691,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"DyNo, a PRF-based inner-product dynamic noisy multi-client functional encryption scheme, claims one-time IND-security with client corruptions and makes global-DP logistic regression on encrypted data practical.","keywords":["noisy functional encryption","multi-client functional encryption","dynamic NMCFE","differential privacy","privacy-preserving machine learning","inner-product functional encryption","logistic regression","pseudorandom function"],"falsifier":"Compute the actual maximum of $|a_2 z - a_1 z^3|$ on $[-\\Theta,\\Theta]$ with $a_1=0.81562/8^3$ and $a_2=1.20096/8$ and compare it with the endpoint value $|a_2\\Theta - a_1\\Theta^3|$ used in Eq. (7); if the true maximum exceeds the endpoint value for some $\\Theta$ allowed in training, the noise schedule is miscalibrated. Equivalently, simulate two adjacent datasets whose only difference is one record placed at the maximizer and measure the $\\ell^2$ norm of the gradient-vector difference.","tokens_in":31773,"feed_emoji":"🔐","tokens_out":6582,"duration_ms":70742,"temperature":0.7,"pith_summary":"This paper introduces dynamic noisy multi-client functional encryption (DyNMCFE), a setting in which an authority can mint encryption keys for clients on the fly and hand analysts decryption keys for labelled subsets of ciphertexts that reveal the desired function evaluation plus controlled noise. The paper's central claim is that its concrete scheme DyNo, an inner-product construction whose security rests only on a pseudorandom function, achieves one-time indistinguishability security even when some clients are corrupted, while being faster and smaller than all prior noisy functional encryption schemes. A sympathetic reader would care because this makes global differential privacy for machine learning on multi-source data, specifically a logistic regression trained on encrypted medical datasets, practical: the paper reports runtimes in milliseconds for encryption and decryption on datasets up to $10^6$ entries, where prior pairing-based schemes take seconds to hours. The scheme also supports the dynamic join and drop-out of data holders across labelled analyses, matching real study workflows.","feed_headline":"PRF-only ciphertexts cut private ML training to milliseconds","feed_subtitle":"A dynamic multi-client scheme gives analysts noisy inner products on encrypted data, with client corruption supported","key_machinery":"The load-bearing object is the label-keyed PRF one-time pad: each ciphertext is the plaintext masked by $\\mathrm{PRF}(ek_i,\\ell)$, and the decryption key aggregates the corresponding masks for all clients in the chosen subset before subtracting a sampled noise $\\nu$. Because the masks are produced by a PRF on per-client keys and labels, label-subset ciphertexts can be combined only when the authority issues the matching key, dynamic registration reduces to handing out a fresh $\\lambda$-bit key, and the noise $\\nu$ is hidden inside the key rather than in the ciphertexts. The security proof reduces DyNo to the noiseless, information-theoretically secure one-time MIFE scheme by swapping PRF outputs for random values, which is why the construction avoids pairings and achieves its small key sizes.","core_discovery":"DyNo works by replacing the vector one-time pad of the basic MIFE scheme with a PRF keyed by each client's secret key and evaluated on the label: the ciphertext for client $i$ under label $\\ell$ is $c_i = x_i + \\mathrm{PRF}(ek_i,\\ell) \\bmod q$, and a decryption key for function $y$ and noise distribution $D$ stores $z = \\sum_i \\langle \\mathrm{PRF}(ek_i,\\ell), y_i\\rangle - \\nu$, so decryption returns $\\sum_i \\langle x_i, y_i\\rangle + \\nu$ and nothing else. This label-dependent one-time pad is the mechanism that carries the security argument: up to a PRF-to-random-function step and a reduction to the information-theoretically secure one-time NMIFE scheme, the adversary's view is independent of the challenge bit. The paper claims one-time IND-security with static client corruptions, correct decryption in $\\mathbb{Z}$ when the modulus is large enough, and concrete efficiency gains: keys and ciphertexts are $\\lambda$ and $m\\log q$ bits rather than group elements, and all algorithms run in milliseconds in the implementation.","pith_inferences":["Editorial: if the sensitivity bound in Eq. (7) does not hold over the full parameter range, the same protocol could be repaired by replacing it with a proven bound or by shrinking the learning rate; the cryptographic scheme itself would be unaffected.","Editorial: the one-ciphertext-per-label-per-client restriction means a long-running study that needs repeated submissions from the same data holder under the same analysis label would require a multi-message variant, and DyNo as presented is one-shot per client-label pair.","Editorial: because the cubic-sigmoid linearization makes the ciphertext length scale as $O(m^4)$ in the number of attributes, the practical sweet spot is low-dimensional medical data; the paper's mention of a linear-sigmoid variant with $O(m^2)$ slots points to a utility-efficiency trade-off it does not explore."],"forward_implications":["An analyst can train a logistic regression by querying inner-product keys for polynomial-approximated gradients while data holders encrypt once per label and then stay offline.","Because only the analyst and the authority exchange decryption keys after data upload, the same encrypted dataset can support multiple analyses until the participants' privacy budget is exhausted.","The security notion allows corrupted clients, so an analyst who colludes with some data holders still learns nothing about the remaining honest clients beyond the noisy function outputs.","The reported runtimes place noisy functional encryption in the range of practical encrypted analytics for dataset sizes where prior pairing-based noisy FE schemes do not terminate.","Training with global differential privacy becomes possible without per-iteration re-encryption, since the noise is added inside each decryption key rather than to the raw data."],"supporting_citations":[{"why":"supplies the original NMIFE security definition and the pairing-based DiffPIPE baseline that DyNo is compared against.","marker":"[50]"},{"why":"gives the one-time inner-product MIFE scheme whose label-free one-time pad DyNo adapts with a PRF.","marker":"[3]"},{"why":"introduces dynamic decentralized functional encryption, the model for separating encryption-key generation from setup.","marker":"[16]"},{"why":"provides the analytic Gaussian mechanism used to calibrate the DP noise in each gradient-descent iteration.","marker":"[10]"},{"why":"defines the competing RIPFE scheme whose runtime and dataset figures are used in the benchmark comparison.","marker":"[21]"},{"why":"supplies the cubic least-squares approximation of the sigmoid that turns logistic-regression updates into inner products.","marker":"[29]"},{"why":"furnishes the one-label-to-many-label reduction used in the security proof of DyNo.","marker":"[32]"},{"why":"implements the analytic Gaussian mechanism used in the experimental noise sampling.","marker":"[46]"}],"fun_headline_variants":["PRF-based noisy FE makes private ML training fast","Dynamic multi-client FE: private ML with corruption support","Noisy FE scheme cuts private ML to milliseconds with PRF keys","Efficient noisy functional encryption for private logistic regression"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The claimed $(\\epsilon,\\delta)$-differential privacy for the logistic regression rests entirely on the sensitivity bound in Eq. (7), which is stated without derivation or a proof that the polynomial deviation is maximized at the endpoint $z=\\Theta$; if that bound underestimates the true influence of one record, the Gaussian noise added per iteration is too small and the privacy guarantee collapses.","fun_headline_variants_meta":{"raw":{"variants":["PRF-based noisy FE makes private ML training fast","Dynamic multi-client FE: private ML with corruption support","Noisy FE scheme cuts private ML to milliseconds with PRF keys","Efficient noisy functional encryption for private logistic regression"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000198,"raw_usage":{"total_tokens":1382,"prompt_tokens":975,"completion_tokens":407,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":591,"completion_tokens_details":{"reasoning_tokens":342}},"tokens_in":591,"tokens_out":407,"duration_ms":4762,"temperature":1.0,"reasoning_tokens":342,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T22:56:11.135570+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute the actual maximum of $|a_2 z - a_1 z^3|$ on $[-\\Theta,\\Theta]$ with $a_1=0.81562/8^3$ and $a_2=1.20096/8$ and compare it with the endpoint value $|a_2\\Theta - a_1\\Theta^3|$ used in Eq. (7); if the true maximum exceeds the endpoint value for some $\\Theta$ allowed in training, the noise schedule is miscalibrated. Equivalently, simulate two adjacent datasets whose only difference is one record placed at the maximizer and measure the $\\ell^2$ norm of the gradient-vector difference.","supporting_citations":[{"cited_title":"Proceedings on Privacy Enhancing Technologies2, 509–530 (2024)","cited_arxiv_id":null,"evidence_quote":"supplies the original NMIFE security definition and the pairing-based DiffPIPE baseline that DyNo is compared against."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"gives the one-time inner-product MIFE scheme whose label-free one-time pad DyNo adapts with a PRF."},{"cited_title":"In: Micciancio, D., Ristenpart, T","cited_arxiv_id":null,"evidence_quote":"introduces dynamic decentralized functional encryption, the model for separating encryption-key generation from setup."},{"cited_title":"In: Dy, J., Krause, A","cited_arxiv_id":null,"evidence_quote":"provides the analytic Gaussian mechanism used to calibrate the DP noise in each gradient-descent iteration."},{"cited_title":"Proceedings on Privacy Enhancing Technologies4, 583–604 (2024)","cited_arxiv_id":null,"evidence_quote":"defines the competing RIPFE scheme whose runtime and dataset figures are used in the benchmark comparison."},{"cited_title":"JMIR medical infor- matics 6(2), e8805 (2018)","cited_arxiv_id":null,"evidence_quote":"supplies the cubic least-squares approximation of the sigmoid that turns logistic-regression updates into inner products."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"furnishes the one-label-to-many-label reduction used in the security proof of DyNo."},{"cited_title":"com/google/differential-privacy","cited_arxiv_id":null,"evidence_quote":"implements the analytic Gaussian mechanism used in the experimental noise sampling."}],"review_version":1}