{"id":"96bab17f-0424-40d5-baf6-f490fe00c02e","arxiv_id":"2505.05920","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":3.0,"correctness_risk":"high","formal_verification":"none","parameter_count":2,"one_line_summary":"A CKKS-encrypted hybrid-kernel SVM is reported to match plaintext accuracy on a credit card dataset, but critical details of the encrypted RBF kernel and adaptive threshold are missing.","lead":"This paper combines a support vector machine with CKKS homomorphic encryption to classify credit card applications without exposing the data. A reader might care if private, real-time credit scoring in the cloud could be practical, but the paper's encrypted kernel and threshold computations are not fully specified.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The encrypted RBF kernel is specified only as 'Enc(K_j^r) ← K_r(Enc(X'), Enc(SV_j))' in Algorithm 2; no polynomial approximation, depth, or precision is given, so the reported 97.06% accuracy and 44.9 ms per-sample runtime cannot be attributed to a real CKKS pipeline.","rationale":"The reader's weakest assumption identifies the same load-bearing gap: Section 4.2's Algorithm 2 writes the encrypted RBF kernel as a single black-box operation without specifying the polynomial approximation required by CKKS. This is not a mere exposition issue; it is the step where the paper's feasibility claim is least secure. CKKS cannot evaluate exp directly, and the accuracy of any approximation directly controls whether the encrypted model matches the plaintext model. Without this detail, the reported 97.06% accuracy and 44.9 ms runtime cannot be reproduced or even checked against the stated three-level modulus chain. The paper's other issues, including the adaptive threshold apparently computed after decryption and the simulated scalability plot, further weaken the central claim, but they are secondary to the missing RBF evaluation. Since the central claim is unsupported as written, the reader's REJECT verdict stands; I see no reason to move it.","tokens_in":7977,"tokens_out":4505,"duration_ms":47947,"concrete_test":"Request the full CKKS kernel specification from the authors, including the polynomial approximation of exp(-γd^2) (degree, coefficients, fitting interval), the number of support vectors, and the exact OpenFHE parameter set. Then implement Algorithm 2 in OpenFHE on the same Credit Card Approval test split and check whether the decrypted sign matches the plaintext PT-FinTech sign on all test samples and whether the accuracy remains 97.06% within the reported 120-to-45-bit noise budget. If the approximation is not supplied or the reproduced accuracy differs by more than the stated margin, the reported result is not evidence for the central claim.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that PP-FinTech achieves 'comparable performance to the plaintext models' on the Credit Card Approval dataset (97.06% accuracy vs. 97.51%, with 44.9 ms per-sample inference). This claim requires that the hybrid kernel, including the RBF term exp(-γ||X' - SV_j||^2), can be evaluated under CKKS with the stated parameters. Section 4.2 and Algorithm 2 never specify how this term is computed: they simply write 'Enc(K_j^r) ← K_r(Enc(X'), Enc(SV_j))'. CKKS can only evaluate polynomial approximations of exp; the choice of approximation (degree, coefficient table, interval of fit, minimax error) determines both classification accuracy and multiplicative depth. The paper reports only a 'three-level modulus chain' and says rescaling is applied, but gives no approximation degree, coefficient values, depth budget, or precision analysis. It also does not state the number of support vectors or the SIMD packing layout, both of which are needed to reproduce the 44.9 ms runtime. Without this information, the reported accuracy and timing are not reproducible, and the paper does not demonstrate that the hybrid-kernel SVM can actually be evaluated homomorphically.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes PP-FinTech, a privacy-preserving credit card approval system that combines the CKKS homomorphic encryption scheme with a soft-margin SVM using a hybrid polynomial-RBF kernel. The authors train the SVM in plaintext, encrypt the model parameters and test features, evaluate the SVM decision score homomorphically, and apply an adaptive threshold to the decision score to produce the final classification label. Experiments on the UCI Credit Card Approval dataset report 97.06% accuracy for PP-FinTech versus 97.51% for the plaintext hybrid model, with an average per-sample inference time of 44.9 ms. The paper claims that this demonstrates comparable performance to plaintext models while preserving privacy.","tokens_in":8303,"tokens_out":5052,"duration_ms":52507,"significance":"Privacy-preserving machine-learning inference is an important and timely problem, particularly for financial applications, and an encrypted SVM with a non-linear kernel would be a useful contribution. The paper correctly identifies the need to manage CKKS noise, reports both accuracy and runtime, and uses the OpenFHE library, which are appropriate methodological choices. However, at present the core technical claims are not substantiated: the encrypted RBF kernel evaluation is not specified in a way that is realizable under CKKS, and the adaptive thresholding step explicitly operates on decrypted scores. These issues are load-bearing for the claimed end-to-end encrypted pipeline, so the significance of the work as written is limited.","major_comments":[{"comment":"The line Enc(K_j^r) ← K_r(Enc(X'), Enc(SV_j)) assumes that the RBF kernel can be evaluated under CKKS, but CKKS only supports additions and multiplications. Computing exp(-γ||X' - SV_j||^2) requires a polynomial approximation (for example, Taylor, Chebyshev, or minimax) with a stated degree, approximation interval, coefficient table, and multiplicative-depth budget. None of these are provided. Consequently, the reported 97.06% accuracy and 44.9 ms per-sample latency cannot be attributed to a real CKKS pipeline, and the experimental results are not reproducible from the manuscript.","section":"Section 4.2, Algorithm 2"},{"comment":"Algorithm 2 explicitly decrypts Enc(D) to D before computing the adaptive threshold θ = λ1·μ + λ2/σ, and the following subsection applies the threshold to plaintext scores. This breaks the end-to-end encryption claim: the server learns the decrypted decision scores, and the threshold depends on the entire batch of test samples, which also leaks aggregate information about other users' scores. Computing μ and σ homomorphically is not described, and operations such as division and reciprocal required for λ2/σ are not native CKKS operations.","section":"Section 4.2, Algorithm 2 and 'Secure Decryption and Classification'"},{"comment":"The hybrid-kernel weights (λ1 = 0.7, λ2 = 0.3) and the adaptive-threshold weights (λ1 = 0.5, λ2 = 0.1) are tuned empirically, and the threshold directly determines the final class label. The paper does not state whether the reported accuracy was obtained on a held-out test set that was not used for this tuning. As written, the evaluation is circular: the threshold weights are chosen to maximize performance on the same data used to report the accuracy, so the claimed 'comparable performance to plaintext' is not established.","section":"Section 4.1, Section 4.2, and Table 1"},{"comment":"The scalability evaluation is explicitly 'simulated' by scaling the observed per-sample latency, not measured on actual batched encrypted inference. This does not provide empirical evidence for the claimed SIMD-based speedup, especially since the text admits that SIMD was not benchmarked separately. In addition, Figure 4's y-axis is labeled in milliseconds but reaches only about 5 ms for 100 samples, which is inconsistent with a per-sample latency of 44.9 ms (100 samples would take roughly 4.5 seconds).","section":"Section 5.4 and Figure 4"}],"minor_comments":[{"comment":"The sentence 'the Credit Card Approval dataset, which is which underwent multiple preprocessing...' contains a typo: 'which is which' should be removed.","section":"Section 4.1"},{"comment":"The ROC curve discussion mentions that AUC is a key summary metric, but no AUC values are reported for either PT-FinTech or PP-FinTech, so the claim that the encrypted model is nearly identical is not quantified.","section":"Section 5.1"},{"comment":"The CKKS parameter description would benefit from a table listing the exact modulus chain, scaling factor, ring dimension, and the number of levels, as well as the approximation parameters for the RBF kernel once they are provided.","section":"Section 4.2"},{"comment":"The runtime breakdown attributes 7 ms to adaptive thresholding, but since Algorithm 2 computes the threshold after decryption, it is unclear whether this 7 ms corresponds to a homomorphic computation or to plaintext post-processing.","section":"Section 5.2"}],"recommendation":"reject","confidential_remarks":"The manuscript has two fundamental problems that cannot be fixed by minor editing: the encrypted RBF kernel is never instantiated with a polynomial approximation, and the adaptive threshold is computed after decrypting the decision score. These issues mean that the headline accuracy and runtime figures do not describe a functioning end-to-end encrypted pipeline. I would encourage the authors to resubmit after providing a complete CKKS implementation of the hybrid kernel, a protocol that avoids server-side decryption, and an evaluation that separates tuning from held-out testing."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take on arXiv:2505.05920. The headline claim doesn't hold up: there is no specified way to evaluate the RBF kernel under CKKS, and the adaptive threshold requires decrypting the decision score on the server. So the reported 97.06% accuracy and 44.9 ms latency cannot be attributed to a fully encrypted pipeline.\n\nWhat's actually here: the paper trains a soft-margin SVM with a hybrid polynomial-RBF kernel on the UCI credit card dataset, then sketches a CKKS-based inference flow. The hybrid kernel idea is straightforward — a weighted sum of two kernels. The SIMD batching is a known optimization. The adaptive threshold is a heuristic. None of this is new; the authors themselves cite prior encrypted SVM work.\n\nWhere it falls down. The RBF kernel is the core problem. CKKS supports only polynomial arithmetic, so exp(-γ||x-sv||²) needs a polynomial approximation (e.g., Chebyshev or minimax) with a stated degree and interval. Algorithm 2 just writes Enc(K_j^r) ← K_r(Enc(X'), Enc(SV_j)) as if it were a homomorphic operation. No approximation, no depth budget, no precision analysis. Without this, the accuracy and timing numbers are not reproducible and may not reflect a real implementation. The adaptive threshold is worse: Algorithm 2 decrypts the decision score D on the server, then computes θ = λ1·μ + λ2/σ from the plaintext scores and returns sign(D−θ). That breaks the claimed end-to-end encryption — the server sees the scores. The 'scalability' result is just the per-sample latency multiplied by batch size, not an actual measurement.\n\nCredit where due: the paper is clearly written and the experimental setup is standard. But these are not minor gaps; they are the entire mechanism of the scheme. The missing RBF approximation alone makes the central claim unverifiable.\n\nRecommendation: desk reject. It's not ready for referees because the load-bearing technique is unspecified. If the authors supply the missing polynomial approximation and move the adaptive threshold to the client side, it could be a modest application paper, but as submitted it doesn't deserve referee time.","headline":"The paper's central claim of a fully encrypted SVM inference pipeline is unsupported because the RBF kernel evaluation is left unspecified and the adaptive threshold requires plaintext scores.","tokens_in":8754,"tokens_out":2579,"would_cite":false,"duration_ms":24625,"reading_group":"no","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A credit-card approval classifier can run fully encrypted and still match plaintext accuracy within half a percentage point.","keywords":["homomorphic encryption","CKKS","support vector machine","encrypted inference","privacy-preserving machine learning","hybrid kernel","adaptive thresholding","credit card approval"],"falsifier":"Inspect the implementation or re-implement Algorithm 2 from the paper. If the encrypted RBF evaluation is actually replaced by a plaintext kernel value, or if no polynomial approximation of $\\exp(-\\gamma\\|x-\\mathrm{sv}\\|^2)$ exists within a three-level CKKS modulus chain, then the reported 97.06% accuracy cannot be produced by fully encrypted inference. A minimal check is to substitute a pure polynomial kernel and see whether accuracy collapses.","tokens_in":7794,"feed_emoji":"🔐","tokens_out":12308,"duration_ms":105619,"temperature":0.7,"pith_summary":"This paper tries to establish that credit-card approval can be performed on encrypted data without sacrificing the accuracy that a bank would get from a plaintext model. It presents PP-FinTech, a support vector machine (a standard classifier that learns a separating boundary) running entirely under CKKS, a homomorphic encryption scheme for approximate arithmetic on encrypted real numbers, using a hybrid polynomial–RBF (radial basis function) kernel for non-linear patterns and an adaptive threshold to absorb encryption noise. On the Credit Card Approval dataset, it reports 97.06% accuracy versus 97.51% for the plaintext hybrid model, with 44.9 ms per encrypted sample. A sympathetic reader would take away that fully encrypted inference for non-linear financial classifiers has moved into a practical range.","feed_headline":"Credit-card approval runs encrypted at near-plaintext accuracy","feed_subtitle":"A CKKS-encrypted SVM with a hybrid kernel classifies in 44.9 ms per sample, keeping applicant data hidden.","key_machinery":"The load-bearing object is the encrypted decision score $C(S')$, built by summing per-support-vector products $C(\\alpha_j)\\cdot C(K(X',SV_j))$ and adding the encrypted bias. The hybrid kernel $K=\\lambda_1 K_p+\\lambda_2 K_r$ is the mathematical mechanism that lets a CKKS circuit approximate non-linear separation, although the RBF component requires an unstated arithmetic approximation of $\\exp(-\\gamma\\|X'-SV_j\\|^2)$. The adaptive threshold $\\theta=\\lambda_1\\mu+\\lambda_2/\\sigma$ is the post-processing mechanism tuned to keep classification stable as CKKS noise accumulates, and SIMD packing (processing many values in parallel within one ciphertext) is the performance mechanism that amortizes per-sample cost across a batch.","core_discovery":"On its own terms, the paper's central discovery is that the SVM decision score $C(S')=\\sum_j C(\\alpha_j)C(K(X',SV_j))+C(b)$ can be evaluated end-to-end under CKKS, and the resulting encrypted classifier performs almost indistinguishably from its plaintext counterpart: accuracy 97.06% vs. 97.51%, precision 98.33% vs. 96.82%, recall 95.16% vs. 96.58%, and F1 96.74% vs. 96.70%. The hybrid kernel combines a polynomial term (native to CKKS arithmetic) with an RBF term, and the adaptive threshold $\\theta=\\lambda_1\\mu+\\lambda_2/\\sigma$ is meant to compensate for noise-induced shifts in the encrypted scores. The paper maintains that with careful parameter selection and SIMD batching, the 44.9 ms per-sample latency makes this practical for privacy-sensitive financial applications.","pith_inferences":["My inference: the strongest replication test is the RBF approximation. If no concrete CKKS-friendly polynomial approximation of $\\exp(-\\gamma\\|x-\\mathrm{sv}\\|^2)$ is supplied, the reported accuracy may come from plaintext kernel evaluation, and the encrypted pipeline would not be complete.","My inference: because the adaptive threshold uses the mean and spread of decision scores, either the client receives a batch of scores to compute $\\theta$, or the server computes encrypted batch statistics; the paper does not specify which, and each choice changes what information the server sees.","My inference: a natural ablation is to run the same CKKS pipeline with the polynomial kernel only; if accuracy stays near 97%, the RBF term is not actually contributing under encryption, and the hybrid kernel's role in the result would need re-examination."],"forward_implications":["A bank could outsource credit-card approval to an untrusted cloud while keeping both the applicant's features and the model's support vectors encrypted throughout, with only the final label revealed to the client.","Non-linear SVMs, which usually require operations homomorphic encryption cannot natively perform, become usable in encrypted form, widening the set of financial models that FHE can serve.","The reported 44.9 ms per-sample latency, if it holds, works out to roughly 20 decisions per second, within the range of interactive credit decisions.","The adaptive thresholding mechanism offers a general template for other encrypted classifiers: use batch statistics to shift the decision boundary and compensate for CKKS noise instead of enlarging parameters."],"supporting_citations":[{"why":"Defines the CKKS scheme, the approximate-arithmetic encryption the whole pipeline is built on.","marker":"[6]"},{"why":"Provides the open-source FHE library used to implement every homomorphic operation in the experiments.","marker":"[8]"},{"why":"Cited for the approximate real-number arithmetic that makes encrypted SVM scores possible under CKKS.","marker":"[7]"},{"why":"Source for SIMD execution techniques that justify the batch-processing optimization behind the per-sample latency.","marker":"[19]"}],"fun_headline_variants":["Encrypted SVM approves cards with near-plaintext accuracy","Homomorphic SVM keeps credit-card data private at 44.9 ms","CKKS-encrypted SVM matches plaintext on credit approval","Privacy-preserving credit checks: encrypted SVM, 97% accuracy","Secure credit-card approval via encrypted SVM at 44.9 ms"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The claim stands on the unstated assumption that the RBF kernel's exponential can be evaluated inside CKKS using only additions and multiplications with enough precision; the paper never specifies this approximation, and if it is wrong the reported accuracy is not from a real encrypted pipeline.","fun_headline_variants_meta":{"raw":{"variants":["Encrypted SVM approves cards with near-plaintext accuracy","Homomorphic SVM keeps credit-card data private at 44.9 ms","CKKS-encrypted SVM matches plaintext on credit approval","Privacy-preserving credit checks: encrypted SVM, 97% accuracy","Secure credit-card approval via encrypted SVM at 44.9 ms"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000643,"raw_usage":{"total_tokens":2913,"prompt_tokens":856,"completion_tokens":2057,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":472,"completion_tokens_details":{"reasoning_tokens":1968}},"tokens_in":472,"tokens_out":2057,"duration_ms":14954,"temperature":1.0,"reasoning_tokens":1968,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T22:52:15.650014+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Inspect the implementation or re-implement Algorithm 2 from the paper. If the encrypted RBF evaluation is actually replaced by a plaintext kernel value, or if no polynomial approximation of $\\exp(-\\gamma\\|x-\\mathrm{sv}\\|^2)$ exists within a three-level CKKS modulus chain, then the reported 97.06% accuracy cannot be produced by fully encrypted inference. A minimal check is to substitute a pure polynomial kernel and see whether accuracy collapses.","supporting_citations":[{"cited_title":"Homomorphic encryption for arith- metic of approximate numbers,","cited_arxiv_id":null,"evidence_quote":"Defines the CKKS scheme, the approximate-arithmetic encryption the whole pipeline is built on."},{"cited_title":"OpenFHE: Open-source fully homomorphic encryption library,","cited_arxiv_id":null,"evidence_quote":"Provides the open-source FHE library used to implement every homomorphic operation in the experiments."},{"cited_title":"Approximate homomorphic encryp- tion with reduced approximation error,","cited_arxiv_id":null,"evidence_quote":"Cited for the approximate real-number arithmetic that makes encrypted SVM scores possible under CKKS."},{"cited_title":"Mimd programs execution support on simd machines: a holistic survey,","cited_arxiv_id":null,"evidence_quote":"Source for SIMD execution techniques that justify the batch-processing optimization behind the per-sample latency."}],"review_version":1}