{"id":"22ac2575-f2fc-4b5e-8ae4-6e5b7640e296","arxiv_id":"2505.12582","paper_version":2,"verdict":"REJECT","confidence":"HIGH","novelty_score":3.0,"correctness_risk":"high","formal_verification":"none","parameter_count":1,"one_line_summary":"The paper claims a compile-time vector encryption method for FHE using precomputed basis ciphertexts and a single randomized zero ciphertext, but the IND-CPA proof is invalid and the scheme is attackable when the randomizer is drawn from the plaintext modulus.","lead":"This paper proposes a way to create fully homomorphic encryption (FHE) ciphertexts for vectors at compile time by combining precomputed encrypted basis vectors with a randomized multiple of an encryption of zero, avoiding live encryption calls. The authors claim this preserves IND-CPA security with less memory than prior caching approaches, but the security proof has a hole and the scheme as defined can be broken by trying all possible randomizers.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The security proof's reduction is invalid because the fixed zero ciphertext r0 is public, so masking by α·r0 adds no entropy and the scheme is deterministically attackable; Lemmas 2–3 fail.","rationale":"The reader's verdict (REJECT, high confidence) is well-supported. The most load-bearing concern is that the construction is not IND-CPA secure at all, because the masking term α·r0 is generated from a single public ciphertext r0 and a scalar drawn from a small set Z_t. The security game in §6.1 gives the adversary (B, r0) as public inputs, and the challenge ciphertext c* is a public linear combination plus α·r0. Since α is the only unknown and t is the plaintext modulus (which is small in FHE applications), the adversary can exhaustively search α and identify the message. This is a direct attack, not merely a proof gap. The proof's Lemma 3 is exactly the false claim that scaling a fixed public ciphertext by a fresh scalar is indistinguishable from a fresh encryption of zero; this is circular because the indistinguishability is what security requires, and it is false because the distribution of {α·r0} is concentrated relative to the fresh-encryption distribution. Lemma 2 is also invalid for a related reason: replacing c_{i+1} with a fresh encryption of the scalar changes the ciphertext distribution, and the reduction does not simulate the fixed basis correctly. The paper's own noise analysis (§5.1) even suggests sampling α from a small range like {0,1} or Z_t, which makes the attack immediate. No amount of parameter adjustment fixes the problem while keeping r0 public and the synthesis deterministic in m once α is known. Thus the central contribution—compile-time FHE encryption with provable security—is not established, and the scheme as defined is insecure. The correct verdict is REJECT, in agreement with the reader.","tokens_in":13853,"tokens_out":1291,"duration_ms":15261,"concrete_test":"Implement the brute-force distinguishing attack in a small BGV/BFV instance: set d=1, t=2, generate (pk,sk), c_1=Enc(e_1), r0=Enc(0), then for a random bit b and α∈{0,1} form c* = m_b·c_1 + α·r0. Give (c_1, r0, c*) to an adversary that tries α=0 and α=1, checks whether c* − α·r0 equals 0 or c_1 (as ciphertexts), and thereby recovers b. If the attack succeeds with probability 1, the scheme fails IND-CPA and Theorem 4 is refuted. Also compare the distributions of α·r0 and a fresh Enc(0) using, e.g., a statistical test on ciphertext coefficients; a clear separation confirms Lemma 3 is false.","verdict_should_be":"REJECT","load_bearing_attack":"The central claim (Theorem 4, §6.3) is that SynthEnc is IND-CPA secure with advantage bounded by (d+1)ε1+ε2. This fails because the adversary is given r0 = Enc(0^d) as a public input (§6.1, Definition 1). In the challenge ciphertext c* = Σ (m_b)_i·c_i + α·r0, every term in the sum is public except the scalar α. The adversary knows the basis c_i and r0, and learns c*. Since plaintexts are vectors over Z_t, the adversary can brute-force α ∈ Z_t: for each candidate α, compute c* − α·r0 and check whether the decryption (or even the plaintext slot pattern) matches one of m0 or m1. Even without decryption, the adversary can test whether c* − α·r0 equals the public linear combination for m0 or m1 by checking correctness of the synthesized ciphertext with known coefficients. This is an exact attack with advantage essentially 1, not negligible. The proof's Lemma 3 asserts that α·r0 is computationally indistinguishable from a fresh encryption of zero for uniform α, but this is false: r0 is a fixed public ciphertext, so the set {α·r0 : α ∈ Z_t} is a low-entropy (size t) subset of the ciphertext space, trivially distinguishable from the full noise distribution of fresh encryptions. Moreover, Lemma 2 substitutes a fresh encryption of a scalar for the scalar-multiplied basis ciphertext, but the distributions differ: c_i = Enc(e_i) has a fixed embedding that cannot be re-randomized that way. The claimed hybrid reduction is therefore not a valid reduction to IND-CPA of the underlying scheme. The construction as defined in §4.3–4.4 and analyzed in §6 is insecure. This is not a matter of parameter tuning: the attack does not depend on noise growth, correctness bounds, or a particular FHE scheme, and it uses only public information.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a method for generating FHE ciphertexts at runtime without invoking the encryption algorithm, by precomputing a public basis of encryptions of unit vectors and a single fixed encryption of the zero vector, then forming new ciphertexts as a linear combination of the basis plus a scalar-multiplied zero ciphertext. It claims that this 'synthesized encryption' scheme SynthEnc is IND-CPA secure assuming the underlying FHE scheme is IND-CPA secure, and provides a hybrid-game proof with an advantage bound of (d+1)ε1+ε2. The manuscript also includes a noise analysis, discussions of compatibility with batching and rotations, and a speculative final section on algebraic generalizations. I find that the security proof is invalid and, more seriously, that the proposed construction is insecure: because the basis and the zero ciphertext are public and the masking scalar is drawn from a small set, an adversary can recover the encrypted message by brute force.","tokens_in":14226,"tokens_out":4438,"duration_ms":45868,"significance":"The practical motivation is sensible: avoiding online encryption in FHE ingestion pipelines is a real systems concern, and the algebraic interface is presented clearly as a module-morphism abstraction. However, the central security claim is not merely unproven but false. The proposed masking step uses a fixed public ciphertext of zero multiplied by a scalar drawn from Z_t (or Z_q), which provides at most log t bits of entropy and permits an exact distinguishing attack when the basis is public. The two supporting lemmas in the security proof are also invalid: Lemma 2 substitutes a fresh encryption of a scalar for a scalar-multiple of a public basis ciphertext, changing the distribution, and Lemma 3 asserts the indistinguishability of α·r0 from a fresh encryption of zero without reducing it to any standard assumption. Consequently, the paper's main contribution as a secure encryption scheme is not established. The paper does contain a reasonable formalization of correctness and noise growth for linear combinations of precomputed ciphertexts, but that does not compensate for the broken security argument.","major_comments":[{"comment":"Definition 1 gives the adversary the public basis B and the fixed zero ciphertext r0, and the challenge ciphertext is c* = Σ_i (m_b)_i·c_i + α·r0 with α uniform in Z_t. Since B and r0 are known, the adversary can enumerate all candidate α∈Z_t, compute c* − α·r0, and check whether the result equals the known linear combination for m0 or m1 (or decrypt it with its own key if it is the owner). This yields an exact distinguisher with advantage negligibly close to 1, so the claimed bound in Theorem 4 is false.","section":"§6.1, Definition 1"},{"comment":"Lemma 2's reduction is invalid: in the actual hybrid games, the i-th coordinate term is (m_b)_{i+1}·c_{i+1}, a scalar multiple of the public fixed ciphertext c_{i+1}, whereas the reduction inserts a fresh challenge ciphertext c* = Enc(m*) into the simulated ciphertext. These two distributions differ because c_{i+1} is given to the adversary as part of B and cannot be replaced by c*. The simulator cannot simulate the scalar-multiplied basis term from a fresh encryption of the scalar, so the claimed bound |Pr[A wins G_i] − Pr[A wins G_{i+1}]| ≤ ε1 is unsupported.","section":"§6.2, Lemma 2"},{"comment":"Lemma 3 asserts that α·r0 is computationally indistinguishable from a fresh encryption of zero, but the proof only restates the property being proved: saying that scalar multiplication 'does not expose plaintext content' is exactly the claim at issue. Since r0 is a fixed public ciphertext, the set {α·r0 : α∈Z_t} has only t elements and is trivially distinguishable from the full distribution of fresh encryptions, for example by checking membership in that low-entropy set or by examining the noise structure. Thus Lemma 3 is false as stated.","section":"§6.2, Lemma 3"},{"comment":"The sampling domain for the masking scalar is inconsistent: Algorithm 2 and §4.3 sample a uniformly from Z_q, while the security game in Definition 1 samples α from Z_t, and the correctness analysis in §5.1 requires |a| to be very small (e.g., in {0,1} or Z_t). If a is uniform in Z_q, the noise term a·r0 is so large that decryption correctness fails; if a is limited to Z_t or a small range, the masking provides at most log t bits of entropy, enabling the attack described above. The construction cannot simultaneously satisfy correctness and the claimed security under any single consistent sampling choice.","section":"§4.3, §5.1, §6.1"}],"minor_comments":[{"comment":"There is no Lemma 1 in the manuscript, yet the proof of Theorem 4 refers to 'Lemma 2' and 'Lemma 3'; the numbering should be fixed by either adding Lemma 1 or renumbering the lemmas.","section":"§6.2"},{"comment":"Algorithm 2 samples the masking scalar a from Z_q at step 4, while Definition 1 samples α from Z_t; the notation and the sampling distribution should be unified across the construction, the security game, and the correctness analysis.","section":"Algorithm 2"},{"comment":"The correctness condition requires each |m_i| < t/4 and a small |a|, but this is stated without justification and appears incompatible with plaintexts spanning the full Z_t module as assumed in the algebraic framework.","section":"§5.1"},{"comment":"The phrase 'randomness space is preserved' is vague; the paper should specify the exact distribution of α·r0 and provide a concrete noise bound for this masking term.","section":"§4.3"},{"comment":"The 'Final Remark' section contains speculative mathematical directions (cohomology, derived categories, non-commutative geometry) that are not connected to the rest of the paper and should be removed or clearly separated as future-work discussion.","section":"§8"}],"recommendation":"reject","confidential_remarks":"The manuscript appears to be formatted as a journal submission with placeholder metadata ('Received/Revised/Accepted/Published', 'Journal Not Specified'). More substantively, the security theorem is contradicted by a direct attack that follows from the public nature of the basis and the zero ciphertext. The paper could potentially be repositioned as a systems-oriented description of an algebraic preprocessing technique without any security claim, but as submitted, the central claim is broken and the proof is not repairable within the current scope. I recommend rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The short version: the security theorem is wrong. The scheme as defined in Definition 1 is insecure against an adversary who just does arithmetic with the public values. Since r0 and all c_i are public, and the mask scalar a is drawn from the tiny set Z_t, the attacker can enumerate a, compute c* - a·r0 for each candidate, and check whether the result equals the deterministic linear combination for m0 or m1. That gives advantage essentially 1. This is not a parameter-tuning issue; it is an immediate consequence of the construction.\n\nTo give credit where it is due: the vector-level basis precomputation is a coherent, if straightforward, extension of Rache's scalar caching. The correctness and noise-growth sections are mostly careful, and the paper is well organized. The abstraction of treating synthesis as a randomized module morphism is a clean framing, even if it does no cryptographic work.\n\nThe soft spots are load-bearing. Lemma 2 substitutes a fresh encryption of a scalar for a scalar-multiplied basis ciphertext, but those have different distributions, and the adversary knows the basis, so the reduction is not valid. Lemma 3 simply asserts that a·r0 is indistinguishable from a fresh encryption of zero, which is the very conclusion the theorem needs and is false because the set {a·r0} has only t elements. The proof is circular. There is also a domain inconsistency: Section 4.3 samples a from Z_q, while Section 5.1 and Definition 1 use Z_t or a small range; the security argument only works (if at all) if the masking scalar is large, but correctness requires it to be small.\n\nThis is not a paper I would send to a serious referee expecting a fixable revision. The central idea, as presented, does not provide semantic security, and the proof strategy cannot be patched without changing the masking mechanism to something like fresh encryptions of zero or a proper rerandomization algorithm, which would also undercut the claimed memory benefit. The system angle might be worth one paragraph in a related-work section of a different paper, but that is the extent of it.","headline":"The compile-time vector encryption idea is a natural system optimization, but the paper's central claim is false: the single-zero-ciphertext masking scheme is trivially attackable, and the security proof does not hold together.","tokens_in":14758,"tokens_out":3893,"would_cite":false,"duration_ms":43356,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["94A60"],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper proposes SynthEnc, which builds batched FHE ciphertexts by linearly combining precomputed encrypted basis vectors and a freshly scaled zero ciphertext, aiming to remove runtime encryption while preserving IND-CPA security.","keywords":["fully homomorphic encryption","ciphertext synthesis","compile-time encryption","batching","IND-CPA security","vector encryption","encrypted databases","homomorphic module morphism"],"falsifier":"In a concrete batched scheme such as BFV or BGV, compute $r_0=\\mathsf{Enc}(0^d)$ once, sample many fresh scalars $\\alpha$, and collect the noise polynomials of $\\alpha r_0$ together with many fresh $\\mathsf{Enc}(0^d)$ ciphertexts; a statistical test on noise norm or higher moments that separates the two distributions with non-negligible advantage would refute Lemma 3 and the proof of Theorem 4.","tokens_in":13595,"feed_emoji":"🔐","tokens_out":9564,"duration_ms":91015,"temperature":0.7,"pith_summary":"Fully homomorphic encryption makes encryption itself the bottleneck when new data has to be ingested continuously, since every packet needs a fresh ciphertext. This paper proposes a compile-time alternative: encrypt the standard basis vectors of the plaintext module once, then synthesize any vector's ciphertext as the $\\mathbb{Z}_t$-linear combination of those basis ciphertexts, masked by a single precomputed zero ciphertext scaled by a freshly sampled scalar. The central claim is that this synthesized encryption is IND-CPA secure whenever the underlying FHE scheme is, with adversarial advantage bounded by $(d+1)\\varepsilon_1+\\varepsilon_2$. If the claim holds, runtime ingestion never calls the encryption routine, only homomorphic addition and scalar multiplication, and the randomness pool shrinks from many zero ciphertexts to one.","feed_headline":"Batched ciphertexts can be synthesized without encrypting at runtime","feed_subtitle":"One encrypted basis plus one scrambled zero ciphertext yields any batch-encoded vector in O(d), no encryption at runtime.","key_machinery":"The central object is a randomized $\\mathbb{Z}_t$-module morphism: a precomputed ciphertext basis $\\mathcal{B}=\\{c_1,\\dots,c_d\\}$ with $c_i=\\mathsf{Enc}(e_i)$, followed by a masking layer built from a single cached zero ciphertext $r_0=\\mathsf{Enc}(0^d)$ scaled by a fresh scalar. Runtime synthesis evaluates $\\mathsf{SynthEnc}(m)=\\sum_i m_i c_i+\\alpha r_0$ using only ciphertext addition and scalar multiplication, so no encryption primitive is invoked online. The security argument is carried by the hybrid sequence $G_0,\\dots,G_{d+1}$ in which consecutive games differ in one plaintext coordinate, with the indistinguishability of $\\alpha r_0$ versus fresh $\\mathsf{Enc}(0^d)$ supplying the final reduction step.","core_discovery":"The paper's discovery is a way to make vector-level precomputation compatible with batched FHE. With $c_i=\\mathsf{Enc}(e_i)$ for the $d$ unit vectors of $\\mathbb{Z}_t^d$ and a fixed $r_0=\\mathsf{Enc}(0^d)$, the construction sets $\\mathsf{SynthEnc}(m)=\\sum_i m_i c_i + \\alpha r_0$ for a fresh $\\alpha \\leftarrow \\mathbb{Z}_t$. Linearity of the underlying encryption gives $\\mathsf{Dec}(\\mathsf{SynthEnc}(m))=m$, while the scalar-masked zero supplies per-message randomness. The proof is a hybrid argument over $d+1$ games that exchange the plaintext coordinates one at a time, yielding the bound $\\mathsf{Adv}^{\\mathrm{IND-CPA}}_{\\mathsf{SynthEnc}}\\le (d+1)\\varepsilon_1+\\varepsilon_2$; Lemma 2 bounds each coordinate swap and Lemma 3 asserts that $\\alpha r_0$ is indistinguishable from a fresh encryption of zero. The construction is claimed to preserve the batched slot layout, so rotation, summation, and aggregation work without repair.","pith_inferences":["The same basis-synthesis idea would extend to tensors or matrix blocks, where the number of stored basis ciphertexts equals the number of entries (or the matrix rank, if low-rank structure is exploited) instead of the number of distinct plaintext values, trading memory for online work in a different curve.","The security bound depends on the untested distributional claim that $\\alpha r_0$ re-randomizes like a fresh encryption of zero; a direct experiment measuring the noise distribution of $\\alpha r_0$ against fresh encryptions, over the intended parameter set, would validate or refute the central step before production use.","If Lemma 3 holds, it implies that homomorphic scalar multiplication is itself a re-randomization mechanism for the zero plaintext, a property stronger than standard IND-CPA and potentially useful as a standalone primitive for ciphertext refreshing."],"forward_implications":["After one offline phase of $d+1$ encryptions, every subsequent vector costs $O(d)$ ciphertext operations and zero encryption calls, so ingestion throughput becomes a function of homomorphic arithmetic rather than of the encryption routine.","The randomness mechanism needs only one stored zero ciphertext instead of a pool of $s$ zero ciphertexts, trading $O(1)$ memory for a fresh scalar multiplication at runtime.","Because synthesized ciphertexts keep the batched slot layout, downstream operations such as rotation, aggregation, relinearization, and modulus switching apply without layout correction.","If the IND-CPA bound is sound, the construction composes with standard FHE APIs and can serve as a drop-in ingestion layer for encrypted databases, streaming pipelines, and secure compiler backends."],"supporting_citations":[{"why":"Supplies the scalar-level encryption-caching baseline (Rache) whose failure to extend to batched vectors motivates the vector synthesis construction.","marker":"[7]"},{"why":"Provides the BFV scheme, a concrete IND-CPA batched FHE instantiation whose linear homomorphisms define SynthEnc.","marker":"[2]"},{"why":"Provides BGV with CRT batching, the slot structure that makes the precomputed unit-vector basis meaningful.","marker":"[9]"},{"why":"Shows the synthesis interface is claimed to extend to approximate-arithmetic FHE, so the construction is not limited to exact modular schemes.","marker":"[3]"}],"fun_headline_variants":["Encrypt once, synthesize any vector: no runtime encryption needed","Precompute encrypted basis, synthesize any vector in O(d)","Zero-encryption FHE: one basis, one zero, any vector","FHE without runtime encryption: algebraic basis synthesis","Compile-time FHE: encrypt basis once, synthesize vectors freely"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole proof depends on two substitutions being invisible to the adversary: swapping in a fresh basis ciphertext one coordinate at a time, and treating a random scalar times the cached zero ciphertext as exactly a newly encrypted zero; if either leaks noise structure, the claimed security bound does not follow.","fun_headline_variants_meta":{"raw":{"variants":["Encrypt once, synthesize any vector: no runtime encryption needed","Precompute encrypted basis, synthesize any vector in O(d)","Zero-encryption FHE: one basis, one zero, any vector","FHE without runtime encryption: algebraic basis synthesis","Compile-time FHE: encrypt basis once, synthesize vectors freely"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000898,"raw_usage":{"total_tokens":3885,"prompt_tokens":982,"completion_tokens":2903,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":598,"completion_tokens_details":{"reasoning_tokens":2830}},"tokens_in":598,"tokens_out":2903,"duration_ms":22189,"temperature":1.0,"reasoning_tokens":2830,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T20:31:46.052760+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"In a concrete batched scheme such as BFV or BGV, compute $r_0=\\mathsf{Enc}(0^d)$ once, sample many fresh scalars $\\alpha$, and collect the noise polynomials of $\\alpha r_0$ together with many fresh $\\mathsf{Enc}(0^d)$ ciphertexts; a statistical test on noise norm or higher moments that separates the two distributions with non-negligible advantage would refute Lemma 3 and the proof of Theorem 4.","supporting_citations":[{"cited_title":"Somewhat Practical Fully Homomorphic Encryption","cited_arxiv_id":null,"evidence_quote":"Provides the BFV scheme, a concrete IND-CPA batched FHE instantiation whose linear homomorphisms define SynthEnc."},{"cited_title":"(Leveled) fully homomorphic encryption without bootstrapping","cited_arxiv_id":null,"evidence_quote":"Provides BGV with CRT batching, the slot structure that makes the precomputed unit-vector basis meaningful."}],"review_version":1}