{"id":"c126ac87-461b-45cd-9a8a-967aaf439466","arxiv_id":"2505.17092","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"An active adversary can exploit additive error injection in passively secure MPC training to poison models, amplify membership inference, reduce fairness, and reconstruct exact training data.","lead":"This paper demonstrates that a malicious computing party can tamper with multiplication operations during secure multiparty model training, invisibly corrupting models or extracting private training data. It challenges the common assumption that passively secure MPC is sufficient for privacy-preserving machine learning.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The headline attack results are not yet shown to hold in the fixed-point arithmetic over Z_M used by real MPC training; the floating-point simulator may not preserve the large additive manipulations the attacks depend on.","rationale":"The paper's strongest contribution is a well-motivated attack framework that would be significant if it transfers to real MPC training. The reader's CONDITIONAL verdict is fair, and I agree with the reader's weakest-assumption analysis: the single most load-bearing premise is that the floating-point simulator faithfully represents the fixed-point, finite-ring behavior of actual passively secure MPC protocols. The paper's own formal model, F_MPC in Figure 4, is over Z_M with truncation, but all experiments use JAX over R with no fixed-point validation. This matters because the attacks deliberately inject large perturbations — forcing comparisons with large Δ and scaling gradients by 10000 — and in a finite ring with truncation such perturbations can wrap modulo M or be partially discarded, changing or destroying the attack. I am not asserting that fixed-point arithmetic necessarily breaks the attacks; the paper may be right that they transfer, but the missing validation is load-bearing because the attack mechanics are explicitly tied to magnitudes and ranges. The concrete test above would settle the issue by rerunning the exact attack recipes under F_MPC with realistic parameters. A secondary, non-foundational issue is that the abstract's all-attacks 'essentially zero risk of detection' phrasing is too strong given Section 5.4, which concedes that reconstruction is not stealthy; this is an overstatement rather than the core technical weakness. The CONDITIONAL verdict remains appropriate: the paper's immediate claims should be accepted only if the fixed-point transfer is demonstrated or the claims are narrowed to the floating-point simulation.","tokens_in":19938,"tokens_out":16553,"duration_ms":161615,"concrete_test":"Implement the Section 5 attacks in a fixed-point simulator that follows Figure 4 exactly: use a 64-bit modulus M and a representative precision f (e.g., f=16 and f=32), apply each adversarial modification as an integer error ϵ ∈ Z_M after truncation, and convert the reported real-valued shifts by ϵ = round(Δ·2^f). Re-run the backdoor and MI experiments (Tables 3a, 3b, 5) and the reconstruction experiment with C=10000. Check (i) whether every intermediate value lies in [-M/2, M/2) after each adversarial injection, and (ii) whether attack success rates stay within the reported ranges (e.g., FMNIST backdoor ASR ≥0.99, FMNIST/LR MI TPR@0.1% ≥4%, reconstruction MAE ≤0.05). If any injected value wraps or the success metrics drop by more than a small tolerance, the simulator-based results do not establish the paper's claim for real MPC training.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that an active adversary can run the described attacks on existing passively secure MPC training protocols. The experiments, however, are run in a JAX simulator over R (Section A.4), while real protocols operate on fixed-point values in Z_M with truncation after each multiplication (Section A.1, Figure 4). The attack mechanics are not scale-invariant: in F_MPC, an injected error ϵ is added to the truncated integer x*y/2^f, so a 'large' real shift Δ in the simulator corresponds to an integer perturbation of roughly Δ·2^f, and any value that crosses the modulus boundary wraps. The attacks rely precisely on large data-independent shifts — e.g., forcing a comparison by adding 'a large positive constant Δ' (Section 3) and gradient scaling with C=10000 (Figure 7) — so a finite ring can either absorb the shift into a wrapped value or truncate it away. The paper acknowledges the issue in Section 2.2 ('we do not believe this will impact our findings') and in the Limitations, but provides no fixed-point validation. If the simulator's float manipulations do not map to realizable, non-wrapping errors in Z_M, then the reported ASRs, MI TPRs, and reconstruction MAEs do not transfer to actual MPC protocols, and the central claim is unsupported. This is a load-bearing premise, not a stylistic gap: an attack that silently fails on the target platform is not an attack on that platform.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies active (malicious) adversaries in passively secure MPC-based machine learning training. The authors introduce low-level attacks on secure comparisons and activation functions (ReLU, piecewise and direct sigmoid/softmax), then compose them into three high-level gradient manipulation strategies: gradient zeroing, shifting, and scaling. They instantiate these into concrete attacks: backdoor and targeted poisoning via parameter transfer and neuron override, membership-inference amplification, training-data reconstruction, fairness degradation, and data-poisoning amplification. Experiments are run in a plaintext floating-point JAX simulator that mimics MPC-friendly operations. The paper argues that these attacks are simple, effective, and in most cases cause little to no model accuracy degradation, thereby challenging the view that passive security is sufficient for MPC training if active adversaries face reputation risk.","tokens_in":20221,"tokens_out":4693,"duration_ms":44256,"significance":"If the attacks transfer to real MPC training protocols, this is a significant result for the MPC and PPML communities: it provides concrete evidence that passively secure training protocols are vulnerable to active adversaries in ways that are both easy to mount and hard to detect by accuracy-based checks. The paper clearly organizes the attack surface (input modification, activation modification, combined modification) and proposes practical, cheap mitigations such as using actively secure sigmoid/softmax. The mathematical analysis of activation-function manipulations is careful under the arithmetic black-box model, and the authors promise open-source code, which aids reproducibility. However, the significance is conditional on the experimental simulator faithfully representing fixed-point MPC arithmetic, which is the paper's main unresolved gap.","major_comments":[{"comment":"","section":"§2.2, §A.1 (Figure 4), §A.4, Limitations"},{"comment":"","section":"§5.4 (Figure 7), §A.1"}],"minor_comments":[{"comment":"","section":"§5.3, Table 5, Abstract"},{"comment":"","section":"§5.2, §5.3, §5.6"},{"comment":"","section":"§A.3 vs §5"},{"comment":"","section":"§2.3, Figure 4"},{"comment":"","section":"Table 1"}],"recommendation":"major_revision","confidential_remarks":"This is a strong and timely paper, but the gap between the abstract's claim of attacks on real MPC protocols and the floating-point-only experimental validation is the main obstacle. The mathematical framework in Section 3 is careful, and the high-level attack strategies are well designed. The fixed-point transfer concern is not a stylistic issue: it can invalidate the attacks if large additive errors wrap around or are truncated. Because this is a fillable gap (a fixed-point simulator or an analysis of modulus requirements would suffice), I recommend major revision rather than rejection. I would also encourage the authors to be more precise about what 'detection' means in their threat model."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's my take on Jagielski et al. The headline is real: they are the first to show that an active adversary can turn the known low-level additive attacks on passive MPC into concrete, effective attacks on ML training—poisoning, fairness degradation, membership inference amplification, and reconstruction. The three gradient-level strategies (shifting, zeroing, scaling) are the right abstraction, and the parameter transfer and neuron override tricks for working without knowing secret-shared weights are the strongest contributions. The MI amplification numbers are striking. If the attacks transfer to real implementations, this is a significant result.\n\nThe soft spot is exactly where the reader put it: all experiments are in a floating-point JAX simulator, not fixed-point arithmetic over Z_M. The paper's own F_MPC functionality (Appendix A.1) is fixed-point with truncation, and Section 2.2 asserts without evidence that this \"will not impact our findings.\" The stress-test worry about wraparound is not fatal in my view—with a 64-bit modulus and typical precision (say f=16), a shift of 10000 is easily representable and survives truncation—but the paper should show this with actual parameters, or better, run a fixed-point simulation. An attack paper whose central claim is \"works on existing protocols\" owes the reader that validation.\n\nSecond issue: the abstract overclaims \"essentially zero risk of detection.\" The reconstruction attack is explicitly not stealthy (accuracy drops to 10%), and the availability attacks degrade accuracy. The \"stealthy\" claim applies to some attacks, not all. The paper should scope it.\n\nMinor: the code availability statement is contradictory (A.3 says open-sourced, A.4 says planned). Experiments are on small models, which is acceptable for a first paper.\n\nBottom line: this is a serious paper that deserves peer review and likely a strong revision. The conceptual contribution is solid; the experimental gap is addressable. I'd want to see fixed-point validation or a precise overflow argument before fully believing the transfer, but I would not desk-reject this.\n\nReading group: yes. I'd cite it (carefully, noting the simulator caveat).","headline":"First credible demonstration that passive MPC training can be actively attacked via additive errors; results are plausible but the fixed-point transfer needs to be shown, not asserted.","tokens_in":20747,"tokens_out":3564,"would_cite":true,"duration_ms":31749,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["68P25","94A60"],"pacs":[],"model":"deepseek-v4-flash","headline":"An active adversary in a passively secure MPC training run can add errors to secret-shared multiplications and, without being detected, poison the model, amplify membership inference, and reconstruct nearly exact training data.","keywords":["secure multiparty computation","passive security","active adversary","additive attacks","machine learning poisoning","membership inference","training data reconstruction","gradient manipulation"],"falsifier":"Run the attacks in an actual fixed-point MPC training protocol over $\\mathbb{Z}_M$ with precision $f$, using the same datasets and the same error magnitudes, and compare the resulting model behaviors to the floating-point simulations. A decisive observation would be whether injected offsets like a shift of 10000 or a scaling of 10000 survive the truncation step after each multiplication and avoid wraparound modulo $M$; if the effective additive errors change materially, attack success rates and accuracy should be re-measured under the fixed-point arithmetic the paper abstracts away.","tokens_in":19728,"feed_emoji":"🕵️","tokens_out":11432,"duration_ms":97051,"temperature":0.7,"pith_summary":"Secure multiparty computation lets parties train on pooled data while keeping inputs secret; 'passive' security assumes corrupt parties follow the protocol, and it is often argued that active cheating is unlikely because it could be detected and hurt reputations. This paper claims that an active party in a passively secure MPC training protocol can, with essentially zero risk of detection, both corrupt the learned model and break its privacy guarantees. The attack surface is the ability to add a chosen error to each secret-shared multiplication, and the paper shows how these errors, applied to comparisons, sigmoids, softmaxes, and gradient multiplications, compose into gradient zeroing, gradient shifting, and gradient scaling. These produce backdoor and targeted poisoning, disproportionate accuracy loss for a targeted data contributor, large membership-inference amplification, and near-exact training-input reconstruction. The experiments run in a floating-point plaintext simulator of MPC, which is the paper's key idealization; if the results carry over to real fixed-point arithmetic, the reputation-based case for passive security in ML training collapses.","feed_headline":"A malicious MPC party can poison models and steal training data","feed_subtitle":"Additive errors on secret-shared multiplications evade detection while shifting gradients and leaking training examples.","key_machinery":"The load-bearing mechanism is the additive attack on a secret-shared multiplication, formalized in an arithmetic black-box functionality where the adversary may supply an error $\\epsilon$ after each product. The model-update step is linear and multiplication-free, so the attacks concentrate on gradient computations, which contain the protocol's only relevant multiplications. On top of this primitive, the paper layers low-level activation manipulations (flipping secure-comparison outputs, offsetting inputs by large constants, and tampering with reciprocal and exponentiation subroutines) and high-level gradient strategies (zeroing, shifting, scaling) that turn isolated errors into whole-model behavior. These layers are what let the adversary act without seeing secret-shared data or weights.","core_discovery":"The paper's central claim is that passively secure MPC training protocols contain a systematic exploitable gap: an active adversary who can place an additive error on every multiplication can implement strong adversarial-ML attacks without ever seeing the secret-shared data or weights. On the low level, the adversary flips outputs of secure comparisons, forces ReLU, piecewise-linear sigmoid, direct sigmoid, and softmax into chosen outputs, and tampers with reciprocal and exponentiation subroutines. On the high level, these primitives become gradient zeroing (removing an example's contribution), gradient shifting (adding a chosen vector to gradients, via parameter transfer or neuron override), and gradient scaling (multiplying gradients by a large scalar supplied by the loss derivative). The paper demonstrates near-perfect backdoor and targeted attacks on logistic regression and small neural networks with little accuracy loss, fairness attacks that reduce accuracy disproportionately for a targeted subpopulation, membership-inference true-positive-rate gains of up to about 40x at low false-positive rates, and reconstruction of almost exact training images (mean absolute error 0.017 of pixel range for logistic regression and 0.036 for neural networks), with the reconstruction attack destroying model utility.","pith_inferences":["I infer that the attacks should be evaluated on dishonest-majority protocols too: the paper notes its manipulations apply to any linear secret-sharing scheme, so additive sharing over $\\mathbb{Z}_M$ is a direct test bed.","I infer that a practical middle-ground defense for gradient shifting could be randomized spot-checking of multiplications: if the adversary injects $p$ errors and a fraction $\\alpha$ of multiplications is checked, detection probability is $1-(1-\\alpha)^p$, and the paper's attack uses so many errors that even tiny $\\alpha$ would catch it; no such protocol is constructed.","I infer that moving from floating-point simulation to fixed-point arithmetic is likely to change the attacks quantitatively rather than eliminate them: moderate additive errors may be trimmed by truncation, while the large shifts used for forcing activations risk modulo wraparound, so an attacker would need to tune error magnitudes to the modulus.","I infer that gradient-scaling privacy attacks will transfer more readily than gradient-shifting poisoning attacks to larger models, because scaling exploits the loss-derivative multiplication common to all gradient computations, whereas shifting relies on gradients transferable across nonconvex networks."],"forward_implications":["If the paper is right, passively secure MPC training offers no meaningful protection against a malicious party; post-hoc accuracy checks and reputation arguments do not catch the attacks.","Computing sigmoid and softmax with active security is a cheap mitigation for the gradient-scaling family, since those activations are computed once per example and take a small fraction of training time in the direct-softmax implementations the paper targets.","Gradient-shifting attacks (parameter transfer for linear models, neuron override for small neural networks) plant backdoors and targeted misclassifications with near-100% success and at most a few percent accuracy loss on the evaluated datasets.","Gradient scaling can amplify membership inference by converting any example into an apparent outlier, raising true-positive rate at low false-positive rates by factors of roughly 2 to 40 on the tested models.","The same gradient-scaling mechanism, pushed to strength 10000 on the final batch, reconstructs a nearly exact training image; this is not stealthy, since accuracy drops to random-guess level."],"supporting_citations":[{"why":"Supplies the passively secure training pipeline and the piecewise-linear sigmoid approximation that the attacks manipulate.","marker":"[1]"},{"why":"Provides the direct softmax and exponentiation protocol used in training, together with the observation that softmax is a small fraction of compute, used both as an attack target and in the mitigation argument.","marker":"[4]"},{"why":"Establishes that some passive protocols are vulnerable only to additive attacks, justifying the additive-error adversary model as broadly applicable.","marker":"[24]"},{"why":"Shows an active inference-time adversary using additive errors on ReLUs, supplying the input-modification technique the paper extends to training.","marker":"[42]"},{"why":"Provides the LiRA membership-inference attack that the paper adapts to measure membership-inference amplification under gradient scaling.","marker":"[36]"},{"why":"Identifies that first-layer gradients are scalar multiples of input features, the property the reconstruction attack exploits.","marker":"[54]"},{"why":"Supports the paper's assumption that fixed-point MPC arithmetic is not too lossy relative to floating point, justifying the simulator.","marker":"[22]"},{"why":"Further supports the fixed-point fidelity assumption by analyzing truncation scaling for large MPC training, the paper's justification for abstracting fixed-point arithmetic away.","marker":"[23]"}],"fun_headline_variants":["Passive MPC training is not safe from covert attacks","Covert MPC attacks poison models and leak exact data","Undetectable attacks break passively secure MPC training","Active attacks on passive MPC steal training data quietly","MPC training flaw: hidden attacks compromise data and models"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that attacks measured in a floating-point plaintext simulator match what happens in real MPC training, which uses fixed-point arithmetic over a finite ring with truncation and possible wraparound; if large additive errors are truncated away or wrap the modulus, the attacks could fail or become detectable.","fun_headline_variants_meta":{"raw":{"variants":["Passive MPC training is not safe from covert attacks","Covert MPC attacks poison models and leak exact data","Undetectable attacks break passively secure MPC training","Active attacks on passive MPC steal training data quietly","MPC training flaw: hidden attacks compromise data and models"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000143,"raw_usage":{"total_tokens":1170,"prompt_tokens":942,"completion_tokens":228,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":558,"completion_tokens_details":{"reasoning_tokens":167}},"tokens_in":558,"tokens_out":228,"duration_ms":3337,"temperature":1.0,"reasoning_tokens":167,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T15:25:07.542875+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the attacks in an actual fixed-point MPC training protocol over $\\mathbb{Z}_M$ with precision $f$, using the same datasets and the same error magnitudes, and compare the resulting model behaviors to the floating-point simulations. A decisive observation would be whether injected offsets like a shift of 10000 or a scaling of 10000 survive the truncation step after each multiplication and avoid wraparound modulo $M$; if the effective additive errors change materially, attack success rates and accuracy should be re-measured under the fixed-point arithmetic the paper abstracts away.","supporting_citations":[{"cited_title":"SecureML: A system for scalable privacy-preserving machine learning,","cited_arxiv_id":null,"evidence_quote":"Supplies the passively secure training pipeline and the piecewise-linear sigmoid approximation that the attacks manipulate."},{"cited_title":"Secure quantized training for deep learning,","cited_arxiv_id":null,"evidence_quote":"Provides the direct softmax and exponentiation protocol used in training, together with the observation that softmax is a small fraction of compute, used both as an attack target and in the mitigation argument."},{"cited_title":"Circuits resilient to additive attacks with applications to secure computation,","cited_arxiv_id":null,"evidence_quote":"Establishes that some passive protocols are vulnerable only to additive attacks, justifying the additive-error adversary model as broadly applicable."},{"cited_title":"Muse: Secure inference resilient to malicious clients,","cited_arxiv_id":null,"evidence_quote":"Shows an active inference-time adversary using additive errors on ReLUs, supplying the input-modification technique the paper extends to training."},{"cited_title":"When the curious abandon honesty: Federated learning is not private,","cited_arxiv_id":null,"evidence_quote":"Identifies that first-layer gradients are scalar multiples of input features, the property the reconstruction attack exploits."},{"cited_title":"CrypTFlow: Secure TensorFlow inference,","cited_arxiv_id":null,"evidence_quote":"Supports the paper's assumption that fixed-point MPC arithmetic is not too lossy relative to floating point, justifying the simulator."},{"cited_title":"Truncation untangled: Scaling fixed-point arithmetic for privacy-preserving machine learning to large models and datasets,","cited_arxiv_id":null,"evidence_quote":"Further supports the fixed-point fidelity assumption by analyzing truncation scaling for large MPC training, the paper's justification for abstracting fixed-point arithmetic away."}],"review_version":1}