{"id":"8824bfdb-43d9-4694-9d6d-ccd941eb2880","arxiv_id":"2505.20577","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"A hybrid homomorphic-encryption and secret-sharing protocol is designed for distributed P2P energy trading, with a claimed provable range for the random encryption coefficient that the numerical test setup does not actually satisfy.","lead":"This paper proposes a privacy-preserving protocol for peer-to-peer electricity trading that combines homomorphic encryption with secret sharing, so neighbors can compute a market solution without seeing each other's private data. The result is potentially useful for future smart-grid markets, though the convergence guarantee has a gap in the reported test settings.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 1 is not applicable to the P2P problem: the actual A_i is wide with σ_min(A_i)=0, so the reported feasible range for r_i is not derived; the objective is also flat in the null space of A_i.","rationale":"The reader's weakest assumption is the correct point of attack. Section IV.A needs σ_min(A_i)=1.0 to enter Cond.2, but the matrix A_i is rectangular with more columns than rows, so its least singular value is zero. Recomputing with σ_min=0 flips the sign in the convergence inequality and makes the reported interval infeasible for the worst-case parameters. A secondary but reinforcing problem is that the augmented Lagrangian is flat along null directions of A_i that do not enter the objective, so Assumption 1's strong convexity is also violated; this rules out the usual fix of reinterpreting σ_min as the smallest nonzero singular value. The empirical convergence could still be genuine, and the protocol may be salvageable with a different proof or parameter regime, but the paper's stated theoretical guarantee is not supported. Hence the reader's REJECT verdict stands.","tokens_in":22330,"tokens_out":16038,"duration_ms":155716,"concrete_test":"Reconstruct A_i for one buyer in the IEEE 15-bus case from constraints (1i)-(1l), compute its SVD, and evaluate the Hessian of L_i in (5) along the null-space vector (0,1,0,−1,2X_i,0) (q_i=1, Q_i=−1, v_i=2X_i). Verify that a zero singular value exists and that the quadratic form vanishes. Then substitute σ_min(A_i)=0, ρ_i=0.02, ξ_{i,b}=0.015 into the convergence inequality from the proof of Theorem 1; if the resulting upper bound on r_i is negative, the reported interval [0.0223,2.3057] is outside any provable region and the central convergence claim fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section IV.A sets σ_min(A_i)=1.0 and σ_max(A_i)=1.4142 for buyers and uses Cond.2 to obtain 0.0223≤r_i≤2.3057. But the equality constraint matrix A_i in (2b) is built from (1i)-(1l). For an agent with trading set S_i, A_i has C=|S_i|+3 rows and D=5+|S_i| columns (p_i,q_i,P_i,Q_i,v_i, and e_{i,j}), so C<D and the standard minimum singular value is 0. The proof of Theorem 1 needs σ_min(A_i)>0 to give the augmented Lagrangian a positive strong-convexity constant ρη=ρ_i+(η†_i−ξ†_{i,a})r_i σ_min²(A_i). With σ_min(A_i)=0, the convergence condition becomes −ξ†_{i,a} σ_max²(A_i) r_i + ρ_i − ξ_{i,b} σ_max²(B_i) ≥ 0. Using the reported worst-case ρ_i≥0.02, ξ_{i,b}=0.015, ξ†_{i,a}=0.02, σ_max(A_i)=1.4142, σ_max(B_i)=1.9021 gives r_i ≤ (0.02−0.0543)/0.04 ≈ −0.857, so no positive r_i satisfies Cond.1, Cond.2, or Cond.3. The failure is not merely numerical: A_i has a null direction (e.g., δq_i=1, δQ_i=−1, δv_i=2X_i, with other increments zero), and G_i has no dependence on q_i, Q_i, or v_i in (1a), so L_i is not ρ-strongly convex on R^D as Assumption 1 requires. Thus Theorem 1's feasible range is not established for the problem actually solved.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes a privacy-preserving scheme for fully distributed P2P energy trading based on CRT-Paillier encryption for secure two-party computations and a tailored secret-sharing mechanism for secure multi-party computations. The authors claim that the scheme is exact, avoids a trusted third party, and preserves the optimality of the distributed PDHG solution. A central contribution is a theoretical feasible range for the random encryption coefficient r_i that is claimed to guarantee linear convergence. Numerical experiments on IEEE 15- to 141-bus systems report exact optimality, privacy, and computational efficiency.","tokens_in":22764,"tokens_out":5761,"duration_ms":55541,"significance":"If the convergence guarantee were valid, the hybrid protocol would be a useful contribution: it avoids a trusted third party, preserves exact optimality, and the reported speedups over standard Paillier encryption are substantial. The paper includes a detailed Appendix with a convergence proof and extensive numerical comparisons across five systems. However, the central convergence result is not applicable to the problem actually solved, because the constraint matrix A_i is wide and the individual cost G_i is not strongly convex on the full variable space. Consequently, the derived feasible range for r_i is unsupported, which undermines the paper's main theoretical contribution and the claimed convergence guarantee.","major_comments":[{"comment":"The numerical assignment σ_min(A_i)=1.0 for buyers is inconsistent with the constraint matrix defined by (2b) together with (1i)-(1l). For an agent with trading set S_i, A_i has C=|S_i|+3 rows and D=5+|S_i| columns, so C<D and the standard minimum singular value is 0. With σ_min(A_i)=0, the sign condition (18f) becomes ξ†_{i,a} σmax²(A_i)=0.04>0, so Cond.2 is not the applicable branch; evaluating Cond.1 gives k_{i,2}=(ρ_i−ξ_{i,b}σmax²(B_i))/(ξ†_{i,a}σmax²(A_i))=(0.02−0.0543)/0.04<0, so no positive r_i satisfies Cond.1, Cond.2, or Cond.3. The claimed feasible range 0.0223≤r_i≤2.3057 therefore does not follow from the stated assumptions.","section":"Section IV.A and Theorem 1"},{"comment":"The proof states that G_η is ρ_η-strongly convex with ρ_η = ρ_i + (η†_i r_i − ξ†_{i,a} r_i) σmin²(A_i). Because A_i is wide, σmin(A_i)=0 and this term vanishes, leaving ρ_η=ρ_i. The subsequent requirement ρ_η − ξ†_{i,a} r_i σmax²(A_i) − ξ_{i,b} σmax²(B_i) ≥ 0 then cannot be met for any r_i>0 with the reported parameters (ρ_i≥0.02, ξ†_{i,a}=0.02, ξ_{i,b}=0.015, σmax(A_i)=1.4142, σmax(B_i)=1.9021). Thus Theorem 1's proof is not applicable to the P2P problem solved in the paper.","section":"Appendix A, after Eq. (28)"},{"comment":"The cost function G_i in (1a)/(2a) is not δ-smooth and ρ-strongly convex on R^D as Assumption 1 requires. It contains the nonsmooth term ω_b[−p_i+Σ_{j∈S_i}e_{i,j}]_+, and it does not depend on q_i, Q_i, or v_i even though those are primal variables in Φ_i. The convergence proof in Appendix A uses ρ_i-strong convexity and δ_i-smoothness of G_i, so this assumption is load-bearing; the paper does not show that the decomposed problem satisfies it.","section":"Assumption 1 and Remark 1"}],"minor_comments":[{"comment":"The symbol k_{i,2} is used for two different expressions in Cond.1 and Cond.2, which makes the conditions hard to read; distinct symbols should be used.","section":"Eqs. (18b) and (18e)"},{"comment":"The quantity c_Φ is first defined as the scalar 1−µ_iξ_{i,a}σmax²(A_i)−µ_iξ_{i,b}σmax²(B_i), but it is then used as a coefficient multiplying ||Φ̃^{k+1}||²; the notation should be clarified.","section":"Appendix A, Eqs. (23)-(27)"},{"comment":"The values σ_max(A_i)=1.4142 and σ_max(B_i)=1.9021 are stated without specifying the actual matrices; because the matrix dimensions and entries are not given in Section II.B, the reader cannot verify these values.","section":"Section IV.A"},{"comment":"The proof of Theorem 2 counts equations and unknowns, but it assumes the random coefficients r_{i,j}^k are independent across iterations and known only to agent j; this modeling choice should be stated in the theorem.","section":"Appendix B"}],"recommendation":"reject","confidential_remarks":"The central flaw is not a presentation issue: the constraint matrices are wide by construction, and the reported σ_min(A_i)=1.0 cannot be correct for the standard singular value. Since the main contribution is the convergence-guaranteeing range for r_i, I do not see a local fix within the scope of a revision. I recommend reject."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The hybrid CRT-Paillier plus tailored secret-sharing protocol is a sensible engineering contribution. Putting the offline/online split into the multi-party computation and using CRT-Paillier to avoid a trusted third party is a real combination, and the efficiency numbers are believable. The privacy argument (underdetermined equations from two or more agents) is also basically sound. If the protocol converges, it would be a practical step for distributed P2P trading.\n\nThe soft spot is load-bearing. Theorem 1 needs the augmented Lagrangian to be strongly convex in the full space, which requires σ_min(A_i) > 0. But in the P2P formulation, A_i is a wide matrix (C < D), so the standard minimum singular value is 0. Section IV.A sets σ_min(A_i) = 1.0 for buyers, which is simply incorrect. With the actual σ_min(A_i) = 0, the denominator in Cond.2 changes sign and the derived range 0.0223 ≤ r_i ≤ 2.3057 does not follow. The stress-test calculation shows that no positive r_i satisfies Cond.1–3 with the reported parameters. There is also a mismatch between Assumption 1 and the objective: the [.]^+ terms are nonsmooth, and G_i is flat along the null direction of A_i, so strong convexity on R^D fails.\n\nThis is not a minor numerical slip; it invalidates the central theoretical claim. The empirical convergence may still hold, and the protocol might be salvageable by working in the range space of A_i or by adding a proximal term, but that is not what the paper does.\n\nThe paper deserves a serious referee because the protocol is novel and the flaw is subtle rather than sloppy. I would send it to review with a clear request to redo the convergence analysis for the actual constraint matrix and to address the smoothness assumption. As written, it should not be accepted.","headline":"Useful hybrid secure-computation protocol for P2P trading, but the convergence guarantee for the random encryption coefficient is built on a false singular value and does not hold for the problem actually solved.","tokens_in":23281,"tokens_out":1816,"would_cite":false,"duration_ms":21459,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A hybrid of CRT-Paillier encryption and secret sharing lets fully distributed P2P energy trading hide prosumer data while retaining exact optimal solutions and linear convergence.","keywords":["peer-to-peer energy trading","privacy preservation","homomorphic encryption","secret sharing","distributed optimization","linear convergence","Chinese Remainder Theorem","smart grid"],"falsifier":"Compute the actual singular values of each agent's matrix $A_i$ in (2b) from constraints (1i)-(1l), checking whether $\\sigma_{\\min}(A_i)=0$ because $A_i$ is $C\\times D$ with $C<D$. If it is zero, then with the stated step sizes none of Cond.1-Cond.3 is satisfied, and the reported feasible range $0.0223\\le r_i\\le 2.3057$ is not supported by Theorem 1.","tokens_in":22113,"feed_emoji":"🔐","tokens_out":9179,"duration_ms":88693,"temperature":0.7,"pith_summary":"This paper tries to establish that fully distributed peer-to-peer energy trading can be made privacy-preserving without giving up exact optimality and without a trusted third party. Its proposal combines two secure-computation tools: CRT-Paillier homomorphic encryption for two-agent operations and a tailored secret-sharing scheme for multi-agent operations, with a random encryption coefficient that both hides data and is provably compatible with linear convergence. The authors derive a feasible range for that coefficient and verify on distribution test systems that the protected protocol reaches the same traded-energy optimum as the centralized and unprotected distributed solutions while keeping per-agent computation low enough for real-time trading. If correct, the result would remove a key obstacle to practical P2P electricity markets: the risk that shared gradients and variables leak household-level consumption or utility parameters.","feed_headline":"P2P energy trading keeps prosumer data private at no cost to optimality","feed_subtitle":"Hybrid encryption and secret sharing keep distributed energy trading exact and private, with no trusted third party.","key_machinery":"The load-bearing object is the hybrid secure computation stack: CRT-Paillier homomorphic encryption for two-party sums, a tailored secret-sharing scheme with polynomial shares $G_i(Z_j)=R_i+\\varphi_{i,1}Z_j+\\dots$ for multi-party sums, and a random encryption coefficient $r_i$ inserted in the two-party encrypted sum. The coefficient is what couples security to convergence: Theorem 1 gives three conditions under which the primal-dual updates converge linearly, producing the feasible range $0.0223\\le r_i\\le 2.3057$ under the buyer parameters used in the simulations. The multi-party protocol is split into an offline phase, where shares are encrypted and distributed once, and an online phase, where each agent only sends one masked value per iteration.","core_discovery":"The central claim is that the hybrid protocol solves the fully distributed P2P trading problem exactly while protecting shared data from honest-but-curious participants. The proof path is to rewrite the trading problem as node-based primal-dual updates, show that without protection these updates let an adversary recover private utility parameters within two iterations, then encrypt the two-party gradient sums with CRT-Paillier homomorphic encryption multiplied by a random coefficient $r_i$, and mask multi-party sums with secret shares. Theorem 1 states the coefficient and the dual step sizes must meet one of three conditions for linear convergence; with the buyer parameters used in the simulations this yields $0.0223\\le r_i\\le 2.3057$. Theorem 2 and its corollary state that a receiving agent cannot infer the other party's exact data from the encrypted or masked sums unless the true values happen to be exact negatives. Numerical results on systems from 15 to 141 buses show the protected method converges in about the same number of iterations as the unprotected one and matches the centralized optimum.","pith_inferences":["Beyond the paper: the convergence guarantee as stated depends on $\\sigma_{\\min}(A_i)=1.0$ for buyers, but the constraint matrices in (2b) are wider than tall, so the standard minimum singular value is zero; if that holds, the proof's conditions are not met by the actual problem and the reported range would need a different derivation.","Beyond the paper: security is argued for honest-but-curious participants, and 128-bit keys are short by modern public-key standards, so a production deployment would need larger keys and a model that also covers malicious behavior.","Beyond the paper: the same offline/online secret-sharing pattern could be reused in other fully distributed optimization settings where two-party and multi-party operations coexist, such as federated learning over sparse networks.","Beyond the paper: a direct experimental check would monitor the convergence rate as $r_i$ approaches the boundaries of $[0.0223,2.3057]$ on different bus systems and compare it with the linear-rate predictions of Theorem 1."],"forward_implications":["The same exact optimum as centralized clearing is achievable with no coordinator and no trusted third party, so privacy need not be traded against economic efficiency.","Random coefficients for two-party encryption can be chosen from a proven interval, meaning security and convergence can be guaranteed simultaneously rather than tuned heuristically.","The CRT-Paillier variant cuts per-agent encryption time by roughly an order of magnitude relative to standard Paillier at 128-bit keys, and the offline secret-sharing phase costs only milliseconds, so the protocol fits a 5-minute real-time trading window even on larger systems.","An eavesdropper or honest-but-curious neighbor cannot recover intermediate power injections, voltages, or utility-function parameters, blocking the two-iteration inference attack demonstrated in the paper.","The offline/online split reduces multi-party communication per iteration from $O(m)$ to $O(1)$ per agent, improving scalability as the number of trading partners grows."],"supporting_citations":[{"why":"Supplies the primal-dual gradient linear-convergence framework whose KKT-based analysis Theorem 1 extends to inequality constraints and to the random encryption coefficient.","marker":"[48]"},{"why":"Defines the Paillier cryptosystem and homomorphic properties that the CRT-Paillier scheme builds on.","marker":"[36]"},{"why":"Provides the fast-decryption technique used to split Paillier exponentiation into the $p^2$ and $q^2$ subspaces.","marker":"[37]"},{"why":"Introduces the private aggregation and secret-sharing mechanism from which the offline-online multi-party protocol is tailored.","marker":"[39]"},{"why":"Serves as the secret-sharing privacy-preserving distributed optimization baseline M1 used for comparison.","marker":"[26]"},{"why":"Serves as another secret-sharing baseline M1 for distributed electric-vehicle charging control.","marker":"[27]"},{"why":"The standard Paillier cryptosystem used as the computational efficiency benchmark.","marker":"[19]"},{"why":"Sets the real-time P2P market time-scale of five minutes used to judge the protocol's computational cost acceptable.","marker":"[3]"}],"fun_headline_variants":["Hybrid crypto keeps P2P energy trading private and exact","Private P2P trading with exact solution and no third party","Zero-optimality-loss privacy for distributed energy trading","Exact private P2P trading via homomorphic encryption and secret sharing","No third party, no privacy leak: exact P2P trading protocol"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The proof assumes each agent's constraint matrix has a positive smallest singular value, set to $1.0$ for buyers in the simulations, but the actual matrices have more columns than rows, so the standard smallest singular value is zero.","fun_headline_variants_meta":{"raw":{"variants":["Hybrid crypto keeps P2P energy trading private and exact","Private P2P trading with exact solution and no third party","Zero-optimality-loss privacy for distributed energy trading","Exact private P2P trading via homomorphic encryption and secret sharing","No third party, no privacy leak: exact P2P trading protocol"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000787,"raw_usage":{"total_tokens":3493,"prompt_tokens":991,"completion_tokens":2502,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":607,"completion_tokens_details":{"reasoning_tokens":2414}},"tokens_in":607,"tokens_out":2502,"duration_ms":17841,"temperature":1.0,"reasoning_tokens":2414,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T13:53:48.886698+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute the actual singular values of each agent's matrix $A_i$ in (2b) from constraints (1i)-(1l), checking whether $\\sigma_{\\min}(A_i)=0$ because $A_i$ is $C\\times D$ with $C<D$. If it is zero, then with the stated step sizes none of Cond.1-Cond.3 is satisfied, and the reported feasible range $0.0223\\le r_i\\le 2.3057$ is not supported by Theorem 1.","supporting_citations":[{"cited_title":"Linear convergence of primal–dual gradient methods and their performance in distributed optimization,","cited_arxiv_id":null,"evidence_quote":"Supplies the primal-dual gradient linear-convergence framework whose KKT-based analysis Theorem 1 extends to inequality constraints and to the random encryption coefficient."},{"cited_title":"Fast decryption algorithm for paillier homomorphic cryptosystem,","cited_arxiv_id":null,"evidence_quote":"Provides the fast-decryption technique used to split Paillier exponentiation into the $p^2$ and $q^2$ subspaces."},{"cited_title":"Private aggregation with application to distributed optimization,","cited_arxiv_id":null,"evidence_quote":"Introduces the private aggregation and secret-sharing mechanism from which the offline-online multi-party protocol is tailored."},{"cited_title":"Fully privacy-preserving distributed optimization based on secret sharing,","cited_arxiv_id":null,"evidence_quote":"Serves as the secret-sharing privacy-preserving distributed optimization baseline M1 used for comparison."},{"cited_title":"Distributed privacy-preserving electric vehicle charging control based on secret sharing,","cited_arxiv_id":null,"evidence_quote":"Serves as another secret-sharing baseline M1 for distributed electric-vehicle charging control."},{"cited_title":"The paillier cryptosystem,","cited_arxiv_id":null,"evidence_quote":"The standard Paillier cryptosystem used as the computational efficiency benchmark."},{"cited_title":"Online optimization for real-time peer-to-peer electricity market mechanisms,","cited_arxiv_id":null,"evidence_quote":"Sets the real-time P2P market time-scale of five minutes used to judge the protocol's computational cost acceptable."}],"review_version":1}