{"id":"f9d8c8dc-5b58-41d8-b131-ad9a7363bf8f","arxiv_id":"2506.01072","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"IDCloak lets n parties privately find their common data rows and build a secret-shared training set for vertical federated learning, with no non-colluding server and with security against up to n-1 colluding parties.","lead":"This paper builds a system for multiple organizations to line up the rows they share in common and train a joint machine learning model, without revealing which individuals are in the common set or letting any single helper server see the data. It combines private set intersection with secret sharing and a new shuffle step, and reports large speedups over prior methods in experiments.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central security claim rests on the 3H-GCT OKVS instantiation satisfying 'random decoding' and 'double obliviousness,' which the paper asserts but neither proves nor empirically validates; if any non-input key decodes to a biased value, ID privacy in both Theorems 1 and 2 fails.","rationale":"The reader's weakest_assumption identifies the same load-bearing concern: ID privacy and the simulation proofs for both sub-protocols depend on OKVS properties that are asserted for the abstraction but not established for the concrete 3H-GCT instantiation. I agree that this is the least secure link in the central claim. The paper has real strengths: it provides a coherent protocol composition, a public implementation, and substantial experiments; those are independent support for feasibility and for the practical-efficiency claims, though the offline-cost exclusion remains a secondary caveat. However, the security claim is the headline claim, and the proofs in Theorems 1 and 2 are dense sketches that replace real OKVS tables with uniform random strings. If the 3H-GCT construction does not fully realize random decoding, a corrupted P1 or a coalition could distinguish real intersection matches from random decodes, and the claimed n-1 semi-honest security would not hold. The concern is not that the authors are wrong, but that the decisive property is unverified in the manuscript. Because the reader already returned CONDITIONAL and this is the same core issue, the verdict should remain UNCHANGED: condition acceptance on a targeted, reproducible check of the 3H-GCT random-decoding and double-obliviousness properties using the authors' own implementation and parameters.","tokens_in":24612,"tokens_out":28388,"duration_ms":323253,"concrete_test":"Using the authors' public implementation, instantiate 3H-GCT with the exact parameters of Section VI-A.2 (cluster size 2^14, weight 3, l=64, hash table b=1.27m, h=3, for m = 2^16 and m = 2^20). For many random key sets and random values: (a) evaluate Decode on a large sample of non-input keys, e.g., 2^30 keys per table, and test the output distribution against uniform over Z_{2^64}, including the frequency of exact zeros; (b) compare full encodings to uniform random vectors with a standard RNG test suite; (c) build the distinguisher from the cmPSI proof: given a real or random OKVS table and OPRF values Y_j for P1 keys, compute Decode(S,Y_j)-Y_j and measure the advantage in guessing which rows are real matches. A non-negligible advantage invalidates Theorems 1 and 2; a clean pass would resolve the concern.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing condition is the OKVS abstraction of Section IV-B as instantiated by 3H-GCT in Section VI-A.2. Theorem 1 (Hybrid 2) and Theorem 2 (Hybrid 1) both replace an honest party's real OKVS table with a uniformly random string, relying on 'double obliviousness' and 'random decoding.' These properties are asserted for the abstraction, but the paper gives no proof or empirical check for the concrete 3H-GCT construction. The specific failure mode is: if there exists a non-input key whose decoding coefficient vector is zero or whose probed positions cancel, Decode(S,k) is a fixed value rather than uniform. In cmPSI, P1 could then distinguish Decode(S_i,Y_j)-Y_j = r^j (a true match, uniform) from Decode = 0 (a non-match), allowing a corrupted P1 to identify intersection bins; in smFA the same distinguisher lets a coalition test membership guesses against S^i_f. The proofs also implicitly treat the encoded values U^j+r^j, with a single r^j shared across all keys in a bin, as independent uniform values before invoking OKVS obliviousness; this requires a PRF/random-oracle uniformization step that is not written down. All of this is checkable, but until checked the security claim is conditional.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes IDCloak, a framework for secure multi-party dataset join in vertical privacy-preserving machine learning. It consists of two protocols: cmPSI, which uses OKVS and OPRF to compute secret-shared flags indicating intersection IDs while keeping IDs private, and smFA, which aligns features using a new secure multi-party shuffle and then removes redundant data based on reconstructed flags. The authors claim this is the first practical multi-party dataset-join framework that keeps IDs private without a non-colluding auxiliary server, and report large efficiency improvements over iPrivJoin, a prior cmPSI protocol, and an MP-SPDZ-based shuffle baseline. The paper includes open-source code, uses standard primitives with parameters inherited from prior work, and presents experiments on six real-world datasets with up to six parties.","tokens_in":24874,"tokens_out":6276,"duration_ms":62385,"significance":"If the security claims are substantiated, this is a strong practical contribution: it removes the non-colluding-server assumption, supports a dishonest majority of up to n-1 corrupted parties, and demonstrates orders-of-magnitude gains in shuffle communication and time. The manuscript is refreshingly concrete: the protocols are specified in detail, the code is public, the parameter choices are not tuned to the results, and the efficiency measurements are reported for realistic WAN/LAN settings. The main risk is that the central security proofs rest on OKVS properties that are asserted rather than proven for the concrete 3H-GCT instantiation, and the secure shuffle component lacks a formal security argument. These are fixable but currently load-bearing.","major_comments":[{"comment":"The security proofs of Theorems 1 and 2 rely critically on the 3H-GCT OKVS instantiation satisfying 'double obliviousness' and 'random decoding' as defined in Definition 2. In the proofs, the honest party's real OKVS table is replaced by a uniformly random string (Theorem 1, Hybrid 2; Theorem 2, Hybrid 1), which is only valid if decoding an encoding with any non-input key yields a value indistinguishable from uniform. The paper asserts these properties for the abstraction, but neither proves them for the concrete 3H-GCT construction nor provides an empirical validation, such as a statistical test of Decode(S,k) over many non-input keys. This is not a cosmetic gap: if there exists a non-input key whose probed positions cancel or decode to a fixed value, a corrupted P1 could distinguish true matches from non-matches in cmPSI and test membership guesses in smFA, directly breaking ID privacy. The manuscript should either supply a proof (or a precise theorem from a cited reference) that 3H-GCT satisfies random decoding and double obliviousness, or add an empirical validation for the chosen parameters. This is the core of the security claim and must be resolved before the theorems can be accepted.","section":"Section IV-B and Section VI.A.2"},{"comment":"The proofs of Theorems 1 and 2 claim that the OKVS substitution yields transcripts that are 'statistically indistinguishable' from real ones. However, the OKVS obliviousness properties in Section IV-B are defined with respect to a 'computational adversary' and are therefore computational notions. Statistical indistinguishability would require the actual distribution of the honest party's OKVS table to be exactly (or nearly) uniform, which is a stronger property than computational obliviousness. The paper does not establish this stronger property for 3H-GCT. The authors should either prove that the concrete OKVS is statistically oblivious (and state the resulting security parameter) or revise the hybrids to claim computational indistinguishability in the standard simulation-based sense. As written, the proof's stated security notion does not match the primitives' properties.","section":"Section V.B, Theorem 1, and Section V.C, Theorem 2"},{"comment":"The secure multi-party shuffle protocol ΠsmShuffle (Protocol 2) is a central component of smFA, and Theorem 2's security depends on it, yet no formal security proof is provided for Protocol 2, and the proof sketch of Theorem 2 does not describe how the shuffle messages are simulated in the hybrid argument. For example, in Case 1 (P1 corrupted), the corrupted parties' view includes all messages exchanged in ΠsmShuffle, but the proof only states that the simulator 'can pick shares of random value' and does not account for the sequential rounds in which each party sends masked values W^{i',i} and permutation-dependent updates. Without a proof that ΠsmShuffle realizes FsmShuffle (or a reduction to the security of ΠO−Shuffle), the security of IDCloak's feature-alignment phase is incomplete. The authors should either provide a full security proof for Protocol 2 or explicitly prove Theorem 2 in a model where FsmShuffle is an ideal functionality used as a hybrid.","section":"Section V.C, Protocol 2 and Theorem 2"},{"comment":"The headline shuffle speedups (up to 138.34x in time and 132.13x in communication) are computed from 'online time' only, as stated in the header of Table VII. The offline phase of Protocol 2 includes multiple invocations of ΠO−Shuffle, random mask generation, and setup that may be substantial; the paper does not report these costs or compare total (offline+online) time with the MP-SPDZ baseline. If the offline costs are non-negligible, the claimed end-to-end improvement could be significantly smaller. The authors should report offline, online, and total time and communication for both IDCloak's shuffle and the baseline, or justify clearly why an online-only comparison is the relevant metric for the target application.","section":"Section VI.D, Table VII and Figure 11"}],"minor_comments":[{"comment":"The text says 'the OPPF execution is replaced by the OPRF sender's simulator'; 'OPPF' should be 'OPRF'.","section":"Section V.B, Theorem 1, Case 2, Hybrid 1"},{"comment":"Equation (1) has mismatched parentheses: after 'Decode(S, F_{k_i}(id^1||j))' there is an opening parenthesis before 'H_o' that is never closed on the same line. Also, the notation v^i is used in the equation while the text uses V^i_f; please unify.","section":"Section V.C.2, Equation (1)"},{"comment":"In Definition 2, the input length is denoted m but the set is written as {i ∈ [n]}; should be {i ∈ [m]} for consistency with the rest of the paper.","section":"Section IV.B, Definition 2"},{"comment":"In the setup phase, the notation for the transformed ID is ambiguous: the text says ID^1[j] = (id^1||j), but later uses ID^1[j] as the key in OPRF; it would help to explicitly define that keys are the concatenated bit-strings with the bin index, and that the bin index is encoded in a fixed-length field to avoid collisions.","section":"Section V.A"},{"comment":"The table formatting for the MP-SPDZ baseline entries (e.g., '12484.92' and '249687.80') appears to run together with the adjacent column; please add explicit separators to improve readability.","section":"Section VI.D, Table VII"}],"recommendation":"major_revision","confidential_remarks":"The paper has a solid system-building component and the core algebraic construction appears correct, but the security theorems are not yet at the level expected for a top security venue. The most important issue is the unproven OKVS random-decoding/double-obliviousness property for the 3H-GCT instantiation; the authors should be encouraged to either prove it, cite a proof for the exact instantiation, or add a convincing empirical validation. The missing formal proof for the shuffle protocol is also a gap that should be addressed. If these are resolved, the paper would likely be a strong contribution. I do not see evidence of circularity in the experimental claims; the parameters are inherited from prior work and the measurements are presented transparently, apart from the online-only shuffle timing."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nTwo things you should know about IDCloak. First, it does close a real gap: a multi-party dataset join for vertical FL that keeps intersection IDs private and needs no non-colluding helper, with code, real datasets, and solid engineering. Second, the security argument is conditional: everything rests on the 3H-GCT OKVS satisfying \"random decoding\" and \"double obliviousness,\" which the paper asserts but never proves or empirically checks. If those properties fail for the concrete instantiation, both Theorem 1 and Theorem 2 have holes.\n\nWhat is genuinely new: the optimized OKVS transmission tree and the n-round secure shuffle with O(ndlm) per-party communication are concrete, measured contributions. The algebraic correctness of the flag computation and the sum-of-shares alignment checks out. The experiments are substantial: six datasets, 2–6 parties, and the comparison against iPrivJoin and cmPSI baselines is honest about the security-model difference. The code is public, which I value.\n\nSoft spots, in proportion. The proof sketches are the main one. Theorem 2 in particular is a few paragraphs of hybrids with no treatment of the interaction between the cmPSI and smFA tables beyond an appeal to the same OKVS property. The stress-test worry is fair: if a non-input key decodes to a fixed value rather than uniform, a corrupted P1 could distinguish a match from a non-match. That is checkable — maybe 3H-GCT is known to satisfy this from the OKVS literature, in which case the fix is a proper citation and a lemma. But as written, the paper leaves it asserted. The shuffle numbers also report online time only; the offline OPRF/OKVS setup cost is not in the headline speedups, which inflates the 138× figure. And iPrivJoin is re-implemented since it is not open-sourced, which is fair but weaker than running the authors' code.\n\nThe citation pattern looks fine; the \"first\" claim is plausible given the table of prior work. No parameter-fitting red flags; parameters inherit from cited work.\n\nWho this is for: anyone working on vertical federated learning or private set intersection systems. It deserves a serious referee — with the request that the OKVS property question be settled in the revision, not hand-waved. My verdict would be conditional accept, not reject, but I would insist on a written lemma (or an external citation with proof) for random decoding of the specific OKVS instantiation, and offline costs reported separately.","headline":"A solid systems paper that closes a real gap in multi-party vPPML join, but the security argument rests on unproven OKVS properties and the proof sketches need tightening.","tokens_in":25461,"tokens_out":2240,"would_cite":true,"duration_ms":21954,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"IDCloak claims the first practical multi-party dataset join for vertical PPML that keeps IDs private with no non-colluding auxiliary server.","keywords":["secure dataset join","vertical privacy-preserving machine learning","multi-party private set intersection","oblivious key-value store","secure shuffle","ID privacy","dishonest majority"],"falsifier":"Encode $h\\cdot m$ random key-value pairs with the paper's 3H-GCT OKVS (cluster size $2^{14}$, weight 3) and decode with thousands of fresh non-input keys: if the decoded values deviate detectably from uniform over $Z_{2^{64}}$, or if two distinct key-value sets yield encodings that agree on some fresh key, the random-decoding property that Theorems 1 and 2 invoke fails.","tokens_in":24393,"feed_emoji":"🔐","tokens_out":5970,"duration_ms":53275,"temperature":0.7,"pith_summary":"IDCloak is a framework for the \"dataset join\" step of vertical privacy-preserving machine learning: the moment when several parties, each holding different features for overlapping samples, must align their rows without learning which specific IDs are shared. The paper claims IDCloak is the first practical multi-party solution that keeps intersection IDs private while requiring no non-colluding auxiliary server, and that it resists collusion by up to $n-1$ semi-honest parties. It splits the join into two protocols: a circuit-based multi-party private set intersection (cmPSI) that yields secret-shared flags marking intersection rows, and a secure multi-party feature alignment (smFA) that uses a new secure shuffle to strip out non-intersection rows. If the claims hold, vertical federated learning can run on a secret-shared, de-duplicated joint dataset at costs the paper reports as up to $7.78\\times$ faster and $8.73\\times$ leaner than the prior cmPSI baseline, and up to $138.34\\times$ faster than the prior shuffle baseline.","feed_headline":"Joining private datasets while hiding which IDs are shared","feed_subtitle":"IDCloak claims the first practical multi-party join for vertical ML without a non-colluding server.","key_machinery":"The load-bearing object is the oblivious key-value store (OKVS), an encoding that takes key-value pairs and produces a table from which decoding recovers the value for an input key, while decoding with any non-input key yields a value that must be computationally indistinguishable from uniform (the \"random decoding\" property); the paper also relies on OKVS double obliviousness, meaning the encoding itself looks uniformly random. Around this primitive, IDCloak wraps OPRF evaluations on hashed IDs of the form $id\\|\\text{bin}$ to stop brute-force membership tests, secret-shared random masks per bin to form the output flags, and a new $n$-round secure shuffle in which each party adds its own private permutation to an aggregated masked share. These pieces let the parties build a secret-shared dataset that contains aligned features for intersection rows and random filler otherwise, then delete the filler after a shuffle hides which rows were real.","core_discovery":"The paper's central claim is that a secure dataset join can be made multi-party, ID-private, and free of a trusted auxiliary server by replacing the two-party OPPRF machinery of iPrivJoin with a combination of OKVS and OPRF. In cmPSI, each party encodes its hashed IDs and PRF values into OKVS tables that are routed to P1 through a latency-aware optimized tree; P1 decodes only the values for its own cuckoo-hashed rows, and the shared random masks held by the other parties turn the result into secret-shared flags that are zero exactly on intersection IDs. In smFA, feature rows are masked with the same PRF values and shared random values, aligned through OKVS decoding by P1, and then a new multi-party shuffle—where each party applies its own random permutation to aggregated masked shares over $n$ rounds—randomizes the flags so the redundant rows can be dropped without revealing which IDs were in the intersection. Theorems 1 and 2 assert semi-honest security against coalitions of $n-1$ parties in the random-oracle and OPRF-hybrid model, and the experiments report efficiency gains over iPrivJoin, the prior cmPSI, and the MP-SPDZ shuffle.","pith_inferences":["A direct empirical test of the 3H-GCT OKVS would be to decode with thousands of non-input keys and measure whether the outputs are truly uniform over $Z_{2^{64}}$; any detectable bias would break the simulator's argument even if the high-level protocols are sound.","The paper reuses OPRF outputs across cmPSI and smFA; if the two OKVS tables for the same ID are ever linkable, a coalition of $n-1$ parties might test membership of a candidate ID, so a composition proof that explicitly handles the two tables together is the crux to scrutinize.","Since the scheme reveals intersection size and requires semi-honest behavior, a natural extension would be malicious-secure versions or threshold versions that hide $c$ when $c$ is small; the OKVS/OPRF structure seems compatible with both directions.","The optimized communication tree is tuned to the time to send one OKVS table and the network delay, so in heterogeneous networks (parties with different bandwidths or latencies) the greedy grouping may need re-derivation; the paper's experiments assume symmetric links."],"forward_implications":["Multi-party vPPML can run on a secret-shared joint dataset that contains only aligned intersection rows, with no party or auxiliary server learning which IDs those rows correspond to.","The honest-majority restriction of prior cmPSI protocols can be relaxed to dishonest majority (up to $n-1$ colluding parties) while still improving time and communication, assuming the OKVS instantiations meet their stated properties.","The proposed shuffle reduces per-party communication for feature alignment from $O(ndlm\\log m)$ to $O(ndlm)$, which is what makes the multi-party setting practical at large data sizes.","IDCloak reveals only the intersection size $c$, and the paper argues this is sufficient for vPPML workflows to decide whether to continue training, so the privacy cost is bounded and explicit.","The same two-protocol structure—secret-shared flags from cmPSI, then shuffle-based alignment—can be reused by other vertical PPML frameworks that accept additive secret-shared training data."],"supporting_citations":[{"why":"Defines iPrivJoin, the two-party ID-private dataset join framework that IDCloak extends to $n$ parties and uses as the primary end-to-end baseline.","marker":"[10]"},{"why":"Introduces OKVS and its obliviousness and random-decoding properties, which both cmPSI and smFA rely on for ID privacy.","marker":"[19]"},{"why":"Supplies the optimized 3H-GCT OKVS and OPRF implementation used in the evaluation, including the concrete parameters (cluster size $2^{14}$, weight 3).","marker":"[20]"},{"why":"The prior cmPSI protocol under honest majority that IDCloak compares against and improves upon in time and communication.","marker":"[23]"},{"why":"Provides MP-SPDZ, whose secure shuffle and zero-equality operator serve as the baseline for the shuffle and cmPSI output comparisons.","marker":"[12]"},{"why":"Provides stash-free cuckoo hashing with $b=1.27m$ and $h=3$, used to build P1's hash table without a stash.","marker":"[5]"}],"fun_headline_variants":["Multi-party join hides IDs without trusted server","Private multi-party dataset join fast and secure","IDCloak: secure multi-party join, no trusted party","Hiding shared IDs in multi-party vertical ML join","No trusted server: private multi-party join for vPPML"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole scheme's ID privacy rests on the OKVS random-decoding property—that encoding random key-value pairs and then decoding with any key that was not an input produces a value computationally indistinguishable from uniform—and on the claim that reusing the same oblivious PRF outputs across the two protocol phases does not let a coalition of $n-1$ parties test membership guesses.","fun_headline_variants_meta":{"raw":{"variants":["Multi-party join hides IDs without trusted server","Private multi-party dataset join fast and secure","IDCloak: secure multi-party join, no trusted party","Hiding shared IDs in multi-party vertical ML join","No trusted server: private multi-party join for vPPML"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000631,"raw_usage":{"total_tokens":3021,"prompt_tokens":1162,"completion_tokens":1859,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":778,"completion_tokens_details":{"reasoning_tokens":1782}},"tokens_in":778,"tokens_out":1859,"duration_ms":15243,"temperature":1.0,"reasoning_tokens":1782,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T11:53:19.019072+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Encode $h\\cdot m$ random key-value pairs with the paper's 3H-GCT OKVS (cluster size $2^{14}$, weight 3) and decode with thousands of fresh non-input keys: if the decoded values deviate detectably from uniform over $Z_{2^{64}}$, or if two distinct key-value sets yield encodings that agree on some fresh key, the random-decoding property that Theorems 1 and 2 invoke fails.","supporting_citations":[{"cited_title":"iprivjoin: An id-private data join framework for privacy-preserving machine learning,","cited_arxiv_id":null,"evidence_quote":"Defines iPrivJoin, the two-party ID-private dataset join framework that IDCloak extends to $n$ parties and uses as the primary end-to-end baseline."},{"cited_title":"Obliv- ious key-value stores and amplification for private set intersection,","cited_arxiv_id":null,"evidence_quote":"Introduces OKVS and its obliviousness and random-decoding properties, which both cmPSI and smFA rely on for ID privacy."},{"cited_title":"Blazing fast psi from improved okvs and subfield vole","cited_arxiv_id":null,"evidence_quote":"Supplies the optimized 3H-GCT OKVS and OPRF implementation used in the evaluation, including the concrete parameters (cluster size $2^{14}$, weight 3)."},{"cited_title":"Efficient linear multiparty psi and extensions to circuit/quorum psi,","cited_arxiv_id":null,"evidence_quote":"The prior cmPSI protocol under honest majority that IDCloak compares against and improves upon in time and communication."},{"cited_title":"MP-SPDZ: A versatile framework for multi-party computa- tion,","cited_arxiv_id":null,"evidence_quote":"Provides MP-SPDZ, whose secure shuffle and zero-equality operator serve as the baseline for the shuffle and cmPSI output comparisons."},{"cited_title":"Scalable private set intersection based on ot extension,","cited_arxiv_id":null,"evidence_quote":"Provides stash-free cuckoo hashing with $b=1.27m$ and $h=3$, used to build P1's hash table without a stash."}],"review_version":1}