{"id":"f78f2213-d2f7-4f00-a90c-6e0d09fd1daf","arxiv_id":"2506.15102","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":2,"one_line_summary":"EVA-S2PMLP proposes secure two-party MLP protocols by splitting inputs into shares and masking matrices, but its base multiplication protocol returns shares whose sum is C_std + A times the masked B, not A times B.","lead":"This paper describes a secure two-party multilayer perceptron framework that claims fast, verifiable training and inference on vertically split data. The core matrix-multiplication protocol contains an algebraic error, so the published algorithms do not compute the claimed values.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"S2PM/S2PRIP online phase does not yield Y_A+Y_B=A×B; residual Ahat×R_B is generically nonzero, and the verification relation holds tautologically, so the MLP stack is unsupported.","rationale":"The reader's strongest_claim correctly identifies that the base S2PM/S2PRIP share-sum relation is the load-bearing assertion. My independent algebraic check confirms the published online phase does not satisfy Y_A+Y_B=A×B: the residual Ahat×R_B never cancels, and the verification identity holds by construction, so it cannot detect the error. This is more fundamental than the security-definition concern in the reader's weakest_assumption: even if the security model were repaired, the protocols compute the wrong function. The reader's rationale already flags the base-protocol algebraic error, so the verdict REJECT is justified. I set agreement_with_reader to 'partial' because the reader's weakest_assumption points to Definition 5 and the rank-deficiency simulation issue, whereas the decisive concern here is the correctness algebra. No code or formal verification is provided, and the published algorithms are sufficient to exhibit a concrete counterexample, so no further external artifact is needed to settle the matter. The verdict should remain REJECT, and no adjustment to the reader's conclusion is required.","tokens_in":66218,"tokens_out":6624,"duration_ms":60931,"concrete_test":"Run Algorithm 18 with A=B=I_2, R_A=diag(1,0), R_B=diag(0,1), Y_B=0, and F_A=F_B=0. Then C0=0, Ahat=diag(2,1), Bhat=diag(1,2). The protocol outputs Y_A=diag(1,2) and Y_B=0, so Y_A+Y_B≠A×B, while Algorithm 19 accepts because Y'_AE+Y'_BF−C0=0. This numerical counterexample directly refutes the share-sum claim in Problem 11 and Appendix A.1, and hence the inherited correctness of the higher S2P protocols and the MLP training/inference pipelines.","verdict_should_be":"UNCHANGED","load_bearing_attack":"In Appendix A.1, Algorithm 18, with Ahat=A+R_A, Bhat=B+R_B, C0=R_A·R_B, Bob sets Y'_B=Y_B−Ahat·Bhat, T=F_B−Y'_B, and Alice sets Y_A=T+F_A−R_A·Bhat. Therefore Y_A+Y_B = (F_A+F_B)−Y'_B−R_A·Bhat = C0 + (Ahat−R_A)·Bhat = C0 + A·Bhat = A·B + (A+R_A)·R_B = A·B + Ahat·R_B, not A·B. Algorithm 17 forces R_A and R_B to be rank-deficient but imposes no condition on Ahat·R_B; for random real inputs this residual is nonzero with probability 1. The same cancellation error appears in the S2PRIP correctness derivation in Section 4.1, where the claimed equality silently drops the Ahat⊛R_B term. The verification stage cannot catch this: Y'_AE+Y'_BF−C0 = (Y_A+Y_B)+R_A·Bhat−Ahat·Bhat−C0 = A·Bhat+R_A·Bhat−Ahat·Bhat = 0 identically, so Algorithm 19 always accepts regardless of the correctness failure. Since every higher protocol (S2PHP, S2PDRL, S2PRL, S2PSM, S2PG-MLP, S2PMLP-TR, S2PMLP-PR) is built on S2PM/S2PRIP, the central claim of accurate and verifiable two-party MLP is unsupported. The security definition in Definition 5 and the rank-deficiency simulation argument are also not well-founded, but the algebraic failure of the base primitive already invalidates the framework.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes EVA-S2PMLP, a two-party protocol suite for privacy-preserving training and inference of multi-layer perceptrons over vertically partitioned data. The framework uses a commodity server that pre-distributes random masks and a stack of primitives: secure two-party matrix multiplication (S2PM), row inner product (S2PRIP), Hadamard product (S2PHP), ReLU derivative (S2PDRL), ReLU (S2PRL), reciprocal (S2PSCR), softmax (S2PSM), gradient computation (S2PG-MLP), and end-to-end training/inference protocols S2PMLP-TR and S2PMLP-PR. The claimed contributions are exact real-number arithmetic, verifiable correctness with negligible failure probability, and communication efficiency, with experiments reporting up to 12.3x improvement over baselines.","tokens_in":66656,"tokens_out":9443,"duration_ms":95589,"significance":"Had the protocols been correct, the framework would be significant: it promises exact ReLU and softmax in a two-party setting, low round counts, and empirical accuracy close to plaintext MLP. The paper also provides extensive comparisons against CrypTen, FATE, SecretFlow, and other frameworks, together with detailed complexity tables. However, the central correctness claim fails already at the base S2PM/S2PRIP primitives, and the security definition and proofs are not sound. The significance of the proposed approach therefore cannot be realized in the current form.","major_comments":[{"comment":"The claimed share-sum relation is algebraically false. With Ahat = A + R_A, Bhat = B + R_B, and F_A + F_B = R_A * R_B, the online phase of S2PM yields Y_A + Y_B = R_A * R_B + A * Bhat = A * B + Ahat * R_B, not A * B. The analogous identity with the row inner product holds for S2PRIP. The residual term Ahat * R_B is generically nonzero, and no constraint in Algorithms 17 or 1 prevents it. Consequently, the correctness proofs of every higher protocol that invokes S2PM or S2PRIP (S2PHP, S2PDRL, S2PRL, S2PSCR, S2PSM, S2PG-MLP, S2PMLP-TR, S2PMLP-PR) are invalid.","section":"Section 4.1 and Appendix A.1 (Algorithms 2, 18)"},{"comment":"The verification stages check a relation that holds identically even when the online phase is wrong. From the same definitions, Y'_A + Y'_B = (Y_A + R_A * Bhat) + (Y_B - Ahat * Bhat) = Y_A + Y_B + R_A * Bhat - Ahat * Bhat. Substituting Y_A + Y_B = A * B + Ahat * R_B gives Y'_A + Y'_B = R_A * R_B = C0. Therefore Y'_A + Y'_B - C0 = 0 regardless of the correctness failure, so Algorithm 19 and the analogous S2PRIP verification always accept. The claimed failure probability of (1/4)^L is not established and is contradicted by the tautological nature of the check.","section":"Appendix A.1 and Section 4.1 (Algorithms 19 and 3)"},{"comment":"The correctness derivation for S2PHP is also internally wrong. For u_i* formed by c repetitions of u_i and v_i* formed by row-major concatenation of c randomly selected permutations of v_i, the diagonal entry of P_A * P_B equals a_i * b_i only if the selected permutations place each beta_k exactly once in each column of the c x c matrix W_i. The protocol selects c permutations uniformly at random from c! possibilities and does not enforce this Latin-square condition; for c > 2 it generically fails. Thus even if S2PM were repaired, S2PHP would not compute the Hadamard product as claimed.","section":"Section 4.4.1 (Algorithm 7)"},{"comment":"Definition 5 is not a secure-computation definition. The property that infinitely many alternative real inputs are consistent with a transcript holds for essentially any continuous input distribution and does not imply computational indistinguishability, nor does it bound the posterior information available to an adversary. The simulation proofs invoke Lemma 1 with rank-deficient R_A and R_B, but random real matrices are full rank with probability one, and the paper provides no mechanism by which the commodity server can generate rank-deficient masks in a privacy-preserving way. The security claims of Theorem 4 and the subsequent theorems are therefore unsupported.","section":"Section 3.2, Definition 5, and Theorems 4-10"},{"comment":"The correctness theorems for S2PMLP-TR and S2PMLP-PR reduce directly to the correctness of S2PHM, S2PRL, S2PDRL, and S2PSM. Since all of those primitives depend on the broken S2PM/S2PRIP base layer, the end-to-end training and inference claims are unsupported. The reported near-plaintext accuracy is not evidence of correctness, because the described protocols do not compute the stated functions.","section":"Sections 5.1 and 5.2"}],"minor_comments":[{"comment":"The text contains numerous typos and OCR artifacts, including 'EV A-S2PMLP', 'so/f_tmax', 'BoB', and the repeated 'D/e.sc/f.sc/i.sc/n.sc/i.sc/t.sc/i.sc/o.sc/n.sc' sequences in Section 3.2; these should be cleaned up.","section":"General presentation"},{"comment":"The communication round counts in Table 3 differ from the theoretical values in Table 2 (e.g., S2PHP is listed as 6 rounds in Table 2 and 6 in Table 3, but S2PRL is 8 vs 10 and S2PSM is 37 vs 47). The paper states this is due to precision optimization but does not describe the optimized algorithms, making the experimental setup not fully reproducible.","section":"Tables 2 and 3"},{"comment":"The security analysis of S2PDRL says the result is public and only reveals r * s * (A + B), but the protocol actually gives both parties the values needed to compute r * s * (A + B). The proof should account for this masked-sum leakage explicitly rather than treating the result as simply relu'(A + B).","section":"Section 4.2"},{"comment":"The repeated claim that the overall failure probability is the product of sub-protocol failure probabilities assumes independence of the verification checks; no justification for this independence is given, and the verification checks are deterministic functions of the same transcript.","section":"Failure probability analyses"}],"recommendation":"reject","confidential_remarks":"The foundational S2PM and S2PHM protocols are taken from the authors' own prior work (EVA-S3PC, reference [43]) and treated as a black box. Combined with the algebraic correctness failure in those foundations, the marginal novelty of the present manuscript is difficult to assess. The experimental section reports plaintext-comparable accuracy despite the described protocol computing different functions; the authors should be asked to reconcile this discrepancy if any revision is considered."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The base S2PM/S2PRIP protocol doesn't produce the shares it claims, and the verification stage is a tautology. That's the main thing you need to know. Section 4.1 and Appendix A.1 derive Y_A+Y_B = A×B, but if you track the algebra with Ahat=A+R_A, Bhat=B+R_B, C0=R_A·R_B, you get Y_A+Y_B = C0 + A·Bhat = A·B + Ahat·R_B. The residual Ahat·R_B is generically nonzero, so the correctness claim fails. The verification check in Algorithm 19 computes Y'_A+Y'_B−C0, which equals zero identically regardless of whether the computation was correct, so it always accepts. The same cancellation error appears in S2PRIP's derivation, where a term is silently dropped.\n\nThis is a load-bearing flaw, not a presentation issue. Every higher protocol — S2PHP, S2PDRL, S2PRL, S2PSM, S2PG-MLP, S2PMLP-TR, S2PMLP-PR — is built on S2PM/S2PRIP, so the whole framework is unsupported. The security proofs don't rescue it: Definition 5's 'infinitely many alternative inputs' over the reals is not computational indistinguishability, and Lemma 1's rank-deficiency assumption is at odds with random real matrices, which are full rank with probability one. There is no code or data artifact, and the performance numbers are not independently checkable.\n\nTo give credit where it's due: the paper is readable, the high-level architecture is sensible, and the composition of exact ReLU/softmax protocols from a data-disguising base is a coherent design idea. The related work is well covered, and the experimental section is thorough in scope, even if the numbers are moot given the correctness failure. The self-citation of the prior EVA-S3PC paper is not itself a problem; the problem is that the inherited primitive is incorrect.\n\nBottom line: the central argument does not hold up, and the flaw is in the base matrix multiplication. A serious referee would spend an afternoon confirming the algebra and then reject. I would desk-reject rather than send it out — the paper's own equations contradict the claimed equality, which is self-refuting on its own terms. Not worth citing, not worth a reading group. If you know anyone building on EVA-S3PC, warn them to check the base protocol first.","headline":"The base S2PM/S2PRIP protocol is algebraically wrong—the output shares include a residual Ahat×R_B—and the verification is a tautology, so the whole EVA-S2PMLP stack is unsupported.","tokens_in":67167,"tokens_out":4246,"would_cite":false,"duration_ms":40459,"reading_group":"no","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that a two-party MLP can be trained and run securely over real numbers by remapping each scalar into a vector or matrix first, so every operation reduces to masked matrix products whose outputs are additive shares.","keywords":["secure two-party computation","multi-layer perceptron","privacy-preserving machine learning","spatial transformation","additive secret sharing","real-number secure computation","verifiable secure computation","exact ReLU and softmax"],"falsifier":"Run the preprocessing phase exactly as specified on 1000 random inputs and record the ranks of the masks $\\mathbf{M}_A$ and $\\mathbf{M}_B$: uniformly random real matrices are full rank with probability 1, so the rank-deficient matrices Lemma 1 requires never appear, and the proof's step that invokes Lemma 1 has no valid instance to execute.","tokens_in":65998,"feed_emoji":"🔐","tokens_out":11863,"duration_ms":115191,"temperature":0.7,"pith_summary":"The paper sets out to show that two organisations holding vertically split data can train and run a multi-layer perceptron without revealing their private inputs, working directly over real numbers rather than fixed-point rings. The route is a spatial transformation (spatial-scale optimization) that rewrites each scalar as a split vector or matrix, turning every needed operation into a masked matrix product whose outputs are additive shares. If the construction holds, exact ReLU and softmax become available in secure two-party MLP, communication rounds stay small and fixed, and model accuracy tracks the plaintext version. The paper also claims verifiability of results and reports up to a $12.3\\times$ reduction in communication over baselines.","feed_headline":"Exact ReLU and softmax in secure two-party MLP, 12.3x less traffic","feed_subtitle":"Spatial transformation maps scalars to matrices, keeping exact activations at 12.3x lower communication cost.","key_machinery":"The carrying object is the spatial transformation: each private scalar is split into $r$ random pieces and arranged, with replicated or permuted structure, into a matrix $\\mathbf{P}_A$ for Alice and $\\mathbf{P}_B$ for Bob so that the target function value appears on the diagonal of the product $\\mathbf{P}_A \\mathbf{P}_B$ (or as the row-wise inner product $A \\circledast B$). The base protocols S2PM and S2PRIP compute this product as additive shares $Y_A + Y_B = \\mathbf{P}_A \\mathbf{P}_B$ using commodity-server masks $\\mathbf{M}_A, \\mathbf{M}_B$ with $\\mathbf{M}_A \\mathbf{M}_B = \\mathbf{C}$; every higher protocol composes these shares, so correctness is carried by the linear share-sum invariant rather than by a new cryptographic primitive.","core_discovery":"The central claim is that a complete two-party MLP training and inference stack can be built on a single secure row-wise inner product (S2PRIP) whose outputs satisfy $Y_A + Y_B = A \\circledast B$ over the real numbers. Around this primitive the paper constructs exact ReLU derivatives, ReLU, softmax, reciprocals, gradients, and then full training (S2PMLP-TR) and prediction (S2PMLP-PR) protocols, each correct by the same algebraic share-sum invariant. The security theorems assert semi-honest privacy in a real-number-field security model, and the experiments claim near-plaintext accuracy (for example $0.9582$ on MNIST versus $0.9638$ plaintext) with up to $12.3\\times$ lower communication than the compared baselines.","pith_inferences":["The same splitting trick is likely portable to convolutions and attention, since those are batched matrix products, but the paper does not analyze either extension.","The security proofs invoke rank-deficient masks at the step where Lemma 1 is used, while the preprocessing pseudocode says only 'generate random matrix'; an implementation must decide how to sample such masks, because uniform real matrices are full rank with probability one.","If round count is indeed the dominant cost in WAN settings, the framework's advantage should persist in real cross-institution deployments, a setting the paper lists as future work.","A clean test of the claimed accuracy advantage would run the same models in plaintext with exact activations against fixed-point approximations, isolating whether the gain comes from the secure layer or from the activation function itself."],"forward_implications":["Two parties with vertically split data can train and run an MLP while each keeps its own inputs private, ending with model parameters held as additive shares.","Exact ReLU and softmax mean the secure model's accuracy can track the plaintext model instead of an approximation of it, which the reported Iris and Wine results illustrate.","The fixed low round counts (for example 117 rounds for inference on the tested networks) keep WAN runtime competitive even when the total byte volume is high.","The verification layer lets a client reject corrupted results, with claimed failure probability below $(1/4^L)^k$ at $L=20$, so detected anomalies are negligible.","Reported communication savings of up to $12.3\\times$ come from replacing many small messages with fewer larger matrix transfers under the spatial transformation."],"supporting_citations":[{"why":"Defines the two-party secure training baseline this work positions itself against and motivates the comparison setup.","marker":"[1]"},{"why":"Supplies the mixed-protocol multiplication approach and round-complexity baseline that the spatial transformation is designed to beat.","marker":"[2]"},{"why":"Provides the composition lemma used to lift security of individual S2PHP calls to the higher protocols.","marker":"[19]"},{"why":"Gives the simulation-based privacy definition used in Definition 3, which the proof claims to satisfy.","marker":"[38]"},{"why":"Introduces the real-number-field security model (Definition 5) on which every security proof in the paper rests.","marker":"[39]"},{"why":"Supplies Lemma 1, the infinite-solutions property of rank-deficient linear systems that the simulators hinge on.","marker":"[40]"},{"why":"Supplies the universal composability framework used to compose sub-protocols into S2PSM, S2PG-MLP, S2PMLP-TR, and S2PMLP-PR.","marker":"[41]"},{"why":"Provides the base S2PM and S2PHM protocols whose share-sum invariant carries all higher protocols.","marker":"[43]"}],"fun_headline_variants":["Spatial transformation yields exact secure MLP, 12.3x less traffic","Secure two-party MLP: exact activations, 12.3x less traffic","12.3x less communication for exact secure two-party MLP","Spatial scaling gives exact activations in secure two-party MLP","EVA-S2PMLP: exact MLP training, 12.3x lower traffic"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole security argument rests on the paper's real-number security model, which equates privacy with the existence of infinitely many alternative inputs consistent with one party's view, together with the assumption that the random masks can be produced with the special structure needed for those infinitely many alternatives to exist.","fun_headline_variants_meta":{"raw":{"variants":["Spatial transformation yields exact secure MLP, 12.3x less traffic","Secure two-party MLP: exact activations, 12.3x less traffic","12.3x less communication for exact secure two-party MLP","Spatial scaling gives exact activations in secure two-party MLP","EVA-S2PMLP: exact MLP training, 12.3x lower traffic"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000854,"raw_usage":{"total_tokens":3701,"prompt_tokens":925,"completion_tokens":2776,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":541,"completion_tokens_details":{"reasoning_tokens":2669}},"tokens_in":541,"tokens_out":2776,"duration_ms":20406,"temperature":1.0,"reasoning_tokens":2669,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T19:44:23.796065+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the preprocessing phase exactly as specified on 1000 random inputs and record the ranks of the masks $\\mathbf{M}_A$ and $\\mathbf{M}_B$: uniformly random real matrices are full rank with probability 1, so the rank-deficient matrices Lemma 1 requires never appear, and the proof's step that invokes Lemma 1 has no valid instance to execute.","supporting_citations":[{"cited_title":"Secureml: A system for scalable privacy- preserving machine learning","cited_arxiv_id":null,"evidence_quote":"Defines the two-party secure training baseline this work positions itself against and motivates the comparison setup."},{"cited_title":"Aby3: A mixed protocol framework for ma- chine learning","cited_arxiv_id":null,"evidence_quote":"Supplies the mixed-protocol multiplication approach and round-complexity baseline that the spatial transformation is designed to beat."},{"cited_title":"Sharemind: A framework for fast privacy-preserving computations","cited_arxiv_id":null,"evidence_quote":"Provides the composition lemma used to lift security of individual S2PHP calls to the higher protocols."},{"cited_title":"How to simulate it–a tutorial on the sim ulation proof technique","cited_arxiv_id":null,"evidence_quote":"Gives the simulation-based privacy definition used in Definition 3, which the proof claims to satisfy."},{"cited_title":"Privac y-preserving mul- tivariate statistical analysis: Linear regression and cla ssification","cited_arxiv_id":null,"evidence_quote":"Introduces the real-number-field security model (Definition 5) on which every security proof in the paper rests."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies Lemma 1, the infinite-solutions property of rank-deficient linear systems that the simulators hinge on."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the universal composability framework used to compose sub-protocols into S2PSM, S2PG-MLP, S2PMLP-TR, and S2PMLP-PR."},{"cited_title":"Eva-s3pc: Efficient, verifiable, accurate secure matrix multiplication proto- col assembly and its application in regression, 2024","cited_arxiv_id":null,"evidence_quote":"Provides the base S2PM and S2PHM protocols whose share-sum invariant carries all higher protocols."}],"review_version":1}