{"id":"e8692a73-9ea6-43c0-a7f1-d381bb997ef0","arxiv_id":"2506.22606","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"A decentralized personal-data architecture uses secure enclaves and federated learning so service providers can compute on user data without accessing it.","lead":"This paper describes a system that keeps a person's data in a private, user-controlled digital vault and lets companies run analyses on it without seeing the raw data. The appeal is a way to get personalized services and model training while keeping data ownership with users.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 1's privacy claim is false as stated: the view includes r_cmp, so any data-dependent computation request lets the adversary trivially distinguish DS0 from DS1.","rationale":"The paper's central formal contribution is Theorem 1, and the proof's own simulator is given the honest computation result r_cmp_i. This makes the stated privacy guarantee internally inconsistent whenever a computation request has data-dependent output, which is precisely the intended use case (analytics, model updates, personalized scores). The flaw is not a matter of disagreement with an external consensus; it is a direct contradiction within the theorem's quantification over arbitrary DS0, DS1 and arbitrary requests. The other security properties are only sketched, but the false privacy theorem is sufficient to reject the central claim. I credit the authors for a concrete prototype description and for explicitly acknowledging side-channel attacks are out of scope, but those do not repair the formal gap. The theorem could be salvaged by restating privacy with an explicit leakage function or by restricting to requests whose outputs are independent of the data, but as written the paper does not deliver the claimed guarantee. Therefore I agree with the reader's REJECT verdict and recommend no change to that verdict.","tokens_in":13976,"tokens_out":2801,"duration_ms":32122,"concrete_test":"Instantiate Theorem 1 with q=1 and a request RE = 'return the first byte of the dataset DS' (a valid compute operation under §3.4). Choose DS0 and DS1 that differ in that first byte. Run the protocol's real execution with an honest-but-curious SP that records its full view. The two real views then contain different r_cmp values, so any algorithm that outputs 1 iff r_cmp equals the known first byte of DS0 distinguishes the views with advantage 1. This check is independent of the AWS enclave: it follows directly from the view definition in §4 and the compute function in §3.4. If the authors respond that such a request is disallowed, the theorem must be restated with an explicit allowed-request class and a leakage function; the current statement is still false.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Theorem 1 (Section 4) asserts that for any PPT adversary corrupting SP and any datasets DS0, DS1, the adversary's views are computationally indistinguishable for any sequence of computation requests. But the real view is defined in the proof as VIEW^π_A = {re_i, σ_i, r_cmp_i}, i.e., it includes the honest computation result r_cmp_i. The simulator S1 receives r_cmp_i as input and only simulates the attestation σ_i from it. If a request's output depends on the data—for example RE = 'return the value of field d1'—then for DS0 and DS1 differing in d1, the two real views contain different r_cmp values. A distinguisher that simply compares the included r_cmp separates the views with probability 1, contradicting the stated indistinguishability. Thus the theorem is not merely unproven; it is false as quantified. The proof sidesteps this by making the simulator an oracle for the honest output, effectively reducing the claim to 'the adversary learns nothing beyond the computation results' without formally defining what 'beyond' excludes. Repairing this requires an explicit public-output leakage function L(DS, RE) or an explicit class of permitted requests, and the theorem must quantify over requests with a fixed leakage. The remaining properties (computation correctness, access control, model integrity) are asserted with 'proofs follow similar arguments' and no reductions are given, but the false privacy theorem is the load-bearing defect.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a decentralized personal data management architecture centered on user-controlled data agents, AWS Nitro secure enclaves, DIDComm messaging, attribute-based access control, and federated learning. The intended security guarantee is that a service provider learns nothing beyond attested computation results, with verifiability and access control enforced cryptographically. Section 4 states Theorem 1, which asserts computational indistinguishability of a corrupted service provider's views for any two datasets and any sequence of computation requests, and sketches a simulation-based proof. Section 5 reports a prototype implementation and runtime experiments on Reddit/Spotify data and federated learning.","tokens_in":14185,"tokens_out":7988,"duration_ms":89701,"significance":"The system concept is timely, and the prototype provides useful engineering evidence that the described architecture can be deployed. If a correct privacy theorem held, the work would be a valuable contribution to decentralized personal data management. However, the formal centerpiece is unsound as stated, and the remaining security properties are asserted without proofs. The paper therefore does not currently substantiate its central privacy and verifiability claims; the prototype is a strength, but it cannot compensate for the invalid security analysis.","major_comments":[{"comment":"The privacy property as quantified is false as stated. The proof defines the real view as VIEW = {re_i, sigma_i, r_cmp_i} and the simulator S1 is given {r_cmp_i} from Cmp(SP, RE, DS). For any request whose output depends on the dataset, for example re = 'return the value of field d1', two datasets differing only in d1 produce different r_cmp values in the real views, so a distinguisher that compares the r_cmp entry separates the views with probability 1. The theorem therefore does not capture the intended claim that the adversary learns nothing beyond the computation results; an explicit leakage function L(DS, RE) and a restriction to request pairs with equal leakage are needed. Because the paper's central privacy guarantee is stated as this theorem, this is a load-bearing defect.","section":"Section 4, Theorem 1"},{"comment":"The reduction to enclave security is invalid. The distinguisher S2 can read the data-dependent r_cmp_i from the view, while the enclave oracle O only controls the attestation theta_i; the honest r_cmp_i are supplied to B from outside the oracle. Thus B's construction does not translate S2's distinguishing advantage into an attack on the enclave, since the distinguishing information is the computation result itself rather than the attestation. In addition, the proof assumes attestation is a signature sigma_i = Sig(r_cmp_i), but a Nitro enclave attestation certifies enclave identity and image hash, not an arbitrary signed message; this modeling choice needs justification.","section":"Section 4, proof of Theorem 1"},{"comment":"Computation Correctness, Access Control, and Model Integrity are listed as security properties, but their proofs are only asserted with 'proofs follow similar arguments' and no reductions are given. In particular, the Access Control property Pr[Allow(RE')=1] <= negl(k) is not a well-formed cryptographic statement: Allow is a deterministic policy function, and the statement does not define an adversary model for credentials, user controller compromise, or ABAC misconfiguration. Since verifiability and access control are advertised as core contributions, the absence of support for these properties leaves major parts of the paper's security claims unsubstantiated.","section":"Section 4, after Theorem 1"}],"minor_comments":[{"comment":"The phrase 'genteel attack vectors' appears to be a typo for 'general' (or 'gentler') attack vectors.","section":"Section 7.2"},{"comment":"Reference [25] is listed with the author 'Unknown' and is a placeholder; reference [27] has nonstandard author formatting that should be corrected.","section":"References"},{"comment":"The probability expressions have mismatched brackets (e.g., the Computation Correctness clause), and the sentence 'The privacy analyses is guarantees' needs rewording.","section":"Section 4, Theorem 1"},{"comment":"The runtime comparison reports results without error bars, number of repetitions, or details of the centralized baseline configuration; adding these would strengthen the evaluation.","section":"Section 5, Figure 4"},{"comment":"The statement that implementation code is 'available on GitHub and will be provided upon request' is ambiguous; a stable repository link should be included for reproducibility.","section":"Sections 3.4 and 5"},{"comment":"The threat model describes service providers as honest-but-curious, while Theorem 1 quantifies over 'any PPT adversary corrupting SP'; the paper should clarify which adversarial model is intended.","section":"Sections 3.2 and 4"}],"recommendation":"reject","confidential_remarks":"The core formal claim is false as stated, and the remaining security properties are not proved, so I cannot recommend publication in the current form. The prototype is a useful engineering contribution and the architectural idea could be viable, but the security analysis would need to be rewritten around an explicit leakage function before a resubmission. I would not recommend a standard major revision because the central theorem is mathematically incorrect rather than merely incomplete; a fresh submission after substantial rework would be more appropriate."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is a real systems build with a broken core theorem. The architecture—user-held data agents, AWS Nitro enclaves for attested computation, federated learning, DIDComm messaging, ABAC access control—is a coherent integration of off-the-shelf pieces, and the prototype (Reddit/Spotify data plugs plus a federated training run) shows the thing actually executes. The related work is fair and the personal-data-store literature is covered decently. That's real credit.\n\nThe problem is Section 4. Theorem 1 asserts that for any two datasets DS0, DS1 and any sequence of computation requests, the adversary's views are computationally indistinguishable. But the view is defined to include the honest computation results r_cmp_i, and the simulator is given those results as input. For any request whose output depends on the data—say 'return field d1'—two datasets differing in d1 yield different r_cmp values, and the adversary distinguishes the views with probability 1. So the theorem is false as quantified, not just unproven. The proof actually reduces to 'the adversary learns nothing beyond the computation results,' which is a sensible goal, but the formal statement doesn't say that. A correct theorem needs an explicit leakage function L(DS, RE) and quantification over datasets with equal leakage. The other three properties (computation correctness, access control, model integrity) are asserted with 'proofs follow similar arguments' and no reductions are given; that's not adequate for a security venue.\n\nOther soft spots, in proportion: the code is said to be on GitHub but only 'provided upon request'; the evaluation is a runtime comparison on one machine and one enclave config with no security evaluation; access control relies on AWS ABAC and the user controller, with no cryptographic argument for tamper-resistance. The self-citation [27] appears only in future-work discussion and is not load-bearing, so that's not a concern. These are fixable, but they're real gaps.\n\nBottom line: the system concept deserves referee time, but the paper in current form would not pass. If this were submitted fresh, I'd send it to a reviewer who understands simulation-based security and ask the authors to fix Theorem 1 or take the paper. The prototype and integration are worth preserving, and the narrative is readable. I would not cite it until the theorem is repaired.","headline":"Real prototype, broken central theorem: Theorem 1's privacy claim is false as stated because the view includes the computation results.","tokens_in":14771,"tokens_out":3009,"would_cite":false,"duration_ms":30749,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims a decentralized data-agent architecture lets service providers compute on personal data while learning nothing beyond the attested results.","keywords":["privacy-enhancing technologies","decentralized data management","verifiable computation","secure enclaves","federated learning","data agents","access control","AWS Nitro enclaves"],"falsifier":"Run the protocol on two datasets that differ in one known field and submit a computation request that returns that field's exact value as its output; if the service provider can distinguish the two runs from the attested results, the privacy claim is false. More directly, if an adversary can recover a raw data value from the attestation or the enclave's side channels, the theorem fails.","tokens_in":13731,"feed_emoji":"🔐","tokens_out":6159,"duration_ms":57931,"temperature":0.7,"pith_summary":"This paper proposes an architecture in which personal data from multiple sources lives in user-controlled \"data agents\" rather than in service provider servers. Service providers submit computation or model-training requests, and the user controller runs them inside a secure enclave, returning only a result accompanied by a cryptographic attestation. The central claim is a simulation-based privacy theorem: any polynomial-time service provider sees views that are computationally indistinguishable for any two user datasets, given the same computation requests. If the claim holds, companies could offer personalized services and train models without ever holding raw user data, while users retain ownership and can selectively share. The authors support this with a prototype integrating AWS Nitro enclaves, DIDComm communication, and federated learning.","feed_headline":"Data agents keep raw data private; firms get attested results","feed_subtitle":"Decentralized data agents let firms run analytics and train models while users keep full control.","key_machinery":"The load-bearing component is the user's data agent, a decentralized secure vault that stores raw data, enforces access control, and runs computations inside an AWS Nitro enclave. The enclave produces a cryptographic attestation sigma for each computed result, which is the only artifact a service provider receives. The proof's engine is the simulator S1 that constructs a view from requests and results alone, making privacy equivalent to the unforgeability of the attestation. Access control is formalized as Allow(RE) = Valid(AC) AND Valid(RE, CP), and federated learning is handled by the model aggregator that verifies each update's attestation before aggregation.","core_discovery":"The core discovery is Theorem 1, which states that for any probabilistic polynomial-time adversary corrupting a service provider, there exists a simulator that produces a view of the protocol from only the computation requests and the honest computation results, with no access to the underlying dataset. The real and simulated views are computationally indistinguishable, so the adversary learns nothing beyond the attested results. The same theorem asserts computation correctness (a valid attestation implies the result was computed correctly), access control (unauthorized requests are rejected with overwhelming probability), and model integrity (federated aggregation is performed on attested updates). The proof works by reducing any distinguisher between real and simulated views to an adversary that breaks the security of the secure enclave's attestation.","pith_inferences":["The privacy theorem as stated quantifies over arbitrary computation requests, but a request whose output is the data itself (for example, \"return the exact value of field X\") would make the two views trivially distinguishable; a practical deployment would need to restrict the set of permitted computation functions so they do not reveal raw data.","The security of the whole system collapses if the enclave attestation implementation is flawed or compromised, since every other guarantee (correctness, model integrity, privacy) reduces to it.","Access control is enforced by the user controller and AWS attribute-based access control, not by cryptography, so a compromised or malicious user controller would break the guarantees even if the enclave is sound.","The architecture could be strengthened by adding differential privacy noise inside the enclave and zero-knowledge proofs, which would extend the claim from computational indistinguishability to measurable privacy against inference attacks."],"forward_implications":["Service providers can run analytics, named-entity recognition, sentiment analysis, and other custom functions on user data without ever receiving the raw data.","Federated learning can be conducted across many user data agents, with each user's local model update attested and aggregated by the service provider's model aggregator.","Users retain complete ownership and fine-grained access control over each data source and can update or revoke permissions per service provider.","Every computation result carries a cryptographically signed attestation, so tampering or incorrect execution is detectable by the verifying service provider.","The architecture is platform-agnostic and was prototyped on AWS, showing linear runtime scaling comparable to a centralized baseline."],"supporting_citations":[{"why":"AWS Nitro enclaves supply the secure enclave and attestation mechanism that underpin the verifiable computation and the privacy proof.","marker":"[8]"},{"why":"DIDComm messaging establishes the authenticated, encrypted channels between data agents and service providers.","marker":"[3]"},{"why":"AWS attribute-based access control enforces the fine-grained permissions that gate every service provider request.","marker":"[5]"},{"why":"Decentralized identifiers provide the cryptographic identities used by DIDComm and credential verification.","marker":"[2]"}],"fun_headline_variants":["Privacy by design: users own data, firms get proofs","Decentralized data vaults with provable privacy for businesses","User-controlled data sharing without exposing raw information","Encrypted computations yield verified insights, not data leaks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the AWS Nitro enclave attestation is an unforgeable proof of the exact computation, and that the service provider sees nothing but the attested result; if a computation request can return data or the enclave can leak, the theorem collapses.","fun_headline_variants_meta":{"raw":{"variants":["Privacy by design: users own data, firms get proofs","Decentralized data vaults with provable privacy for businesses","User-controlled data sharing without exposing raw information","Encrypted computations yield verified insights, not data leaks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000264,"raw_usage":{"total_tokens":1560,"prompt_tokens":858,"completion_tokens":702,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":474,"completion_tokens_details":{"reasoning_tokens":650}},"tokens_in":474,"tokens_out":702,"duration_ms":7489,"temperature":1.0,"reasoning_tokens":650,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T22:02:03.433020+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the protocol on two datasets that differ in one known field and submit a computation request that returns that field's exact value as its output; if the service provider can distinguish the two runs from the attested results, the privacy claim is false. More directly, if an adversary can recover a raw data value from the attestation or the enclave's side channels, the theorem fails.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"AWS Nitro enclaves supply the secure enclave and attestation mechanism that underpin the verifiable computation and the privacy proof."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"DIDComm messaging establishes the authenticated, encrypted channels between data agents and service providers."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"AWS attribute-based access control enforces the fine-grained permissions that gate every service provider request."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Decentralized identifiers provide the cryptographic identities used by DIDComm and credential verification."}],"review_version":1}