{"id":"133d0962-01e1-4132-b780-678ee554503e","arxiv_id":"2508.19459","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Hermitian-curve AG codes yield X-secure T-private PIR schemes with rate 1 minus (X+T+3q^2-q-2)/N, beating elliptic and hyperelliptic schemes for large X+T.","lead":"This paper builds a new private-information-retrieval scheme using algebraic-geometry codes on Hermitian curves, which have many rational points. The scheme reaches higher retrieval rates than earlier curve-based schemes when the security and privacy parameters are large.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Proposition 3.5 and Table 3 use deg(Dfull) instead of the code length N=deg(Dfull)-g+1, understating the scheme's maximum rate.","rationale":"The reader's conditional verdict is appropriate: Theorem 3.3 itself appears mathematically sound, but the paper's reported maximum rates and numerical comparisons rest on an inconsistent definition of N. The point-count inequality flagged by the reader is not actually problematic for the Hermitian curve, since its rational point count and the construction's exclusion conditions are exactly as assumed for the parameter ranges used in the comparisons. The N mismatch is more concrete and directly affects the central numerical claims: Proposition 3.5 and Table 3 understate the scheme's rate, because they divide by deg(Dfull) rather than the information-set length deg(Dfull)-g+1. Correcting this makes the Hermitian scheme's rates higher, so the qualitative direction of the paper's main claim may survive, but the stated rates and thresholds must be revised. I would keep the verdict at CONDITIONAL, requiring this correction and a restatement of the unqualified superiority claim in the abstract and conclusions.","tokens_in":16418,"tokens_out":22747,"duration_ms":233739,"concrete_test":"Recompute Table 3's last row for q=11, X=T=5 using N=deg(Dfull)-g+1=789 instead of deg(Dfull)=843. If the rate changes from 0.50890 to 0.5437, the maximum-rate formula uses the wrong code length. Then recompute all entries in Table 3 and recheck the comparison thresholds in Propositions 4.8 and 4.9 with the corrected N.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Theorem 3.3 defines the number of servers as N = ℓ(Dfull) = deg(Dfull) - g(H_q) + 1 = L + X + T + 3q^2 - q - 2. However, the proof of Proposition 3.5 maximizes L with the phrase 'N = L + X + T + (7q^2 - 3q - 6)/2', which is deg(Dfull), not the code length from Theorem 3.3. Table 3 is computed from this wrong denominator. For q=11, X=T=5, Proposition 3.5 gives m=44, L=429, deg(Dfull)=843, while the correct N = deg(Dfull)-g+1 = 843-55+1 = 789. Thus the rate should be 429/789 ≈ 0.5437, not 429/843 ≈ 0.50890 as listed. The same error affects all entries in Proposition 3.5 and Table 3, and consequently the numerical comparisons in Section 4. This is an internal inconsistency with Theorem 3.3, independent of the point-count condition, which is actually satisfied by the Hermitian curve's q^3+1 rational points.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper constructs X-secure T-private PIR schemes using algebraic-geometry codes on the Hermitian curve H_q over F_{q^2}. The construction instantiates the CSA framework of [19] with Riemann-Roch spaces on H_q. Theorem 3.3 states that, under a point-count condition, there is an XSTPIR scheme with rate R = L/N and N = L + X + T + 3q^2 - q - 2, where L = mq - g(H_q). Proposition 3.5 optimizes L from the Hasse-Weil point count and gives a formula for the maximum rate; Section 4 compares these rates with the rational, elliptic, and hyperelliptic constructions from [19,20].","tokens_in":16619,"tokens_out":18379,"duration_ms":181983,"significance":"If the technical issues are repaired, the paper makes a solid contribution: it gives a new family of CSA-PIR schemes from a maximal curve, with a proof of Theorem 3.3 that is largely sound. Equations (19)-(21) correctly place Vnoise inside L(Dnoise), the intersection argument L(Dinfo)∩L(Dnoise)={0} is valid, and the dual-distance bounds yielding X+1 and T+1 are standard. The rates are not fitted; they are derived from Riemann-Roch and from the exact point count of the Hermitian curve. The main weakness is an internally inconsistent denominator in the rate-optimization statement and in Table 3, which understates the Hermitian scheme's rate. The qualitative comparison with other curve families appears robust, but the numerical claims must be corrected.","major_comments":[{"comment":"The maximum-rate formula in Proposition 3.5 uses the wrong N. Theorem 3.3 defines N = ℓ(Dfull) = deg(Dfull) - g(H_q) + 1 = L + X + T + 3q^2 - q - 2. In contrast, Proposition 3.5 states 'N = L + X + T + (7q^2 - 3q - 6)/2', which is deg(Dfull), not the code length/number of servers. This is not a harmless typo: the proof of Proposition 3.5 maximizes L with respect to this deg-based N, and Table 3 is computed accordingly. The errors understate the achievable rate. For q=11, X=T=5, Proposition 3.5 gives m=44, L=429, deg(Dfull)=843, but the correct N is 843-55+1=789, so the rate is 429/789≈0.5437, not 429/843≈0.5089 as listed. The same correction applies to every entry of the last row of Table 3. The point-count optimization itself is correct, but the rate formula and all numerical values depending on it must be recomputed with N=deg(Dfull)-g+1.","section":"Proposition 3.5 and Section 3"},{"comment":"Table 3's last row, labelled q(q-1)/2, reports rates L/deg(Dfull) rather than L/N from Theorem 3.3. This makes the table inconsistent with the theorem it is supposed to illustrate. It also creates tension with Propositions 4.8 and 4.9, which (correctly) use N = L + X + T + 3q^2 - q - 2 in the denominators of the bounds. The manuscript should reconcile these: either Proposition 3.5 and Table 3 should be corrected to the Theorem 3.3 definition of N, or the theorem's N should be used everywhere. Until this is done, the numerical comparison between the Hermitian construction and the hyperelliptic constructions is not reliable as stated.","section":"Table 3 and internal consistency"}],"minor_comments":[{"comment":"The displayed derivative after the definition of P(q,M) is incorrect: ∂P/∂M = q^3 - 2q^2 - 3q + 1, not 2q^3 - 4q^2 - 4q - 4. The positivity conclusion still holds for q≥3, so this is a typographical error, but it should be fixed.","section":"Proposition 4.8"},{"comment":"The hyperelliptic equation is displayed as 'y2−x2q+1−a2gx2g+···+a0=0'; this appears to be a typo for 'y^2 - x^{2g+1} - a_{2g}x^{2g} - ... - a_0 = 0'. Please correct the exponent.","section":"Proposition 4.9"},{"comment":"The congruence condition is written as 'L+g(H_q)≡q 0'; this should be 'L+g(H_q) ≡ 0 (mod q)'.","section":"Theorem 3.3"},{"comment":"The abstract claims the Hermitian construction achieves 'higher retrieval rates' than the other families without qualification. Section 4 shows this only for sufficiently large X+T (Propositions 4.8 and 4.9). Consider adding the qualifying regime to the abstract or conclusions.","section":"Abstract and Section 4"}],"recommendation":"major_revision","confidential_remarks":"The denominator error is localized and fixable, and the algebraic proof of Theorem 3.3 is sound. I would not reject on this basis, but the maximum-rate proposition and Table 3 need to be corrected before the paper can be accepted. The qualitative conclusion that Hermitian curves improve rates for large X+T appears to survive the correction, since correcting N increases the Hermitian rates."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the main construction is sound and the custom basis is genuine work, but the paper's own rate tables use the wrong denominator. The error is in the authors' favor—it understates the Hermitian rates—so the central theorem survives, but every numerical rate in Proposition 3.5 and Table 3 needs recomputation before the comparative claims can be taken at face value.\n\nWhat is new: this is the Hermitian-curve instantiation of the Makkonen–Karpuk–Hollanti CSA-AG framework, and the load-bearing new ingredient is the basis of L(Dinfo) built from functions h_i^(z) = y^(z-1)/∏(x-α...) chosen so that the noise divisor stays L-independent. That is a real constraint—the obvious monomial basis would let deg(Dfull) grow with L—and the construction handles it. The algebra in Theorem 3.3 checks out: equations (19)–(21) do put Vnoise inside L(Dnoise), the intersection L(Dinfo)∩L(Dnoise)=0 is correct, and the dual-distance bounds give X+1 and T+1. The rate formula follows from Riemann–Roch, and the point-count optimization in Proposition 3.5 yields the right maximum L. The independence proof of Proposition 3.1 is slightly compressed—it should say that each f_z has degree at most m−z yet vanishes at m−z+1 points, forcing it to be zero—but the step is true and easily filled in.\n\nThe soft spots, in order:\n\n1. The denominator error. The proof of Proposition 3.5 writes N = L+X+T+(7q^2−3q−6)/2, but that is deg(Dfull), not the code length. Theorem 3.3 correctly has N = deg(Dfull)−g+1 = L+X+T+3q^2−q−2. Table 3 is built from the wrong denominator. Example: q=11, X=T=5, m=44, L=429, deg(Dfull)=843, true N=789, so the rate is 0.544, not 0.509. Correcting this raises all Hermitian rates, so the paper's comparison with hyperelliptic and elliptic schemes becomes stronger, not weaker. Still, it is an actual internal inconsistency with Theorem 3.3, not a cosmetic issue.\n\n2. The abstract and conclusions are unqualified. Propositions 4.8 and 4.9 prove Hermitian superiority only for sufficiently large X+T; the paper's own tables show the opposite for small X+T. The corrected denominator moves the crossover earlier, but the blanket claim \"higher retrieval rates\" is still not supported as written.\n\n3. Minor presentation issues: many typos and OCR artifacts, and the point-count condition for the maximum rate is a numerical existence constraint, separate from the algebra. For the tabulated cases it holds, but the reader has to check it.\n\nBottom line: this is a solid extension of the CSA-AG framework, not a new paradigm. It deserves a serious referee. I would send it, with the rate calculations flagged for recomputation.","headline":"The Hermitian CSA-PIR construction is sound and the custom basis trick is real, but the paper's own rate tables use deg(Dfull) instead of the code length, understating the Hermitian rates; fix that and the comparison claims get stronger.","tokens_in":17171,"tokens_out":5989,"would_cite":true,"duration_ms":56560,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["11G20","94B05"],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper constructs X-secure T-private PIR schemes from AG codes on Hermitian curves, with rate 1−(X+T+3q^2−q−2)/N, and proves these out-perform earlier genus-0, genus-1, and hyperelliptic constructions at fixed field size.","keywords":["private information retrieval","cross-subspace alignment","algebraic geometry codes","Hermitian curve","maximal curves","X-secure T-private PIR","Riemann-Roch spaces","finite fields"],"falsifier":"Take q=11 with X=T=5, fix the mq points P_{i,z} in the construction, and count the distinct F_{121}-rational points of H_q outside {P∞,P0}∪{P_{i,z}}. The construction needs 1330 distinct points and H_q has 1332, leaving only two spare points; if any selected α_i or β_{i,z} causes a collision, the hypothesis of Theorem 3.3 fails and the maximum rate 429/789 is not attained for those parameters.","tokens_in":16259,"feed_emoji":"🔐","tokens_out":11533,"duration_ms":98424,"temperature":0.7,"pith_summary":"This paper constructs a private information retrieval (PIR) scheme whose code comes from the Hermitian curve H_q, a maximal curve over F_{q^2} with q^3+1 rational points. The construction fits the cross-subspace alignment (CSA) framework: Riemann–Roch spaces on H_q supply the encrypted, query, security, and privacy subspaces, and the curve's many rational points let the evaluation code be long, pushing the PIR rate to 1 − (X+T+3q^2−q−2)/N for X-secure, T-private retrieval. The authors derive the largest rate their method can reach and show that, for fixed field size and sufficiently large X+T, it exceeds the rates of earlier CSA schemes built from rational, elliptic, and hyperelliptic curves. A reader should care because PIR capacity is limited by download overhead, and this is a concrete family where more rational points on the underlying curve translate directly into less overhead.","feed_headline":"Hermitian curves lift PIR rates past genus-0 and genus-1 schemes","feed_subtitle":"A maximal curve's surplus rational points yield longer codes and higher X-secure T-private retrieval rates at fixed field size.","key_machinery":"The load-bearing object is the divisor Dinfo = −(h) + (L+g(H_q)−1)P∞ on H_q, where h = ∏_{i=1}^m 1/(x−α_i) has poles at the mq selected points P_{i,z}. The paper constructs an explicit F_{q^2}-basis of L(Dinfo) from functions h_i^{(z)} = y^{z−1}∏(x−α_{i′}) and uses the divisors Dnoise = (X+T+4g(H_q)+q−2)P∞ + (q^2−1)P0 and Dfull = Dinfo's support plus Dnoise to satisfy the subspace conditions of Theorem 2.2. The evaluation map on a set of deg(Dfull)+1 rational points is injective, giving an information set of size N; the security and privacy parameters are controlled by the minimum distances of the dual codes of the corresponding evaluation codes. The point count q^3+1 of the Hermitian curve","core_discovery":"On its own terms, the paper establishes Theorem 3.3: for the Hermitian curve H_q of genus q(q−1)/2, if L = mq − q(q−1)/2 with m chosen so that L + g(H_q) ≡ 0 (mod q), and if enough F_{q^2}-rational points of H_q remain after excluding P∞, P0, and mq selected affine points, then there exists an X-secure and T-private PIR scheme with rate R = L/N = 1 − (X+T+3q^2−q−2)/N, where N = L+X+T+3q^2−q−2. It then gives the maximum rate: L = mq − g(H_q) with m = floor((q^3−3q^2+q+1−(X+T))/(2q)). The improvement over earlier genus-0, genus-1, and hyperelliptic CSA schemes comes from H_q being F_{q^2}-maximal: its q^3+1 rational points allow longer evaluation sets, hence a larger L for the same security an","pith_inferences":["The comparison results depend on asymptotic conditions such as X+T ≥ 3(q+2); for small X+T, the Hermitian scheme may not beat elliptic or hyperelliptic ones, so the 'best curve' question is parameter-dependent rather than settled by maximality alone.","One could test whether other maximal curves, such as Suzuki or Ree curves, fit the same divisor template; the Hermitian construction uses an explicit basis of L(mP∞), so a similar basis for other Deligne–Lusztig curves would be the main obstacle.","The rate formula assumes the full set of q^3+1 rational points is available; in practice, the selected α_i and β_{i,z} must be checked for collisions, so a small-q implementation would reveal whether the advertised maximum is actually reachable."],"forward_implications":["For fixed field size and sufficiently large X+T, the Hermitian scheme out-rates the genus-0 construction from Theorem 2.3, the elliptic construction from Theorem 2.4, and the hyperelliptic construction from Theorem 2.5.","The scheme answers the open direction in [20] of building CSA-based PIR from maximal curves; Hermitian curves are the first maximal family used this way.","Because the overhead term X+T+3q^2−q−2 does not grow with L, longer codes are strictly better: the rate approaches 1 as the curve supplies more usable rational points.","The explicit maximum-rate formula lets a designer choose q, X, T and immediately read off the best L and N for the Hermitian construction, without searching over divisors."],"supporting_citations":[{"why":"Supplies Theorem 2.2 and the genus-0/genus-1 XSTPIR constructions that the Hermitian scheme extends and compares against.","marker":"[19]"},{"why":"Supplies the hyperelliptic XSTPIR construction and states the open direction of maximal curves that this paper addresses.","marker":"[20]"},{"why":"Defines cross-subspace alignment and the rate/capacity framework for X-secure T-private PIR.","marker":"[16]"},{"why":"Supplies Riemann-Roch spaces, AG code definitions, and dimension/duality theorems used throughout.","marker":"[24]"},{"why":"Supplies AG code parameters, including the designed distance, used for the dual-code bounds in Theorem 3.3.","marker":"[14]"},{"why":"Supplies the condition for maximal hyperelliptic curves used in the rate comparisons.","marker":"[28]"},{"why":"Supplies existence of F_q-maximal elliptic curves used in Proposition 4.8's comparison.","marker":"[30]"}],"fun_headline_variants":["Hermitian curve codes boost private retrieval rates","Maximal curve yields faster PIR schemes","Hermitian AG codes beat genus-0 and genus-1 PIR","Surplus rational points on Hermitian curve lift PIR rates","Hermitian curve PIR: longer codes, higher rates"],"cache_read_input_tokens":2688,"weakest_assumption_plain":"The construction's advertised rates are only reachable if, after setting aside the Hermitian curve's point at infinity, the point P0, and the mq chosen affine points, enough distinct F_{q^2}-rational points remain to form the evaluation set; any collision or shortage of those points makes the maximum-rate formula unattainable.","fun_headline_variants_meta":{"raw":{"variants":["Hermitian curve codes boost private retrieval rates","Maximal curve yields faster PIR schemes","Hermitian AG codes beat genus-0 and genus-1 PIR","Surplus rational points on Hermitian curve lift PIR rates","Hermitian curve PIR: longer codes, higher rates"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000566,"raw_usage":{"total_tokens":2547,"prompt_tokens":798,"completion_tokens":1749,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":542,"completion_tokens_details":{"reasoning_tokens":1684}},"tokens_in":542,"tokens_out":1749,"duration_ms":13542,"temperature":1.0,"reasoning_tokens":1684,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T15:50:44.990602+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take q=11 with X=T=5, fix the mq points P_{i,z} in the construction, and count the distinct F_{121}-rational points of H_q outside {P∞,P0}∪{P_{i,z}}. The construction needs 1330 distinct points and H_q has 1332, leaving only two spare points; if any selected α_i or β_{i,z} causes a collision, the hypothesis of Theorem 3.3 fails and the maximum rate 429/789 is not attained for those parameters.","supporting_citations":[{"cited_title":"Karpuk, and Camilla Hollanti","cited_arxiv_id":null,"evidence_quote":"Supplies Theorem 2.2 and the genus-0/genus-1 XSTPIR constructions that the Hermitian scheme extends and compares against."},{"cited_title":"Secret Sharing for Secure and Private Information Retrieval: A Construction Using Algebraic Geometry Codes","cited_arxiv_id":"2408.00542","evidence_quote":"Supplies the hyperelliptic XSTPIR construction and states the open direction of maximal curves that this paper addresses."},{"cited_title":"Cross subspace alignment and the asymptotic capacity of X-secure T-private information retrieval","cited_arxiv_id":null,"evidence_quote":"Defines cross-subspace alignment and the rate/capacity framework for X-secure T-private PIR."},{"cited_title":"Algebraic function fields and codes, volume 254","cited_arxiv_id":null,"evidence_quote":"Supplies Riemann-Roch spaces, AG code definitions, and dimension/duality theorems used throughout."},{"cited_title":"Van Lint, and Ruud Pellikaan","cited_arxiv_id":null,"evidence_quote":"Supplies AG code parameters, including the designed distance, used for the dual-code bounds in Theorem 3.3."},{"cited_title":"A note on certain maximal hyperelliptic curves.Finite Fields Their Appl., 18(5):1013–1016, 2012","cited_arxiv_id":null,"evidence_quote":"Supplies the condition for maximal hyperelliptic curves used in the rate comparisons."},{"cited_title":"Washington","cited_arxiv_id":null,"evidence_quote":"Supplies existence of F_q-maximal elliptic curves used in Proposition 4.8's comparison."}],"review_version":1}