{"id":"240230a4-4629-4941-8805-29c4b218801b","arxiv_id":"2509.03427","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Pairing the PASTA stream cipher with BFV homomorphic encryption in federated learning cuts client upload by about 2000x and keeps MNIST accuracy within 1.3% of plaintext, but makes server aggregation roughly 15,000x more expensive.","lead":"Federated learning clients usually send model updates in the clear, and those updates leak private data. This paper tests a hybrid encryption scheme where clients encrypt updates with a fast cipher and the server decrypts them inside fully homomorphic encryption, cutting upload size about 2000x and keeping MNIST accuracy near plaintext, at the cost of a huge server slowdown.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Algorithm 2's signed-to-unsigned conversion mis-encodes negative quantized weights in PASTA's F_65537, casting doubt on the reported accuracy unless the implementation deviates from the pseudocode.","rationale":"The reader's weakest_assumption focused on the shared HE secret key and the resulting vulnerability to a single malicious client. That is a real and candidly stated limitation, but it concerns the privacy threat model, which the paper explicitly scopes. The central trade-off claim (accuracy, bandwidth, runtime) is independent of that threat model. In contrast, the signed-to-unsigned conversion issue directly challenges whether the experimental numbers are achievable at all. If the pseudocode is followed, negative weights would be encrypted incorrectly and the reported 97.6% accuracy would be impossible; if the implementation deviates, the paper omits a critical detail needed for reproduction. This is a more load-bearing concern because it strikes at the validity of the headline result, not just its security framing. I therefore disagree with the reader's selection of the weakest assumption, while agreeing that the verdict should remain CONDITIONAL pending clarification of the encoding and reruns with clean baselines.","tokens_in":13869,"tokens_out":15993,"duration_ms":162737,"concrete_test":"Run a minimal end-to-end check: quantize the value -1.0 with α=5 (giving int8 -1), convert it to uint64 exactly as stated in Algorithm 2, PASTA-encrypt it, perform the server-side HESD, decrypt with BFV, and apply Algorithm 3's dequantization. If the recovered value is not -1.0, the encoding is wrong. Additionally, inspect the actual conversion code or require the authors to provide the exact formula (e.g., int8_val % q or int8_val + 128) and a commit hash. If the test fails, re-run the MNIST experiment with a corrected encoding to see whether the reported 97.6% accuracy still holds.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central empirical claim—97.6% accuracy with only a 1.3% drop from plaintext—depends on the entire HHE pipeline operating correctly. A load-bearing correctness gap appears in the quantization/encryption path. The system uses BFV plaintext modulus q = 65537 (Section 6.2), so every plaintext value must be embedded in F_q. Quantized int8 weights range from -127 to 127 (Algorithm 2, line 8). For a negative value x, the correct F_q embedding is x mod q = q - |x|. However, Algorithm 2, line 10 says 'quantized uint64 <- convert to uint64(quantized int8)'. In typical two's-complement languages, converting a negative int8 to uint64 yields 2^64 - |x|. Since 2^16 ≡ -1 (mod q), 2^64 ≡ 1 (mod q), so this reduces modulo q to 1 - |x|, not q - |x|. For x = -1, this gives 0 instead of 65536; for x = -2, gives 65536 instead of 65535. Algorithm 3 (lines 11–14) dequantizes by treating any plaintext > q/2 as negative (subtracting q). Under the described conversion, negative weights would be decrypted as entirely different values, corrupting the aggregated model. The paper reports high accuracy, which suggests the actual implementation uses a different encoding (e.g., x % q or an offset), but the pseudocode does not specify it and no code is provided. This is a concrete reproducibility/correctness gap in the core protocol, more fundamental than parameter tuning or threat-model scope.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a hybrid homomorphic encryption (HHE) framework for federated learning that combines the PASTA symmetric cipher with the BFV FHE scheme. Clients encrypt local model updates with PASTA and send the lightweight ciphertexts together with a BFV-encrypted PASTA key to the server, which homomorphically evaluates PASTA decryption and aggregates the resulting BFV ciphertexts under FedAvg. A prototype built on Flower is evaluated on IID MNIST with 12 clients and 10 rounds; the paper reports roughly 97.4–97.6% accuracy versus about 99% for plaintext FL, a >2,000× reduction in client upload traffic, and a ~30% client-runtime reduction relative to pure BFV, at the cost of a very large server-side computation increase.","tokens_in":14208,"tokens_out":8920,"duration_ms":85639,"significance":"If the implementation is correct, this is a useful demonstration of transciphering in federated learning: it quantifies a realistic trade-off between client-side efficiency and server-side cost, and it builds on public PASTA/BFV implementations rather than proposing a new primitive. The paper is also transparent about the severe server overhead and about the fact that a single malicious client breaks confidentiality. However, the central empirical claim currently rests on an underspecified and, as written, incorrect signed-integer encoding in the quantization/encryption path, and the manuscript does not provide code to resolve the ambiguity. The shared HE secret key and honest-client assumption also substantially narrow the privacy claim, so the paper needs revision before the results can be accepted as reproducible and the contribution clearly scoped.","major_comments":[{"comment":"The encoding of negative quantized weights is not specified and, as written, is incorrect under standard two's-complement semantics. With q=65537, converting an int8 value -k to uint64 yields 2^64-k ≡ 1-k (mod q). Algorithm 3's rule 'if x > q//2 then x -= q' then decodes -1 to 0, -2 to -1, -3 to -2, etc. Positive weights are unaffected, but negative weights—which certainly occur in the CNN—are systematically corrupted. The reported 97.6% accuracy therefore cannot be reproduced from the pseudocode unless the implementation uses a different encoding (e.g., x mod q, an offset, or PASTA-specific limb handling). Please specify the exact modular mapping in the algorithms and make the code available; this is a correctness issue, not a tuning issue.","section":"§5, Algorithm 2 line 10; Algorithm 3 lines 10–14"},{"comment":"The overflow bound is stated as 2^8 × 2^{x1} × 2^{x2} < 2^16+1, with x1 'the number of batches per client' and x2 'the number of training clients', and valid configurations must satisfy 2^{x1+x2} ≤ 2^8. The chosen configuration has x1=63 and x2=4, which contradicts this inequality. Either x1 is intended to be log2 of the number of batches, or the inequality should be a product such as 2^8 · x1 · x2 < q (the chosen 63×4×127 product satisfies the latter). Please correct the formula and explain the derivation, since this is the stated basis for the configuration selection.","section":"§6.2, parameter constraints"},{"comment":"Because every client holds HE sk, the confidentiality guarantees SP.1–SP.3 hold only while all clients are honest and no client colludes with the server or another client. The paper itself concedes that a single malicious client can decrypt an honest client's PASTA key and therefore its update. This assumption is stronger than the honest-but-curious server that motivates the work, and it substantially narrows the 'end-to-end privacy' claim in the abstract. Please state the honest-client assumption explicitly in the abstract and conclusions, and discuss the implications for the cross-device FL scenarios the paper targets.","section":"§4.1–4.2, threat model and SP.1–SP.3"}],"minor_comments":[{"comment":"Numerical inconsistencies: the abstract and introduction report HHE accuracy 97.6%, plaintext 98.9%, BFV 98.04%, while Table 2 reports 97.39%, 99.00%, and 98.21%. These should be reconciled; the claimed '1.3% below plaintext' changes to about 1.6% when using Table 2.","section":"Abstract, §1, Table 2"},{"comment":"The sentence '12 clients, each with 63 training batches, where 4 were used for training and 12 for evaluation' is unclear. I assume it means 4 clients participate in each training phase and 12 in each evaluation phase; please reword.","section":"§6.2"},{"comment":"The HESD procedure is described at a high level only. Since the PASTA decryption circuit is the main server-side cost, a short description of its structure and the number of homomorphic multiplications would aid reproducibility.","section":"§4.1 / Algorithm 1"},{"comment":"The division by n implicitly assumes equal client dataset sizes. For general FedAvg with unequal n_k, the server must first scale each client's update by n_k before summing. Please state this assumption or adjust the pseudocode.","section":"Algorithm 3, line 17"},{"comment":"No repository link or code artifact is provided. Given the encoding ambiguity in Algorithm 2, making the implementation available is essential for reproducibility.","section":"Throughout"},{"comment":"Minor typos: 'Backgound' in the Section 2 heading, 'measured has' in §6.3, and 'serve' in SP.2.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The encoding issue is the main technical blocker. It may be fixable by correcting the pseudocode and releasing the code, but until then the central accuracy claim is not verifiable. The shared-HE-sk threat model also makes the 'privacy-preserving' framing weaker than the abstract suggests; the authors should be encouraged to either use a multi-key scheme or clearly scope the contribution to fully trusted clients. The paper is otherwise a reasonable systems demonstration, and I do not see circularity in the experimental claims."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Worth your time. This is the first complete HHE-based FL framework I've seen, pairing PASTA with BFV and doing transciphering on the server. The engineering is substantial: a working Flower integration, chunked HESD, and a clever trick of leaving FedAvg division to clients because BFV can't divide. The headline measurements—2000x upload cut, 30% client runtime saving, 1.3% accuracy drop—are plausible and honestly reported. The paper is also unusually candid: it states the 15,621x server slowdown and admits that giving every client the BFV secret key means one malicious client breaks confidentiality. That's not a hidden flaw; it's in the threat model.\n\nWhere it gets softer: the numbers don't quite line up. Abstract says 97.6% HHE accuracy; Table 2 says 97.39%. Plaintext 98.9 vs 99.00, BFV 98.04 vs 98.21. These need to be reconciled with the raw data. The BFV baseline OOM'd at round 3, so its accuracy number is suspect as a fair comparison. There is a single run, no seeds, no error bars. And the Section 6.2 modulus inequality looks like a typo.\n\nThe bigger technical concern is the quantization path. Algorithm 2 says 'convert to uint64' without specifying the mapping for negative int8 values. If the implementation uses a standard C++ cast, a value like -1 becomes 2^64-1, which reduces to 0 mod 65537, not 65536. Decryption would then see 0 and dequantize it as 0 instead of -1. That would destroy accuracy. The reported 97.6% implies the real code does something different—probably an explicit mod-add—but the paper doesn't say. This is a reproducibility gap in the core protocol, not a parameter tweak. The fix is easy: spell out the encoding, and release the code or at least the exact conversion functions.\n\nThe honesty about the shared-key risk is refreshing, but it means the 'end-to-end privacy' phrasing overstates what the scheme delivers. It's privacy against an honest-but-curious server and external eavesdroppers, not against malicious clients.\n\nAll of this is fixable. The core idea is sound and the measurements look like a real prototype rather than a toy. I'd want a referee to see it, and I'd want the authors to answer the encoding question before acceptance. For someone working on FL and HE, this is worth a careful read.","headline":"First real HHE-for-FL prototype with honest numbers, but the quantization encoding in the pseudocode and the single-malicious-client assumption need fixing before I'd trust the headline accuracy.","tokens_in":14781,"tokens_out":4841,"would_cite":true,"duration_ms":43516,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Hybrid homomorphic encryption lets weak clients train federated models privately with a 2,000x bandwidth cut.","keywords":["federated learning","hybrid homomorphic encryption","PASTA stream cipher","BFV","transciphering","secure aggregation","privacy-preserving machine learning","MNIST"],"falsifier":"Run the same HHE-FL protocol with one client replaced by a malicious participant who uses the shared HE secret key to decrypt the PASTA key of another client during the aggregation phase, and observe whether the victim's plaintext model update is recovered; if it is, the central confidentiality claim is disproved.","tokens_in":13661,"feed_emoji":"🔐","tokens_out":1657,"duration_ms":17894,"temperature":0.7,"pith_summary":"The paper proposes the first hybrid homomorphic encryption (HHE) framework for federated learning, pairing the lightweight PASTA symmetric cipher with the BFV fully homomorphic scheme. Clients encrypt their model updates with PASTA and send those small ciphertexts plus a homomorphically encrypted PASTA key to the server, which homomorphically converts them to BFV ciphertexts and securely aggregates. On an IID MNIST benchmark with 12 clients and 10 rounds, the system reaches 97.6% accuracy (1.3% below plaintext), cuts client upload traffic by over 2,000x, and reduces client runtime by 30% compared to pure BFV, while shifting a massive computational burden (roughly 15,621x server cost per client) to a well-provisioned server. If the approach scales, it would make privacy-preserving federated learning practical for resource-constrained IoT devices that cannot run FHE directly.","feed_headline":"Hybrid encryption cuts federated learning bandwidth 2,000x","feed_subtitle":"A PASTA-plus-BFV scheme keeps model accuracy within 1.3% of plaintext while offloading heavy computation to the server.","key_machinery":"The central object is the HESD (Homomorphic Evaluation of Symmetric Decryption) routine, built on the PASTA stream cipher and the BFV FHE scheme. PASTA is an HE-friendly stream cipher designed for low multiplicative depth over integers modulo a 16-bit prime, so its decryption circuit can be evaluated homomorphically with modest depth. The server receives the PASTA-encrypted weight chunks and the PASTA key encrypted under BFV, evaluates PASTA decryption to get BFV ciphertexts of the weights, and aggregates them homomorphically under FedAvg. The quantization to int8 and chunk-based processing enable the lightweight symmetric encryption on the client while keeping server-side circuit depth mana","core_discovery":"The central claim is that hybrid homomorphic encryption can make federated learning with fully homomorphic encryption practical for weak clients, without sacrificing model quality. The authors build an end-to-end framework, integrated into the Flower federated learning system, where clients use the PASTA stream cipher for lightweight encryption of quantized local model updates, and the server performs a homomorphic evaluation of PASTA's decryption circuit (HESD) using the BFV scheme, converting the symmetric ciphertexts into BFV ciphertexts and then performing FedAvg aggregation. Experiments on IID MNIST with 12 clients and 10 rounds show 97.6% accuracy versus 98.9% for plaintext and 98.0% f","pith_inferences":["The underlying design pattern—using a cheap symmetric cipher for the bulk of client work and FHE only for the aggregation server—could generalize beyond PASTA/BFV to other HE-friendly ciphers (e.g., RASTA, DASTA) and schemes (BGV, CKKS) with careful tuning of plaintext modulus and quantization.","The paper does not explore non-IID data or gradient inversion resistance; a testable extension would be to evaluate whether the HHE approach defends against gradient inversion attacks on non-IID partitions, where privacy leaks are more damaging.","The server-side 15,621x cost is reported per client; the authors' linear scaling model suggests that batched or GPU-optimized transciphering could close the gap, and a natural next experiment is to benchmark the same setup on a dedicated HE accelerator or multi-core server.","The shared HE secret key assumption is a fundamental bottleneck; a multi-key HHE design where each client has its own PASTA key and the server aggregates without decrypting individual updates would remove the single point of failure, at the cost of more complex HE operations."],"forward_implications":["If scalable, this approach could enable privacy-preserving federated learning on IoT devices, smart wearables, and other resource-constrained hardware that cannot run FHE locally.","The 2000x upload reduction directly addresses the main communication bottleneck in cross-device federated learning, making the encryption overhead negligible compared to raw model updates.","The server-side cost, while high in this prototype, is amenable to parallelization across clients and chunks, as the authors note, and future HE-friendly ciphers could lower it.","The single-key distribution model means participating clients must decrypt the global model with the shared secret key, which reveals the aggregated model—a tension with strict confidentiality for individual updates.","The framework's end-to-end implementation on Flower provides a concrete reference for integrating HHE into existing federated learning stacks."],"supporting_citations":[{"why":"Introduces the PASTA symmetric cipher and the hybrid homomorphic encryption framework that the paper builds on; provides the C++ implementation used for PASTA and BFV.","marker":"[10]"},{"why":"Defines the BFV FHE scheme that the paper uses for server-side homomorphic aggregation and transciphering.","marker":"[13]"},{"why":"Describes the Flower federated learning framework that the prototype is built on.","marker":"[4]"},{"why":"Supplies TenSEAL, the library used to implement the pure-BFV baseline for comparison.","marker":"[3]"},{"why":"Defines FedAvg, the aggregation algorithm that the HHE system implements homomorphically.","marker":"[26]"},{"why":"Originates the transciphering idea that HHE leverages, where a symmetric key is encrypted under HE and decryption is evaluated homomorphically.","marker":"[27]"},{"why":"Provides the quantization method (scale quantization to int8) used to convert float model weights to integer plaintexts for PASTA.","marker":"[21]"},{"why":"The 8k-parameter CNN architecture used as the model for the MNIST experiments.","marker":"[33]"}],"fun_headline_variants":["Hybrid encryption cuts FL uploads 2,000x, keeps 97.6% accuracy","PASTA+BFV: 2,000x smaller client uploads, server does more","FL bandwidth down 2,000x with hybrid homomorphic encryption","Cut FL client load 2,000x with hybrid encryption"],"cache_read_input_tokens":2688,"weakest_assumption_plain":"The paper assumes every client is honest and that no client colludes with the server or with other clients; in particular, it hands every client a copy of the homomorphic secret key, so one malicious client could decrypt another client's model update and break confidentiality.","fun_headline_variants_meta":{"raw":{"variants":["Hybrid encryption cuts FL uploads 2,000x, keeps 97.6% accuracy","PASTA+BFV: 2,000x smaller client uploads, server does more","FL bandwidth down 2,000x with hybrid homomorphic encryption","Cut FL client load 2,000x with hybrid encryption"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000993,"raw_usage":{"total_tokens":4068,"prompt_tokens":792,"completion_tokens":3276,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":536,"completion_tokens_details":{"reasoning_tokens":3189}},"tokens_in":536,"tokens_out":3276,"duration_ms":25031,"temperature":1.0,"reasoning_tokens":3189,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T10:56:19.183906+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same HHE-FL protocol with one client replaced by a malicious participant who uses the shared HE secret key to decrypt the PASTA key of another client during the aggregation phase, and observe whether the victim's plaintext model update is recovered; if it is, the central confidentiality claim is disproved.","supporting_citations":[{"cited_title":"Cryptology ePrint Archive, Paper 2021/731 (2021), https://eprint.iacr.org/2021/731","cited_arxiv_id":null,"evidence_quote":"Introduces the PASTA symmetric cipher and the hybrid homomorphic encryption framework that the paper builds on; provides the C++ implementation used for PASTA and BFV."},{"cited_title":"Cryp- tology ePrint Archive, Paper 2012/144 (2012), https://eprint.iacr.org/2012/144","cited_arxiv_id":null,"evidence_quote":"Defines the BFV FHE scheme that the paper uses for server-side homomorphic aggregation and transciphering."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Originates the transciphering idea that HHE leverages, where a symmetric key is encrypted under HE and decryption is evaluated homomorphically."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The 8k-parameter CNN architecture used as the model for the MNIST experiments."}],"review_version":1}