{"id":"b24e20b4-c4c6-4893-87e5-a9d7ab39d366","arxiv_id":"2509.03806","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"An intermittent observer can recover DSSE search queries with up to about 90% accuracy by linking query groups across observation rounds via co-occurrence graph matching.","lead":"This paper presents Peekaboo, an attack that recovers search queries against encrypted databases even when the eavesdropper only observes the system in short, separated windows. It links query groups across observation rounds using co-occurrence graphs, and outperforms prior attacks under this intermittent-observation model.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Co-occurrence stability across rounds is the load-bearing assumption for external SP inference; the paper's own multi-round results show drift-induced error accumulation, so the 90% claim is not established under topic shift.","rationale":"I read the paper as making a conditional empirical claim: an IOA can recover search patterns and keywords whenever the co-occurrence structure of the client's document collection is stable across observation rounds. The attack's novelty is the cross-round QAP matching in Algorithm 2. The weakest link is not the crypto model but the corpus assumption. The paper states it explicitly and provides no sensitivity analysis for topic drift or large-scale deletions. Figure 5's decreasing ARI with more rounds and Appendix J's lower FVP accuracy are symptoms. The proposed experiment with controlled drift would directly test whether the 90% AP claim survives realistic non-stationarity. The reader identified the same assumption, so I agree. I would keep the verdict conditional: the paper should state the stability regime and correct the abstract/body padding discrepancy (Figure 10 shows ~20% under padding, not >40%), but the core attack is plausible and code is available.","tokens_in":33704,"tokens_out":7532,"duration_ms":76997,"concrete_test":"Run Peekaboo on a controlled drift experiment using the Enron/Lucene datasets: for each of 8 rounds, randomly delete δ% of client documents and replace them with documents from a different topic cluster (held out from the similarity dataset), with δ ∈ {0, 5, 10, 20, 30}; keep all hyperparameters fixed (δ=0.95, maxlevel=5, pg=0.05) and the same query schedule as §5.3. Compute the ARI of the inferred SP and the AP query accuracy of Jigsaw+. If ARI falls below 0.9 or accuracy below ~70% for δ≥10%, the stability assumption is the binding constraint and the abstract's unconditional claims require qualification.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central mechanism for external SP inference is Section 3.2 / Algorithm 2: groups from different rounds are matched by solving a QAP (Eq. 4) over co-occurrence matrices C1=IDT(IDT)^T/|F| and C2=IDH(IDH)^T/|F|. This is valid only under the premise stated in §3.2: 'the co-occurrence of queries (i.e., the probability of two queries appearing in the same file) remains across different rounds.' That premise is an empirical property of the document corpus, not a property of the leakage model, and the paper's own evaluation shows it degrading: Figure 5 reports ARI falling as the number of rounds grows ('errors in earlier matches affect ... later rounds'), and Appendix J reports only ~40% FVP accuracy on Wikipedia. The client model in §5.1 deletes outdated emails (one year for Enron, three years for Lucene) and randomly deletes 10% of additions; over longer horizons or with topic drift, the joint keyword-document distribution changes, so C_x and C_y are no longer equal up to permutation and QAP matching will systematically misalign groups. Because P2 (Algorithm 3) consumes the merged groups M produced by P1, any external-SP error propagates directly into query recovery; the headline '90% query accuracy with AP' therefore holds only in a regime where co-occurrence is approximately stationary. The paper does not quantify this regime or test drift.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces a passive attack framework, Peekaboo, against Dynamic Searchable Symmetric Encryption (DSSE) under an intermittent-observation attacker (IOA) model. The attacker observes leakage in short, separated rounds rather than continuously. Peekaboo infers the search pattern (SP) in two steps: internal SP via response-similarity grouping (Algorithm 1) and external SP via co-occurrence matrices matched across rounds with a quadratic assignment problem (Algorithm 2). It then instantiates query recovery by adapting two prior similar-data attacks, Sap and Jigsaw, into Sap+ and Jigsaw+ (Algorithm 3). The evaluation on Enron, Lucene, and Wikipedia reports adjusted Rand index above 0.9 for SP inference in most settings, query accuracy around 90% with AP leakage and around 50% with FVP on Enron/Lucene, and comparisons against FMA and against idealized 'with SP' baselines. The paper also evaluates countermeasures (file-size padding and access-pattern obfuscation) and provides public code.","tokens_in":34112,"tokens_out":6715,"duration_ms":72276,"significance":"The intermittent-observation threat model is a meaningful extension of prior persistent-attacker models, and the idea of using stable keyword co-occurrence to bridge observation gaps is novel and plausible. The framework is general in that it can be instantiated on multiple similar-data attacks, and the evaluation includes useful upper-bound comparisons with oracle SP knowledge. The code is provided, and the experiments cover multiple datasets and leakage types. If the results are representative, the attack is a clear improvement over FMA, which is the main prior DSSE passive attack in the same setting. However, the central co-occurrence-stability assumption is empirical and not stress-tested beyond the particular update schedules used, and some headline claims in the abstract outrun the reported numbers.","major_comments":[{"comment":"The abstract claims '>40% accuracy against file size padding', but §6 reports that both Jigsaw+ and Sap+ drop from roughly 50% to about 20% accuracy under padding on Enron and Lucene, with FMA at about 20%–35%. The >40% figure appears to hold only for the 'with SP' baselines or for particular configurations, not for the actual Peekaboo instantiations. This is a direct contradiction between the advertised robustness and the evaluation. The abstract and the contribution list should be corrected or the claim should be restricted to the settings that support it.","section":"Abstract and §6 (Figure 10)"},{"comment":"The external-SP inference relies on the premise stated in §3.2 that keyword co-occurrence remains stable across rounds. This is an empirical assumption about the document corpus, not a property of the DSSE leakage. The QAP matching in Eq. (4) aligns C1 and C2, but if the joint distribution of keywords and documents drifts due to deletions, topic change, or large re-encryption, the matrices are no longer close up to permutation and the matching will systematically misalign groups. The paper's own Figure 5 shows ARI decreasing as the number of rounds grows, and Appendix J reports only about 40% FVP accuracy on Wikipedia. Because Algorithm 3 consumes the merged groups produced by Algorithm 2, errors in external SP propagate into query recovery. The authors should quantify the stability regime (e.g., measure co-occurrence matrix drift under their update schedules) and either add topic-shift/","section":"§3.2, Eq. (4), Algorithm 2, Fig. 5, Appendix J"},{"comment":"The headline '90% query accuracy vs. FMA's 30%' is reported for AP leakage on Enron/Lucene with the default keyword universe. The same section reports FVP accuracy of only about 50% for Jigsaw+, and Appendix J gives about 40% FVP and around 80% AP on Wikipedia. Figure 9 also shows accuracy degrading sharply as |W| grows (e.g., Enron AP from >95% at |W|=500 to 70% at |W|=3000). The summary claims should therefore be stated as conditional on leakage type, dataset, and keyword universe, not as universal properties of Peekaboo. This is a reporting/scope issue, but it affects the abstract and the paper's central message.","section":"§5.3, Figs. 6–9, Appendix J"}],"minor_comments":[{"comment":"The text says Jigsaw+ and Sap+ 'have the best accuracy of above 90% and 0.6%, respectively.' The '0.6%' is presumably a typo for '60%' or similar; as written it is inconsistent with the figures and with the accuracy values reported elsewhere.","section":"Appendix F"},{"comment":"The sentence 'the attacker cannot distinguish whether two encrypted files from two rounds are under the same file' should read '... are the same file' or '... belong to the same file.' The current phrasing is confusing.","section":"§3.2"},{"comment":"The symbol '∽' before percentages is nonstandard; use '~' or 'approximately' consistently.","section":"Abstract"},{"comment":"The Wikipedia results are confined to an appendix, but they materially qualify the main claims (especially the FVP results). Consider presenting at least the Wikipedia summary in the main body or explicitly flagging in Section 5 that the headline numbers are dataset-specific.","section":"§5.3 and Appendix J"}],"recommendation":"major_revision","confidential_remarks":"The paper is technically interesting and the experimental comparison is generally well designed, including the with-SP oracle baselines. The main risk is that the abstract and contribution list overstate both the countermeasure resistance and the generality of the 90% accuracy result, while the core co-occurrence-stability assumption is not stress-tested. These issues are fixable with additional experiments or more careful wording, so I do not see a need for rejection, but the revision should address them before publication."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First, this paper is worth reading: it adds a genuinely new attacker model to the DSSE literature. The intermittent-observation attacker is a real practical constraint (APT sleep cycles, re-encryption), and the cross-round co-occurrence matching via QAP is a smart way to reconstruct the search pattern when file identities and sizes are reset between rounds. The experimental case is solid: ARI >0.9 for pattern recovery, Jigsaw+ around 90% query accuracy with AP versus FMA's ~30%, and the code is available. The formalization of internal/external SP is clean, and the instantiation over Sap and Jigsaw is a natural extension.\n\nThe soft spots are real but not fatal. The abstract claims >40% accuracy against file size padding, but Section 6 and Figure 10 show Jigsaw+ and Sap+ dropping to about 20% at k=1000. That is an inconsistency the authors must fix. Also, the load-bearing assumption is that keyword co-occurrence stays stable across rounds. The paper states this directly, and Figure 5 shows ARI decreasing as rounds grow—errors accumulate. They test on Enron/Lucene with modest daily updates, not topic shift or large deletions, so the headline numbers should be scoped to that regime. The Wikipedia appendix shows ~40% FVP accuracy, so the strong claims are really about AP. Finally, the evaluation has no error bars and several hyperparameters (delta, maxlevel, pg, alpha, beta, BaseRec, ConfRec) are tuned on the test datasets, so the point estimates are optimistic.\n\nFor a researcher working on DSSE leakage attacks or defenses, this is a useful contribution. It deserves peer review, not desk rejection, but the abstract must be corrected and the authors should provide error bars and a drift experiment before acceptance. I'd use the paper in my own work and would bring it to a reading group.","headline":"Genuinely new attacker model, solid experiments, but the padding claim is overstated and the co-occurrence-stability assumption needs a stress test.","tokens_in":34588,"tokens_out":2555,"would_cite":true,"duration_ms":24255,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Intermittent observation of encrypted search leakage is enough to recover the underlying queries with around 90% accuracy.","keywords":["Dynamic Searchable Symmetric Encryption","leakage abuse attack","intermittent observation","search pattern recovery","query recovery","co-occurrence matrix","quadratic assignment problem","passive attack"],"falsifier":"A decisive test is to run Peekaboo on a DSSE trace where between every observation round the corpus is replaced by documents with unrelated keyword co-occurrence, for example messages on disjoint topics. If the adjusted rand index for search-pattern recovery stays above 0.9, the co-occurrence assumption is not actually load-bearing; if it collapses, the premise is confirmed as what makes the attack work.","tokens_in":1483,"feed_emoji":"🔍","tokens_out":1562,"duration_ms":54221,"temperature":0.7,"pith_summary":"The paper asks whether a passive attacker who only observes the leakage of a dynamic encrypted search system during short, separated time windows can still recover what the client is searching for. It argues yes: even when the attacker cannot link queries across rounds by matching files, the stable co-occurrence of keywords inside the documents lets the attacker regroup queries round by round and then run standard query-recovery attacks on the merged groups. On email corpora the claimed result is an adjusted rand index above 0.9 for recovering the search pattern and roughly 90% query-recovery accuracy with access-pattern leakage, compared with about 30% for the previous FMA attack. If true, intermittent observation does not meaningfully protect DSSE users: the threat model assumed by earlier attacks is not needed for highly effective query recovery.","feed_headline":"Intermittent snooping recovers 90% of encrypted search queries","feed_subtitle":"A new passive attack rebuilds the hidden search pattern from keyword co-occurrence across observation gaps.","key_machinery":"The load-bearing object is the co-occurrence matrix of query groups: entry (i,j) is the normalized count of files returned in common by queries of group i and group j within a round. Because file identities are refreshed between rounds, the paper replaces identity matching with graph matching: it builds a co-occurrence matrix for each round's groups and aligns matrices across rounds by solving a quadratic assignment problem (using the IHOP heuristic), pruning low-confidence matches. This carries the whole external search-pattern inference; everything else—frequency, volume, and co-occurrence for query recovery—is derived from these merged groups.","core_discovery":"Peekaboo's central claim is that the search pattern—the partition of observed queries by the keyword they issue for—is inferable even under intermittent observation. Within one observation round, queries are grouped by similarity of their access pattern or file-volume pattern. The key step for cross-round linkage is that groups from different rounds are matched not by file identity (which changes with updates and re-encryption) but by their co-occurrence matrix, i.e., how often two query groups return files in common; this matrix is assumed stable across rounds. Matching is then a quadratic assignment problem solved with the IHOP heuristic. Once rounds are stitched together, the attacker der","pith_inferences":["Inference: If co-occurrence stability holds beyond the tested email corpora, similar attacks should transfer to other encrypted-search settings that leak access or file-volume patterns, such as structured encryption or encrypted databases, not just DSSE.","Inference: The defensive lesson is that countermeasures must perturb the co-occurrence structure between rounds, not merely pad file sizes; padding only removes a portion of the file-volume signal.","Inference: A testable extension is to measure how much topic drift between rounds is needed to break the attack; the paper's stability assumption predicts a threshold beyond which graph matching fails, and that threshold could be measured on real document streams."],"forward_implications":["Search-pattern recovery with ARI above 0.9 means the internal and external search pattern cannot be treated as concealed from intermittent observers.","Query recovery reaches about 90% accuracy with access-pattern leakage and about 50% with file-volume-pattern leakage on tested email corpora, roughly tripling the accuracy of the previous FMA attack.","Accuracy grows with the number of observation rounds and the number of observed queries, so even short repeated observation windows are dangerous.","File-size padding degrades the attack only partially, and access-pattern obfuscation at tested parameters leaves Jigsaw+ near 90% accuracy.","The framework is generic: any similar-data attack that relies on frequency, volume, or co-occurrence can be instantiated as an 'Attack+' variant for intermittent observation."],"supporting_citations":[{"why":"Supplies the FMA baseline and the response-similarity formulas used to infer the internal search pattern.","marker":"[51]"},{"why":"Supplies the IHOP quadratic-assignment solver used to match co-occurrence matrices across observation rounds.","marker":"[37]"},{"why":"Supplies the Sap attack, which is adapted into Sap+ for query recovery under dynamic volumes.","marker":"[36]"},{"why":"Supplies the Jigsaw attack, which is adapted into Jigsaw+ for query recovery under dynamic frequencies and co-occurrence.","marker":"[34]"},{"why":"Provides the adjusted rand index used to score search-pattern recovery accuracy.","marker":"[25]"},{"why":"Supplies the Enron email corpus used to simulate client behavior and attacker auxiliary knowledge.","marker":"[49]"},{"why":"Supplies the Lucene email corpus used as a second real-world dataset for evaluation.","marker":"[20]"},{"why":"Supplies daily search-trend frequencies used to model the client's query behavior.","marker":"[32]"}],"fun_headline_variants":["Intermittent snooping recovers 90% of encrypted queries","Sparse peeks rebuild hidden search patterns with 90% accuracy","Passive attack exploits intermittent leaks to infer encrypted queries","New DSSE attack: intermittent observation yields 90% query recovery"],"cache_read_input_tokens":36224,"weakest_assumption_plain":"Keyword co-occurrence in the client's document collection stays stable across observation rounds, even though which files contain which keywords changes; if the topic mix shifts greatly between rounds, the graph matching used to align rounds breaks down.","fun_headline_variants_meta":{"raw":{"variants":["Intermittent snooping recovers 90% of encrypted queries","Sparse peeks rebuild hidden search patterns with 90% accuracy","Passive attack exploits intermittent leaks to infer encrypted queries","New DSSE attack: intermittent observation yields 90% query recovery"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000313,"raw_usage":{"total_tokens":1606,"prompt_tokens":723,"completion_tokens":883,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":467,"completion_tokens_details":{"reasoning_tokens":810}},"tokens_in":467,"tokens_out":883,"duration_ms":7744,"temperature":1.0,"reasoning_tokens":810,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T10:38:31.324987+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A decisive test is to run Peekaboo on a DSSE trace where between every observation round the corpus is replaced by documents with unrelated keyword co-occurrence, for example messages on disjoint topics. If the adjusted rand index for search-pattern recovery stays above 0.9, the co-occurrence assumption is not actually load-bearing; if it collapses, the premise is confirmed as what makes the attack work.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the IHOP quadratic-assignment solver used to match co-occurrence matrices across observation rounds."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the Sap attack, which is adapted into Sap+ for query recovery under dynamic volumes."},{"cited_title":"Yang, and Kaitai Liang","cited_arxiv_id":null,"evidence_quote":"Supplies the Jigsaw attack, which is adapted into Jigsaw+ for query recovery under dynamic frequencies and co-occurrence."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the adjusted rand index used to score search-pattern recovery accuracy."},{"cited_title":"Cohen, MLD","cited_arxiv_id":null,"evidence_quote":"Supplies the Enron email corpus used to simulate client behavior and attacker auxiliary knowledge."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the Lucene email corpus used as a second real-world dataset for evaluation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies daily search-trend frequencies used to model the client's query behavior."}],"review_version":1}