{"id":"3c0d46b8-5d50-4775-9bba-bc3df63c3f4e","arxiv_id":"2605.26903","paper_version":2,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":7.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"Introduces an anonymous two-party GBDT protocol using dual circuit-PSI and halved-cost ciphertext packing in homomorphic encryption to hide shared record IDs while claiming competitive efficiency.","lead":"The paper designs a protocol for two-party gradient boosting decision tree training that hides which records the parties share by alternating dual circuit-PSI and propagating state via oblivious programmable pseudorandom functions. A smart generalist might read it because the work targets privacy-preserving analytics on sensitive vertically partitioned data in finance and healthcare without the ID leakage of standard private set intersection.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"Whether alternating dual circuit-PSI + OPPRF propagation avoids new leakage and domain-size overhead (while halved packing yields end-to-end gains) is the unverified hinge for the competitiveness claim.","rationale":"Reader's weakest_assumption directly isolates the two load-bearing design assumptions for the efficiency claim; no stronger objection is identifiable from the supplied abstract and strongest_claim. Verdict therefore stays UNVERDICTED.","tokens_in":1791,"tokens_out":311,"duration_ms":25718,"concrete_test":"Re-derive the end-to-end complexity expression in the full paper's experimental section using the exact parameter set (domain size, number of trees, feature dimension) and recompute Table/Figure entries after restoring the original packing cost; if the ratio to the leaky baseline exceeds 1.5×, the competitiveness claim weakens.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The headline efficiency claim rests on two design moves: (1) alternating receiver roles in circuit-PSI combined with OPPRF to propagate shared state without universal alignment, and (2) a factor-of-two reduction in ciphertext packing for the (R)LWE-based conversion. The abstract asserts these resolve the domain-size cost dilemma and keep the protocol competitive, yet provides no concrete parameter analysis showing that OPPRF calls remain sub-linear in domain size or that the packing change dominates total runtime under the reported experimental settings. If either assumption fails, the \"remains competitive with leaky approaches\" result does not follow.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper proposes a protocol for anonymous two-party gradient boosting decision tree (GBDT) training on vertically partitioned data. It employs dual circuit-PSI with alternating receiver roles combined with oblivious programmable pseudorandom functions (OPPRF) to propagate shared state and avoid universal alignment, thereby resolving domain-size scaling costs for ID hiding. A secondary contribution halves the ciphertext packing cost when converting SIMD homomorphic encryption based on (ring) LWE, building on prior secure GBDT work. Comparative experiments are claimed to show the protocol remains competitive in efficiency with leaky baselines, with techniques extensible to other vertically partitioned analytics.","tokens_in":1940,"tokens_out":533,"duration_ms":40548,"significance":"If the efficiency and anonymity claims hold under concrete parameters, the work provides a meaningful step toward practical ID-hiding secure computation for interpretable models in regulated domains such as finance and healthcare. Explicitly tackling the domain-size dilemma for anonymous PSI-based alignment and the packing optimization are concrete technical contributions. The extension claim broadens potential impact beyond GBDT.","major_comments":[{"comment":"§4 (Experiments): The central competitiveness claim rests on comparative runtime results, yet no parameter analysis or tables demonstrate that OPPRF invocations remain sub-linear in domain size or that the halved packing cost dominates end-to-end runtime under the reported settings and domain sizes. This directly affects whether the 'remains competitive with leaky approaches' result follows from the design.","section":"§4 (Experiments)"},{"comment":"§3 (Protocol): The security argument that alternating dual circuit-PSI plus OPPRF state propagation introduces no new leakage (beyond the intended anonymity) is load-bearing for the anonymity guarantee but receives only a high-level description; a concrete leakage analysis or reduction to the underlying primitives' security is needed to support the 'dark forest' training claim.","section":"§3 (Protocol)"}],"minor_comments":[{"comment":"Abstract and §1: The phrase 'comparative experiments show our protocol remains competitive' would be strengthened by naming the leaky baselines and key metrics (e.g., wall-clock time, communication) even at a high level.","section":"Abstract"},{"comment":"Notation: The description of 'pick-then-sum over local features' would benefit from an explicit equation or pseudocode fragment showing how circuit-PSI outputs feed into the GBDT split computation.","section":"§3.2"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the thoughtful and constructive report. The two major comments identify areas where the current manuscript would benefit from additional detail. We address each point below and commit to revisions that strengthen the presentation without altering the core claims.","responses":[{"response":"We agree that the experimental section would be strengthened by explicit parameter sweeps and cost breakdowns. In the revised version we will add tables and figures that (i) measure OPPRF invocation cost versus domain size for the concrete parameters used in the GBDT experiments, confirming sub-linear scaling, and (ii) isolate the contribution of the halved ciphertext-packing optimization to end-to-end runtime. These additions will make the competitiveness claim rest on documented measurements rather than aggregate timings alone.","revision_made":"yes","referee_comment":"[§4 (Experiments)] §4 (Experiments): The central competitiveness claim rests on comparative runtime results, yet no parameter analysis or tables demonstrate that OPPRF invocations remain sub-linear in domain size or that the halved packing cost dominates end-to-end runtime under the reported settings and domain sizes. This directly affects whether the 'remains competitive with leaky approaches' result follows from the design."},{"response":"The current security discussion in §3 is indeed high-level. We will expand it to include an explicit leakage profile for the alternating dual circuit-PSI + OPPRF composition, showing that the only information revealed is the intended anonymity set (i.e., no additional leakage on record identifiers or feature values). Where possible we will sketch reductions to the security of the underlying circuit-PSI and OPPRF primitives. This concrete analysis will be added without changing the protocol itself.","revision_made":"yes","referee_comment":"[§3 (Protocol)] §3 (Protocol): The security argument that alternating dual circuit-PSI plus OPPRF state propagation introduces no new leakage (beyond the intended anonymity) is load-bearing for the anonymity guarantee but receives only a high-level description; a concrete leakage analysis or reduction to the underlying primitives' security is needed to support the 'dark forest' training claim."}],"tokens_in":1453,"tokens_out":454,"duration_ms":30948,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The core advance is a protocol that trains gradient-boosted trees on vertically split data while hiding which record IDs the two parties share. Standard PSI leaks that information; circuit-PSI alone is too slow for repeated use. Their fix has the parties switch roles as receiver and uses OPPRF to carry the circuit-PSI output forward as shared state. This avoids a full alignment step whose cost would grow with the entire ID space.\n\nThey also halve the ciphertext packing overhead when converting SIMD homomorphic encryption, building on the Usenix Security 2023 GBDT work. The abstract positions this as the first treatment of the anonymous case and claims the result stays competitive with leaky baselines.\n\nThe construction is honest about its building blocks and does not hide behind fitted parameters. If the full paper supplies the security argument and the experimental numbers with parameter settings, that would be useful evidence.\n\nThe soft spot is exactly the one the stress-test flags: the efficiency story depends on OPPRF calls staying cheap and the packing reduction actually driving end-to-end time under the concrete settings. The abstract gives no runtime tables, no domain-size scaling plots, and no security proof sketch, so the central claim cannot be checked yet.\n\nThis is for people who need ID-hiding vertical protocols in regulated domains where trees are preferred over neural nets. A reader already working on circuit-PSI or secure tree training would find the design worth examining.\n\nI would send it to peer review so the experiments and proofs can be inspected; the idea is worth the time even if the numbers need tightening.","headline":"The paper starts anonymous two-party GBDT by alternating circuit-PSI receivers and propagating state via OPPRF to hide IDs without domain-size blowup, plus a packing cut, but the competitiveness claim is still unverified.","tokens_in":2485,"tokens_out":410,"would_cite":false,"duration_ms":29570,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Two-party gradient boosting decision trees can be trained on vertically partitioned data while hiding shared record identifiers.","keywords":["anonymous gradient boosting","two-party computation","secure machine learning","circuit private set intersection","gradient boosted decision trees","vertically partitioned data","homomorphic encryption","oblivious programmable pseudorandom function"],"falsifier":"An implementation in which total communication or runtime grows linearly with the size of the ID domain, or in which the parties can still determine which records they share, would show the claimed avoidance of domain-size cost has not been achieved.","tokens_in":2686,"feed_emoji":"🔒","tokens_out":745,"duration_ms":26817,"temperature":0.7,"pith_summary":"The paper develops a protocol for training gradient-boosted decision trees across two parties that each hold different features of the same records, without revealing which records the parties share. It replaces standard private set intersection with an alternating dual circuit-PSI construction that uses oblivious programmable pseudorandom functions to carry state between rounds, thereby avoiding full alignment over the entire ID domain. The protocol also halves the ciphertext-packing overhead previously required when converting single-instruction multiple-data operations under ring learning-with-errors encryption. Experiments indicate the resulting scheme stays competitive in runtime and communication with earlier approaches that leak the intersection. The same ID-hiding aggregation technique is presented as reusable for other vertically partitioned analytics tasks.","feed_headline":"Two-party GBDT training hides shared record IDs","feed_subtitle":"Dual circuit-PSI with state propagation and halved packing cost keeps the protocol competitive with leaky baselines.","key_machinery":"Alternating dual circuit-PSI with OPPRF state propagation, which lets each party run pick-then-sum locally and carries intersection-derived state forward without domain-size alignment.","core_discovery":"By letting the two parties alternate as receiver in successive circuit-PSI instances and propagating the outputs as shared state through oblivious programmable pseudorandom functions, the protocol performs the necessary pick-then-sum operations over local features without ever materializing a universal record alignment whose cost would scale with domain size; the same design halves the cost of the ciphertext packing step used in prior secure GBDT work, yielding an end-to-end protocol that remains competitive with leaky baselines while hiding which records are shared.","pith_inferences":["The alternating-receiver pattern may generalize to multi-party settings where more than two data owners must hide their intersections.","The state-propagation technique could be tested on other decision-tree variants or on gradient-boosted models with different splitting criteria.","If the OPPRF component can be replaced by a lighter primitive, the protocol's concrete cost could drop further on datasets with very large ID domains."],"forward_implications":["The same ID-hiding aggregation can be applied to other vertically partitioned analytics beyond GBDT.","Secure GBDT training becomes feasible in settings such as finance and healthcare where revealing shared record identifiers is undesirable.","The halved ciphertext-packing technique reduces overhead in any prior secure machine-learning computation that relied on the earlier packing method.","Avoiding universal alignment removes the need for parties to agree on a common ID space in advance."],"fun_headline_variants":["Dual circuit-PSI hides shared IDs in two-party GBDT","Alternating circuit-PSI propagates state for anonymous GBDT","ID-hiding GBDT training sidesteps full record alignment cost","Two-party anonymous GBDT halves packing while hiding IDs"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"The design assumes that alternating dual circuit-PSI with OPPRF state propagation can be realized without introducing new leakage or prohibitive overhead that scales with domain size, and that the halved ciphertext packing cost translates to end-to-end gains under the concrete parameter choices used in the experiments.","fun_headline_variants_meta":{"raw":{"variants":["Dual circuit-PSI hides shared IDs in two-party GBDT","Alternating circuit-PSI propagates state for anonymous GBDT","ID-hiding GBDT training sidesteps full record alignment cost","Two-party anonymous GBDT halves packing while hiding IDs"]},"model":"grok-4.3","cost_usd":0.003617,"raw_usage":{"total_tokens":1921,"prompt_tokens":733,"num_sources_used":0,"completion_tokens":70,"cost_in_usd_ticks":36174500,"prompt_tokens_details":{"text_tokens":733,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":1118,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":733,"tokens_out":70,"duration_ms":14887,"temperature":1.0,"reasoning_tokens":1118,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-29T16:43:39.699742+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"An implementation in which total communication or runtime grows linearly with the size of the ID domain, or in which the parties can still determine which records they share, would show the claimed avoidance of domain-size cost has not been achieved.","supporting_citations":[],"review_version":1}