{"id":"a1234edd-e0ac-4a83-942f-da4737bb9298","arxiv_id":"2607.06612","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Multi-server multi-key FHE with a shared random mask lets PRoVeFL run complex Byzantine-robust FL aggregation privately and verifiably, with large reported speedups over Prio and ELSA.","lead":"PRoVeFL is a multi-server federated learning system that keeps client model updates private with multi-key homomorphic encryption, filters poisoned updates with standard robust rules, and lets peers check that aggregation was done correctly. It matters because it claims large speedups over prior private-robust systems while supporting richer defenses than simple norm clipping.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.5","headline":"Post-decryption privacy (Thm 2) fails for the core primitives: masked statistics from PSE/SCO leak directions, pairwise geometries and (via public u0 or e_i) permit algebraic recovery of client updates, so the hybrid model does not deliver the claimed privacy for Krum/Trimmed-Mean/FLTrust.","rationale":"The reader correctly isolates the one-honest-server + mask-secrecy assumption as delicate, but the deeper load-bearing failure is already present even when that assumption holds: the masked statistics that the hybrid design deliberately decrypts are information-theoretically rich for every non-linear robust rule the paper claims to support. The security proof of Thm 2 contains an internal contradiction (H1 both depends on the secrets and is claimed to be independent of them) and the concrete leakage for FLTrust/Krum/Trimmed-Mean is immediate from the published equations. Because the strongest claim is the simultaneous achievement of strong privacy, complex robustness and verifiability, a break in privacy for the flagship instantiations collapses the claim. Efficiency numbers for the simple L∞ baseline remain interesting engineering, but they do not rescue the privacy argument that the abstract and Table 1 advertise. Hence the verdict moves from CONDITIONAL to REJECT; independent re-execution of the SEAL code would be valuable but is secondary to the analytic gap.","tokens_in":27303,"tokens_out":822,"duration_ms":161332,"concrete_test":"Instantiate the FLTrust flow of Fig 6 on a toy instance (n=3 clients, dimension 4, public u_0 with no zero entries, random r in a small prime field, SEAL/CKKS encoding of the same values). After collaborative decryption of the d_i and e_i, algebraically recover each u_i from (d_i ./ u_0) and the product ∥d_i ./ u_0∥·e_i; if the recovered vectors match the originals to machine precision, Thm 2 and the privacy claim are false for the very scheme the paper highlights.","verdict_should_be":"REJECT","load_bearing_attack":"The central claim requires that collaborative decryption of masked intermediates Enc(r·s_ik) reveals nothing usable about individual u_i (beyond the masked values themselves) while still permitting correct plaintext selection/filtering. Thm 2 asserts that the post-decryption view {d_i} is indistinguishable from uniform and therefore independent of the plaintexts. The hybrid argument does not establish this: H1 is defined as d'_i = f(r',s_i) (which still depends on the secret updates/distances/inner-products) yet the proof text then claims the simulator can output independent random vectors without knowing any client secret. The two statements contradict. Concretely, for FLTrust (Fig 6) the decrypted vectors satisfy d_i = r·(u_i ⊙ u_0) and e_i = r/∥u_i∥; any server recovers the direction of each u_i immediately (ratios of coordinates) and, when e_i is also opened, computes r² = ∥r u_i∥·e_i and therefore the full u_i. For Trimmed-Mean the full set of decrypted coordinate-wise differences d_ij = r·(u_i-u_j) likewise determines every update up to a single global scale and translation; for Krum the scaled distance matrix determines the configuration up to isometry and scale. In all three cases the “masked” view already constitutes a substantial leakage of the client updates, contradicting both the theorem statement and the privacy guarantee of §3.1.1. Opening r later to unmask a final selected or averaged model only makes the leakage total. The additive blinding δ of §4.2.5 does not remove the algebraic relations.","agreement_with_reader":"partial"},"referee_report":{"model":"grok-4.5","summary":"PRoVeFL is a multi-server federated-learning framework that aims to provide client-update privacy (via multi-key CKKS-style FHE under an at-least-one-honest-server assumption), Byzantine-robust aggregation for complex rules (Krum, Trimmed Mean, FLTrust, MESAS, etc.), and peer-server verifiability of the aggregation steps via discrete-log commitments. Clients encrypt masked shares under a jointly generated multiplicative mask Enc(r); servers perform method-specific homomorphic operations, collaboratively decrypt only the masked intermediate statistics, verify them against client commitments, and finish selection/filtering in the plaintext domain. Empirical evaluation reports large speed-ups versus Prio and ELSA under a relaxed L∞ defense and shows that the robust rules retain accuracy under Trim and Backdoor attacks when run inside the encrypted pipeline.","tokens_in":27721,"tokens_out":1254,"duration_ms":13189,"significance":"If the privacy, robustness and verifiability claims hold simultaneously, the work would be a useful systems contribution: it is one of the few frameworks that supports non-trivial Byzantine rules (pairwise distances, coordinate-wise sorting, cosine similarity) rather than only norm clipping, while remaining faster than prior distributed-trust baselines. The modular primitive set (LA/PSE/SCO/SF), the concrete instantiations (Figs. 4–6, A.10), the SEAL implementation, and the runtime/communication tables are concrete engineering assets. The security reductions to Ring-LWE and DLP (Theorems 1–3) are the right style of argument for this literature, even if their statements need tightening.","major_comments":[{"comment":"Theorem 2 (Appendix C) and the privacy claim of §3.1.1 are not established for the core primitives. The hybrid H1 is defined as d'_i = f(r', s_i) (still a function of the secret updates/distances/inner products) yet the proof text asserts that the simulator can output independent random vectors without knowing any client secret; the two statements contradict. Concretely, for FLTrust (Fig. 6) the opened vectors satisfy d_i = r·(u_i ⊙ u_0) and e_i = r/∥u_i∥, so any server recovers the direction of each u_i and, when e_i is also opened, recovers r and therefore the full u_i. For Trimmed-Mean the full set of coordinate-wise differences d_ij = r·(u_i-u_j) determines every update up to global scale and translation; for Krum the scaled distance matrix determines the configuration up to isometry and scale. The additive blinding δ of §4.2.5 does not close these algebraic channels. The claimed pos","section":null},{"comment":"The experimental comparison in Tables 3–4 is restricted to a relaxed L∞ / norm-clipping defense because ELSA and Prio do not support Krum/Trimmed-Mean/FLTrust. The headline 100\times/10\times speed-ups therefore do not apply to the complex rules that constitute the paper's main algorithmic contribution. Either the complex rules must be benchmarked against the closest available secure baselines (or against a pure-FHE baseline), or the abstract and §6.2.3 claims must be restated so that they match the evaluated defense.","section":null},{"comment":"The threat model (§3.1) and the strengthened collusion discussion (§4.2.5) assume that at least one server remains honest and will abort on failed checks, yet the final selected or averaged model is eventually unmasked for the clients. Once r is effectively known (or once a selected plaintext update is published), earlier masked intermediates become fully recoverable. The manuscript never states what is revealed to clients at the end of a round, nor how the final global model is protected from the same algebraic recovery that already works on the intermediate view. This gap must be closed for the privacy guarantee to be well-defined.","section":null}],"minor_comments":[{"comment":"Table 1 marks PRoVeFL with ✓✓ for robustness coverage; the footnote is helpful but the table itself should list which concrete rules are actually implemented and evaluated.","section":null},{"comment":"Figures 7–8 and the runtime-breakdown plots (D.11–D.12) would be clearer with error bars or min/max ranges; the text only says “averaged over 5 runs.”","section":null},{"comment":"Notation for the split dimension N/m versus the full dimension N is overloaded in several places (e.g., FLTrust trust-score formula); a short notation table would help.","section":null},{"comment":"The polynomial-modulus degree is fixed at 32768; a short sensitivity note on packing efficiency versus security level would strengthen the systems claims.","section":null},{"comment":"A few typos remain (e.g., “analsze” in §6.1.2, “The trimmed-mean” capitalization in §4.4.2).","section":null}],"recommendation":"major_revision","confidential_remarks":"The privacy gap identified by the stress-test is real and load-bearing; I would not accept the paper until Theorems 2–3 and the threat-model statement are rewritten so that they accurately describe what is (and is not) revealed by the opened masked statistics. The engineering contribution is still valuable if the claims are scoped correctly, so major revision rather than reject is appropriate. Fit for a systems/security venue is good once the security statements match the construction."},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"The new piece is a modular multi-server pipeline that uses multi-key CKKS plus a shared multiplicative mask so that comparison-heavy Byzantine rules (Krum, Trimmed Mean, FLTrust, MESAS) can be finished in the clear after threshold decryption of masked intermediates, with peer commitment checks for verifiability under a one-honest-server model. That combination is not present in ELSA, Prio, MUDGUARD or the pure MK-CKKS FL papers, and the engineering is concrete: SEAL code, packing aligned to the modulus degree, Batcher networks for sorting, and clear runtime breakdowns that show the plaintext offload actually saves time.\n\nWhat works: the modularity is real. Instantiations are spelled out with verification equations, accuracy under Trim/Backdoor stays close to plaintext, and the reported speedups versus Prio/ELSA (and RoFL) under comparable distributed trust look large and useful for anyone who already accepts multi-server FL. Client cost stays low; server cost scales with more servers. The security reductions to RLWE + DLP are standard and the circularity burden is low.\n\nThe soft spot is not minor. Theorem 2 claims the post-decryption view of the masked statistics is indistinguishable from uniform and independent of the plaintexts. The hybrid argument is inconsistent (H1 still depends on the secret distances/inner products, yet the text says the simulator can emit independent random vectors). Concretely, for FLTrust the opened d_i = r·(u_i ⊙ u_0) plus e_i immediately give directions and, with the norm, full recovery of each u_i. For Trimmed Mean the full set of coordinate-wise differences determines the updates up to scale/translation; for Krum the scaled distance matrix leaks geometry. Additive blinding δ does not erase those algebraic relations. So the hybrid model does not deliver the privacy guarantee claimed in §3.1.1 for the rules the paper emphasizes. The one-honest-server abort model is also strong, and pairwise costs remain quadratic.\n\nThis is for people building secure multi-server FL who already live with distributed trust and want complex robust rules rather than pure norm clipping. The systems contribution and numbers are worth a serious referee; the privacy theorem needs to be fixed or the claim narrowed before anyone should rely on it. I would send it to review.","headline":"Useful multi-server hybrid for complex robust FL rules with real speedups, but the post-decryption privacy claim does not hold for the core primitives.","tokens_in":28397,"tokens_out":565,"would_cite":true,"duration_ms":7800,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.5","headline":"PRoVeFL lets federated learning keep client updates private, filter poisoned ones with complex robust rules, and verify the server did the aggregation correctly, all under multi-server multi-key encryption that is far faster than prior dist","keywords":["federated learning","Byzantine-robust aggregation","multi-key homomorphic encryption","verifiable aggregation","privacy-preserving machine learning","secure multi-party computation","poisoning attacks"],"falsifier":"Run the same Krum or Trimmed-Mean aggregation both in the clear and inside PRoVeFL on identical poisoned updates; if the selected global model or the set of filtered clients differs, or if an honest server accepts a forged aggregate that fails the commitment check, the central claim fails.","tokens_in":28141,"feed_emoji":"🔒","tokens_out":936,"duration_ms":16572,"temperature":0.7,"pith_summary":"Federated learning usually forces a painful choice: hide client updates from the server, or detect and remove poisoned updates, or let clients check that the server aggregated honestly. Existing secure systems either support only crude filters such as norm clipping, leak information, or become impractically slow because almost everything must stay encrypted. PRoVeFL claims that a small set of servers holding shares of a multi-key fully homomorphic encryption key, plus a jointly sampled random multiplicative mask, can break the trade-off. Clients send encrypted shares of their updates; servers perform the heavy statistical work of rules such as Krum, Trimmed Mean or FLTrust partly in the clear on masked values, then reassemble a correct global model that any honest server can cryptographically vouch for. The result is a modular framework that is private against all-but-one colluding servers, robust against malicious clients, and verifiable, while running up to two orders of magnitude faster than the closest prior systems that offer comparable distributed-trust guarantees.","feed_headline":"Private FL that filters poisoned updates and proves the server played fair","feed_subtitle":"Multi-server encryption plus a secret mask lets complex robust rules run mostly in the clear, up to 100x faster than prior systems.","key_machinery":"The jointly generated encrypted random mask Enc(r) that each client multiplies into its update shares; after threshold decryption only the masked intermediate statistics appear, preserving order and relative magnitudes so that sorting, selection and scoring steps of Krum, Trimmed Mean, FLTrust or MESAS can finish in the clear.","core_discovery":"A multi-server architecture using multi-key fully homomorphic encryption, combined with a secret random multiplicative mask that servers apply to client updates before collaborative decryption, lets complex Byzantine-robust aggregation rules be evaluated largely in the plaintext domain without revealing the underlying updates, while commitment checks give every honest server a way to abort if any other server cheats.","pith_inferences":["The same mask-plus-threshold-decryption pattern could be applied to other distributed statistics beyond federated learning, such as secure median or top-k selection in multi-party analytics.","If the additive blinding layer is strengthened further, the protocol might tolerate a larger fraction of colluding clients without changing the server-side primitives.","The modular design suggests a practical path for vendors who already run multi-party secure aggregation to swap in richer robust rules without rewriting the entire stack."],"forward_implications":["Complex robust aggregators that previously required cleartext updates can now be used inside privacy-preserving federated learning without redesigning their statistical logic.","Clients need only trust that at least one of a small number of servers is honest; they no longer need a single trusted aggregator or expensive zero-knowledge proofs for every coordinate.","Communication and computation scale with the number of servers rather than forcing every client into heavy multi-party computation, making larger participant pools practical.","The same hybrid mask-and-decrypt pattern can be reused for any aggregation rule whose decisions depend only on order, sign or relative magnitude of masked statistics."],"fun_headline_variants":["Multi-server FHE lets robust FL rules run mostly in cleartext privately","Secret mask plus multi-key encryption verifies fair aggregation in FL","Encrypted shares enable Byzantine-robust private FL with one honest server","PRoVeFL offloads complex stats to plaintext while proving no server cheat","Clients distribute masked updates for private verifiable robust aggregation"],"cache_read_input_tokens":0,"weakest_assumption_plain":"Security collapses if every server is dishonest or if the jointly sampled mask becomes known to a coalition of clients and the remaining servers, because the masked intermediate values would then unmask honest clients' updates.","fun_headline_variants_meta":{"raw":{"variants":["Multi-server FHE lets robust FL rules run mostly in cleartext privately","Secret mask plus multi-key encryption verifies fair aggregation in FL","Encrypted shares enable Byzantine-robust private FL with one honest server","PRoVeFL offloads complex stats to plaintext while proving no server cheat","Clients distribute masked updates for private verifiable robust aggregation"]},"model":"grok-4.5","effort":"low","cost_usd":0.004996,"raw_usage":{"total_tokens":1434,"prompt_tokens":854,"num_sources_used":0,"completion_tokens":73,"cost_in_usd_ticks":49960000,"prompt_tokens_details":{"text_tokens":854,"audio_tokens":0,"image_tokens":0,"cached_tokens":128},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":507,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":854,"tokens_out":73,"duration_ms":6722,"temperature":1.0,"reasoning_tokens":507,"cache_read_input_tokens":128,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-11T01:47:38.127307+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"Run the same Krum or Trimmed-Mean aggregation both in the clear and inside PRoVeFL on identical poisoned updates; if the selected global model or the set of filtered clients differs, or if an honest server accepts a forged aggregate that fails the commitment check, the central claim fails.","supporting_citations":[],"review_version":1}