{"id":"d6caec15-04dc-4973-aaa7-a3a6f6f21581","arxiv_id":"2607.21136","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":7,"one_line_summary":"An explicit MPC controller is replaced by a polynomial, encrypted with BFV homomorphic encryption, and run on a lab device; the demo works, but the claimed stability guarantee relies on an invalid error bound.","lead":"This paper shows a cloud computer evaluating a model-predictive controller on encrypted data—using a polynomial stand-in for the controller so the cloud never sees the sensor values or the control law. The approach is tested on a small lab device, but the stability proof has a gap: it assumes the encryption's rounding error is only an added disturbance, which the equations do not support.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Lemma 1's key identity (14a) is false: evaluating the PWA/polynomial law on quantized state x̂ changes u by F_i q_x plus state-dependent terms, not just q_u; reported S2 numbers already show a 6.5× discrepancy.","rationale":"The reader's weakest assumption is exactly the load-bearing failure: Lemma 1's Eq. (14a) conflates the effect of evaluating the control law on a quantized state with the additive input quantization error q_u. The robust MPC and the polynomial stabilization tube in Section 3.2 are synthesized for the true state x; they provide no certificate for the perturbed input μ(x+q_x). Since the paper's headline claims—stability, recursive feasibility, and close-to-optimal encrypted control—all route through Lemma 1 and Corollary 1, this is not a minor technical gap but an invalid central guarantee. The reported experimental numbers already provide a simple quantitative contradiction: for the implemented polynomial controller and Setup S2, the first-order state-quantization contribution to the control error is about 6.5 times the reported q_u, so Eq. (14a) cannot hold even approximately. I see no independent support that rescues the theoretical claim; the experimental timing results are plausible but do not validate the stability certificate. Therefore the reader's reject verdict should stand unchanged.","tokens_in":14041,"tokens_out":6649,"duration_ms":57755,"concrete_test":"Reconstruct the Section 4 robust explicit MPC (system (25), |x|≤4, |u|≤1, N=10, Qx=10, Qu=1, disturbance bound 0.05) and compute each region gain F_i. Then simulate x_{t+1}=A x_t + B μ(x_t+q_{x,t}) + D d_t over a fine grid of q_x in [−10^{−θx}/2,10^{−θx}/2] and d∈D, checking x∈X, u∈U, and L(x_{t+1})≤γL(x_t). If any feasible (x,q_x) leaves the tube, Eq. (14a) is refuted. A decisive first check: with α from (31) and reported S2 qx=1.7e-4, qu=0.6e-4, the first-order term −2.311 qx gives |eμ(x+qx)−eμ(x)|≈3.9e-4, roughly 6.5×qu; if this exceeds the W-allowance, the robust design did not cover the implemented controller.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central stability/recursive-feasibility claim rests on Definition 1 and Lemma 1: all encrypted evaluation error is represented as an additive disturbance w∈W=[D A B]. The proof of Lemma 1 asserts in Eq. (14a) that ∥μ̂(x̂)−μ(x)∥∞=∥q_u∥∞. This is not derived and is false in general. If x and x̂=x+q_x lie in the same region R_i, μ̂(x̂)−μ(x)=F_i q_x; if they fall in different regions, the difference is F_i x̂+g_i−F_j x−g_j, which is state-dependent and region-dependent. For the polynomial controller actually implemented, (15) with α from (31) gives eμ(x+q_x)−eμ(x)=−2.311 q_x + 0.0098[(x+q_x)^2−x^2]+⋯, so the first-order term alone is −2.311 q_x. For Setup S2, q_x=1.7×10^-4 yields |eμ(x+q_x)−eμ(x)|≈3.9×10^-4, about 6.5× larger than the reported q_u=0.6×10^-4. Thus the robust MPC was not designed against the true state-quantization-induced control perturbation; the tube/LP in Section 3.2 verifies eμ(x), not eμ(x̂). Lemma 1 and Corollary 1 therefore do not establish closed-loop stability or recursive feasibility for the encrypted loop.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes an encrypted MPC architecture: design a robust explicit MPC for an LTI system with additive uncertainty, approximate its PWA control law by a polynomial, encrypt the polynomial coefficients with the BFV fully homomorphic encryption scheme, evaluate the polynomial on encrypted state measurements in the cloud, and claim closed-loop stability, recursive feasibility, and data/controller privacy. The experimental implementation on the Flexy2.0 laboratory device is used to demonstrate the practicality of the encrypted evaluation pipeline. The central theoretical claim is that the quantization errors introduced by the encryption encoding can be represented as an additive disturbance in the prediction model, and that evaluating the control law on a quantized state changes the control input exactly by the input quantization error q_u.","tokens_in":14575,"tokens_out":6059,"duration_ms":59291,"significance":"If the proof were sound, the contribution would be meaningful: it would combine fully homomorphic encryption with polynomial approximation of explicit MPC, avoiding both online optimization and the point-location problem, while ostensibly preserving robust stability and recursive feasibility. The paper builds on established tools, namely Borrelli et al. [28] for robust explicit MPC and Kvasnica et al. [31] for stabilizing polynomial approximation, and reports concrete experimental timings and quantization levels, which are useful engineering data points. However, the central equivalence on which the stability guarantee rests is incorrect, so the claimed closed-loop guarantee is not established; the experimental sections do not compensate for this theoretical gap.","major_comments":[{"comment":"Equation (14a) asserts that ||μ̂(x̂) − μ(x)||∞ = ||q_u||∞ 'by design'. This is false. For x̂ = x + q_x, if x and x̂ lie in the same region R_i, then μ̂(x̂) − μ(x) = F_i q_x. If they lie in different regions R_i and R_j, the difference is (F_i x̂ + g_i) − (F_j x + g_j), which is state- and region-dependent. The equality is not a design property but a substantive assumption that is generally violated. Since Lemma 1 is the basis for Corollary 1, the closed-loop stability and recursive-feasibility claim for the encrypted loop is unsupported.","section":"Lemma 1, Eq. (14a)"},{"comment":"The disturbance model uses W = [D A B], so the prediction model (6)/(13) only accounts for A q_x + B q_u plus the process disturbance. The actual closed-loop with the quantized controller is A(x + q_x) + B μ̂(x̂) = A x + B μ(x) + B(μ̂(x̂) − μ(x)) + A q_x. The term B(μ̂(x̂) − μ(x)) is not included in W unless μ̂(x̂) − μ(x) = q_u, which is false. For the polynomial controller (15) used in Section 4, μ̂(x̂) − μ(x) has a first-order term α_1 q_x with α_1 = −2.311 from (31), plus higher-order state-dependent terms. The robust MPC (8) therefore does not cover the actual encryption-induced control perturbation.","section":"Definition 1 and Section 3.1, Eqs. (6)/(13)"},{"comment":"The stabilizing-polynomial argument in Corollary 1 inherits the gap. Lemma 3.5 of [31], cited in Proof 2, applies to eμ(x), i.e., evaluation on the exact state; the stabilizing tube LP (22) is constructed with the exact state x and eμ(x), as seen in Eqs. (19)–(20). No condition in (22) enforces a property of eμ(x̂) for x̂ = x + q_x with q_x ≠ 0. Thus even if the polynomial approximation is stabilizing for exact states, the proof does not extend to the encrypted implementation.","section":"Corollary 1 and Section 3.2, Eq. (22)"},{"comment":"The reported experiments do not validate the robust stability/feasibility claim. The S2 setup reports q_x = 1.7·10^-4 and q_u = 0.6·10^-4. The first-order state-quantization-induced control error is |α_1 q_x| ≈ 3.9·10^-4, about 6.5 times larger than q_u. The tube and the robust MPC were designed against the smaller disturbance set, so the experimental runs at S2 do not exercise the actual worst-case perturbation. Finite disturbance-rejection trajectories at two precision settings cannot substitute for the missing invariance argument.","section":"Section 4.3, Eq. (31) and Table 1"}],"minor_comments":[{"comment":"In line 6, the variable x_{I,k} should be u_{I,k} or a similar control-input symbol; the step decrypts and decodes the control input, not the state.","section":"Algorithm 1, line 6"},{"comment":"The quantization definition is written as m_I = (m·10^θ) without an explicit rounding/floor operation. Please state precisely which rounding is used and how overflow beyond the plaintext modulus is avoided.","section":"Eq. (4)"},{"comment":"References [36] and [37] are identical. Please correct the duplicate or point to the intended source.","section":"References"},{"comment":"There are minor typographical errors: 'n the objective function' on page 11 and 'empathized' on page 9 should read 'In the objective function' and 'emphasized'.","section":"Section 3.1 and 3.2"},{"comment":"The reported suboptimality of 56% for eμ relative to μ is large; the abstract/conclusion describe the result as 'close-to-optimal'. Please clarify the metric and discuss whether this level of suboptimality is consistent with the claimed closeness.","section":"Section 4.3"}],"recommendation":"reject","confidential_remarks":"I concur with the reader's rejection. The central identity in Lemma 1 is not a minor gap but a false statement, and the disturbance model W = [D A B] does not account for the actual state-quantization-induced control error. Repairing this would require reworking the robust synthesis to include B(μ̂(x̂) − μ(x)) in the disturbance set, re-solving the tube LP, and re-running the experiments. That is beyond a revision of the present manuscript; a resubmission with a corrected theoretical framework could be considered."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe demo is real and worth knowing about: this is a legitimate laboratory implementation of a polynomial approximation of explicit MPC evaluated under BFV fully homomorphic encryption, with per-step times around 3–6 ms against a 10 ms sampling period. Combining the Kvasnica–Löfberg–Fikar stabilizing polynomial approach with FHE is a sensible way to dodge the point-location problem in encrypted explicit MPC, and the authors report enough parameters (N=4096, plaintext moduli, precision degrees) to reproduce the setup. The experimental section is the strongest part of the paper.\n\nThe soft spot is load-bearing, though. Lemma 1 asserts (14a): ||μ̂(x̂) − μ(x)||∞ = ||q_u||∞, “by design.” That is not derived, and it is not true. If x̂ = x + q_x lies in the same region, the control difference is F_i q_x, not q_u; across a region boundary it is state-dependent. For the polynomial actually implemented, α₁ = −2.311, so with S2’s q_x = 1.7×10⁻⁴ the control perturbation from state quantization is roughly 3.9×10⁻⁴, about 6.5× larger than the reported q_u = 0.6×10⁻⁴. The W = [D A B] model in (13) accounts for A q_x in the dynamics, but not for the fact that the controller evaluates eμ(x̂), not eμ(x). The tube/LP in Section 3.2 therefore verifies eμ(x), and Corollary 1 inherits the gap. As written, the stability and recursive-feasibility guarantee for the encrypted loop is not established.\n\nThere is also a wording problem: the conclusion calls the result “close-to-optimal,” while the paper’s own simulation reports 56% suboptimality against the explicit MPC cost. That is an overstatement.\n\nThe approach is still promising, and the experiment is credible. What is missing is a correct error analysis that either folds the state-quantization-induced control error into the disturbance set or proves a proper bound for eμ(x+q_x) − eμ(x) and designs the tube against it. I would send this to peer review because the experimental contribution deserves airing after a major revision, but I would not accept it as is.\n\nRecommendation: major revision, with the stability proof redone and the optimality claim toned down.","headline":"Real hardware demo of encrypted polynomial MPC, but the central stability proof collapses on a false error bound.","tokens_in":14997,"tokens_out":2312,"would_cite":false,"duration_ms":49257,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that model predictive control can be encrypted end-to-end—states and controller coefficients stay secret on an untrusted cloud—by evaluating a stabilizing polynomial proxy of the explicit MPC law under fully homomorphic enc","keywords":["encrypted control","homomorphic encryption","BFV cryptosystem","explicit model predictive control","polynomial approximation","robust MPC","recursive feasibility","quantization"],"falsifier":"Take the reported controller α=[0, −2.3110, 0.0098, 0.00078], state bounds |x|≤4, and a precision θx matching the experiment. For each x∈[−4,4], compute the worst-case evaluation error eµ(x̂)−eµ(x) with x̂=x+qx for qx at the claimed quantization level, and compare it with the disturbance bound max|Ww|≤0.05 used in the design. If at any x the true error exceeds that bound, or if a simulation of the closed loop with that state-dependent error leaves the feasible tube T(L,γ), the paper's stability guarantee fails for those settings. The same check can be run for larger polynomial degrees or tight","tokens_in":13984,"feed_emoji":"🔐","tokens_out":10089,"duration_ms":93346,"temperature":0.7,"pith_summary":"Encrypted control has been stuck between two compromises: partially homomorphic schemes force the controller or the data to stay public, and encrypted implicit MPC requires an online optimizer or a second trusted machine. This paper tries to break that by outsourcing the controller as a low-degree polynomial—a certified stand-in for the explicit MPC law—evaluated with a fully homomorphic encryption scheme that supports both addition and multiplication on ciphertexts. The trick is to fold the inevitable quantization error of the encryption step into the MPC prediction model as an additive disturbance, so the robust formulation already covers the damage the encryption does. A laboratory experiment on a fan/flex-resistor plant runs the loop at a 10 ms sampling period, with per-evaluation times around 3 ms, and the paper reports that stability and recursive feasibility are preserved by construction. If the claim stands, any third-party platform can safely evaluate a constrained, optimal-ish control law without ever learning the process measurements or the controller's coefficients.","feed_headline":"Encrypted MPC runs in the cloud without exposing the plant","feed_subtitle":"A polynomial proxy keeps stability and constraints intact while the cloud never sees states or controller gains.","key_machinery":"The mechanisms are three. The identity that converts the cryptographic nuisance into a design handle is the exact rewrite of the quantized closed loop as an LTI system plus additive disturbance: f(·)=Ax+Bu+W w(t), w=(d,qx,qu), W=[D A B]; rounding errors enter the robust MPC prediction model as a bounded set, so the standard robust-feasibility argument applies. The second is the stabilizing polynomial approximation: coefficients α come from a stability-tube LP on a PWA Lyapunov function with Pólya multipliers, so the cloud avoids the explicit-MPC point-location problem and online optimization entirely. The third is the BFV fully homomorphic scheme, which supports homomorphic addition and mult","core_discovery":"The paper's central claim is that a constrained model predictive controller can be fully outsourced to an untrusted cloud over encrypted channels without sacrificing closed-loop guarantees. The construction replaces the explicit piecewise-affine MPC law with a certified stabilizing polynomial eµ(x) = Σ α_i x^i, evaluates that polynomial on encrypted, quantized states and encrypted coefficients using the BFV fully homomorphic scheme, and folds the quantization error into the robust MPC's prediction model as an additive disturbance w=(d,qx,qu) with W=[D A B]. Lemma 1 and Corollary 1 argue that the encrypted quantized polynomial controller remains stabilizing and recursively feasible. Experimen","pith_inferences":["Because the polynomial proxy has a fixed degree and fixed coefficients, the same architecture could be applied to nonlinear plants or to non-MPC controllers as long as a stabilizing polynomial can be certified; the paper's formulation is specific to LTI robust MPC, but the trade-off it exploits (a small degree for a large region of certified stability) is general.","The reported degree-3 polynomial has a Lipschitz constant on the order of 2.4 on the state domain, roughly 2.5 times larger than the A=0.966 coefficient that the disturbance model uses for the state-quantization term. A direct check of whether the true evaluation error eµ(x̂)−eµ(x) stays inside the designed disturbance set W would settle whether the guarantee is as tight as the paper suggests.","The cloud still observes the polynomial degree κ and the ciphertext arithmetic pattern, so 'controller privacy' means the coefficients stay hidden while the controller family is revealed; whether that meets industrial secrecy requirements is a threat-model question the paper leaves open.","The numerical results are for a scalar state and scalar input; extending the scalar-product evaluation to multi-input systems would multiply the number of encrypted products, so the reported ~3 ms timing should be read as a lower-bound benchmark rather than a guarantee for higher-dimensional plants."],"forward_implications":["A cloud service can now evaluate a constrained MPC law on encrypted states and encrypted coefficients, so neither process data nor control strategy is exposed, while the closed-loop stability and recursive feasibility of the original robust MPC are preserved by design.","The controller's memory footprint drops from the explicit PWA law's 0.84 kB to a 0.2 kB polynomial, opening room for embedded deployment of encrypted control.","Per-evaluation times around 3.3 to 6.3 ms with BFV parameters N=4096 fit comfortably in the 10 ms sampling period of the reported experiment, evidence that fully homomorphic encrypted control is not too slow for fast laboratory-scale loops.","The design procedure gives a principled recipe for choosing encryption precision (θx, θα, plaintext modulus τ): quantization errors are consumed by the robust MPC's disturbance set, so the closed loop is guaranteed by construction rather than by post-hoc tuning.","The same two-step recipe—explicit robust MPC, then certified polynomial approximation—can be carried out for any LTI plant that satisfies Assumption 1, making the result a template for encrypted constrained control, not a one-off experiment."],"fun_headline_variants":["Polynomial proxy lets encrypted MPC run on untrusted cloud","Stable encrypted MPC outsourced to cloud via polynomial fit","Encrypted MPC keeps constraints stable with polynomial proxy","Cloud sees ciphertext only as encrypted MPC stays feasible","Secure MPC: polynomial homomorphic eval preserves stability"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is that every error introduced by encryption and quantization is representable as a bounded additive disturbance inside the robust MPC's prediction model—in particular, that evaluating the polynomial on the quantized state produces a control-input error q_u that stays inside the pre-designed set Q_u, for every feasible state x. If the actual error is state-dependent (as polynomial powers make it) and escapes those bounds, the stability and recursive-f","fun_headline_variants_meta":{"raw":{"variants":["Polynomial proxy lets encrypted MPC run on untrusted cloud","Stable encrypted MPC outsourced to cloud via polynomial fit","Encrypted MPC keeps constraints stable with polynomial proxy","Cloud sees ciphertext only as encrypted MPC stays feasible","Secure MPC: polynomial homomorphic eval preserves stability"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000323,"raw_usage":{"total_tokens":1593,"prompt_tokens":631,"completion_tokens":962,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":375,"completion_tokens_details":{"reasoning_tokens":886}},"tokens_in":375,"tokens_out":962,"duration_ms":7490,"temperature":1.0,"reasoning_tokens":886,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T08:20:55.988235+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take the reported controller α=[0, −2.3110, 0.0098, 0.00078], state bounds |x|≤4, and a precision θx matching the experiment. For each x∈[−4,4], compute the worst-case evaluation error eµ(x̂)−eµ(x) with x̂=x+qx for qx at the claimed quantization level, and compare it with the disturbance bound max|Ww|≤0.05 used in the design. If at any x the true error exceeds that bound, or if a simulation of the closed loop with that state-dependent error leaves the feasible tube T(L,γ), the paper's stability guarantee fails for those settings. The same check can be run for larger polynomial degrees or tight","supporting_citations":[],"review_version":1}