Robust and Verifiable MPC with Applications to Linear Machine Learning Inference

Jimmy Dani; Juan Garay; Nitesh Saxena; Soamar Homsi; Tzu-Shen Wang

REVIEW 4 major objections 5 minor 30 references

Robust and Verifiable MPC with Applications to Linear Machine Learning Inference

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A dishonest-majority MPC protocol can identify every cheating server and still deliver the correct output, by recovering the cheater's share through a semi-honest third party.

desk verdict A plausible STTP-based robustness upgrade to Rivinius et al., but the security analysis has a threshold bug that undercuts the 'up to n-2' claim. read the letter →

arxiv 2506.00518 v1 pith:H62YVIC3 submitted 2025-05-31 cs.CR

Tzu-Shen Wang , Jimmy Dani , Juan Garay , Soamar Homsi , Nitesh Saxena This is my paper

classification cs.CR

keywords multi-partycomputationcompleteidentifiabilityrobustnessdishonestmajoritylattice-basedcommitmenthomomorphicencryptionmachinelearninginferencepublicverifiability

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to build a secure multi-party computation protocol that, even when most participating servers are malicious, does not stop at identifying the cheaters but also finishes the computation correctly. It targets the gap between SPDZ-style protocols, which abort on misbehavior, and costlier identifiable-abort protocols, which detect but cannot continue. The authors claim complete identifiability and robustness with up to n-2 malicious servers out of n, while preserving privacy as long as at least one server is honest. If true, outsourced computation such as machine-learning inference could tolerate cheating servers without restarting, at a moderate performance cost.

What carries the argument

The load-bearing mechanism is the pairing of a commitment-enhanced secret sharing (CESS) share with a BGV homomorphic encryption of the same share: the lattice-based commitments give complete identifiability, the homomorphic ciphertexts give recoverability, and the STTP bridges the two by holding all decryption keys and commitments and arbitrating accusations. Lattice-based commitments keep the protocol efficient because they require only additions and multiplications rather than the costly exponentiations of Pedersen commitments, and BGV ciphertexts are updated alongside the circuit so that a malicious share can be decrypted at the exact layer where it was caught.

What would settle it

Run the protocol with n servers, an honest STTP, and exactly n-2 colluding malicious servers that send inconsistent opened shares; the theorem predicts the STTP's commitment checks will identify all of them and the surviving honest servers will still output the correct value. If the output is wrong, or if any honest party disagrees about the cheaters' identities, the central claim is false.

Watch

Extended reading notes

Core claim

The protocol upgrades the completely-identifiable-abort approach of commitment-enhanced secret sharing into a robust protocol by adding a semi-honest trusted third party (STTP) that holds every server's share commitment and the decryption keys for all homomorphically encrypted shares. When a server is caught cheating, the STTP broadcasts that server's decryption key, the honest servers decrypt the malicious share, verify it against the commitment, and one designated server folds the recovered share into its own, so the computation continues without restart. The paper proves that this protocol realizes the ideal functionality for robust, publicly verifiable MPC with complete identifiability, and it degrades to security with abort only when n-1 servers are corrupt, because exposing n-1 shares would let the last honest server reconstruct the client's input.

Load-bearing premise

The load-bearing premise is that the semi-honest trusted third party is genuinely uncorrupted and honestly arbitrates every accusation, while the client is assumed honest; if the STTP were malicious, it holds all decryption keys and commitments, and both privacy and recovery would collapse.

Editorial extensions

If this is right

A service running this protocol can keep producing correct results even when most of its servers are malicious, so a detected cheater no longer forces a full restart.
All honest parties agree on the identities of every cheating server, and the published commitments let outsiders verify that the recovery was performed correctly.
ML-as-a-service inference over linear models retains the same accuracy as plaintext computation, with 88.33% accuracy on the Wisconsin Breast Cancer dataset and 100% on the Iris subset in the paper's benchmarks, while adding stronger security guarantees.
Recovering from a malicious server adds roughly 0.096 seconds of amortized time in the benchmark, close to the cost of continuing the computation with one fewer server.
The protocol deliberately downgrades to abort only when n-1 servers are malicious, because opening n-1 shares would let the one remaining server reconstruct the client's input.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Our inference: the STTP-assisted recovery pattern could be lifted out of this specific design and applied to any CESS-type protocol whose share commitments are paired with homomorphic encryptions; the paper does not claim this generalization.
Our inference: because the benchmark shows a very high number of communication rounds (1860 for the breast-cancer dataset), batching more inputs per polynomial slot likely reduces per-inference cost more than further ciphertext-level optimization would.
Our inference: the n-2 ceiling looks like a structural consequence of the constraint that the final honest server must never see n-1 shares; a different secret-sharing layout with multiple surviving servers might change that trade-off, but the paper does not explore it.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: the new combination is real—adding a semi-honest third party to the lattice-based CESS protocol to get robustness—but the paper's own simulator contradicts its headline threshold. The proof needs work before the central claim holds.

What's genuinely new: the idea of using an STTP to convert identifiable abort into robustness via homomorphic encryption and share recovery, building on [7]. The benchmarks are concrete and show the recovery overhead (about 0.096s in their setup). The Network-A benchmark is more meaningful than the linear ML part, which is trivially linear for MPC.

The main problem: the threshold. The abstract says 'up to n−2', Section I-A at one point says 'less than n−2', and the simulator in Fig. 6 aborts when Lcheat ≥ n−2. The ideal functionality in Fig. 3, however, only sets OUT=⊥ when |Lcheat| ≥ n−1. So for exactly n−2 identified cheaters, the functionality demands output delivery while the simulator aborts. That's a direct mismatch, and it's not a minor typo—it marks the boundary of the claimed robustness. If the real protocol aborts at n−2, then the guarantee is only for at most n−3 malicious parties, which is weaker than the abstract's headline. The proof sketch in Section III-C doesn't analyze the recovery loop's abort behavior, so the paper doesn't resolve this.

Also, the STTP is a strong assumption: it's honest and semi-honest, cannot be corrupted, and holds decryption keys. That's effectively an honest party in the system, which makes 'dishonest majority' a narrower claim than it sounds. The paper is upfront about it, but it limits the practical applicability. And the ML inference section is mostly linear logistic regression, which is a simple dot product—not a compelling showcase for an MPC protocol.

On the other hand, the paper is honestly written and engages with the prior work (Cunningham et al., Rivinius et al.). The core idea is plausible. The threshold bug looks fixable by either changing the ideal functionality to abort at n−2 (but then the 'robustness for up to n−2' claim becomes false) or by extending the simulator to handle n−2 without abort (which requires a real argument). Either way, the paper needs a serious revision before it's correct.

For you: if you work on robust MPC with trusted setup, it's worth a skim. But I wouldn't cite it in its current form. It deserves a referee—the construction is concrete and the issues are addressable—but my own verdict would be reject pending the threshold fix and a fuller proof.

Referee Report

4 major / 5 minor

Summary. The paper proposes an MPC protocol, Π_RV-MPC, that aims to achieve complete identifiability and robustness (guaranteed output delivery) against a dishonest majority of servers. The protocol builds on the lattice-based commitment approach of Rivinius et al. [7] and adds a semi-honest trusted third party (STTP) that holds all commitments and decryption keys, validates accusations, and enables recovery of malicious servers' shares via homomorphic encryption, so the computation can continue without restart. The paper claims privacy if at least one server is honest, robustness for 'up to n-2' (or 'less than n-2' in the abstract) malicious servers, and benchmarks the protocol on Network-A and on linear ML inference tasks over the Wisconsin Breast Cancer and Iris datasets.

Significance. If the security claims were fully established, the protocol would be a meaningful contribution: it would offer stronger guarantees than SPDZ-style security-with-abort while remaining practical, and it would improve on the efficiency of the identifiable-abort protocol of Cunningham et al. The paper includes experimental evidence on both a neural-network benchmark and linear ML inference, and it explicitly addresses the tradeoff between robustness and the number of malicious servers. However, the significance is conditional on the security proof being completed and on the trust model (an uncorruptible semi-honest STTP) being clearly justified. The main novelty is the STTP-based recovery mechanism, and that mechanism is not rigorously analyzed in the present manuscript.

major comments (4)

[Section III-A and III-C, Fig. 3 and Fig. 6] There is a mismatch between the ideal functionality and the simulator at the claimed corruption threshold. The ideal functionality F^f_CIDA-RV-MPC (Fig. 3) sets OUT = ⊥ only when |Lcheat| >= n-1, so it requires the output to be delivered whenever the number of detected cheaters is at most n-2. The simulator S_RV-MPC (Fig. 6, step 1), however, aborts whenever Lcheat >= n-2. For an execution with exactly n-2 detected malicious parties, the simulator halts while the functionality is required to produce OUT ≠ ⊥. The proof does not reconcile this discrepancy, so Theorem 1 is not established for the 'up to n-2' robustness claim made in Section I-A. The abstract's 'less than n-2' wording is consistent with the simulator, but it contradicts Section I-A and the protocol's stated design goal. This is an internal inconsistency in the security argument, not merely a presentation issue.
[Section III-C, 'Security Proof'] The proof of Theorem 1 is a proof sketch that delegates most of the argument to prior works [5]-[7] and does not analyze the new recovery mechanism. In particular, the simulator in Fig. 6 contains no steps corresponding to the recovery loop in Fig. 5 (steps 2-6), including the STTP's validation of accusations, the iterative elimination of inconsistent shares, and the local updates of commitments and ciphertexts. Since the STTP-based recovery is the paper's central contribution, the claim that Π_RV-MPC realizes F^f_CIDA-RV-MPC requires a direct simulation argument for these steps. The current proof does not show that the real-world recovery process is indistinguishable from the ideal functionality's behavior, especially in the case where multiple servers are detected one after another.
[Sections I-A, II-A, and III-B] The security and robustness guarantees depend on an uncorruptible semi-honest trusted third party (STTP) that holds all decryption keys and all commitments and correctly validates accusations. This is a strong trust assumption that is not reflected in the abstract's wording 'dishonest majority of participants who may behave arbitrarily'. In the proposed model, the STTP is a participant that is assumed not to deviate from the protocol; if the STTP were corrupted, privacy could be broken (it holds decryption keys) and the recovery mechanism would fail. The paper should state the trust model precisely, explain how an STTP that 'can be one of the clients' is compatible with the client being assumed honest, and discuss whether this weakens the claimed dishonest-majority guarantee.
[Section III-B, 'Online phase'] The protocol assumes the client is honest and only provides inputs and receives outputs. In an ML-as-a-service scenario, the client is a separate party whose behavior may not be trustworthy. The paper does not specify what happens if a client submits malformed shares or encryptions, or if the client colludes with some servers. This assumption should be stated as a limitation and, if possible, addressed by a brief argument or by referencing standard techniques for handling malicious input parties.

minor comments (5)

[Abstract] The phrase 'We achieves robustness' is a grammatical error and should read 'We achieve robustness'.
[Section II-B, 'Commitments'] The commitment hiding definition contains a typo: 'non-trival info' should be 'non-trivial info'.
[Section IV-A, Table III caption] The caption 'The three columns from left to right indicate: time of recovery from malicious shares, recovery time plus remaining computation with two parties, and run time if three parties behave honestly' is helpful, but the table body does not label the columns; adding explicit column headers would improve readability.
[Section IV-B, 'Framework design'] Figure 7 includes 'STTP' as a recipient of the output y, but the surrounding text does not explain what role the STTP plays in the ML inference framework after the computation. Please clarify whether the STTP is involved in the online computation or only in the recovery phase.
[Section IV-D, 'Comparative analysis'] The text refers to 'MASCOT* (mama)' without defining 'mama'; this appears to be an informal label from the MP-SPDZ framework and should be defined or removed.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the construction is based on external building blocks and independent benchmarks; the n-2 abort mismatch is a proof gap, not circular reasoning.

full rationale

The protocol's derivation chain does not reduce to its own inputs. Robustness is engineered by adding an STTP that cannot be corrupted and holds decryption keys (Sections I-A and III-B), so the claimed guarantee is a constructed property rather than a renamed benchmark or a fitted value. The security argument is a simulation-style proof that combines techniques from external prior works [5]-[7], none of which are by this paper's authors; thus the delegation to these citations is independent support rather than a self-citation chain. The ML evaluation compares against centralized accuracy and external protocols (SPDZ, MASCOT, SPDZ2k, LowGear), so there is no fitted-parameter-called-prediction pattern. There is, however, a real correctness and proof-completeness gap at the n-2 corruption threshold: F_CIDA-RV-MPC sets OUT to bottom only when |Lcheat| >= n-1 (Fig. 3), while simulator S_RV-MPC aborts already when Lcheat >= n-2 (Fig. 6), and Section III-C only gives a proof sketch that does not analyze the recovery loop's abort behavior. That mismatch undermines Theorem 1 as written, but it is an internal inconsistency in the security argument, not an equivalence between conclusion and premise; therefore it does not raise the circularity score.

Assumptions & free parameters 0 free parameters · 5 assumptions · 1 invented entities

The protocol introduces a single new trust assumption (the STTP) and otherwise relies on standard cryptographic assumptions and the prior construction of [7]. No free parameters are fitted because the contribution is a protocol, not a data-derived model.

assumptions (5)

domain assumption A semi-honest trusted third party (STTP) exists and cannot be corrupted.
The robust recovery mechanism relies on the STTP to hold keys and commitments and to broadcast decryption keys (Section I-A, Section III-B).
domain assumption The client is honest and only provides inputs and receives outputs.
The offline phase assumes 'the client remains honest' (Section III-B).
domain assumption The Fiat-Shamir heuristic is applied in the random oracle model, with a programmable random oracle for simulation.
Used to make Sigma protocols non-interactive and to let the simulator fake proofs (Section II-C, Section III-C).
standard math The lattice-based commitment scheme and BGV encryption are secure under standard hardness assumptions (e.g., RLWE).
The protocol inherits these cryptographic assumptions from [7] and [21].
domain assumption Parties are connected by point-to-point synchronous channels, a PKI, and a bulletin board.
Section II-A states the network model.

invented entities (1)

Semi-honest trusted third party (STTP)
purpose: Holds decryption keys and all commitments; on valid accusation, broadcasts the accused server's decryption key so others can recover its share and continue.
The STTP is a new trust assumption introduced by this work; no independent evidence of its availability or trustworthiness is provided.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Robust and Verifiable MPC with Applications to Linear Machine Learning Inference." pith.science (2026). https://pith.science/paper/H62YVIC3

@misc{pith2026250600518,
  author       = {Pith},
  title        = {Pith review of: Robust and Verifiable MPC with Applications to Linear Machine Learning Inference},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/H62YVIC3}},
  note         = {Machine review of arXiv:2506.00518}
}

read the original abstract

In this work, we present an efficient secure multi-party computation MPC protocol that provides strong security guarantees in settings with dishonest majority of participants who may behave arbitrarily. Unlike the popular MPC implementation known as SPDZ [Crypto '12], which only ensures security with abort, our protocol achieves both complete identifiability and robustness. With complete identifiability, honest parties can detect and unanimously agree on the identity of any malicious party. Robustness allows the protocol to continue with the computation without requiring a restart, even when malicious behavior is detected. Additionally, our approach addresses the performance limitations observed in the protocol by Cunningham et al. [ICITS '17], which, while achieving complete identifiability, is hindered by the costly exponentiation operations required by the choice of commitment scheme. Our protocol is based on the approach by Rivinius et al. [S&P '22], utilizing lattice-based commitment for better efficiency. We achieved robustness with the help of a semi-honest trusted third party. We benchmark our robust protocol, showing the efficient recovery from parties' malicious behavior. Finally, we benchmark our protocol on a ML-as-a-service scenario, wherein clients off-load the desired computation to the servers, and verify the computation result. We benchmark on linear ML inference, running on various datasets. While our efficiency is slightly lower compared to SPDZ's, we offer stronger security properties that provide distinct advantages.

Figures

Figures reproduced from arXiv: 2506.00518 by the authors.

**Figure 2.** Ideal functionality for MPC with completely identifiable abort. Combining the F f CIDA-MPC approach with a “trusted dealer” robustness, can be achieved for a number of corruptions of up to n − 2 parties. For the reason for dissimilar thresholds (i.e., n − 2 vs. n − 1), please refer to I-A. The functionality F f CIDA-RV-MPC for robustness with public verifiability at [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 4.** The protocol’s offline phase. C sends the private homomorphic encryption keys to all STTPs, then distributes share xi to ST T Pi . Each ST T Pi computes the homomorphic encryptions and lattice-based commitments of xi , broadcasts the lattice-based commitments, sends the homomorphic encryptions to all the servers, and delivers each share to the corresponding server. Note that each ST T Pi only gets a single share xi … view at source ↗

Figures from the paper (2 more)

**Figure 5.** Figure 5: Our robust and publicly verifiable MPC protocol (online phase). [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]

**Figure 7.** Figure 7: A Design of ML Inference Framework The linear model is trained on publicly available data, and model parameters comprising weights (w) and biases (b), which are subsequently secret-shared among computation parties involved in MPC protocol. Similarly, inference input d…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

30 extracted references · 29 canonical work pages

[7]

Publicly account- able robust multi-party computation,

M. Rivinius, P. Reisert, D. Rausch, and R. K ¨usters, “Publicly account- able robust multi-party computation,” in 43rd IEEE Symposium on Security and Privacy, SP 2022, San Francisco, CA, USA, May 22-26, 2022, pp. 2430–2449, IEEE, 2022

work page 2022
[5]

Multiparty computation from somewhat homomorphic encryption,

I. Damg ˚ard, V . Pastro, N. P. Smart, and S. Zakarias, “Multiparty computation from somewhat homomorphic encryption,” in Advances in Cryptology - CRYPTO 2012 - 32nd Annual Cryptology Conference, Santa Barbara, CA, USA, August 19-23, 2012. Proceedings (R. Safavi- Naini and R. Canetti, eds.), vol. 7417 of Lecture Notes in Computer Science, pp. 643–662, Spr...

work page 2012
[1]

Protocols for secure computations (extended abstract),

A. C.-C. Yao, “Protocols for secure computations (extended abstract),” in FOCS, pp. 160–164, IEEE Computer Society, 1982

work page 1982
[2]

How to play any mental game or A completeness theorem for protocols with honest majority,

O. Goldreich, S. Micali, and A. Wigderson, “How to play any mental game or A completeness theorem for protocols with honest majority,” in STOC, pp. 218–229, ACM, 1987

work page 1987
[3]

Completeness theorems for non-cryptographic fault-tolerant distributed computation (extended abstract),

M. Ben-Or, S. Goldwasser, and A. Wigderson, “Completeness theorems for non-cryptographic fault-tolerant distributed computation (extended abstract),” in STOC’88, pp. 1–10, 1988

work page 1988
[4]

Multiparty unconditionally secure protocols (abstract),

D. Chaum, C. Cr ´epeau, and I. Damg ˚ard, “Multiparty unconditionally secure protocols (abstract),” in STOC’88, pp. 11–19, 1988

work page 1988
[6]

Catching MPC cheaters: Identification and openability,

R. K. Cunningham, B. Fuller, and S. Yakoubov, “Catching MPC cheaters: Identification and openability,” in Information Theoretic Se- curity - 10th International Conference, ICITS 2017, Hong Kong, China, November 29 - December 2, 2017, Proceedings (J. Shikata, ed.), vol. 10681 of Lecture Notes in Computer Science, pp. 110–134, Springer, 2017

work page 2017
[8]

Secureml: A system for scalable privacy- preserving machine learning,

P. Mohassel and Y . Zhang, “Secureml: A system for scalable privacy- preserving machine learning,” in 2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017 , pp. 19–38, IEEE Computer Society, 2017

work page 2017

Show all 30 references

[9]

MP-SPDZ: A versatile framework for multi-party compu- tation,

M. Keller, “MP-SPDZ: A versatile framework for multi-party compu- tation,” in CCS ’20: 2020 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event, USA, November 9-13, 2020 (J. Ligatti, X. Ou, J. Katz, and G. Vigna, eds.), pp. 1575–1590, ACM, 2020

2020
[10]

Homomorphic evaluation of the AES circuit,

C. Gentry, S. Halevi, and N. P. Smart, “Homomorphic evaluation of the AES circuit,” IACR Cryptol. ePrint Arch. , p. 99, 2012

2012
[11]

Overdrive: Making SPDZ great again,

M. Keller, V . Pastro, and D. Rotaru, “Overdrive: Making SPDZ great again,” IACR Cryptol. ePrint Arch. , p. 1230, 2017

2017
[12]

MASCOT: faster malicious arith- metic secure computation with oblivious transfer,

M. Keller, E. Orsini, and P. Scholl, “MASCOT: faster malicious arith- metic secure computation with oblivious transfer,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, Vienna, Austria, October 24-28, 2016(E. R. Weippl, S. Katzen- beis...

2016
[13]

Multiparty computation with covert security and public verifiability,

P. Scholl, M. Simkin, and L. Siniscalchi, “Multiparty computation with covert security and public verifiability,” IACR Cryptol. ePrint Arch. , p. 366, 2021

2021
[14]

How to generate and exchange secrets (extended abstract),

A. C. Yao, “How to generate and exchange secrets (extended abstract),” in FOCS, (Toronto, Ontario, Canada), pp. 162–167, IEEE, 1986

1986
[15]

Verifiable secret sharing and multiparty protocols with honest majority,

T. Rabin and M. Ben-Or, “Verifiable secret sharing and multiparty protocols with honest majority,” in Proceedings of the Twenty-First Annual ACM Symposium on Theory of Computing , STOC ’89, (New York, NY , USA), p. 73–85, Association for Computing Machinery, 1989

1989
[16]

Efficient multiparty computations secure against an adaptive adversary,

R. Cramer, I. Damg ˚ard, S. Dziembowski, M. Hirt, and T. Rabin, “Efficient multiparty computations secure against an adaptive adversary,” in Proceedings of the 17th International Conference on Theory and Application of Cryptographic Techniques , EUROCRYPT’99, (Berlin, Heidelbe...

1999
[17]

Katz and Y

J. Katz and Y . Lindell, Introduction to Modern Cryptography. Chapman and Hall/CRC Press, 2007

2007
[18]

Proofs of partial knowl- edge and simplified design of witness hiding protocols,

R. Cramer, I. Damg ˚ard, and B. Schoenmakers, “Proofs of partial knowl- edge and simplified design of witness hiding protocols,” in Advances in Cryptology - CRYPTO ’94, 14th Annual International Cryptology Conference, Santa Barbara, California, USA, August 21-25, 1994, Proceed...

1994
[19]

Fiat-shamir with aborts: Applications to lattice and factoring-based signatures,

V . Lyubashevsky, “Fiat-shamir with aborts: Applications to lattice and factoring-based signatures,” in Advances in Cryptology - ASIACRYPT 2009, 15th International Conference on the Theory and Application of Cryptology and Information Security, Tokyo, Japan, December 6- 10, 20...

2009
[20]

Lattice signatures without trapdoors,

V . Lyubashevsky, “Lattice signatures without trapdoors,” in Advances in Cryptology - EUROCRYPT 2012 - 31st Annual International Con- ference on the Theory and Applications of Cryptographic Techniques, Cambridge, UK, April 15-19, 2012. Proceedings (D. Pointcheval and T. Johans...

2012
[21]

(leveled) fully ho- momorphic encryption without bootstrapping,

Z. Brakerski, C. Gentry, and V . Vaikuntanathan, “(leveled) fully ho- momorphic encryption without bootstrapping,” ACM Trans. Comput. Theory, vol. 6, no. 3, pp. 13:1–13:36, 2014

2014
[22]

Universally composable security: A new paradigm for cryptographic protocols,

R. Canetti, “Universally composable security: A new paradigm for cryptographic protocols,” in Cryptology ePrint Archive, Report 2000/067 , December 2005. Latest version at http://eprint.iacr.org/2000/067/

2000
[23]

On ideal lattices and learning with errors over rings,

V . Lyubashevsky, C. Peikert, and O. Regev, “On ideal lattices and learning with errors over rings,” J. ACM, vol. 60, no. 6, pp. 43:1–43:35, 2013. 10

2013
[24]

On the concrete hardness of learning with errors,

M. R. Albrecht, R. Player, and S. Scott, “On the concrete hardness of learning with errors,” J. Math. Cryptol., vol. 9, no. 3, pp. 169–203, 2015

2015
[25]

Mascot: Faster malicious arithmetic secure computation with oblivious transfer,

M. Keller, E. Orsini, and P. Scholl, “Mascot: Faster malicious arithmetic secure computation with oblivious transfer,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security , CCS ’16, (New York, NY , USA), p. 830–842, Association for Computin...

2016
[26]

Spdz2k: Efficient mpc mod 2k for dishonest majority,

R. Cramer, I. Damg ˚ard, D. E. Escudero, P. Scholl, and C. Xing, “Spdz2k: Efficient mpc mod 2k for dishonest majority,” inIACR Cryptology ePrint Archive, 2018

2018
[27]

Overdrive: Making spdz great again,

M. Keller, V . Pastro, and D. Rotaru, “Overdrive: Making spdz great again,” IACR Cryptol. ePrint Arch. , vol. 2017, p. 1230, 2018

2017
[28]

Breast Cancer Wisconsin (Diagnostic)

W. S. Wolberg, O. L. Mangasarian, N. Street, and W. Street, “Breast Cancer Wisconsin (Diagnostic).” UCI Machine Learning Repository,
[29]

The use of multiple measurements in taxonomic prob- lems,

R. A. Fisher, “The use of multiple measurements in taxonomic prob- lems,” Annals of eugenics , vol. 7, no. 2, pp. 179–188, 1936. 11

1936
[1995]

DOI: https://doi.org/10.24432/C5DW2B

doi

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [7]

Publicly account- able robust multi-party computation,

M. Rivinius, P. Reisert, D. Rausch, and R. K ¨usters, “Publicly account- able robust multi-party computation,” in 43rd IEEE Symposium on Security and Privacy, SP 2022, San Francisco, CA, USA, May 22-26, 2022, pp. 2430–2449, IEEE, 2022

work page 2022

[2] [5]

Multiparty computation from somewhat homomorphic encryption,

I. Damg ˚ard, V . Pastro, N. P. Smart, and S. Zakarias, “Multiparty computation from somewhat homomorphic encryption,” in Advances in Cryptology - CRYPTO 2012 - 32nd Annual Cryptology Conference, Santa Barbara, CA, USA, August 19-23, 2012. Proceedings (R. Safavi- Naini and R. Canetti, eds.), vol. 7417 of Lecture Notes in Computer Science, pp. 643–662, Spr...

work page 2012

[3] [1]

Protocols for secure computations (extended abstract),

A. C.-C. Yao, “Protocols for secure computations (extended abstract),” in FOCS, pp. 160–164, IEEE Computer Society, 1982

work page 1982

[4] [2]

How to play any mental game or A completeness theorem for protocols with honest majority,

O. Goldreich, S. Micali, and A. Wigderson, “How to play any mental game or A completeness theorem for protocols with honest majority,” in STOC, pp. 218–229, ACM, 1987

work page 1987

[5] [3]

Completeness theorems for non-cryptographic fault-tolerant distributed computation (extended abstract),

M. Ben-Or, S. Goldwasser, and A. Wigderson, “Completeness theorems for non-cryptographic fault-tolerant distributed computation (extended abstract),” in STOC’88, pp. 1–10, 1988

work page 1988

[6] [4]

Multiparty unconditionally secure protocols (abstract),

D. Chaum, C. Cr ´epeau, and I. Damg ˚ard, “Multiparty unconditionally secure protocols (abstract),” in STOC’88, pp. 11–19, 1988

work page 1988

[7] [6]

Catching MPC cheaters: Identification and openability,

R. K. Cunningham, B. Fuller, and S. Yakoubov, “Catching MPC cheaters: Identification and openability,” in Information Theoretic Se- curity - 10th International Conference, ICITS 2017, Hong Kong, China, November 29 - December 2, 2017, Proceedings (J. Shikata, ed.), vol. 10681 of Lecture Notes in Computer Science, pp. 110–134, Springer, 2017

work page 2017

[8] [8]

Secureml: A system for scalable privacy- preserving machine learning,

P. Mohassel and Y . Zhang, “Secureml: A system for scalable privacy- preserving machine learning,” in 2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017 , pp. 19–38, IEEE Computer Society, 2017

work page 2017