Stability Buys Time: A Re-Keying Game for Encrypted Multi-Agent Control

John S. Baras; Sai Sandeep Damera

Re-key cadence for encrypted multi-agent control is set by graph fragility: marginally stable fleets must re-key far more often.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-15 03:41 UTC pith:IOPFXVQ7

load-bearing objection Clean Stackelberg framing that ties CKKS re-key cadence to multi-agent graph fragility, but abstract-only so the equilibrium and detector separation stay uncheckable. the 4 major comments →

arxiv 2607.12742 v1 pith:IOPFXVQ7 submitted 2026-07-14 cs.CR cs.GTcs.SYeess.SY

Stability Buys Time: A Re-Keying Game for Encrypted Multi-Agent Control

Sai Sandeep Damera , John S. Baras This is my paper

classification cs.CR cs.GTcs.SYeess.SY

keywords encrypted controlCKKSfully homomorphic encryptionre-keyingStackelberg gamemulti-agent systemsgraph topologyadvanced persistent threat

verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Encrypted multi-agent control over CKKS-style approximate fully homomorphic encryption must decrypt to actuate, so encryption noise becomes an unavoidable key-recovery leak. The paper models the resulting security problem under an advanced persistent threat as a two-phase game: passive reconnaissance followed by active manipulation, separated by a residual detector that sees only the active phase. Because overt attacks are caught, a rational adversary stays stealthy; the defender's only reset is re-keying (not bootstrapping). At the Stackelberg equilibrium of the resulting detection-evasion timing game the defender re-keys on the laziest schedule that still denies the adversary, and that schedule is fixed by the control-theoretic fragility of the multi-agent graph. Marginally stable topologies must re-key far more often than well-connected ones. A three-way tension among FHE precision, control accuracy and re-key cadence therefore defines a securability window in which re-keying is simply the price of using an efficient approximate cryptosystem inside a feedback loop.

Core claim

At the Stackelberg equilibrium of the active detection-evasion timing game the defender re-keys on the laziest cadence that denies a stealthy adversary, and that cadence is dictated by the control-theoretic fragility of the multi-agent graph topology: marginally stable graphs must re-key far more frequently than well-connected ones.

What carries the argument

A two-phase Stackelberg detection-evasion timing game whose phases are cleanly separated by a residual detector that observes only active manipulation; the defender's sole reset action is re-keying, which erases accumulated leakage and forces the equilibrium re-key interval to be set by graph fragility.

Load-bearing premise

The residual detector is assumed to see only active manipulation and not the passive key-recovery leakage from decryption noise, so the two phases cleanly separate and a rational adversary optimally stays stealthy.

What would settle it

On a concrete multi-agent topology, measure whether an adversary that also exploits passive decryption-noise leakage can force a materially shorter re-key interval than the paper's equilibrium predicts for that graph's fragility.

Watch this falsifier — get emailed when new claim-graph text bears on it.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

Clean Stackelberg framing that ties CKKS re-key cadence to multi-agent graph fragility, but abstract-only so the equilibrium and detector separation stay uncheckable.

read the letter

The punchline is simple: this paper treats re-keying under an APT for CKKS-encrypted multi-agent control as a two-phase Stackelberg timing game, and claims the equilibrium cadence is set by the control-theoretic fragility of the communication graph. Marginally stable topologies must re-key far more often than well-connected ones. That link is the thing worth knowing.

What is actually new is the packaging. Static FHE security and honest-but-curious encrypted control are already on the table; the authors fold CKKS decryption-noise leakage, residual detection that is claimed to see only active manipulation, re-keying (not bootstrapping) as the defender’s refresh, and multi-agent graph spectrum into one detection-evasion game. The passive phase is said to reduce to the known flooding tradeoff; the active phase yields a laziest-safe re-key schedule. They also flag a three-way window among FHE precision, control accuracy, and re-key cadence, with a securability floor and a static-suffices ceiling. That framing is coherent and useful for the subfield.

The soft spots are exactly what you expect from an abstract-only read. No equations, no payoff structure, no residual-detector model, no spectral mapping, and no equilibrium derivation are visible, so the central claim cannot be checked. The load-bearing premise is the clean separation: the detector sees only manipulation, not passive key-recovery leakage, and the adversary therefore stays stealthy. If that fails, the two-phase game is ill-posed. Circularity looks low; they are not fitting free parameters and calling it prediction. Soundness is simply unverified rather than refuted.

This is for people who already work on encrypted control, secure multi-agent CPS, or approximate FHE in feedback loops. A control theorist who cares about topology and a crypto person who cares about refresh costs will both get something. It does not rewrite either field, but it gives a concrete design rule if the math holds.

I would send it to a serious referee. The idea is sharp enough and the problem is real enough that the full paper deserves the scrutiny, even if heavy revision follows. Bring it to reading group only if someone has already pulled the PDF and can walk through the game and the graph argument; otherwise park it until the proofs are in hand.

Referee Report

4 major / 3 minor

Summary. The manuscript models the security of multi-agent control under approximate FHE (CKKS) as a two-phase advanced persistent threat game: a passive reconnaissance phase driven by key-recovery leakage from decryption noise, followed by an active stealthy-manipulation phase. The phases are separated by a residual detector that, by assumption, observes only active manipulation. The passive phase is said to reduce to a known flooding tradeoff; the active phase is cast as a detection-evasion timing game whose Stackelberg equilibrium has the defender re-keying at the laziest cadence that still denies the adversary. That cadence is claimed to be set by the control-theoretic fragility of the multi-agent graph topology, so that marginally stable graphs must re-key far more often than well-connected ones. A three-way tension among FHE precision, control accuracy, and re-key cadence is asserted to define a securability window between a floor and a static-suffices ceiling, with re-keying presented as the price of precision efficiency. The broader framing is that security for an approximate cryptosystem inside a feedback loop is a dynamic game whose defender move is the scheme’s own refresh.

Significance. If the Stackelberg equilibrium derivation and the topology-to-cadence mapping are correct, the paper would supply a concrete, control-theoretic rule for re-keying policy in encrypted multi-agent systems, moving the literature beyond honest-but-curious cloud models and purely static analyses of approximate FHE. Explicitly treating re-keying (rather than bootstrapping) as the defender’s response to accumulated leakage, and identifying a precision–accuracy–cadence design window, would be practically useful. The reduction of the passive phase to a known flooding tradeoff and the game-theoretic (rather than fitted) character of the central claim are strengths if fully substantiated. The broader claim that any system that must repeatedly decrypt to act faces an analogous dynamic game is a potentially transferable framing contribution.

major comments (4)

[Abstract (full text unavailable)] Only the abstract is available for this review; the Stackelberg equilibrium of the active detection-evasion timing game, the payoff structure, and the claimed mapping from multi-agent graph fragility to re-key cadence are therefore uncheckable. Without the equilibrium derivation, lemmas, or any supporting analysis, the central claim that the defender’s optimal cadence is set by topology cannot be assessed for correctness.
[Abstract (residual-detector separation)] The load-bearing separation premise—that a residual detector “sees only the manipulation” and does not register passive key-recovery leakage from CKKS decryption noise—is asserted but not justified in the available text. If the detector also observes passive leakage, or if the adversary is not rational/stealthy, the two-phase game is ill-posed and the equilibrium re-key cadence does not follow. This axiom must be stated formally and defended (or relaxed) before the equilibrium claim can be accepted.
[Abstract (passive-phase reduction)] The claim that the passive phase “reduces to the known flooding tradeoff” is stated without a reduction argument, reference to the precise prior result, or error analysis. Because the active-phase equilibrium is said to rest on this reduction, the reduction itself is load-bearing and must be supplied with explicit assumptions and bounds.
[Abstract (three-way tension / securability window)] The three-way precision–accuracy–cadence window (securability floor to static-suffices ceiling) is asserted as the region in which the game lives, yet no quantitative characterization, inequalities, or numerical illustration appears in the available material. Without that characterization the design claim remains programmatic rather than demonstrated.

minor comments (3)

[Abstract] The abstract uses “measured residual detector” without defining what is measured or how the residual is formed; a one-sentence clarification would help readers who are not already in the encrypted-control literature.
[Abstract] “Laziest cadence that denies the stealthy adversary” is evocative but informal; once the full text is available, a precise mathematical definition (e.g., maximal re-key interval that keeps adversary value below a threshold) should appear early.
[Abstract (closing sentence)] The broader applicability claim (“applying beyond control to any system that must repeatedly decrypt to act”) is interesting but currently unsupported; even a short discussion paragraph or related-work pointer would strengthen it.

Circularity Check

0 steps flagged

Abstract-only review: no equations or self-citations available to exhibit circular reduction; claimed game equilibrium and topology-to-cadence mapping cannot be checked for circularity.

full rationale

Only the abstract is available; the full text, equations, proofs, and bibliography are not. Circularity analysis requires quoting specific paper text and exhibiting a reduction (e.g., Eq. X equals Eq. Y by construction, or a fitted parameter renamed as prediction). The abstract presents a modeling claim: a two-phase APT game (passive flooding tradeoff + active detection-evasion timing game) whose Stackelberg equilibrium re-key cadence is set by multi-agent graph fragility, with residual-detector separation of phases. No free parameters are fitted to data and called predictions; no uniqueness theorem or cosh-style ansatz is imported via self-citation; no known empirical pattern is merely renamed. The passive phase is said to 'reduce to the known flooding tradeoff,' which is ordinary dependence on prior literature, not a self-definitional loop visible here. Without equations or author-overlap citations to inspect, no circular step can be exhibited under the hard rules. Score 0 is therefore the correct honest finding for an abstract-only review: absence of evidence of circularity, not evidence of absence of circularity in the unseen full paper. Load-bearing premises (detector sees only manipulation; rational stealthy adversary) are assumptions whose validity is a correctness risk, not a circularity finding.

Axiom & Free-Parameter Ledger

0 free parameters · 5 axioms · 1 invented entities

Abstract-only audit. Free parameters and invented entities cannot be exhaustively listed without equations. The claim rests on standard crypto/control/game machinery plus several domain modeling choices that cleanly separate passive leakage from active detection and elevate re-keying over bootstrapping.

axioms (5)

domain assumption CKKS decryption noise is a key-recovery leak that accumulates and is unavoidable because the control loop must decrypt to actuate.
Stated as background fact that motivates the whole game; not re-derived in the abstract.
ad hoc to paper A residual detector observes only active manipulation, not passive reconnaissance leakage, cleanly separating the two game phases.
Explicit modeling choice in the abstract; load-bearing for the timing-game structure.
domain assumption Only re-keying (not bootstrapping) resets accumulated key-recovery leakage, so re-keying is the active defense.
Asserted as the reason the defender’s move is re-keying; depends on how leakage is modeled under CKKS refresh operations.
domain assumption The adversary is rational and therefore stays stealthy because overt manipulation is caught; the active phase is a detection-evasion timing game with a Stackelberg equilibrium.
Standard rational-player game-theory assumption applied to APT inside the cryptosystem.
domain assumption Control-theoretic fragility of the multi-agent graph topology determines the laziest denying re-key cadence.
Core modeling link between plant dynamics and crypto refresh; not justified in the abstract beyond assertion.

invented entities (1)

Two-phase APT re-keying game for approximate FHE control (passive flooding then active stealthy timing, separated by residual detector) no independent evidence
purpose: To turn static FHE/encrypted-control security into a dynamic defender–adversary game whose equilibrium yields a topology-dependent re-key schedule.
The game structure is the paper’s modeling contribution; independent evidence would be theorems/simulations in the full paper, not available here.

pith-pipeline@v1.1.0-grok45 · 6233 in / 3033 out tokens · 29045 ms · 2026-07-15T03:41:57.814182+00:00 · methodology

0 comments

read the original abstract

Encrypted control lets a cloud coordinate a fleet of agents on fully homomorphically encrypted state, keeping their positions and commands private. The approximate scheme for real-valued control, CKKS, returns decryptions that carry the encryption noise, a key-recovery leak; the loop must decrypt to actuate, so the leak is unavoidable. Yet the security of approximate FHE is studied statically, encrypted control assumes an honest-but-curious cloud, and persistent-threat games never reach inside the cryptosystem. We model the loop's security under an advanced persistent threat as a two-phase game, passive reconnaissance then active manipulation, separated by a measured residual detector that sees only the manipulation. The passive phase reduces to the known flooding tradeoff; the active defense is re-keying, not bootstrapping, since only re-keying resets accumulated leakage. The active phase is a detection-evasion timing game: overt manipulation is caught, so the rational adversary stays stealthy, and at its Stackelberg equilibrium the defender re-keys on the laziest cadence that denies it, set by the control-theoretic fragility of the graph topology. The marginally-stable graph must re-key far more often than the well-connected one. A three-way tension among FHE precision, control accuracy, and re-key cadence sets where this game lives, between a securability floor and a static-suffices ceiling. The efficient secure point is that window, where re-keying is the price of precision efficiency. More broadly, security for an approximate cryptosystem in a feedback loop is a dynamic game whose defender's move is the scheme's own refresh, applying beyond control to any system that must repeatedly decrypt to act.

Stability Buys Time: A Re-Keying Game for Encrypted Multi-Agent Control

Core claim

What carries the argument

Load-bearing premise

What would settle it

discussion (0)