Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

MM-Food-100K: A 100,000-Sample Multimodal Food Intelligence Dataset with Verifiable Provenance

T0 review · 4 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A reported AES-key recovery attack on the MIRAGE cache is a simulation artifact: randomizing the eviction seed per run eliminates the leak.

desk verdict The body is a solid, reproducible critique of the RCO AES key recovery on MIRAGE, but the submission's front matter is a completely different food-dataset paper, and the debunking's central RNG assumption remains unvalidated. read the letter →

arxiv 2508.10429 v1 pith:J7VRARQQ submitted 2025-08-14 cs.AI cs.CRcs.CV

Yi Dong , Yusuke Muraoka , Scott Shi , Yi Zhang This is my paper · ORCID
classification cs.AIcs.CRcs.CV
keywords cacheoccupancysidechannelMIRAGEAESkeyrecoverysimulationartifactglobalevictionRNGrandomizedcachesguessingentropy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that a reported AES-key recovery attack on MIRAGE, a fully associative randomized cache, is not a real vulnerability. Reusing the attack authors' released simulator, it finds the reported leakage depends on a simulation choice: the random generator that controls MIRAGE's global evictions is re-seeded to the same constant value before every AES encryption, so each run evicts the same cache lines and timings become artificially deterministic. Once the seed is randomized per run to reflect real hardware, the correlation between AES T-table accesses and attacker-observed timings disappears, and the key's guessing entropy stays above 90% after thousands of traces. A second bug made the original paper under-report how many traces were needed, but the seed flaw is the decisive one. A sympathetic reading says MIRAGE's occupancy channel leaks far less than claimed.

What carries the argument

The load-bearing object is the pseudorandom generator MIRAGE uses for global evictions, and the seed it starts from in simulation. The original attack rests on a constant seed (mt_rand(42)) restarting every AES run; the fix seeds each run with std::random_device, giving $O \approx f(V, R)$ rather than $O \approx f(V)$. This formula is the central identity: cache occupancy is a function of both victim accesses and random global eviction decisions. With the seed fixed, the random term is constant and key-dependent accesses dominate; with the seed random, eviction noise overwhelms the key signal.

What would settle it

Run the released simulator with the original constant seed (42) and again with per-run random seeds, then compare attacker array-access time distributions for repeated encryptions of the same plaintext and key. If the random-seed runs still cluster into repeatable, key-correlated timing groups, the refutation fails; if they overlap with roughly 100,000-cycle spread while the fixed-seed runs collapse to identical histograms, the leakage is simulation-only. On real MIRAGE hardware, the same test settles it directly.

Watch

Extended reading notes

Core claim

The paper establishes that the claimed AES-key leakage on MIRAGE via cache occupancy is not a property of the hardware but an artifact of the simulator. In the attacked paper's released code, the RNG that drives MIRAGE's global evictions is initialized with a constant seed (42) at the start of every AES encryption, so each encryption follows the same deterministic eviction sequence; cache occupancy then depends on victim accesses alone, $O \approx f(V)$, which creates a clean correlation with key-dependent T-table lookups. Randomizing the seed per encryption restores $O \approx f(V, R)$, where $R$ is the random eviction sequence; the attacker's timing distributions spread by roughly 100,000

Load-bearing premise

The whole refutation rests on the premise that MIRAGE's global-eviction randomness cannot be reset or predicted by the attacker between AES runs, so a per-run random seed is the right model; if an attacker could force or know that seed, the reported leakage could return, and the fix also assumes the chosen random source is truly random on the target system.

Editorial extensions

If this is right

  • AES key recovery on MIRAGE through cache occupancy should not be treated as a hardware-level finding; a faithful simulator leaves guessing entropy above 90% after thousands of traces.
  • MIRAGE's core design guarantee, that conflict-based attacks cannot find set-associative evictions, is not contradicted by the reported occupancy attack.
  • Evaluators of future randomized-cache attacks must randomize RNG state across simulated runs; any constant-seed artifact can manufacture spurious leakage.
  • The same-year survey of randomized-cache security that repeats the occupancy claim needs a correction, since its figure relies on the same flawed analysis.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper's own conclusion, the constant-seed pattern is a general reproducibility hazard: any cache-side-channel simulator that restarts per encryption and seeds its eviction RNG once can produce deterministic traces that no real hardware would show.
  • The paper does not rule out occupancy attacks that exploit one long-running RNG state rather than restarting per encryption, or that use statistical denoising; it rules out this template attack's signal under realistic per-run randomness.
  • The refutation's strength tracks the entropy quality of the per-run seed source. On platforms where std::random_device degenerates to a predictable sequence, the practical conclusion could differ; the authors flag this caveat.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The body of the manuscript is a short critique of the SEC'25 paper "Systematic Evaluation of Randomized Cache Designs against Cache Occupancy" (RCO). The authors reproduce RCO's AES key-recovery experiment on the MIRAGE randomized cache using the released artifact and identify two bugs. The first (Appendix A) is a guessing-entropy (GE) analysis bug: RCO's code enforces max_traces per trace file rather than across all trace files, so it uses roughly 6x more traces than intended, under-reporting the number of traces needed to reach a given GE. The second (Appendix B) is a modeling bug: RCO initializes MIRAGE's global-eviction RNG with a fixed seed (42) before each AES run, producing a deterministic eviction sequence across runs. The authors patch the artifact to use a per-run random seed, observe that the correlation between victim key-byte accesses and attacker timings disappears, and report GE remaining above 90% after thousands of traces. They conclude that RCO's claimed AES key leakage from MIRAGE is a simulation artifact, not a real vulnerability. The paper's front matter, however, is inconsistent with the body: the title and abstract describe a food-image dataset (MM-Food-100K), not the MIRAGE security analysis.

Significance. If the technical claims hold, this is a significant correction to the randomized-cache side-channel literature. The paper is useful because it ships an open-source reproduction, pinpoints a concrete code-level bug (the per-file max_traces error), and demonstrates with a minimal patch that the fixed-seed modeling choice can create artificial correlations. The GE bug in Appendix A is convincingly documented with a diff and explains the discrepancy between RCO's reported numbers and the reproduced trend. The main conceptual contribution—that the RCO attack depends on a deterministic eviction sequence—is plausible and deserves to be aired. However, the paper's strongest conclusion, that MIRAGE is not vulnerable to occupancy-based AES key recovery, is conditional on an unstated and unvalidated assumption about the adversarial controllability of MIRAGE's eviction RNG state. The evidence presented is consistent with the claim, but it does not yet establish the claim for real hardware. The manuscript also needs substantial editorial work to fix the front-matter mismatch.

major comments (4)
  1. [Abstract / front matter] The supplied title and abstract describe "MM-Food-100K: A 100,000-Sample Multimodal Food Intelligence Dataset" while the body is a security analysis of MIRAGE randomized caches (arXiv 2508.10431v3). This mismatch makes the manuscript impossible to evaluate as a coherent submission. The authors must reconcile the front matter with the actual content, or confirm that the wrong metadata was supplied.
  2. [§III-A and Appendix B] The central claim that randomizing the global-eviction seed "reflects realistic operation" is load-bearing and is not supported by any analysis of MIRAGE's RNG implementation. The paper asserts that "the attacker cannot reset the RNG to a constant state on each AES run," but it does not justify this for MIRAGE: if the real eviction RNG is a predictable PRNG whose state can be observed or reset, the deterministic correlation exploited by RCO could reappear. Please provide a threat-model analysis of MIRAGE's RNG source (TRNG vs PRNG, reset behavior, attacker observability) or demonstrate robustness under adversarial seed control, e.g., repeated fixed seeds, time-derived seeds, or known PRNG states. The reliance on std::random_device is also fragile; the paper's own footnote 3 notes it can be deterministic on some systems. The evaluation should report the platform's entropy source or use a
  3. [§III-C and Figure 4] The quantitative evidence for "no leakage" is a single GE curve with no multiple trials, confidence intervals, or specification of how many random seeds, keys, and plaintexts were used. Guessing entropy, as defined in the paper (GE = Σ log2(R_i)), is measured in bits, so the repeated statement "GE above 90%" is ambiguous; it should be "above 90 bits" or "above 90% of the 128-bit key." Without repeated randomized trials or worst-case adversarial seed choices, the claim that "the attack fails" is not statistically established.
  4. [§III-B] The paper asserts that after the seed fix, the 64KB L1 cache configuration also shows no correlation between profiled and victim key heatmaps, but no result is shown; the text only says "we confirmed." Since the L1 size is presented as a second modeling concern, the corresponding result should be documented in a figure, table, or appendix.
minor comments (5)
  1. [Figure 4] The y-axis label is missing or cropped; please label it as "Guessing Entropy (bits)" and include axis ticks so readers can verify the >90-bit claim.
  2. [Appendix A] The bug/fix diff is clear, but it would help to add a short comment in the code showing that traces_used is incremented per trace and checked across files, to make the global limit explicit.
  3. [Figure 3(a)] The observation that 100 repetitions of the same encryption produce identical access times is a check on determinism, not itself a proof of the modeling error; consider stating this explicitly so readers do not misinterpret the histogram as evidence of a separate bug.
  4. [References] Reference [7] is a URL to cppreference.com; add an access date and, if possible, a version or commit identifier for a stable citation.
  5. [Title] The title "Yet Another Mirage of Breaking MIRAGE" is informal; a more descriptive title (e.g., "On the Impact of Eviction-RNG Seeding in Simulated MIRAGE Attacks") would be appropriate for a journal.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the debunking rests on independent artifact reproduction; minor self-citation of prior MIRAGE defense is not load-bearing.

full rationale

The paper's central negative result—that RCO's AES key recovery disappears when the global-eviction RNG is reseeded with a random value for each AES run—follows from the modeling assumption it introduces, not from a fitted parameter or from the authors' prior claims. The evidence is an independent reproduction using RCO's publicly released artifact and open-source code, and Bug-1 (trace indexing) is demonstrated by a concrete code diff in Appendix A. The 'fix' in Appendix B is a one-line change to the RNG initializer; it is not tuned to produce the conclusion. The only self-citations are [1] (original MIRAGE design) and [4] (a prior defense by the same author), used as background; neither carries the derivation. Section III-A and footnote 3 explicitly disclose the load-bearing assumptions that std::random_device be truly random and that an attacker cannot reset the RNG state; these are unverified hardware/threat-model assumptions, but assumptions are not circular definitions. The finding is therefore non-circular; the modest score reflects the presence of a minor self-citation in the narrative, not a circular step.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The body's conclusion adds no fitted parameters and no new entities; its claims rest on modeling assumptions about the RNG and on prior MIRAGE design guarantees. The abstract's dataset claims (wallet ledger, Codatta QA) would introduce their own parameters, but they are not supported by any body text.

assumptions (3)
  • domain assumption Global eviction RNG state is not attacker-controllable or predictable across AES runs.
    The fix's realism claim; the paper offers no proof, only the assertion that a real attacker cannot reset the RNG. Entered in Section III-A.
  • domain assumption std::random_device is cryptographically non-deterministic on the evaluation machine.
    Used to seed the corrected RNG; the paper's own footnote says deterministic output is possible on some systems (Section I, footnote 3).
  • domain assumption MIRAGE's global evictions are uniformly random and independent, as in the original design.
    The attack and rebuttal both assume MIRAGE's eviction policy selects victims uniformly at random (Section II-A).

how reviews work

0 comments
Cite this review

Pith. "Pith review of MM-Food-100K: A 100,000-Sample Multimodal Food Intelligence Dataset with Verifiable Provenance." pith.science (2026). https://pith.science/paper/J7VRARQQ

@misc{pith2026250810429,
  author       = {Pith},
  title        = {Pith review of: MM-Food-100K: A 100,000-Sample Multimodal Food Intelligence Dataset with Verifiable Provenance},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/J7VRARQQ}},
  note         = {Machine review of arXiv:2508.10429}
}
read the original abstract

We present MM-Food-100K, a public 100,000-sample multimodal food intelligence dataset with verifiable provenance. It is a curated approximately 10% open subset of an original 1.2 million, quality-accepted corpus of food images annotated for a wide range of information (such as dish name, region of creation). The corpus was collected over six weeks from over 87,000 contributors using the Codatta contribution model, which combines community sourcing with configurable AI-assisted quality checks; each submission is linked to a wallet address in a secure off-chain ledger for traceability, with a full on-chain protocol on the roadmap. We describe the schema, pipeline, and QA, and validate utility by fine-tuning large vision-language models (ChatGPT 5, ChatGPT OSS, Qwen-Max) on image-based nutrition prediction. Fine-tuning yields consistent gains over out-of-box baselines across standard metrics; we report results primarily on the MM-Food-100K subset. We release MM-Food-100K for publicly free access and retain approximately 90% for potential commercial access with revenue sharing to contributors.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. OmniFood-Bench: Evaluating VLMs for Nutrient Reasoning and Personalized Health Advice

    cs.AI 2026-07 conditional novelty 6.0 of 10

    VLMs show a Semantic-Physical Gap on food images: strong dish naming but high MAPE on mass/nutrients and frequent unsafe advice for high-risk disease profiles.

Reference graph

Works this paper leans on

19 extracted references · 17 canonical work pages · cited by 1 Pith paper

  1. [1]

    (2014, September)

    Bossard, L., Guillaumin, M., & Van Gool, L. (2014, September). Food-101--mining discriminative components with random forests. In European conference on computer vision (pp. 446--461). Cham: Springer International Publishing

    work page 2014

  2. [2]

    Salvador, A., Hynes, N., Aytar, Y., Marin, J., Ofli, F., Weber, I., & Torralba, A. (2017). Learning cross-modal embeddings for cooking recipes and food images. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 3020--3028)

    work page 2017

  3. [3]

    Achiam, J., Adler, S., Agarwal, S., Ahmad, L., Akkaya, I., Aleman, F. L., ... & McGrew, B. (2023). Gpt-4 technical report. arXiv preprint arXiv:2303.08774

    arXiv 2023

  4. [4]

    W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S.,

    Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., ... & Sutskever, I. (2021, July). Learning transferable visual models from natural language supervision. In International conference on machine learning (pp. 8748--8763). PMLR

    work page 2021

  5. [5]

    Yin, S., Fu, C., Zhao, S., Li, K., Sun, X., Xu, T., & Chen, E. (2024). A survey on multimodal large language models. National Science Review, 11(12), nwae403

    work page 2024

  6. [6]

    & Murphy, K

    Meyers, A., Johnston, N., Rathod, V., Korattikara, A., Gorban, A., Silberman, N., ... & Murphy, K. P. (2015). Im2calories: towards an automated mobile vision food diary. In Proceedings of the IEEE international conference on computer vision (pp. 1233--1241)

    work page 2015

  7. [7]

    J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S.,

    Hu, E. J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., ... & Chen, W. (2022). Lora: Low-rank adaptation of large language models. ICLR, 1(2), 3

    work page 2022

  8. [8]

    Dettmers, T., Pagnoni, A., Holtzman, A., & Zettlemoyer, L. (2023). Qlora: Efficient finetuning of quantized llms. Advances in neural information processing systems, 36, 10088--10115

    work page 2023

Show all 19 references
  1. [9]

    Xin, Y., Luo, S., Zhou, H., Du, J., Liu, X., Fan, Y., ... & Du, Y. (2024). Parameter-efficient fine-tuning for pre-trained vision models: A survey. arXiv e-prints, arXiv--2402

    2024

  2. [10]

    Minaee, S., Mikolov, T., Nikzad, N., Chenaghlu, M., Socher, R., Amatriain, X., & Gao, J. (2024). Large language models: A survey. arXiv preprint arXiv:2402.06196

    2024 arXiv

  3. [11]

    (2020, March)

    Liu, J., Peng, S., Long, C., Wei, L., Liu, Y., & Tian, Z. (2020, March). Blockchain for data science. In Proceedings of the 2020 2nd International Conference on Blockchain Technology (pp. 24--28)

    2020

  4. [12]

    Wang, K., Dong, J., Wang, Y., & Yin, H. (2019). Securing data with blockchain and AI. IEEE Access, 7, 77981--77989

    2019

  5. [13]

    P., Nfor, K

    Theodore Armand, T. P., Nfor, K. A., Kim, J. I., & Kim, H. C. (2024). Applications of artificial intelligence, machine learning, and deep learning in nutrition: A systematic review. Nutrients, 16(7), 1073

    2024

  6. [14]

    R., Albarqouni, S.,

    Rieke, N., Hancox, J., Li, W., Milletari, F., Roth, H. R., Albarqouni, S., ... & Cardoso, M. J. (2020). The future of digital health with federated learning. NPJ digital medicine, 3(1), 119

    2020

  7. [15]

    He, K., Mao, R., Lin, Q., Ruan, Y., Lan, X., Feng, M., & Cambria, E. (2025). A survey of large language models for healthcare: from data, technology, and applications to accountability and ethics. Information Fusion, 118, 102963

    2025

  8. [16]

    T., Lyu, Y

    Cheng, S. T., Lyu, Y. J., & Teng, C. (2025). Image-Based Nutritional Advisory System: Employing Multimodal Deep Learning for Food Classification and Nutritional Analysis. Applied Sciences, 15(9), 4911

    2025

  9. [17]

    K., Ansari, T

    Muhammad, S. K., Ansari, T. A., Shabbir, B., Almagharbeh, W. T., Rehman, A., Arjmand, R., & Ghulam, A. (2025). THE ROLE OF ARTIFICIAL INTELLIGENCE IN PUBLIC HEALTH SURVEILLANCE: A POST-PANDEMIC PERSPECTIVE. Insights-Journal of Life and Social Sciences, 3(3 (Social)), 74--80

    2025

  10. [18]

    Jiang, L., Qiu, B., Liu, X., Huang, C., & Lin, K. (2020). DeepFood: food image analysis and dietary assessment via deep model. IEEE Access, 8, 47477--47489

    2020

  11. [19]

    S., O'Brien, J., Cai, C

    Park, J. S., O'Brien, J., Cai, C. J., Morris, M. R., Liang, P., & Bernstein, M. S. (2023, October). Generative agents: Interactive simulacra of human behavior. In Proceedings of the 36th annual ACM symposium on user interface software and technology (pp. 1--22)

    2023

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.