{"id":"05b8a1de-0e65-4f6a-af52-f88ae90b533c","arxiv_id":"2506.07957","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Single-bit flips in CKKS ciphertexts can silently corrupt decrypted outputs, and the RNS and NTT optimizations used in practice amplify the damage.","lead":"This paper studies how single flipped bits in CKKS homomorphic encryption data corrupt the decrypted result. It finds that bit position, scale factor, and the RNS/NTT optimizations strongly influence the error magnitude, and warns that silent data corruption is a real risk in HE systems.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Figure 6 varies RNS and NTT simultaneously and uses an unspecified baseline, so the paper's central claim that RNS/NTT amplify bit errors is not yet supported; an isolated factorial comparison is needed.","rationale":"The reader's weakest assumption includes several experimental limitations: toy N=4, exclusion of homomorphic computation stages, unspecified no-RNS/NTT setup, and a single MNIST image. My stress-test focuses on the confounded and unspecified RNS/NTT comparison as the single most load-bearing issue, because the RNS/NTT amplification claim is the paper's most distinctive contribution and the basis for the broader practical warning. This is a narrower point than the reader's list, hence 'partial' agreement. The paper honestly states that errors during homomorphic computation are out of scope, so the N=4 toy and missing computation stages are acknowledged limitations rather than internal inconsistencies; they are generalizability concerns. The scale-factor finding is mathematically straightforward (dividing by a larger Delta attenuates an absolute bit-flip error) and consistent with CKKS mechanics, although tested only at N=4. The RNS and NTT arguments are individually plausible: CRT reconstruction from residues does multiply a small residue error by a large factor, and the NTT butterfly does spread a single input error to all outputs. However, plausible mechanisms are not sufficient when the only empirical evidence confounds the two. The proposed factorial test would settle whether the catastrophic effect is due to RNS, NTT, or their interaction, and would force the authors to specify or provide the no-RNS/non-NTT baseline. In the absence of that test, the current verdict of CONDITIONAL acceptance is appropriate: the paper is a useful motivation and first-cut study, but its central practical warning about RNS/NTT requires the clarified, controlled experiment and artifact release before it can be taken as established. No change to the reader's verdict is needed.","tokens_in":5095,"tokens_out":9872,"duration_ms":122377,"concrete_test":"Run the Figure 6 comparison as a 2x2 factorial experiment: (RNS on/off) x (NTT on/off), using a clearly specified non-RNS/non-NTT reference implementation (e.g., a Python big-integer CKKS with schoolbook polynomial multiplication) while keeping all other parameters (degree, scale factor, modulus size, bit-flip position) fixed across conditions. Apply single-bit flips in the encoding phase for a batch of at least 100 MNIST images and 10 random bit positions per image, and report mean SSIM or L2 error per condition. If the RNS-off conditions also show high distortion, the attribution of the damage to RNS is wrong; if only the combined condition is catastrophic, the conclusion should be revised to an interaction effect rather than a blanket warning about RNS/NTT.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's headline claim that RNS and NTT optimizations 'may lead to severe consequences in the presence of bit errors' rests almost entirely on Figure 6, which compares a single MNIST image processed 'without the application of RNS and NTT' against the same image processed 'with RNS and NTT.' This comparison varies two factors at once, so the observed distortion cannot be attributed to RNS or to NTT individually. The qualitative mechanisms offered for each (Eq. 2 for RNS amplification, the Cooley-Tukey butterfly in Fig. 7 for NTT diffusion) are plausible, but no experiment isolates them. Furthermore, the 'without RNS and NTT' condition is not described: OpenFHE natively uses RNS and NTT, so it is unclear how this reference implementation was realized—whether a different library, a big-integer CKKS, a modified pipeline, or a parameter change was used. Without a precise specification or released code, the result is irreproducible and the comparison may be confounded by unrelated implementation differences. If, for example, the distortion is driven mainly by RNS alone, or only by the interaction of RNS and NTT, the conclusion as stated would be misleading. This is the most load-bearing weakness because the RNS/NTT amplification is the paper's distinctive contribution and the basis for its broader warning about silent data corruption in practical CKKS systems.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper presents an experimental fault-injection study of the CKKS homomorphic encryption scheme using OpenFHE. The authors flip single bits in plaintext and ciphertext polynomial coefficients and measure the L2 norm of the recovered message after the encode-encrypt-decrypt-decode pipeline, examining the effect of bit position, the scale factor Δ, and the RNS and NTT optimizations. They report that bit-flip errors are more pronounced in c1 than in c0, that larger scale factors improve bit-error resilience, and that the use of RNS and NTT amplifies a single bit error enough to visually destroy an MNIST image. The paper concludes that silent data corruption is a serious concern for practical CKKS-based systems.","tokens_in":5303,"tokens_out":4761,"duration_ms":60922,"significance":"If fully supported, this would be a useful first characterization of CKKS error sensitivity, with implications for hardware fault tolerance and error detection in HE accelerators. The paper's strengths are its direct measurement approach and the absence of fitted parameters or circular predictions; the findings are genuine measurements of an implemented pipeline. However, the experimental basis is currently too narrow for the strength of the conclusions: the parameter sweep is extremely limited, the RNS/NTT comparison is confounded and unspecified, and the study excludes errors during homomorphic computation, which dominates real workloads. The paper is suitable as a preliminary study, but the central practical warning requires substantially more evidence.","major_comments":[{"comment":"The claim that RNS and NTT 'may lead to severe consequences in the presence of bit errors' rests on a comparison that varies RNS and NTT simultaneously against an unspecified baseline. OpenFHE natively uses RNS and NTT, so the manuscript must explain how the 'without the application of RNS and NTT' condition was realized, and it should isolate the two factors in a factorial experiment (none, RNS-only, NTT-only, both). As written, the observed distortion cannot be attributed to either optimization individually, and the result is not reproducible without the implementation details.","section":"Section II-C, Figure 6"},{"comment":"The general claims about bit-position sensitivity and scale-factor resilience are based on a single polynomial degree N=4, one input message, and three hand-picked values of Δ, with no replicates, confidence intervals, or variation of the modulus and security parameters. Since N=4 is far below practical CKKS degrees (typically 2^12 to 2^16), the observed patterns, such as 'the first 50 bits of each coefficient result in negligible effects,' may not transfer to realistic workloads. The authors should either broaden the parameter sweep substantially or explicitly restrict the conclusions to the tested configuration.","section":"Section II-A and II-B, Figures 4-5"},{"comment":"The paper explicitly limits the study to encoding, encryption, decryption, and decoding and defers errors arising during homomorphic computation to future work, yet the conclusion warns that silent data corruption 'is anticipated to become a prevalent challenge' in HE systems. Since practical CKKS workloads spend most of their time in homomorphic multiplications and rotations, the absence of computation-stage fault injection leaves the practical severity claim unsupported. The conclusions should be reworded to match the experimental scope, or the study should include at least one representative homomorphic computation.","section":"Section II (methodology) and Section III (conclusion)"},{"comment":"The proposed mechanisms for RNS and NTT amplification are plausible but are not quantitatively connected to the shown image. I ask the authors to report a numerical error metric (e.g., L2 or maximum pixel error) for Figure 6, state the polynomial degree and parameter set used for that experiment, and repeat the experiment over several images to demonstrate that the effect is not an artifact of one sample. As it stands, the single-image qualitative illustration is too thin to support the paper's headline claim.","section":"Section II-C, Equation 2 and Figure 7"}],"minor_comments":[{"comment":"The label 'Norm-2' should be written as 'L2 norm' or 'ℓ2 norm', and axis captions should use consistent capitalization, e.g., 'Modified bit index'.","section":"Throughout"},{"comment":"The displayed formula for RNS reconstruction is garbled in the manuscript; the equation and surrounding text should be typeset cleanly, with all variables (L, qk, Qk, Q) defined at first use.","section":"Equation 2"},{"comment":"The experimental setup should state the exact OpenFHE version, the CKKS parameters (N, q, Δ, security level), and the slot configuration; 'Arch Linux 257.5-1' appears to be a kernel version rather than a distribution release and should be clarified.","section":"Section II"},{"comment":"The caption does not say which stage the bit flip occurred in, which coefficient or bit was flipped, or how the input image was mapped to CKKS slots; these details should be added to make the experiment reproducible.","section":"Figure 6"},{"comment":"The phrase 'shifts right the coefficient' is imprecise: multiplication by the scale factor is not a bit shift in the usual sense, and the statement should be rephrased using the actual fixed-point encoding formula.","section":"Section II-B"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is quite short and reads more like an extended abstract than a full archival paper. The central RNS/NTT claim, which is the paper's most distinctive contribution, is currently supported by a single confounded and under-specified experiment; this is a load-bearing weakness that must be fixed. I would also ask the editor to require a data/code availability statement, as the fault-injection procedure is simple enough to release and would greatly increase the value of the paper."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is a useful first-cut fault-injection study of CKKS, with clear motivation and a simple, honest methodology. The new measurements show that bit-error impact depends on bit position and scale factor, and the qualitative mechanisms for why RNS and NTT might amplify errors are plausible. The authors also explicitly limit the study to encoding/encryption/decryption/decoding, which is a fair scope statement.\n\nThe soft spots are real, though. The experiments use polynomial degree N=4, a handful of hand-picked parameters, and one MNIST image for the RNS/NTT comparison. No code or data is released, and the \"no RNS/NTT\" condition is not described; OpenFHE natively uses both, so it's unclear what baseline was used. More importantly, Figure 6 varies RNS and NTT simultaneously, so even if the baseline were specified, the observed distortion cannot be attributed to either technique individually. Since the RNS/NTT amplification is the paper's distinctive contribution and the basis for the broader warning about silent data corruption, that weakness is load-bearing. The claim of being the \"first work\" in this area is also unverified, though relative to the ten cited references the measurements do appear new.\n\nThe remaining findings—bit-position and scale-factor dependencies—are more solid, but they align with what one would expect from CKKS's structure, so the paper reads more as a quantified confirmation than a surprising discovery.\n\nWho is this for? Researchers thinking about hardware faults in HE systems who want a starting point and a clear articulation of why SDC is a concern. As a motivation and preliminary study, it has value. But as it stands, the central RNS/NTT conclusion is not yet supported, and the lack of artifacts prevents reproducibility.\n\nI would send it to a serious referee, but with an explicit request to focus on the experimental design of the RNS/NTT comparison and to ask for either an isolated factorial experiment or a major frame change that downgrades the RNS/NTT claim to speculation. The paper deserves revision, not desk rejection.","headline":"Useful first-cut fault-injection study of CKKS, but the central RNS/NTT amplification claim rests on a single confounded experiment and needs revision or reframing before it can carry the paper's warning about silent data corruption.","tokens_in":5886,"tokens_out":2009,"would_cite":false,"duration_ms":22802,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that CKKS homomorphic encryption is silently vulnerable to single-bit flips, and that the RNS and NTT optimizations used to make it practical greatly amplify that vulnerability.","keywords":["CKKS","homomorphic encryption","silent data corruption","fault injection","error sensitivity","residue number system","number theoretic transform","scale factor"],"falsifier":"Run the same single-bit fault-injection campaign on a production-scale CKKS setup (for example, $N = 4096$ or $8192$ with several MNIST or CIFAR images) and inject flips during homomorphic multiplications; if higher-order bit flips no longer track $\\mathrm{L}^2$ error growth, or if disabling RNS and NTT no longer removes the image distortion, the paper's central sensitivity claims fall.","tokens_in":4894,"feed_emoji":"🔐","tokens_out":6005,"duration_ms":59463,"temperature":0.7,"pith_summary":"This paper sets out to show that bit-level faults, the kind produced by flaky hardware or software, can pass through a CKKS homomorphic encryption pipeline without detection and corrupt the recovered data. By injecting one bit flip at a time into plaintext and ciphertext coefficients and measuring the $\\mathrm{L}^2$ error after decoding, the authors find that error impact grows with the flipped bit's significance and that the ciphertext polynomial $c_1(X)$ is more sensitive because decryption multiplies it by the secret key. They also report that increasing the scale factor $\\Delta$ reduces error, because scaling shifts data into higher-up bits, and that the RNS and NTT optimizations amplify single-bit errors: RNS reconstruction multiplies a flipped remainder by a large factor, and NTT butterflies spread one error across many outputs. The work's point is that silent data corruption is a realistic threat in HE systems and that robustness deserves a seat alongside performance and security when configuring CKKS.","feed_headline":"RNS and NTT optimizations make CKKS more fragile to bit errors","feed_subtitle":"Fault-injection study shows single-bit errors slip through CKKS silently; larger scale factors are the only resilience lever.","key_machinery":"The central mechanism is the fault-injection campaign itself: a single-bit error model that flips, one at a time, every bit of every 64-bit coefficient in the CKKS plaintext and ciphertext, then runs the full encode-encrypt-decrypt-decode pipeline and compares the recovered message with the original using the $\\mathrm{L}^2$ norm. The paper's explanations for the observed sensitivity rest on the CKKS decryption formula $m' = [c_0 + c_1 \\times s]_Q$, the scale factor $\\Delta$ that shifts coefficient values left, RNS residue reconstruction via $p = \\left(\\sum_{k=1}^{L} r_k \\left[\\left(1/Q_k\\right) \\bmod q_k\\right] Q_k\\right) \\bmod Q$, and the Cooley-Tukey NTT butterfly that propagates one input error to all outputs. Together these pieces account for bit-position dependence, scale-factor resilience, and optimization-induced amplification.","core_discovery":"On its own terms, the paper discovers that error sensitivity in CKKS is governed by three knobs: bit position, scale factor, and the optimization stack. A single flipped bit in a 64-bit coefficient produces negligible output error if it sits in the lower roughly 50 bits, but error grows sharply for higher bits; $c_1(X)$ flips yield larger peaks than $c_0(X)$ flips because the decryption equation $m' = [c_0 + c_1 \\times s]_Q$ multiplies $c_1$ by the secret key, dispersing the fault. Larger scale factors ($2^{40}$ and $2^{50}$ versus $2^{20}$) shrink the recovered $\\mathrm{L}^2$ error, which the authors interpret as a \"right shift\" that increases the number of bits untouched by a given flip. Most strikingly, a bit error in the encoding stage distorts a MNIST image completely when RNS and NTT are enabled, while the same flip leaves a recognizable image when these optimizations are off; the paper explains this through the large multiplicative factor in RNS coefficient reconstruction and the all-to-all spreading of an error through a Cooley-Tukey butterfly. The intended upshot is that the very optimizations that make CKKS tractable also make it more brittle under faults.","pith_inferences":["If the amplification mechanism is right, applying error-correcting codes to RNS remainders before reconstruction, or recomputing an NTT with a checksum, would be natural hardening strategies; the paper does not explore these.","The exclusion of errors during homomorphic computation leaves an open gap: multiplications and rotations add their own noise, so a fault during those stages may interact with the noise budget differently than the pre-computation flips studied here.","The $N=4$ toy setting suggests the error-sensitivity curves might shift with polynomial degree and ciphertext modulus; mapping how the 'negligible lower bits' cut moves under realistic parameters would be a direct testable extension.","Because the MNIST comparison uses a single image, a natural next experiment is to measure the fraction of images corrupted beyond a recognition threshold across a full dataset, with and without RNS and NTT."],"forward_implications":["HE deployments must treat silent data corruption as a first-class risk: a single flipped bit can pass undetected through the entire CKKS pipeline and produce corrupted plaintext.","Choosing a larger scale factor $\\Delta$ buys error resilience at the cost of noise budget and computational efficiency, so robustness should enter the CKKS parameter-selection trade-off.","Because RNS reconstruction multiplies a flipped remainder by a large factor, systems using full-RNS CKKS need additional error detection or correction around residue arithmetic.","NTT-based polynomial multiplication spreads a single input fault across all outputs, so fault tolerance should be evaluated at the transform level, not just the coefficient level.","Bit-position sensitivity implies that protecting the most significant bits of coefficients could capture most of the error risk, though low bits still matter for exact recovery."],"supporting_citations":[{"why":"Supplies the CKKS scheme under test, including its approximate fixed-point arithmetic.","marker":"[6]"},{"why":"Introduces the full-RNS variant of CKKS whose optimizations are evaluated for error amplification.","marker":"[7]"},{"why":"Provides the Learning With Errors hardness assumption that motivates the noise-based design.","marker":"[8]"},{"why":"Documents real silent data corruptions at scale, establishing the practical threat model.","marker":"[9]"},{"why":"Provides the CKKS implementation with native RNS and NTT support used for all experiments.","marker":"[10]"}],"fun_headline_variants":["CKKS bit flips evade detection, worse with RNS/NTT","Single bit errors in CKKS harder to catch with optimizations","Scale factor is the only resilience lever for CKKS bit faults","RNS and NTT increase CKKS sensitivity to bit flips","Optimized CKKS more brittle: single bit flips cause silent corruption"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The experiments use polynomial degree $N = 4$, inject errors only in encoding, encryption, decryption, and decoding (never during homomorphic computation), and compare RNS/NTT on a single MNIST image using an unspecified 'without RNS and NTT' configuration, so the reported sensitivity patterns depend on those choices being representative of real CKKS workloads.","fun_headline_variants_meta":{"raw":{"variants":["CKKS bit flips evade detection, worse with RNS/NTT","Single bit errors in CKKS harder to catch with optimizations","Scale factor is the only resilience lever for CKKS bit faults","RNS and NTT increase CKKS sensitivity to bit flips","Optimized CKKS more brittle: single bit flips cause silent corruption"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000809,"raw_usage":{"total_tokens":3622,"prompt_tokens":1089,"completion_tokens":2533,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":705,"completion_tokens_details":{"reasoning_tokens":2443}},"tokens_in":705,"tokens_out":2533,"duration_ms":21837,"temperature":1.0,"reasoning_tokens":2443,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T05:21:14.516037+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same single-bit fault-injection campaign on a production-scale CKKS setup (for example, $N = 4096$ or $8192$ with several MNIST or CIFAR images) and inject flips during homomorphic multiplications; if higher-order bit flips no longer track $\\mathrm{L}^2$ error growth, or if disabling RNS and NTT no longer removes the image distortion, the paper's central sensitivity claims fall.","supporting_citations":[{"cited_title":"A full RNS variant of approximate homomorphic encryption,","cited_arxiv_id":null,"evidence_quote":"Introduces the full-RNS variant of CKKS whose optimizations are evaluated for error amplification."},{"cited_title":"OpenFHE: Open-source fully homomorphic encryption library,","cited_arxiv_id":null,"evidence_quote":"Provides the CKKS implementation with native RNS and NTT support used for all experiments."}],"review_version":1}