{"id":"74ff5074-b587-495b-9fc9-1c0bdc94c023","arxiv_id":"2608.11147","paper_version":1,"verdict":"REJECT","confidence":"LOW","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"In unoptimized CKKS multiplication, a bit flip that corrupts both partial-product uses of c0 or c1 is mathematically masked, while a flip hitting only one use leads to silent data corruption.","lead":"This paper analyzes single-bit memory errors during server-side CKKS homomorphic multiplication, finding that faults which corrupt both uses of a ciphertext component are masked, while faults hitting only one use corrupt the output. The finding could guide selective error protection in FHE accelerators, though the manuscript does not include the promised experimental results.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Eq. (5) does not establish masking: the claimed 'low-magnitude' error term decrypts to e_{i,j} times the other plaintext, which is not small.","rationale":"Reader's REJECT verdict is correct but for a different reason than the weakest_assumption. The reader worries relinearization might break the additive structure; in fact, relinearization is linear in d0, d1, and d2, so Eq. (5) follows if the evk term is included. The real problem is that the error term e_{i,j}*(c0'', c1'') decrypts to e_{i,j} times the plaintext of the other ciphertext, which is not a small noise. The paper never bounds this term and in fact calls it 'low-magnitude' without justification. This is load-bearing because the entire 'masked vs. SDC' classification rests on it. If Eq. (5) faults are actually corruptions, the headline claim that timing and location determine whether a fault is masked or corrupting does not survive. A single analytical check—computing the norm of e_{i,j}*m'' for the paper's own parameters—settles it. No need for a full empirical study. This does not attack the authors' integrity; it is an algebra error in interpreting Eq. (5). The paper's complete absence of empirical results and the missing Fig. 2 reinforce the rejection, but the specific algebraic flaw identified here is the more fundamental reason the central claim fails.","tokens_in":5269,"tokens_out":8684,"duration_ms":79368,"concrete_test":"Using the paper's parameters (N=64, logQ=60, logΔ=25), encrypt two messages m1=m2=1.0, multiply them, and inject a single-bit fault into c0 before multiplication at a high-order bit position j (e.g., j=30) so that the fault enters both d0 and d1, as in Eq. (5). Decrypt, decode, and compute MREP. If the MREP is comparable to the error from Eq. (6) or exceeds the precision threshold (e.g., >1%), the 'masked' classification in Section III-B is refuted. Alternatively, without any implementation, analytically compute the largest coefficient of e_{i,j} * m'' for m''=Δ and compare it to the decryption-error tolerance; if it exceeds the tolerance, Eq. (5) does not describe a masked fault.","verdict_should_be":"REJECT","load_bearing_attack":"The paper's central claim depends on the dichotomy in Section III-B: a fault that enters both d0 and d1 (Eq. 5) is 'masked,' whereas a fault entering only d1 (Eq. 6) causes SDC. The key step is the assertion in Section III-C that after decryption the error term in Eq. (5) is an 'additional low-magnitude term.' This assertion is not true in general. With the notation of Eq. (4), a fault in c0 before multiplication produces the ciphertext cmult + e_{i,j}*(c0'', c1''), where (c0'', c1'') is the second multiplicand ciphertext. Decrypting this error term gives e_{i,j} * (m'' + e_noise), where m'' is the plaintext encrypted by the second ciphertext. The error is therefore proportional to 2^j times the coefficients of m''. Since CKKS plaintexts are scaled by the scaling factor Δ and can encode arbitrary data, the product e_{i,j}*m'' is not a small rounding error; for a high-order bit flip (large j) it is comparable to the message magnitude, and for j near log Q it can be enormous. Thus the 'masked' outcome in Eq. (5) is, in fact, a data-dependent corruption. The distinction between Eq. (5) and Eq. (6) is not 'benign vs. SDC' but rather 'error contains e_{i,j}*m'' vs. error also contains the secret-key-dependent term e_{i,j}*c1''*sk.' The paper provides no bound on ||e_{i,j}*m''|| and no experimental evidence that such faults are masked. Consequently, the central claim as stated—that location and timing determine whether a fault is masked or corrupting—is unsupported and, for the concrete algebra of CKKS, incorrect.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies transient single-bit errors in server-side CKKS homomorphic multiplication, using an unoptimized implementation (no NTT/RNS). It claims that the timing and location of bit flips in the ciphertext components c0 and c1 determine whether the error is masked, silently corrupts the output, or is detected. The central theoretical argument, formalized in Eqs. (5) and (6), distinguishes a fault that enters both partial products d0 and d1 (claimed to yield a valid ciphertext plus a low-magnitude error) from a fault entering only d1 (claimed to produce a non-ciphertext term and hence SDC). The paper also asserts empirical support via an injection tool and MREP evaluation, but no empirical data or figures are included.","tokens_in":5672,"tokens_out":4843,"duration_ms":43618,"significance":"If correct, the paper would provide a useful fault-propagation model for CKKS multiplication and guide fault-tolerant HE accelerator design. The algebraic distinction between faults entering one versus both partial products is a conceptually clear starting point. However, the central claim is not established: the key assertion that the error term in Eq. (5) is low-magnitude is incorrect, and the manuscript contains no empirical results to back the claimed observations. The paper is therefore of limited value in its current form.","major_comments":[{"comment":"The assertion that the error term e_{i,j}*(c0'', c1'') decrypts to an 'additional low-magnitude term' is incorrect. Decrypting that term yields e_{i,j}*(m'' + e''), where m'' is the plaintext encoded in the second ciphertext and e'' is its inherent noise. In CKKS, plaintext coefficients are scaled by the scaling factor Δ and encode arbitrary real or complex data, so e_{i,j}*m'' is not small: for a bit flip at position j it contributes 2^j times a shifted coefficient of m''. For high-order bit flips this error is comparable to or larger than the message itself. The paper provides no bound on ||e_{i,j}*m''||, so the 'masked' outcome is in fact a data-dependent corruption, not a benign result.","section":"Section III-C, Eq. (5)"},{"comment":"The derivation assumes that after relinearization the faulted ciphertext is exactly the correct multiplication result plus e_{i,j}*(c0'', c1'') with (c0'', c1'') a valid ciphertext. The paper does not prove that the relinearization step, which involves key-switching and rounding, preserves this additive structure. If relinearization mixes the error into the ciphertext components differently, the algebraic form of Eq. (5) may not hold. This is a load-bearing gap because Eq. (5) is the entire basis for the claimed masking behavior.","section":"Section III-C, Eq. (5)"},{"comment":"The manuscript explicitly claims empirical support ('These observations are supported by both theoretical analysis and empirical evaluation'; 'we injected single bit transient errors ... using MREP'), but no MREP results, error distributions, or baseline comparisons appear anywhere in the paper. The only referenced figure (Fig. 2) is not included. This absence means the central claim cannot be verified empirically, despite the paper's framing.","section":"Sections I and II"},{"comment":"The proposed dichotomy between 'masked' and SDC collapses once the error term in Eq. (5) is recognized as a data-dependent corruption proportional to e_{i,j}*m''. Both the 'both partial products' and 'one partial product' fault cases then produce silent corruption, differing only in whether an additional secret-key-dependent term appears. The abstract's claim that timing and location determine whether the output is correct is therefore unsupported; the two cases differ in error magnitude, not in masked versus SDC behavior.","section":"Sections I and III-B"}],"minor_comments":[{"comment":"Figure 2 is referenced but not included in the manuscript; add the figure with the error characterization data it is meant to show.","section":"Section III-A"},{"comment":"The term 'gap' is used without definition; clarify whether it refers to the number of unused slots between FFT slots or to another structural parameter.","section":"Section III-A"},{"comment":"The phrase 'the timing of errors' is not operationalized; the analysis concerns which partial product (d0 or d1) receives the fault, not a time axis. Explain what 'timing' means in this context.","section":"Section I"},{"comment":"The C-CKKS implementation is described as based on OpenFHE, HEaaN, SEAL, and PyFHE, but the manuscript does not specify which components are taken from each; add an implementation note or a repository link for reproducibility.","section":"Section II"},{"comment":"The statement that the sign of e_{i,j} does not affect the analysis should be justified, since a 1-to-0 flip produces a negative error; the magnitude analysis is sign-independent, but this is not stated.","section":"Section III-C"}],"recommendation":"reject","confidential_remarks":"The central theoretical claim in Eq. (5) is not correct as stated: the 'masked' fault case actually decrypts to a term proportional to the second plaintext. Unless the authors can show that this term is bounded by the scheme's inherent noise, which is implausible for arbitrary data and high-order bit flips, the paper's main dichotomy does not hold. The manuscript also lacks the empirical results it claims to provide. I recommend rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThis paper makes a simple algebraic point about CKKS multiplication under transient faults and then draws a conclusion the algebra does not support. The one genuinely new observation is the timing/location axis: a bit flip that enters both partial products of c0 (or c1) leaves a valid ciphertext, while a flip entering only one partial product produces an invalid ciphertext that decrypts into garbage. That distinction is real and worth keeping, but the paper calls the first case \"masked\" and claims the resulting error is a low-magnitude term. That claim is wrong.\n\nIf you decrypt Eq. (5) one step further, the error term e_{i,j}*(c0'', c1'') yields e_{i,j}*(m'' + noise), where m'' is the plaintext of the second multiplicand. That is a data-dependent term proportional to 2^j times the coefficients of m''. For any high-order bit flip it is not low-magnitude at all; for j near log Q it can be enormous. So the true distinction is not \"benign vs. SDC\" but \"error that avoids the secret-key-dependent blow-up vs. error that includes e_{i,j}*c1''*sk.\" The paper provides no bound on the \"masked\" error and no experiments. In fact, the empirical evaluation promised in Section I is entirely absent: no MREP data, no error distributions, no baseline comparison. Fig. 2 is a placeholder.\n\nWhat the paper does well: the reuse structure of c0/c1 in the schoolbook multiplication and the algebraic decomposition into Eqs. (5) and (6) is a useful way to think about where faults land. The writing is clear about the distinction between the two paths. But the central claim, that timing and location determine whether a fault is silent or corrupting, is unsupported and, as stated, incorrect.\n\nWhere it stands: as a preprint it is not ready. The core observation might survive a rewrite that drops the word \"masked\" and replaces it with \"structured-error vs. unstructured-error,\" adds a real empirical section with actual MREP values, and derives or at least discusses the magnitude of the structured error term. The citations to the authors' own earlier work are fine; the problem is not self-citation, it is the gap between claim and evidence.\n\nWho this is for: people working on fault-tolerant FHE accelerators might get a useful starting point, but only after the fix. I would not bring it to the reading group as is. My recommendation: if you are deciding whether to referee it, say yes—it deserves a serious referee who will catch the missing data and the over-interpretation. But the verdict should be reject, with an invitation to resubmit.","headline":"The timing/location distinction is a real algebraic observation, but the 'masked' conclusion is wrong and the promised empirical evaluation is absent.","tokens_in":6187,"tokens_out":3499,"would_cite":false,"duration_ms":34030,"reading_group":"no","serious_thinker":"unclear","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"In CKKS homomorphic multiplication, a single-bit flip is benign or corrupting depending on whether it enters both uses of a ciphertext component or only one partial product.","keywords":["CKKS","homomorphic encryption","transient errors","fault injection","silent data corruption","ciphertext multiplication","error resilience","relinearization"],"falsifier":"Run pairwise fault injections on identical CKKS multiplications: one bit flip in $c_0$ that enters both $d_0$ and $d_1$, and the same flip restricted to $d_1$ only. If the decrypted maximum relative error in the first case is statistically indistinguishable from the second, the paper's algebraic masking claim is refuted; the distinction in Eqs. (5) and (6) predicts a clear gap.","tokens_in":5109,"feed_emoji":"🔐","tokens_out":8668,"duration_ms":181177,"temperature":0.7,"pith_summary":"This paper asks why some transient hardware bit flips in CKKS homomorphic multiplication vanish without harm while others silently destroy the decrypted result. It argues that the answer is algebraic: because each ciphertext polynomial $c_0$ and $c_1$ is reused across the partial products $d_0,d_1,d_2$, a flip that enters both uses of a component keeps the faulted ciphertext inside the space of valid ciphertexts, so decryption's cancellation suppresses it. A flip that enters only one partial product pushes the ciphertext outside that space, and the result decrypts to severe corruption. The authors support this with structural derivations and fault-injection experiments, and conclude that both the timing and the location of an error, not just its magnitude, determine whether the error is masked or becomes silent data corruption. If correct, fault-resilience strategies for FHE need to protect the asymmetric, single-use paths rather than treat all bits equally.","feed_headline":"Location decides whether CKKS bit flips corrupt the result","feed_subtitle":"Faults touching both partial products stay masked; faults hitting only one break decryption and poison the output.","key_machinery":"The load-bearing object is the double-use symmetry of the ciphertext components inside the three partial products of CKKS multiplication, together with the error polynomial $e_{i,j}=2^j X^i$ that models a single-bit flip. Writing the faulted multiplication as Eq. (5) (fault inside both uses of $c_0$) versus Eq. (6) (fault only inside $d_1$) is what carries the argument: the first expansion remains in ciphertext space because the extra term is a product of a scalar error and a valid ciphertext, while the second does not. This distinction is then tied to the empirical masking-versus-SDC pattern through error-propagation traces and maximum relative error measurements.","core_discovery":"On the paper's own terms, the central claim is that in the CKKS scheme, ciphertext–ciphertext multiplication has a built-in symmetry that decides the fate of a transient single-bit error. The multiplication forms three partial products $(d_0,d_1,d_2)$; $c_0$ appears in $d_0$ and $d_1$, and $c_1$ appears in $d_1$ and $d_2$. If a bit flip in $c_0$ is present in both of its appearances, the faulted result is algebraically the correct product plus an error term $e_{i,j}(c_0'',c_1'')$, which is itself a valid ciphertext; decryption therefore performs its usual cancellation and leaves only a small extra noise term. If the same flip appears only in $d_1$, the result is the correct product plus $e_{i,j}(0,c_1')$, which is not a ciphertext, so the secret-key cancellation fails and the decrypted output is badly corrupted. The paper concludes that homomorphic multiplication is highly susceptible to faults, and that the timing and location of an error in $c_0$ or $c_1$ determine whether the error is masked or silent.","pith_inferences":["The paper does not test it, but Eq. (5) implies masked faults still add noise, so many such faults could accumulate and erode the CKKS noise budget over a long computation.","Because the same double-use partial-product structure appears in other RLWE-based multiplication schemes, the masked-versus-SDC distinction may transfer, although the paper does not claim this.","A natural extension would inject faults into the relinearization-key path, since Eqs. (5) and (6) treat the $d^{evk}$ terms as fault-free.","Read as a design pointer, the result suggests protecting the $d_1$ computation rather than triplicating the whole multiplication, which the authors do not state explicitly."],"forward_implications":["A fault-injection study that records only the bit position, without the component and timing, will misestimate silent data corruption rates for CKKS multiplication.","Protection can focus on single-use paths such as a fault landing only in $d_1$, where decryption cannot cancel the injected error.","A fault that is replicated across both uses of a component can be left unprotected, since decryption still returns the product plus a bounded noise term.","Because $c_0$ and $c_1$ feed different partial products, their resilience profiles differ, so $c_0$ faults and $c_1$ faults follow distinct propagation paths."],"supporting_citations":[{"why":"Defines the CKKS scheme and its encryption, decryption, and relinearized multiplication, the structure on which Eq. (5) is built.","marker":"[4]"},{"why":"Supplies the Silent Data Corruption outcome class that the paper uses to distinguish masked from corrupting faults.","marker":"[16]"},{"why":"Provides the open-source FHE library base for the paper's C-CKKS implementation used to trace error propagation.","marker":"[17]"},{"why":"One of the reference FHE implementations the paper's C-CKKS implementation is based on.","marker":"[18]"},{"why":"Another reference FHE implementation the paper's C-CKKS implementation is based on.","marker":"[19]"},{"why":"Supplies the fault-injection tool used to insert single-bit transient errors during multiplication.","marker":"[20]"},{"why":"Earlier characterization of client-side CKKS bit-flip sensitivity that this paper extends to server-side multiplication.","marker":"[21]"},{"why":"Earlier quantification of FHE bit-error resilience that motivates the masked-versus-corrupted fault framing.","marker":"[22]"}],"fun_headline_variants":["CKKS bit flips: location decides if they poison output","In CKKS multiplication, fault timing and position decide corruption","Symmetry in CKKS multiplication masks or reveals transient errors","One bit flip in CKKS ciphertext can break decryption if misplaced"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The masked conclusion rests on the assumption that after relinearization a fault hitting both uses of a component still leaves a valid ciphertext whose decryption error stays small; if relinearization mixes the injected error into both components in a way that breaks the cancellation, the masking result would not follow.","fun_headline_variants_meta":{"raw":{"variants":["CKKS bit flips: location decides if they poison output","In CKKS multiplication, fault timing and position decide corruption","Symmetry in CKKS multiplication masks or reveals transient errors","One bit flip in CKKS ciphertext can break decryption if misplaced"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000289,"raw_usage":{"total_tokens":1665,"prompt_tokens":891,"completion_tokens":774,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":507,"completion_tokens_details":{"reasoning_tokens":703}},"tokens_in":507,"tokens_out":774,"duration_ms":8285,"temperature":1.0,"reasoning_tokens":703,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T05:13:18.276552+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run pairwise fault injections on identical CKKS multiplications: one bit flip in $c_0$ that enters both $d_0$ and $d_1$, and the same flip restricted to $d_1$ only. If the decrypted maximum relative error in the first case is statistically indistinguishable from the second, the paper's algebraic masking claim is refuted; the distinction in Eqs. (5) and (6) predicts a clear gap.","supporting_citations":[{"cited_title":"Characterizing the sensitivity to individual bit flips in client-side operations of the ckks scheme,","cited_arxiv_id":null,"evidence_quote":"Earlier characterization of client-side CKKS bit-flip sensitivity that this paper extends to server-side multiplication."},{"cited_title":"Quantifying the bit- error resilience of fhe compute,","cited_arxiv_id":null,"evidence_quote":"Earlier quantification of FHE bit-error resilience that motivates the masked-versus-corrupted fault framing."}],"review_version":1}