Formal detection models for reaction attacks

Determine which aggregate detection heuristics, including query-volume and rejection-rate monitoring, can provably prevent secret-key recovery from CKKS validity-reaction oracles.

Background

The attack generates many validity queries and typically induces a high rejection rate, suggesting that aggregate monitoring could detect malicious behavior. The paper identifies formalizing detector models and proving their effectiveness as an unresolved direction, rather than establishing that any particular threshold or heuristic prevents key recovery.

References

We highlight four directions for future work: (i) Detection Models: Formalizing detector models to determine which aggregate heuristics (e.g., query volume, rejection rates) provably prevent key recovery; (ii) Closing Theoretical Gaps: Reducing the minimal query gap between our theoretical bound and the experimental average for sparse secrets (close to the $\approx 1.05$ gap in uniform ternary); (iii) Scheme Generality: Investigating whether similar reaction attacks threaten other widely deployed RLWE schemes, such as BGV and BFV; and (iv) Safe Validation: Designing output-validation mechanisms that support legitimate retries without leaking externally exploitable accept/reject bits.

— Reaction Attack on CKKS Deployments with Asymptotically Optimal Query Complexity  (2610.21127 - Bian et al., 15 Oct 2026) in Section 7, Conclusion and Open Questions

Note that variants utilizing IND-CPA${\text{D}}$-resistant noise flooding may also conform to this template if the flooding parameters remain below these strict margins; a full analysis under randomized-oracle flooding (where the reaction bit becomes probabilistic) is left for future work.

— Reaction Attack on CKKS Deployments with Asymptotically Optimal Query Complexity  (2610.21127 - Bian et al., 15 Oct 2026) in Section 5.3, Conditional Applicability to CKKS Variants