Tight query bounds for sparse-secret attacks

Reduce the gap between the theoretical reaction-query bound and the experimental average achieved by the sparse-secret CKKS attack.

Background

For sparse ternary secrets, the paper presents a group-testing attack using O(hlog⁡(N/h))O(h\log(N/h)) reaction queries and reports a remaining gap between the theoretical bound and the empirical average. Closing this gap is explicitly identified as an open direction, analogous to the approximately 1.05 gap reported for uniform ternary secrets.

References

We highlight four directions for future work: (i) Detection Models: Formalizing detector models to determine which aggregate heuristics (e.g., query volume, rejection rates) provably prevent key recovery; (ii) Closing Theoretical Gaps: Reducing the minimal query gap between our theoretical bound and the experimental average for sparse secrets (close to the $\approx 1.05$ gap in uniform ternary); (iii) Scheme Generality: Investigating whether similar reaction attacks threaten other widely deployed RLWE schemes, such as BGV and BFV; and (iv) Safe Validation: Designing output-validation mechanisms that support legitimate retries without leaking externally exploitable accept/reject bits.

— Reaction Attack on CKKS Deployments with Asymptotically Optimal Query Complexity  (2610.21127 - Bian et al., 15 Oct 2026) in Section 7, Conclusion and Open Questions