Traceable Over-Threshold MP-PSI

• Traceable Over-Threshold MP-PSI is a protocol that reveals, for each over-threshold element, both the element and the exact set of parties holding it while only considering elements in the leader’s set.
• It combines techniques such as Shamir’s secret sharing, oblivious programmable PRFs, and optional OLE to provide threshold enforcement and traceability in a semi-honest security model.
• The protocol supports applications in network anomaly detection, digital forensics, and AML by offering efficient, traceable multi-party evidence corroboration despite exponential reconstruction complexity in t.

Searching arXiv for the cited protocol paper and adjacent MP-PSI/TPSI work. Traceable Over-Threshold Multi-Party Private Set Intersection (T-OT-MP-PSI) is a strengthening of threshold multi-party private set intersection in which the protocol discloses not only elements present in at least $t$ participants’ sets, but also the corresponding holders of each disclosed element. In the formulation studied in "Practical Traceable Over-Threshold Multi-Party Private Set Intersection" (Yang et al., 31 Dec 2025), there are $n \ge 3$ parties $P_0,\dots,P_{n-1}$, each holding a private set $S_i=\{e_0^i,\dots,e_{m-1}^i\}$ over a universe $\mathcal{U}$, and a fixed threshold $t$ with $1<t\le n$. For each element $e$, its multiplicity is $c(e)=|\{i\in[0,n-1]:e\in S_i\}|$, and the over-threshold target is $\{e\in\mathcal{U}:c(e)\ge t\}$. T-OT-MP-PSI makes this threshold intersection traceable by requiring the output party to learn, for each over-threshold element, the element itself, the number of parties holding it, and exactly which parties those are (Yang et al., 31 Dec 2025).

1. Formal functionality and traceability semantics

The functionality $n \ge 3$0 designates a single leader or output party $n \ge 3$1. Each $n \ge 3$2 provides its set $n \ge 3$3, the threshold $n \ge 3$4 is public, and the output is given only to $n \ge 3$5: $n \ge 3$6 while $n \ge 3$7 output $n \ge 3$8 (Yang et al., 31 Dec 2025). The traceability aspect is therefore explicit: for each over-threshold element, the leader sees exactly which parties hold it.

A defining semantic restriction is that only elements in $n \ge 3$9 can appear in the output. If $P_0,\dots,P_{n-1}$0 but appears in many other sets, it is ignored. This is not an implementation artifact but part of the stated ideal functionality. A common misconception is to equate this functionality with a symmetric threshold intersection over all parties; in fact, the construction is asymmetric, with $P_0,\dots,P_{n-1}$1 serving simultaneously as the leader and the reference set holder.

The motivation for this strengthening comes from settings in which mere discovery of shared elements is insufficient. The paper identifies regulatory and forensic scenarios in which one must also know who holds the suspicious artifact, for purposes such as attributing anomalies or alerts in network anomaly detection, constructing reliable evidence chains in digital forensics, and coordinating cross-institutional actions in AML or suspicious account analysis (Yang et al., 31 Dec 2025). This suggests that T-OT-MP-PSI is best understood not as a purely privacy-preserving set primitive, but as a threshold evidence-corroboration primitive with holder attribution.

2. Security model, leakage, and collusion thresholds

The protocols are proved in the semi-honest model, with simulation-based security in the standard indistinguishability sense: $P_0,\dots,P_{n-1}$2 Here $P_0,\dots,P_{n-1}$3 are the corrupted parties’ inputs, $P_0,\dots,P_{n-1}$4 their outputs from the ideal functionality, and $P_0,\dots,P_{n-1}$5 is the corrupted set (Yang et al., 31 Dec 2025).

The ideal leakage is sharply delimited. For each $P_0,\dots,P_{n-1}$6 with $P_0,\dots,P_{n-1}$7, the functionality reveals that fact and exactly which parties hold $P_0,\dots,P_{n-1}$8. It should reveal nothing about whether any non-output party holds a given $P_0,\dots,P_{n-1}$9 when $S_i=\{e_0^i,\dots,e_{m-1}^i\}$0, and nothing about elements not in $S_i=\{e_0^i,\dots,e_{m-1}^i\}$1. Traceability therefore increases intentional leakage for over-threshold elements, but only for those elements.

Two security envelopes are distinguished. ET-OT-MP-PSI is secure against collusion of up to $S_i=\{e_0^i,\dots,e_{m-1}^i\}$2 semi-honest parties. ST-OT-MP-PSI is secure against collusion of up to $S_i=\{e_0^i,\dots,e_{m-1}^i\}$3 semi-honest parties. The corresponding informal theorems are: $S_i=\{e_0^i,\dots,e_{m-1}^i\}$4 for ET-OT-MP-PSI, and

$S_i=\{e_0^i,\dots,e_{m-1}^i\}$5

for ST-OT-MP-PSI (Yang et al., 31 Dec 2025).

The distinction is driven by a specific leakage channel in the efficient protocol. In ET-OT-MP-PSI, if $S_i=\{e_0^i,\dots,e_{m-1}^i\}$6 parties collude, they can exploit Shamir’s structure and the reconstructibility of zero-share polynomials to test whether an honest party holds an element even when $S_i=\{e_0^i,\dots,e_{m-1}^i\}$7. In ST-OT-MP-PSI, the update shares are made dependent on both the element and cross-party OLE, so that a corrupted coalition of size $S_i=\{e_0^i,\dots,e_{m-1}^i\}$8 can test membership only when enough of them also hold the element, in which case the result is already implied by the ideal output. The paper’s security interpretation is therefore not merely that ST has a larger corruption threshold, but that it aligns the residual inferable information with the ideal functionality.

3. Core cryptographic structure

The constructions combine Shamir’s secret sharing, oblivious programmable pseudorandom functions (OPPRF), hashing-based binning, and in the stronger variant, oblivious linear evaluation (OLE) (Yang et al., 31 Dec 2025).

Shamir’s sharing supplies the threshold mechanism. A dealer chooses a secret $S_i=\{e_0^i,\dots,e_{m-1}^i\}$9, random coefficients $\mathcal{U}$0, and defines

$\mathcal{U}$1

Party $\mathcal{U}$2 receives share $\mathcal{U}$3, and any $\mathcal{U}$4 shares reconstruct

$\mathcal{U}$5

A zero-sharing refresh polynomial

$\mathcal{U}$6

updates shares without changing the underlying secret or threshold (Yang et al., 31 Dec 2025).

OPPRF supplies conditional share delivery. The sender programs points $\mathcal{U}$7, the receiver inputs queries $\mathcal{U}$8, and the receiver learns $\mathcal{U}$9 on programmed matches and random values otherwise. In these protocols, $t$0 typically programs a share destined for $t$1 at each element $t$2, and $t$3 queries its local elements. If $t$4, then $t$5 gets the true share $t$6; otherwise it gets a random field element. Receiver-side indistinguishability between true shares and random outputs is central to privacy (Yang et al., 31 Dec 2025).

Hashing is used to scale OPPRF to large sets. The notation includes $t$7 bins, Cuckoo hashing $t$8, Simple hashing $t$9, and $1<t\le n$0, the maximum padded Simple-hash bin size. Padding hides bin load. The paper uses Simple hashing for senders and Cuckoo hashing for receivers so that there is at most one receiver item per bin (Yang et al., 31 Dec 2025).

In ST-OT-MP-PSI, OLE is introduced in the share-update phase. Base OLE has sender input $1<t\le n$1, receiver input $1<t\le n$2, and receiver output $1<t\le n$3. The implementation uses an RLWE-based OLE over a 128-bit effective modulus $1<t\le n$4, represented as a product of 32-bit primes. This OLE layer creates a three-party correlation linking $1<t\le n$5’s element, $1<t\le n$6’s element, and helper-party zero-share contributions. When the elements match, the extra term cancels; when they do not, the resulting share is information-theoretically random to $1<t\le n$7 (Yang et al., 31 Dec 2025).

4. ET-OT-MP-PSI and ST-OT-MP-PSI

ET-OT-MP-PSI has three phases: conditional secret sharing, secret-share update, and conditional collection with reconstruction. In the first phase, for each $1<t\le n$8, $1<t\le n$9 samples

$e$0

and computes shares

$e$1

Hashed OPPRF then delivers $e$2 to $e$3 if and only if $e$4 holds the same element; otherwise $e$5 receives a random field element $e$6 (Yang et al., 31 Dec 2025).

In the second phase, each $e$7 for $e$8 samples a zero-sharing polynomial $e$9 for each bin $c(e)=|\{i\in[0,n-1]:e\in S_i\}|$0, sends evaluations to all parties, and each party computes

$c(e)=|\{i\in[0,n-1]:e\in S_i\}|$1

This produces a fresh sharing of secret $c(e)=|\{i\in[0,n-1]:e\in S_i\}|$2. $c(e)=|\{i\in[0,n-1]:e\in S_i\}|$3 updates its own share as

$c(e)=|\{i\in[0,n-1]:e\in S_i\}|$4

and the other parties incorporate their $c(e)=|\{i\in[0,n-1]:e\in S_i\}|$5 contributions in the later OPPRF transfer (Yang et al., 31 Dec 2025).

In the third phase, each $c(e)=|\{i\in[0,n-1]:e\in S_i\}|$6 programs

$c(e)=|\{i\in[0,n-1]:e\in S_i\}|$7

into an OPPRF back to $c(e)=|\{i\in[0,n-1]:e\in S_i\}|$8. If $c(e)=|\{i\in[0,n-1]:e\in S_i\}|$9, then $\{e\in\mathcal{U}:c(e)\ge t\}$0 receives a correct refreshed share $\{e\in\mathcal{U}:c(e)\ge t\}$1; otherwise $\{e\in\mathcal{U}:c(e)\ge t\}$2 is random. For each $\{e\in\mathcal{U}:c(e)\ge t\}$3, $\{e\in\mathcal{U}:c(e)\ge t\}$4 considers all subsets of size $\{e\in\mathcal{U}:c(e)\ge t\}$5 that include its own share, interpolates a candidate polynomial, and checks whether the reconstructed secret equals $\{e\in\mathcal{U}:c(e)\ge t\}$6. If so, the element is over-threshold, and the full holder set is recovered by checking which $\{e\in\mathcal{U}:c(e)\ge t\}$7 lie on the reconstructed polynomial (Yang et al., 31 Dec 2025).

ST-OT-MP-PSI preserves this three-phase structure but changes both the shared secret and the refresh logic. Instead of using $\{e\in\mathcal{U}:c(e)\ge t\}$8 directly as the Shamir secret, $\{e\in\mathcal{U}:c(e)\ge t\}$9 chooses a fresh random value $n \ge 3$00 uniquely mapped to $n \ge 3$01, and shares $n \ge 3$02. This ensures that even if $n \ge 3$03 parties collude and reconstruct the secret, they recover only the random label $n \ge 3$04, not $n \ge 3$05 directly (Yang et al., 31 Dec 2025).

The modified update phase uses OLE-generated values $n \ge 3$06 at $n \ge 3$07 and $n \ge 3$08 at $n \ge 3$09, indexed by a slot $n \ge 3$10, so that the final collected share becomes

$n \ge 3$11

If $n \ge 3$12, the last term vanishes and the share is correct; otherwise it is random and useless for reconstruction (Yang et al., 31 Dec 2025). The paper characterizes this as the mechanism that breaks the membership-test attack possible in ET-OT-MP-PSI.

5. Complexity and empirical performance

The central asymptotic distinction is between the sharing and communication phases, which are polynomial, and the reconstruction phase, which remains exponential in the threshold parameter. For each element, reconstruction considers $n \ge 3$13 subsets, giving the bound

$n \ge 3$14

The paper explicitly attributes the exponential term to reconstruction (Yang et al., 31 Dec 2025).

Protocol	Main asymptotic features	Corruption tolerance
Mahdavi et al.	Communication $n \ge 3$15; computation $n \ge 3$16	$n \ge 3$17, under extra non-collusion assumptions between special roles
ET-OT-MP-PSI	Leader and client communication $n \ge 3$18; leader computation $n \ge 3$19	$n \ge 3$20
ST-OT-MP-PSI	Leader communication $n \ge 3$21; client communication $n \ge 3$22; leader computation $n \ge 3$23	$n \ge 3$24

The implementation uses C++ with NTL and Boost, Shamir sharing over the largest 128-bit prime $n \ge 3$25, a table-based OPPRF adapted to $n \ge 3$26 by replacing XOR with modular addition and subtraction, and for ST-OT-MP-PSI an RLWE-based OLE extended to a 128-bit modulus via CRT on four 32-bit primes, requiring four OPPRF invocations per logical share. The reported hardware is a 3.1GHz Xeon with 80 vCores and 192GB RAM in a LAN setting, with 128-bit elements (Yang et al., 31 Dec 2025).

The measured runtimes are averaged over 10 runs. For ET-OT-MP-PSI with $n \ge 3$27, runtimes are $n \ge 3$28 s at $n \ge 3$29, $n \ge 3$30 s at $n \ge 3$31, $n \ge 3$32 s at $n \ge 3$33, and $n \ge 3$34 s at $n \ge 3$35. For ST-OT-MP-PSI with the same $n \ge 3$36 and $n \ge 3$37, the runtimes are $n \ge 3$38 s, $n \ge 3$39 s, and $n \ge 3$40 s at $n \ge 3$41, respectively. The paper states that runtimes scale linearly in $n \ge 3$42, as expected (Yang et al., 31 Dec 2025).

Against Mahdavi et al.’s protocol, the reported benchmark improvements are large. For $n \ge 3$43, $n \ge 3$44, and $n \ge 3$45, Mahdavi et al. require $n \ge 3$46 s total, ET-OT-MP-PSI requires $n \ge 3$47 s, and ST-OT-MP-PSI requires $n \ge 3$48 s, corresponding to approximately $n \ge 3$49 and $n \ge 3$50 speedups. For $n \ge 3$51, $n \ge 3$52, and $n \ge 3$53, Mahdavi et al. require $n \ge 3$54 s, ET-OT-MP-PSI requires $n \ge 3$55 s, and ST-OT-MP-PSI requires $n \ge 3$56 s, corresponding to approximately $n \ge 3$57 and $n \ge 3$58 speedups (Yang et al., 31 Dec 2025). A second common misconception is that the stronger protocol simply dominates the efficient one; in fact, ST-OT-MP-PSI deliberately trades higher communication and OLE overhead for the jump from $n \ge 3$59 to $n \ge 3$60 corruption tolerance.

6. Relation to prior work, adjacent directions, and limitations

Earlier MP-PSI protocols, including work by Freedman et al., Cheon et al., Kolesnikov et al., Chandran et al., and Wu et al., focus on exact intersection $n \ge 3$61 or its cardinality, typically with full anonymity. Threshold variants, including work by Kissner–Song, Miyaji–Nishida, Bay et al., Chandran et al., Ma et al., and Yang et al., compute elements present in at least $n \ge 3$62 sets, but almost all are anonymous and do not reveal holder identities. Mahdavi et al. are identified as the first explicit traceable OT-MP-PSI construction, using OPRF, Shamir secret sharing, and Paillier HE, but with security only against $n \ge 3$63 colluding semi-honest parties under a non-collusion assumption between special roles, and with computational complexity $n \ge 3$64 (Yang et al., 31 Dec 2025).

Within this lineage, the distinguishing features of the 2025 construction are the explicit T-OT-MP-PSI functionality, removal of any special non-collusion role assumption, an efficient protocol in the Shamir-plus-OPPRF regime, and a security-enhanced protocol that upgrades the corruption threshold to $n \ge 3$65 by adding OLE-based three-party share updates (Yang et al., 31 Dec 2025). A plausible implication is that the main conceptual novelty is not traceability alone, but the design of share-update rules that prevent below-threshold membership testing by colluding semi-honest parties.

The stated limitations are equally important. The security model is semi-honest; no malicious security is provided. Reconstruction still has exponential cost in $n \ge 3$66, so the protocols remain practical only for moderate $n \ge 3$67 and $n \ge 3$68. In ST-OT-MP-PSI, OLE and CRT-based implementation add overhead. The functionality has only one output party $n \ge 3$69, and extending it to multi-output or fully symmetric output is left as an open direction (Yang et al., 31 Dec 2025).

Adjacent research directions clarify the boundaries of the primitive. "Quantum Multi-Party Threshold Private Set Intersection with Explicit Cardinality Testing" (Gong et al., 26 Jun 2026) studies a different threshold semantics: it computes the one-bit predicate $n \ge 3$70 and reveals the intersection only conditionally, using hidden-label measurement vectors, OLE-based inner products, and a lightweight garbled circuit. It does not target holder traceability. "Verifiable and Collusion-Resistant Multi-Party Quantum Private Set Operations" (Gong et al., 26 Jun 2026) develops a verifiable MP-QPSI framework with a malicious TP, threshold FHE, and trap-based verification, but, as its detailed formulation makes explicit, there is no threshold $n \ge 3$71 in that paper and no explicit functionality $n \ge 3$72. These neighboring lines suggest that traceability, explicit threshold testing, and verifiable outsourced execution remain partially orthogonal design axes rather than a single unified primitive.

The motivating applications remain those in which multiple independent data owners must discover evidence corroborated by at least $n \ge 3$73 parties and must know which parties those are: network anomaly detection, digital forensics, and suspicious account analysis or AML (Yang et al., 31 Dec 2025). In such settings, T-OT-MP-PSI formalizes a specific balance between privacy and attributable disclosure: only elements appearing in at least $n \ge 3$74 sets are revealed, together with the exact set of parties holding each such element, and nothing more.