{ "schema_version": 1, "builder_plan": { "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.", "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.", "baseline": "Your existing checks with the same tasks, permissions, and tool responses.", "steps": [ "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.", "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.", "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.", "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test." ], "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.", "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation." }, "builder_review": null, "arxiv_id": "2610.08255", "title": "HE-OFT: Privacy-Preserving One-Shot Federated Fine-Tuning under Homomorphic Encryption", "summary": "HE-OFT replaces standard federated fine-tuning, in which participants exchange model or gradient updates and all receive the trained model, with a one-shot protocol where clients upload a single CKKS-encrypted classifier-head displacement over a frozen backbone and no party obtains the final model. The cost is severe: per-query inference takes 443-1713 s on one CPU core (56-255 s with GPU level restoration), accuracy falls to 61-79%, and the approach is restricted to low-rank adapters plus a head on text or vision classification. It can fail through the 4-15 point accuracy loss versus a disclosed model, the operational burden of multiparty CKKS key management and quorum decryption, and infeasible latency for any interactive production workload.", "rationale": "This targets a narrow regulatory setting where no participant may hold the trained model, and its multi-minute encrypted inference latency and accuracy loss make it impractical for a small team's production adoption on a single 24 GB GPU today.", "technique": "Encrypted one-shot federated fine-tuning (HE-OFT)", "family": "seguranca_e_guardrails", "recommendation": "observar", "published": "2026-10-06", "as_of": "2026-10-18", "editorial_status": "indexed", "source_url": "https://arxiv.org/abs/2610.08255", "independent_implementations": 0, "total_implementations": 1, "stars": 0, "citations": 0, "claims": [ { "claim_id": "claim-01", "statement": "HE-OFT replaces standard federated fine-tuning, in which participants exchange model or gradient updates and all receive the trained model, with a one-shot protocol where clients upload a single CKKS-encrypted classifier-head displacement over a frozen backbone and no party obtains the final model. The cost is severe: per-query inference takes 443-1713 s on one CPU core (56-255 s with GPU level restoration), accuracy falls to 61-79%, and the approach is restricted to low-rank adapters plus a head on text or vision classification. It can fail through the 4-15 point accuracy loss versus a disclosed model, the operational burden of multiparty CKKS key management and quorum decryption, and infeasible latency for any interactive production workload.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.08255", "source_page": null, "source_excerpt": "" }, { "claim_id": "claim-02", "statement": "HE-OFT reaches 61-79% accuracy across five tasks versus 20-48% for a client training alone, retaining 85-96% of the accuracy of a disclosed-model baseline.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.08255", "source_page": null, "source_excerpt": "" } ], "exposure_map": [ { "dimension": "quality", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compute", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "latency", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "operations", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compatibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "security", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "data_and_training", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "reproducibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" } ], "risks": [], "minimum_test": [], "open_questions": [], "independent_tests": [], "lab_reproductions": [], "report_available": false, "validation_tier": "unknown", "evidence_tier": "unknown", "infrastructure_basis": "unknown", "equations": [], "equations_status": "not_fetched", "core_kind": "", "equations_fetched_at": "", "equations_source_url": "", "equations_source_sha256": "", "exposures_reviewed_at": "", "exposures_source_sha256": "" }