Oversized salary
Submit 4,000,000,000 into a 24-bit Sum circuit. The malicious client constructs a malformed encoding directly.
01
One report, two envelopes
Choose a measurement, split it, then let both aggregators contribute a verifier share. Only their combined verifier can accept.
24-bit range: 0 to 16,777,215. Client-side limits are convenience, not the defense.
- 1Enter
- 2Shard
- 3Prepare
- 4Collect
02
Collector tally
The protocol result is computed from output shares. The plain sum is computed separately and compared.
03
Make the verifier say no
These controls bypass the friendly input path and attack the real proof preparation code.
Damaged proof share
Flip one Field64 element after sharding. The salary shares are untouched; proof consistency fails.
Replayed report
Send the identical report twice. Preparation verifies it again and accepts it again; only this lab's nonce registry, outside the VDAF, refuses the duplicate.
TRUST ASSUMPTION
Put both envelopes on one desk
One aggregator sees only a random-looking share. If both aggregators collude, their shares add back to the encoded input.
04
What a valid proof cannot prove
A validity proof checks the circuit statement, not the world outside it.
NEGATIVE CLAIM 01
A well-formed lie still passes
Prio3 checks that a report is in range and correctly shared. It cannot check that the report is true.
NEGATIVE CLAIM 02
A private share can reveal a public total
Prio3 does not add differential privacy. With one accepted report, the aggregate is the report.
05
Pinned evidence
Runtime checks use the same deterministic inputs as the committed unit tests.
Protocol scope and extension seams
Real here
- Field64 arithmetic and serialization
- TurboSHAKE128 with domain byte 1
- BBCGGI19 FLP prove, query, and decide
- Prio3Count and bounded Prio3Sum
Not this lab
- DAP transport or HTTP
- Poplar1 or IDPF
- SumVec or Histogram
- Differential privacy on the result
- More than two aggregators
Extension seams
- Vector circuits in
src/flp/circuit.ts - DP after
unshard() - Additional VDAF instances beside Prio3