all the parameters of the message-signature pairs, with the message often taking up a significant portion. To address the above problem, [PERSON] et al. [6] introduced the concept of message recovery: It enables the sender to avoid sending the signed message and to send only the signature, and it can recover the message while confirming the validity of the signature. This obviously decreases the quantity of information that needs to be transferred, which saves transmission bandwidth. Moreover, it is more convenient for both the sender and the receiver. The implementation of message recovery is considered as an encoding method [7, 8], as it involves adding additional information to the signature to achieve message recoverability. Since then, [PERSON] et al. [9] have proposed a signature scheme for message recovery with specified verifiers based on elliptic curves and bilinear pairs, and the scheme was proven to be secure under the stochastic prediction model. In 2020, [PERSON] et al. [10] proposed a provably secure elliptic curve-based digital signature authentication scheme with message recovery. Their scheme uses a hash token function instead of a hash function, allowing for reversed signature and verification procedures and message recovery from the signature r-component. In 2013, [PERSON] et al. [11] first introduced the concept of message recovery to lattice-based cryptography. In 2023, [PERSON] et al. [12] proposed an identity-based proxy signature scheme on the lattice, and it also worked with message recovery. The difference between traditional digital signatures and message recovery signatures is shown in Figure 1.  
Nevertheless, to the best of our knowledge, the group signature schemes currently proposed do not possess the functionality of message recovery. This will directly result in group members having to send additional messages to the verifier. Therefore, constructing a group signature scheme with message recovery (GS-MR) will reduce the amount of data received by the verifier and provide greater transparency and application scalability to group privacy scenarios. Furthermore, in domains such as federated learning, the GS-MR scheme has significant advantages over traditional group signature schemes. For example, in federated learning, participants train the model locally and send the model parameter updates to a central server, which aggregates these parameter updates and distributes the aggregated model parameters to the participants. The GS-MR scheme can be used to verify the integrity of the model parameters transmitted by the central server and to recover  
Figure 1: The difference between traditional digital signatures and message recovery signatures. the original model update information. This ensures that the model parameters are not tampered with during the transmission process and provides verifiability of the results to the participants. In addition, in certain scenarios, such as model analysis or debugging of model updates, federated learning may require the recovery of the original participant data without centralizing the raw data on the central server. The GS-MR scheme can facilitate the recovery of participants' original data from the group signatures, eliminating the need for centralized data collection. This helps protect the privacy of subscriber data and reduces the need for data transmission. With the continuous breakthroughs in the field of quantum computing, group signature schemes based on traditional number theory constructions are becoming insecure. In 1996, [PERSON] [13] introduced the lattice as a cryptographic system with a special algebraic structure. In the post-quantum era, lattice-based cryptography has become a hot research topic in cryptography because of its high asymptotic efficiency, parallelizability, and simplicity of operation. In addition, probabilistic polynomial-time efficient methods for solving difficult problems on lattice do not yet exist under quantum computers [14]. Thanks to the multiple advantages of lattices, [PERSON] et al.