## 5 Security and Privacy Analysis
### Privacy  
We now analyze the privacy properties of our architecture, focusing on the confidentiality guarantees provided by the privacy-preserving arbitration mechanism. **Theorem 4** (Homomorphic Encryption Confidentiality). : _The basic homomorphic encryption-based arbitration scheme provides computational indistinguishability of executor outputs against a semi-honest arbitration module, assuming the security of the underlying homomorphic encryption scheme._  
Proof. : Let \(\Pi=(KeyGen,Enc,Dec,Eval)\) be a semantically secure homomorphic encryption scheme. For any two distinct outputs \(O_{i}\) and \(O_{j}\) from executors, an adversary controlling the arbitration module observes only the ciphertexts \(C_{i}=Enc_{pk}(O_{i})\) and \(C_{j}=Enc_{pk}(O_{j})\). By the semantic security property of \(\Pi\), for any probabilistic polynomial-time adversary \(\mathcal{A}\), there exists a negligible function \(negl\) such that  
\[|\Pr[\mathcal{A}(Enc_{pk}(O_{i}))=1]-\Pr[\mathcal{A}(Enc_{pk}(O_{j}))=1]|\leq neg (n), \tag{31}\]  
where \(n\) is the security parameter. Similarly, the difference ciphertexts \(D_{ij}=C_{i}\odot C_{j}=Enc_{pk}(O_{i}-O_{j})\) reveal no information about the individual values \(O_{i}\) and \(O_{j}\) to the arbitration module, as the module cannot decrypt these values without the private key. Therefore, the basic scheme ensures that the arbitration module learns nothing about the actual executor outputs beyond what can be inferred from the publicly known encryption algorithm and public key. **Theorem 5** (Aggregated Differences Privacy). : _The communication-optimized scheme with aggregated differences preserves the confidentiality of individual executor outputs while revealing only the overall consistency status to the arbitration module._  
Proof. : In the communication-optimized scheme, the arbitration module computes an aggregated difference, as shown in Equation (7). The cloud platform decrypts this to obtain \(\Delta_{agg}=\sum_{i=1}^{n-1}\sum_{j=i+1}^{n}(O_{i}-O_{j})\). If all outputs are identical (i.e., \(\forall i,j:O_{i}=O_{j}\)), then \(\Delta_{agg}=0\). However, if at least one output differs, then \(\Delta_{agg}\
eq 0\) with overwhelming probability due to the algebraic properties of the output space. The arbitration module learns only a binary result: whether all outputs are consistent or not. In the consistent case, no additional information is revealed beyond the fact of consistency. In the inconsistent case, the system reverts to the basic scheme, which we have proven secure in Theorem 4. Therefore, the communication-optimized scheme preserves the confidentiality of individual executor outputs while efficiently determining their consistency status. **Theorem 6** (Adaptive Privacy Budget Security). : _The adaptive privacy budget scheme with parameter \(\varepsilon\) leaks at most \((1-\varepsilon)\times n\) bits of each \(n\)-bit executor output to the arbitration module, while maintaining the security properties of the basic scheme for the remaining \(\varepsilon\times n\) bits._  
Proof. : In the adaptive privacy budget scheme, each executor's output \(O_{i}\) of length \(n\) bits is divided into two parts:  
* \(O_{i}^{visible}\): The first \((1-\varepsilon)\times n\) bits, which are hashed and sent in the clear;
* \(O_{i}^{protected}\): The remaining \(\varepsilon\times n\) bits, which remain fully encrypted. For the visible portion, the arbitration module receives \(H(O_{i}^{visible})\) for each executor \(i\). Since cryptographic hash functions are one-way, the module cannot directly recover \(O_{i}^{visible}\). However, for low-entropy data or through offline dictionary attacks, the module may potentially recover up to \((1-\varepsilon)\times n\) bits of information. For the protected portion, the security reduces to that of the basic homomorphic encryption scheme, which we have proven secure in Theorem 4. Thus, the protected portion maintains computational indistinguishability against the arbitration module.