A secret tampering detection system, in which σ represents an arbitrary integer of 1 or more, N and D represent predetermined natural numbers, i represents each integer of 0 or more and less than σ, and j represents each integer of 0 or more and less than D, the secret tampering detection system including at least three secret tampering detection apparatuses (1 1,..., 1 K), the secret tampering detection system inputting a share [ → x] that becomes a vector → x with N elements when reconstructed and a share [ → y] that becomes a vector → y with N elements when reconstructed, and outputting a share [ → z] that becomes a vector → z when reconstructed, the vector → z being a result of multiplying the vector → x and the vector → y for each of the elements, wherein each of the secret tampering detection apparatuses (1 1,..., 1 K) includes: a random number generation part adapted to generate, for each integer i, σ shares [ → r i] each of which becomes a random number vector → r i with N+D elements when reconstructed and σ shares [ → s i] each of which becomes a random number vector → s i with N+D elements when reconstructed; a random number multiplication part adapted to multiply, for each integer i, the share [ → r i] and the share [ → s i] by secure computation to generate σ shares [ → t i] each of which becomes a vector → t i when reconstructed, the vector → t i being a result of multiplying the vector → r i and the vector → s i for each of the elements; a secret multiplication part adapted to multiply the share [ → x] and the share [ → y] by secure computation to generate the share [ → z]; a random number verification part adapted to randomly select, for each integer i, D different integers p i,j, D being 0 or more and less than D+N, and discloses a p i,j -th element of each of the shares [ → r i], [ → s i], [ → t i], to confirm whether a set of the disclosed values corresponding respectively to the shares [ → r i], [ → s i], [ → t i] has integrity as multiplication; a random number substitution part adapted to generate, for each integer i, shares [ → r' i], [ → s' i], [ → t' i] obtained by performing random substitution on elements of each of the shares [ → r i], [ → s i], [ → t i] except for the p i,j -th element; a subtraction value disclosure part adapted to compute and disclose [ → x- → r' i], [ → y- → s' i] for each integer i; a verification value computing part adapted to compute, for each integer i, [ → c i]:=[ → z]-( → x- → r' i)[ → y]-( → y- → s' i)[ → r' i]-[ → t' i] to generate a share [ → c i] that becomes a vector → c i of a verification value c i when reconstructed; and a verification value confirmation part adapted to confirm, for each integer i, that the verification values c i are all zero by using the share [ → c i]. a random number generation part adapted to generate, for each integer i, σ shares [ → r i] each of which becomes a random number vector → r i with N+D elements when reconstructed and σ shares [ → s i] each of which becomes a random number vector → s i with N+D elements when reconstructed; a random number multiplication part adapted to multiply, for each integer i, the share [ → r i] and the share [ → s i] by secure computation to generate σ shares [ → t i] each of which becomes a vector → t i when reconstructed, the vector → t i being a result of multiplying the vector → r i and the vector → s i for each of the elements; a secret multiplication part adapted to multiply the share [ → x] and the share [ → y] by secure computation to generate the share [ → z]; a random number verification part adapted to randomly select, for each integer i, D different integers p i,j, D being 0 or more and less than D+N, and discloses a p i,j -th element of each of the shares [ → r i], [ → s i], [ → t i], to confirm whether a set of the disclosed values corresponding respectively to the shares [ → r i], [ → s i], [ → t i] has integrity as multiplication; a random number substitution part adapted to generate, for each integer i, shares [ → r' i], [ → s' i], [ → t' i] obtained by performing random substitution on elements of each of the shares [ → r i], [ → s i], [ → t i] except for the p i,j -th element; a subtraction value disclosure part adapted to compute and disclose [ → x- → r' i], [ → y- → s' i] for each integer i; a verification value computing part adapted to compute, for each integer i, [ → c i]:=[ → z]-( → x- → r' i)[ → y]-( → y- → s' i)[ → r' i]-[ → t' i] to generate a share [ → c i] that becomes a vector → c i of a verification value c i when reconstructed; and a verification value confirmation part adapted to confirm, for each integer i, that the verification values c i are all zero by using the share [ → c i].