How the Cloud Secretly Directs a Drone Swarm Without a Leak express
A cloud service dishes out commands to a drone swarm without any knowledge of their movements. The signals are encrypted, but each maneuver leaves a barely visible trace in the cipher, like ink bleeding through paper from the pressure of a pen. Over time, these ink stains coalesce into a pattern, and the hidden data is no longer a secret.
Researchers liken this standoff to a waiting game. The attacker passively accumulates leaks, as if peeking at watermarks emerging on paper. His plans can be spotted the same way astronomers detect a planet by the faint dimming of a star. Once surveillance is detected, the defender doesn’t patch the cipher: they just swap the key, as if ripping out a used page and starting fresh. Thus a rhythm of key rotation emerges, dictated not by the cipher’s robustness but by how delay-sensitive the swarm is.
Surprisingly, swarm security depends not only on cryptography — the control channel’s bandwidth plays the lead role. The faster the drones can absorb a new key without veering off course, the less often it needs to be changed.
Original abstract
as written by the authors arXiv:2607.12742
Encrypted control lets a cloud coordinate a fleet of agents on fully homomorphically encrypted state, keeping their positions and commands private. The approximate scheme for real-valued control, CKKS, returns decryptions that carry the encryption noise, a key-recovery leak; the loop must decrypt to actuate, so the leak is unavoidable. Yet the security of approximate FHE is studied statically, encrypted control assumes an honest-but-curious cloud, and persistent-threat games never reach inside the cryptosystem. We model the loop's security under an advanced persistent threat as a two-phase game, passive reconnaissance then active manipulation, separated by a measured residual detector that sees only the manipulation. The passive phase reduces to the known flooding tradeoff; the active defense is re-keying, not bootstrapping, since only re-keying resets accumulated leakage. The active phase is a detection-evasion timing game: overt manipulation is caught, so the rational adversary stays stealthy, and at its Stackelberg equilibrium the defender re-keys on the laziest cadence that denies it, set by the control-theoretic fragility of the graph topology. The marginally-stable graph must re-key far more often than the well-connected one. A three-way tension among FHE precision, control accuracy, and re-key cadence sets where this game lives, between a securability floor and a static-suffices ceiling. The efficient secure point is that window, where re-keying is the price of precision efficiency. More broadly, security for an approximate cryptosystem in a feedback loop is a dynamic game whose defender's move is the scheme's own refresh, applying beyond control to any system that must repeatedly decrypt to act.
Noise in encrypted data is like an ink imprint: even if you erase the writing, the pen’s pressure leaves marks on the next page. These microscopic indentations give away the key: that’s why in cryptography, the pages themselves are torn out regularly.