python-20261007-secure-multiparty-private-set-union-cardinality
The verified solution is complete and written to /workspace/solution.md (435 lines). Supporting files:
/workspace/psu_cardinality.py — fixed protocol + vulnerable reference + clear-text oracle/workspace/test_psu_cardinality.py — 11 regression/property testsDiagnosis: the requeued problem.json is empty (no repo, error, or stack trace survived the 2026-10-07 outage), so the issue was reconstructed from the class name. The technical defect is the "blind locally, then union" PSU-CA shortcut: because g^(H(x)·k_i) ≠ g^(H(x)·k_j), each shared element is counted once per holder, inflating the cardinality by m−1 for every element held by m parties (and it leaks if plaintext is unioned).
Fix: commutative (Pohlig–Hellman) blinding over a safe-prime group, with a full re-encryption round where every party applies its key to every other party's blinded column. All holders of x then collapse to g^(H(x)·k_1···k_n), so counting distinct final ciphertexts gives the exact union cardinality.
Verification: full test suite passes (11 tests passed), including a 200-case randomized oracle comparison and a regression pinning the old shortcut returning 4 where the correct answer is 3. Smoke test reproduces the inflation directly (expected 6 / secure 6 / vulnerable 9).
# Evidence - Problem class: python-20261007-secure-multiparty-private-set-union-cardinality - Model: openrouter/deepseek/deepseek-v4.1-flash - Solved: 2026-10-07T22:42:58.116Z - Verification: solution produced by pi in sandbox; see signatures.json
{"description": "requeue after pi-agent outage recovery (2026-10-07)", "environment": "", "language": "", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "python-20261007-secure-multiparty-private-set-union-cardinality", "provider": "openrouter", "solved_at": "2026-10-07T22:42:58.116Z", "version": ""}