ダークプール研究系統図 2019

2 つの流れ、1 つの問題

From 2019 to 2025, two independent groups attacked the MPC-based ダークプールの問題に反対の方向から取り組んだ. ブリストル線はマッチング機構の実現可能性; JPM 線は暗号学的正確性. それらは the 2022 年の方向漏洩問題で合流した.

The Direction Leakage Problem The Bristol line's 2019-2020 papers leaked buy/sell direction to operators — a critical プライバシー flaw identified by JPM's pp-dark-pools-2020. This became the unifying problem that forced both lines to evolve. Cartlidge solved it in 2022 via bucket quantization; JPM had already used FHE from day 1.

Why Only Prime Match Shipped Prime Match succeeded by accepting radical simplifications: abandon price discovery, abandon CDA, abandon FHE, let the bank be a trusted operator. The result: only min(x,y) needed, linear operations only, extremely cheap malicious security. Research purity vs. shipping reality.

The 収束 Point kicking-the-bucket-2022 is the sole paper where Polychroniadou (JPM) co-authored with the Bristol team. It synthesized Bristol's multi-asset approach with JPM's direction-hiding mandate. But even this collaboration didn't bridge the production gap.

What Was Never Solved Price discovery remains an open problem in プライバシー-preserving dark pools. All production systems (Prime Match, Atlas-X) sidestep it entirely — they use external price benchmarks (NBBO, VWAP) or don't need price at all. A true プライバシー-preserving price discovery mechanism doesn't exist yet.

Capability Summary

Paper	Line	Dir. Hidden	Multi-Instr	Operators	Collusion	Price Disc.	Production
mpc-dark-side-2019	Bristol	✗	✗	2-3	weak	✗	✗
turquoise-plato-2020	Bristol	✗	✓	3	weak	ext NBBO	✗
kicking-the-bucket-2022	収束	✓	△	3	weak	ext NBBO	✗
all-for-one-2022	Bristol	✓	✗	≤100	strong	ext NBBO	✗
pp-dark-pools-2020	JPM	✓	✗	1 (FHE)	N/A	✗	✗
secret-match-2020	JPM	✓	✗	threshold	N/A	✗	✗
priority-queue-2023	JPM	✓	△	3-party	honest-maj	CDA polylog	✗
prime-match-2023	JPM	△ (price pub)	~10	bank	bank trust	✗	★ PROD
atlas-x-2024	JPM	✓ (DP noise)	N/A axe	JPM	N/A	N/A	★ PROD

ブリストル/KU ルーヴェン系

Cartlidge, Smart, and Talibi Alaoui drove this line from 2019 to 2022, progressively scaling from a 3-mechanism feasibility study to a full multi-asset exchange simulation. They solved direction leakage only when Polychroniadou joined in 2022.

mpc-dark-side-2019

AsiaCCS 2019

Cartlidge, Smart, Talibi Alaoui

MPC SCALE-MAMBA Feasibility

Question Which of 3 マッチング機構s (CDA / periodic / volume match) is practical via MPC? Answer Volume match at ~800 orders/sec is practical. CDA: only 10–50 orders/sec — too slow. Setup 2–3 MPC operators, single instrument, SCALE-MAMBA framework

Direction (buy/sell) leaks to operators. Multi-instrument unsupported. Only 2–3 operators allowed.

turquoise-plato-2020

preprint 2020

Cartlidge, Smart, Talibi Alaoui

MPC Multi-Asset Scale

Question Can the single-instrument PoC scale to a real exchange? Target: Turquoise Plato Uncross — Europe's largest ダークプール. Answer 4000+ instruments × €10B daily — commercial viability demonstrated. Key Innovation Instrument identifiers also secret-shared — parties don't learn which instrument is being matched. First multi-asset MPC ダークプール.

Direction still leaks. Collusion resistance remains weak. "Who is the operator?" unanswered.

kicking-the-bucket-2022

preprint 2022

Cartlidge, Smart, Talibi Alaoui + Polychroniadou (JPM)

収束 MPC Direction Hidden

Question Can buy/sell direction also be hidden from operators? Answer Bucket quantization — reduce orders to equal-amount buckets, then mix in zero-volume orders to hide participation itself. Direction fully hidden. Historical Significance FIRST paper where Polychroniadou co-authored with the Bristol team. The two streams formally merged here.

Bucket quantization solves the direction leakage problem that JPM had identified in 2020. Two research lines achieve synthesis.

"Who acts as operator?" still unresolved. Collusion resistance still weak. Single-instrument experiment only in this paper.

all-for-one-darkpool-2022

preprint 2022

Cartlidge, Smart, Talibi Alaoui

No-Operator Collusion Resist. MPC

Question Can all ≤100 participants themselves be operators, eliminating trusted third parties? Answer AWS hosting cost under $1/auction. Two scenarios: Liquidnet-type (100 institutions = all operators) vs Plato-type (25 major stakeholders = operators). Strong collusion resistance achieved. Scenarios Liquidnet: 100 institutions each run one operator node. Plato: 25 major stakeholders as operators, rest are clients.

Single-instrument experiment only. Price discovery still unsolved. Never demonstrated at production scale.

Bristol Line Trajectory Summary The Bristol line made steady, incremental progress: マッチング機構の実現可能性 (2019) → real-world scale (2020) → direction hiding via collaboration (2022) → operator elimination (2022). Each paper cleanly solved one residual problem from the prior paper. But none reached production — each solution introduced new complexity that made deployment harder.

JPMorgan AI Research Line

Polychroniadou and collaborators attacked the problem from a 暗号学的正確性 standpoint from day 1. They prioritized direction プライバシー (FHE), then discovered the production path required abandoning FHE and CDA entirely. Two systems reached live deployment.

pp-dark-pools-aamas-2020

AAMAS 2020

Polychroniadou, Asharov

FHE Critique Extended Abstract

Critique of Bristol Line (1) Collusion risk remains. (2) "Extra operator" identity unclear. (3) Direction leaks to operators — fundamental flaw. Proposal Single operator + FHE. Direction fully hidden without any direction-aware computation outside encrypted domain.

Single-instrument. No price discovery. FHE performance uncharacterized at this stage.

secret-match-icaif-2020

ICAIF 2020

Polychroniadou, Balch et al.

TFHE GPU Post-Quantum

Implementation Threshold TFHE with GPU-parallel integer FHE library. Full paper implementation of pp-dark-pools. Key Features FIFO fairness (not just price-time priority). Star-shaped network — clients never communicate with each other, only with operator. Post-quantum security from TFHE lattice basis. Evaluation ABIDES market simulator. Demonstrated correctness, not production throughput.

FHE still too slow for production volumes. Threshold setup overhead significant.

priority-queue-pets2023

PETS 2023

Polychroniadou et al.

MPC Theoretical Best Never Deployed

貢献 New data-independent priority queue: amortized polylog insertion, constant-time read-front. Breaks Toft's prior barrier on oblivious data structures. Result MPC-based CDA at ~136 tx/sec on sorted orderbook — 2–3 orders of magnitude faster than any prior work. Status Best theoretical result in the field. Published the same year Prime Match was running in production with a vastly simpler approach.

Highest theoretical throughput achieved for プライバシー-preserving CDA. Demonstrates the research-production gap: academic best ≠ what ships.

prime-match-2023 ★

USENIX Security 2023

Polychroniadou, Balch et al.

PRODUCTION MPC World First

Key Strategic Pivots Abandoned FHE (too slow). Abandoned CDA (too slow). Abandoned price discovery entirely. Result: only min(x,y) computation needed = linear operations only. Performance ~10 instruments/sec, 2–3 rounds. Extremely cheap malicious security from linearity. Historical Note Deployment began September 2021 — 18+ months before the paper was published. World's first MPC system in production in the financial industry.

Linear operations only → malicious security essentially free. The simplification that made production possible.

atlas-x-aamas2024 ★

AAMAS 2024

Polychroniadou et al.

PRODUCTION Differential Privacy Not MPC

Different Approach Differential Privacy (not MPC) for axe inventory list leakage. Continual observation DP aggregator with concentrated client direction hiding. Scale 3 regions (USA / Europe / Asia) × 2 years in production. "First DP deployment in the banking industry." Problem Solved Banks' axe lists (inventory they want to trade) were leaking client direction. DP adds calibrated noise to protect this without destroying utility.

Shows JPM's pragmatism: if DP solves the problem cheaper than MPC, use DP. Tool selection by fit, not ideology.

収束: The Direction Leakage Problem

Direction leakage — the leaking of buy/sell intent to operators — was the cross-cutting problem that forced both research lines to evolve. It was identified by JPM in 2020 and solved by the collaborative paper in 2022.

The Direction Leakage Problem — Detailed

Bristol's Blind Spot (2019–2020)

Cartlidge's MPC protocols revealed buy/sell direction to operators during matching. An operator running the MPC sees which input slots are buys and which are sells — they just can't see the quantities or identities directly. But direction alone can be highly sensitive: if a large institution is accumulating (all buys), counterparties can front-run.

This wasn't treated as a critical flaw by the Bristol line initially — the focus was on scale and commercial viability.

JPM's Starting Point

Polychroniadou's 2020 AAMAS abstract led with the direction leakage critique. The entire FHE approach was motivated by ensuring operators compute on encrypted inputs without ever learning direction. This is a different philosophical stance: プライバシー as a hard requirement from day 1, not an incremental addition.

FHE achieves this by design — the operator performs homomorphic min(x,y) without ever decrypting inputs.

Philosophical Comparison

Bristol Philosophy

Start with practical feasibility
Build incrementally: single → multi-instrument
Scale to real exchanges first, security later
MPC with secret-shared identifiers
Multiple operators = distributed trust
Favor collusion-resistant architecture

JPM Philosophy

Start with cryptographic security guarantees
Direction プライバシー is non-negotiable
Single trusted operator acceptable if bank is trustworthy
FHE first, optimize later (or abandon)
Ship what works, even if simplified
DP acceptable when MPC overkill

Full Capability Comparison

Property	Bristol (peak: kicking-the-bucket)	JPM (peak: prime-match)
Direction Privacy	✓ (bucket quantization)	△ (prices public, quantities hidden)
Multi-Instrument	✓ (secret-shared identifiers)	~10 instruments/sec
Operator Model	3-party MPC or ≤100 participants	Bank as trusted single operator
Collusion Resistance	✓ (all-for-one model)	Bank-trust model (no collusion resistance)
Price Discovery	External NBBO benchmark	None (abandoned)
Malicious Security	Honest-majority assumed	✓ (from linearity of min(x,y))
Production	✗	★ Since Sept 2021
Post-Quantum	✗	✓ (TFHE lattice basis)

Why the 収束 Didn't Lead to Deployment kicking-the-bucket-2022 synthesized the best of both lines. But the resulting protocol was still 3-operator MPC with bucket quantization complexity — still too complex for a bank to operate. JPM's production path required abandoning the complexity, not adding to it. The academic synthesis and the production system evolved separately after 2022.

The 本番化ギャップ

Eight research papers. One production system. Why did only Prime Match ship? The answer is a series of deliberate simplifications — each one trading research richness for operational feasibility. Understanding this tradeoff matrix is the key insight of the entire genealogy.

Prime Match's Production Secret Prime Match launched in September 2021, 18+ months before its paper was published. It succeeded by accepting three radical simplifications: (1) No price discovery — use external NBBO. (2) No CDA — batch periodic matching only. (3) No FHE — just min(x,y) which is linear. Linearity makes malicious security essentially free.

Per-Paper: What Was Given Up

mpc-dark-side-2019 Bristol

Volume match mechanism, SCALE-MAMBA performance baseline

CDA (too slow), direction プライバシー, multi-instrument

Correct prioritization for a feasibility study. But the gaps became the research agenda for the next 5 years.

turquoise-plato-2020 Bristol

Multi-instrument, real-world scale, commercial viability evidence

Direction プライバシー, collusion resistance

Adding multi-instrument was the right priority for the 2020 extension. JPM's critique hadn't been absorbed yet.

kicking-the-bucket-2022 収束

Direction プライバシー (bucket quantization), multi-asset capability

Performance (bucket overhead), collusion resistance, price discovery

Solved the right problem but added complexity that pushed production further away, not closer.

all-for-one-2022 Bristol

Collusion resistance (no-operator model), strong security guarantees

Performance (all participants = operators is expensive), single-instrument only

Maximum security, minimum deployability. Pure research exploration of the theoretical upper bound.

priority-queue-pets2023 JPM Research

Theoretical best CDA throughput, data-independent プライバシー guarantee

Deployment relevance (Prime Match already running with simpler approach)

Great paper, wrong timing. By the time this was published, JPM had already shipped the opposite philosophy.

prime-match-2023 ★ PRODUCTION

Malicious security (from linearity), multi-instrument (~10), real throughput, actual deployment

Price discovery, direction プライバシー on price (price is public), CDA, FHE, multi-operator

Accepted every simplification necessary. The paper explicitly acknowledges these as intentional architectural choices, not limitations to be fixed later.

Roadmap: What Needs to Be Solved for the Next Generation

Open Problem 1: Private Price Discovery No production system solves this. All use external benchmarks. A true プライバシー-preserving price formation mechanism would require a sorted, private orderbook in real-time — the exact problem priority-queue-pets2023 approaches theoretically but hasn't deployed. Estimated difficulty: 5+ years.

Open Problem 2: Collusion-Resistant Production Prime Match trusts the bank entirely. all-for-one-2022 has strong collusion resistance but no deployment path. Bridging these — a production system with non-trivial collusion resistance — requires solving the operator coordination problem. MPC with TEE operators may be the path.

Next Step 1: TEE + MPC Hybrid Use TEEs (Intel TDX, AMD SEV) to reduce MPC rounds without trusting a single party. Operators run in verified enclaves, reducing collusion surface. This is already appearing in newer academic work (2024-2025) and may be the bridge between research and production.

Next Step 2: ZK-based Matching Replace MPC with ZK proofs for matching correctness. Clients submit encrypted orders, matching engine publishes ZK proof of correct matching. Eliminates multi-party communication rounds. Renegade Protocol is attempting this approach for DEX dark pools.

実装ガイド

For researchers and engineers wanting to build a プライバシー-preserving ダークプール from scratch. This guide synthesizes the reading order, implementation strategy, and key lessons from 6 years of research.

Reading Order

prime-match-2023 (USENIX Security 2023) — START HERE

Read the production paper first. Understand what was simplified and why. This is the existence proof that MPC dark pools can ship. Contains the min(x,y)-only insight that makes malicious security cheap.

mpc-dark-side-2019 (AsiaCCS 2019) — Mechanism Baseline

Understand the 3-mechanism taxonomy (CDA / periodic / volume match). This paper's performance numbers are still the reference baseline. SCALE-MAMBA provides the MPC substrate if you want to replicate.

kicking-the-bucket-2022 — Direction Hiding

If your deployment requires direction プライバシー (not just quantity プライバシー), this is the mandatory reference. Bucket quantization is the state-of-the-art MPC approach for direction hiding. Read after understanding the baseline.

turquoise-plato-2020 — Multi-Asset Architecture

The multi-instrument extension is non-trivial. Secret-sharing instrument identifiers is the key insight. Read this to understand the data model for a realistic multi-asset ダークプール.

priority-queue-pets2023 (PETS 2023) — Theoretical Best

If you need private CDA (not periodic matching), this is the state-of-the-art data structure. Amortized polylog priority queue operations in MPC. The 136 tx/sec result is the benchmark to beat.

atlas-x-aamas2024 (AAMAS 2024) — DP Alternative

If MPC is overkill for your specific プライバシー problem (e.g., only protecting aggregate inventory signals), differential プライバシー may suffice. Atlas-X demonstrates this is viable in banking. Read to understand when DP beats MPC.

all-for-one-2022 — Collusion Architecture

If you need strong collusion resistance (no trusted operator), this is the architecture reference. The Liquidnet-type model (all participants = operators) is practically achievable at $1/auction on AWS.

Implementation Decision Tree

Key Lessons

1
Start with the production paper. Prime Match proves MPC dark pools can ship. Read it before any research paper. Its architecture choices are not limitations — they are the production-viable design space.
2
Price discovery is a separate problem — don't couple it. Every production system uses external price benchmarks. Trying to solve price discovery inside the プライバシー-preserving matching engine has never shipped. Decouple these concerns.
3
Linearity = cheap malicious security. min(x,y) requires only linear operations. This makes malicious-secure MPC essentially free compared to garbled circuits or FHE. Design your matching primitive to stay linear whenever possible.
4
FHE is not ready for financial matching throughput. TFHE on GPU was the 2020 approach; it's still not competitive with MPC for throughput-sensitive matching. If direction プライバシー via FHE is required, budget for GPU infrastructure and expect 10x latency.
5
Bucket quantization works for direction hiding. kicking-the-bucket-2022 is the state-of-the-art MPC approach for hiding buy/sell direction. If you need direction プライバシー in MPC (not FHE), implement bucket quantization with zero-volume padding orders.
6
Operator model is a governance problem, not a technical one. The "who is the operator?" question is about legal liability, regulatory status, and commercial relationships — not cryptography. Multi-operator MPC is technically feasible (all-for-one-2022 proves it); getting institutions to agree on governance is the real bottleneck.
7
Consider DP for leakage on aggregate signals. Atlas-X shows that not every プライバシー problem needs MPC. If you're protecting aggregate inventory signals (not individual order content), differential プライバシー with continual observation is simpler, cheaper, and has been deployed at scale.
8
TEE + MPC hybrid is the likely next step. The research gap between all-for-one-2022 (strong guarantees, no production path) and prime-match-2023 (production, weak guarantees) suggests a TEE-backed MPC approach could split the difference. Watch for 2025-2027 papers combining Intel TDX/AMD SEV with MPC for dark pools.

If You're Building for DeFi (Not TradFi) The entire genealogy above is TradFi-focused. For DeFi dark pools, the operator model changes entirely — smart contracts replace trusted operators. Renegade Protocol uses MPC with on-chain settlement. Penumbra uses ZK proofs. The direction-leakage and price-discovery problems still apply, but the trust model is inverted (trustless by default, プライバシー added on top).