# Why does the new encryption scheme proposed by authors stop an adversary from guessing the subspace of the secret key?

In this paper, the authors construct an encryption scheme that is supposed to be resilient to tampering and leaking (as opposed to just leaking).

Specifically this scheme:

If you look at the update procedure they simply multiply the current secret key $g^s$ and multiply it by $g^{Bu}$

If you tamper with this updated secret key you get a mutated secret key $T(g^{s+Bu})$. How do we know this new mutated secret key does not depend on the random subspace $B$ (in some arbitrary way) ?