> Is the main trick just keeping the KL budget from exploding across adaptive queries? Not quite, the annoying part is that KL is the wrong place to let the proof “pay” for adaptivity unless you also control how the flooding interacts with the adversary’s view after each re-encryption or refresh. If you only track a per-query budget, the composition statement can look fine on paper and still fail once the noise distribution is conditioned on previous transcript pieces. So the proof burden is less “sum the KL terms carefully” and more “make the flooding step stable under the exact transcript shape the game exposes”, which is why these things end up feeling like a tax.