{"id":"65c7ed07-3844-4520-a5e5-6347fe1f7a6c","arxiv_id":"1908.09888","paper_version":2,"verdict":"REJECT","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":7,"one_line_summary":"DPFact combines elastic averaging SGD, output perturbation under zero-concentrated differential privacy, and l2,1 regularization to enable collaborative tensor factorization for phenotyping from distributed EHRs.","lead":"This paper proposes DPFact, a privacy-preserving method for hospitals to jointly find disease patterns in their electronic health records without sharing raw patient data. It adds differentially private noise to the factor matrices exchanged with a central server and uses sparsity to capture both shared and site-specific clinical phenotypes.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 4.1's DP guarantee is unsupported: the Gaussian noise is calibrated using a data-dependent Lipschitz constant, with no clipping or global bound, so the sensitivity bound Δ2(f)=2τLη is not a valid worst-case sensitivity.","rationale":"The central contribution of DPFact is its formal differential privacy guarantee. The reader's REJECT rests on the claim that Theorem 4.1's sensitivity analysis is circular. Our independent review reaches the same conclusion. The L2 sensitivity calculation in Section 4.2.1 cites Wu et al. for Δ2(f)=2τLη, but the Lipschitz constant L in Appendix A.1 is computed from the current factor matrices, which are private. Nowhere in Algorithm 1 are factor matrices clipped or constrained to a bounded set, so the objective's gradient is not globally Lipschitz; the norm ‖(A^T A)*(C^T C)+γI‖_F can grow without bound. Thus the noise added in (18) is not calibrated to a worst-case sensitivity and there is no (ε,δ)-DP guarantee. A secondary issue is that E in Theorem 4.1 is the number of epochs at convergence, a data-dependent stopping time, so the total privacy budget is not fixed a priori. Both issues are load-bearing, but the sensitivity problem is the root: even with a fixed E, the per-epoch noise would be scaled by a data-dependent quantity. The empirical evaluation, including the factor match score and AUC comparisons, is useful but cannot compensate for the absence of a valid privacy proof. The paper's own text acknowledges that the Lipschitz constant is computed from the data (Appendix A.1), which is exactly the point of failure. The proposed concrete test—re-running the sensitivity computation on neighboring datasets—would settle the issue quantitatively. In summary, the reader's verdict is correct and our stress-test does not change it.","tokens_in":18065,"tokens_out":6112,"duration_ms":57613,"concrete_test":"Implement DPFact without noise (or with the exact noise mechanism) and run it to convergence on two synthetic neighboring tensors D and D' that differ in one nonzero entry. Record the factor matrices at convergence on each, then compute L(D) and L(D') using the Appendix A.1 formula. If L(D) ≠ L(D'), the sensitivity estimate is data-dependent; if L(D') > L(D) for any pair, then noise calibrated from D under-protects D'. An even more direct test: verify whether Algorithm 1 contains any step that bounds ‖A‖,‖B‖,‖C‖; since it does not, the Lipschitz constant is unbounded over the algorithm's trajectory, and no finite Δ2 exists. Re-deriving Theorem 4.1 without the data-dependent evaluation of L should be impossible within the stated assumptions.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 4.2.1 defines the L2 sensitivity of the local optimization as Δ2(f)=2τLη, where L is the Lipschitz constant of ∇f. Appendix A.1 computes L as the Frobenius norm of (A[t]^T A[t])*(C[t]^T C[t]) + γI. Because A[t] and C[t] are themselves learned from the private local tensor O[t], this L is a data-dependent quantity. The algorithm in Section 4.1 contains no clipping, projection, or bounded initialization of the factor matrices; the optimization domain is unbounded, so no finite global Lipschitz constant exists that holds uniformly over neighboring datasets. For the Gaussian mechanism to satisfy (ε,δ)-DP, the noise scale must be fixed a priori from a worst-case sensitivity sup_{D,D'} ‖f(D)-f(D')‖, independent of the realized dataset. The paper instead calibrates σ from the empirical factor norms observed after training on the actual data. If a neighboring dataset yields larger factor norms, the actual sensitivity exceeds the claimed Δ2 and the privacy loss is larger than the stated budget. Thus Theorem 4.1's proof does not establish differential privacy; the central claim of a rigorous privacy guarantee fails. The data-dependent epoch count E in Theorem 4.1 (E is defined as the number of epochs when the algorithm converges) compounds the issue, since the per-epoch budget ρ is chosen based on the data-dependent stopping time, but the sensitivity flaw alone is sufficient to invalidate the guarantee.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes DPFact, a differentially private collaborative tensor factorization method for computational phenotyping from horizontally partitioned EHR tensors. Each hospital runs τ passes of permutation-based SGD on its local tensor, updates patient and feature factor matrices, adds Gaussian noise to the feature factor matrices under zero-concentrated differential privacy (zCDP), and sends the perturbed factors to a semi-trusted server, which aggregates them into global factors using an EASGD-style update. The main theoretical claim (Theorem 4.1) is that the whole procedure is (ε,δ)-differentially private with per-epoch, per-factor budget ρ = ε²/(8E log(1/δ)), where E is the number of epochs at convergence. Experiments on MIMIC-III, CMS DE-SynPUF, and a synthetic dataset compare DPFact with CP-ALS, centralized SGD, and the federated TRIP method, reporting lower communication cost and competitive or better AUC, plus qualitative phenotype discovery. The stress-test concern about data-dependent sensitivity is confirmed by the manuscript itself: Appendix A.1 computes the Lipschitz constant L from the learned factor matrices.","tokens_in":18414,"tokens_out":11543,"duration_ms":112567,"significance":"If its privacy guarantee were valid, DPFact would be a useful contribution: it combines zCDP-based output perturbation with a communication-efficient EASGD formulation, and the l2,1-regularization provides a plausible mechanism for discovering site-specific phenotypes in heterogeneous populations. The empirical evaluation is careful and reproducible in spirit: code is publicly released, three datasets (two real, one synthetic) are used, and the factor-match-score analysis in Figure 3(b) gives a concrete picture of the privacy-utility trade-off. These strengths do not compensate for the fact that the central claim, the formal differential privacy guarantee, rests on a sensitivity bound computed from the private data itself; as stated, Theorem 4.1 is not proven and the mechanism as described does not clearly provide (ε,δ)-DP.","major_comments":[{"comment":"The sensitivity bound Δ2(f) = 2τLη used to calibrate the Gaussian noise is not a valid worst-case sensitivity because L is data-dependent. Appendix A.1 computes L as the Frobenius norm of (A[t]^T A[t])*(C[t]^T C[t]) + γI, and A[t] and C[t] are themselves learned from the private local tensor O[t]. Algorithm 1 contains no clipping, no projection, and no bounded initialization of the factor matrices; the optimization domain is unbounded, so no finite uniform bound on L holds over all neighboring datasets. Proposition 2.7 requires the noise to be calibrated from the worst-case sensitivity sup_{D,D'} ‖f(D) − f(D')‖, which is independent of the realized dataset; calibrating σ from the empirical Lipschitz constant observed during training makes the noise distribution a function of the private data, so the (ε,δ)-DP claim in Theorem 4.1 does not follow from the stated construction. This is a load-bearing gap because the formal privacy guarantee is the paper's central claimed contribution.","section":"§4.2.1, Appendix A.1, Theorem 4.1"},{"comment":"The composition count E in Theorem 4.1 is the number of epochs at which the algorithm happens to converge, which is a data-dependent stopping time. The per-epoch budget ρ = ε²/(8E log(1/δ)) is therefore chosen after observing the run, and the proof in §4.2.2 composes 2Eρb mechanisms with E itself dependent on the data. For a valid statement of differential privacy, E must be a fixed, a priori bound on the number of released mechanisms (or the guarantee must be stated as a function of a separately bounded E); otherwise the privacy loss of the realized run is not bounded by the claimed ε. The reported total budgets in §5.4.4, e.g., (1.2, 10⁻⁴) for MIMIC-III, are computed from empirical convergence points and hence inherit this problem.","section":"Theorem 4.1, §4.2.2"},{"comment":"Even accepting the formula Δ2(f) = 2τLη, the sensitivity analysis concerns only the local objective (15) with two of the three factor matrices held fixed. In the actual algorithm, the feature-factor updates (16)–(17) depend on A[t], which is itself updated over the τ passes through (13) and the proximal step (14); the Lipschitz constant computed in Appendix A.1 fixes A[t] and C[t] at their current values and therefore does not bound the end-to-end sensitivity of the released B[t] with respect to a change in one entry of O[t]. The proof gives no argument covering the coupled updates, so the claimed bound on the released factors is not established even in principle.","section":"§4.1.1–4.1.2, Appendix A.1"}],"minor_comments":[{"comment":"The text states that the Gaussian mechanism adds noise with standard deviation σ = Δ2²/(2ρ); this quantity has the units of variance, and Algorithm 1 line 12 correctly draws noise from N(0, Δ2²/(2ρ)). The text should say variance, or should set σ = Δ2/√(2ρ).","section":"§4.1.3"},{"comment":"The parallel composition statement as written gives (1/T)Σρ_t; the standard zCDP parallel composition guarantees max_t ρ_t, and the average form is not a valid general composition bound (it coincides with the maximum only in the symmetric application used in §4.2.2). Please restate the proposition correctly or explicitly restrict it to the special case actually used.","section":"§2.3, Proposition 2.10"},{"comment":"The phrase 'the objective function (15) satisfies L-Lipschitz, with Lipschitz constant L the tight upper bound of the gradient' conflates Lipschitz continuity of the function with Lipschitz continuity of the gradient; what is needed in the formula Δ2(f) = 2τLη is L-smoothness of f.","section":"§4.2.1"},{"comment":"The communication-cost table for 1, 5, and 10 sites appears twice (as Table 2 in §5.4.5 and as Table 8 in Appendix A.3), and the text in §5.4.5 refers to 'Table 8' when the nearby table is labeled Table 2. Please remove the duplicate and fix the cross-reference.","section":"§5.4.5, Tables 2 and 8"}],"recommendation":"reject","confidential_remarks":"The reader's report and the stress-test analysis identify a genuine, load-bearing defect in the privacy proof; my reading of §4.2.1 and Appendix A.1 confirms that the sensitivity bound is data-dependent and that the epoch count E is a data-dependent stopping time. This is not a presentation issue: fixing it requires re-specifying the mechanism (e.g., clipping the factor matrices or gradients to obtain a data-independent L, and fixing E a priori) and re-running the experiments with the modified algorithm. The empirical work is otherwise solid, and the public code is a credit to the authors; I would consider a revised submission that addresses the sensitivity calibration and the epoch count seriously."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a solid engineering paper with a serious formal bug. The empirical side is useful, but Theorem 4.1 does not establish differential privacy as stated.\n\nWhat's genuinely new: DPFact combines EASGD-style communication-efficient distributed optimization with output perturbation under zCDP and an l2,1 penalty to capture site-specific phenotypes. That combination is original, and the experiments on MIMIC-III and CMS are real, with code released. The communication savings versus ADMM-based TRIP are believable, and the AUC comparisons are informative for the phenotyping community.\n\nThe soft spot is load-bearing: the proof of Theorem 4.1 uses the L2 sensitivity bound Δ2(f)=2τLη, where L is the Lipschitz constant of the local gradient. Appendix A.1 computes L as the Frobenius norm of (A^T A)*(C^T C)+γI, which depends on the local factor matrices A and C. Those factors are learned from the private data. The algorithm never clips the factors or provides a data-independent upper bound. So the noise scale is a function of the data under analysis. If a neighboring dataset yields larger factor norms, the actual sensitivity exceeds the claimed Δ2, and the privacy loss is larger than the reported ρ. The Gaussian mechanism requires a worst-case sensitivity fixed a priori; the paper's calibration does not satisfy that. This is not a minor gap; it is the central promise of the paper.\n\nA related issue is that the epoch count E is defined as the number of epochs when the algorithm converges, so the per-epoch budget ρ is effectively chosen after seeing the data. The total ε is reported post hoc rather than set a priori. That further weakens the formal guarantee.\n\nThe empirical work is otherwise decent. Hyperparameters (γ, μ, η) are tuned per dataset, and μ is chosen per ICU, which is fine for demonstrating utility but not for a rigorous privacy proof. The headline numbers lack error bars, but the qualitative conclusions are likely stable.\n\nWho should read this? Researchers working on federated tensor factorization or privacy-preserving phenotyping will find the problem formulation and experiments useful, and the privacy bug is a good cautionary case. I would not rely on it as a source of a rigorous DP guarantee.\n\nRecommendation: send it to peer review. The problem is important and the flaw is likely fixable with clipping or a data-independent Lipschitz bound. A good referee can point the authors to the standard fix. But the current version should not be accepted as is.","headline":"A well-engineered federated tensor factorization paper whose central privacy claim is invalidated by a data-dependent sensitivity bound.","tokens_in":18955,"tokens_out":2543,"would_cite":false,"duration_ms":25004,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"DPFact enables collaborative phenotyping across hospitals with formal differential privacy, and reports better accuracy and lower communication cost than federated tensor-factorization baselines.","keywords":["differential privacy","tensor factorization","computational phenotyping","collaborative learning","electronic health records","zero-concentrated differential privacy","elastic averaging SGD","l2,1 regularization"],"falsifier":"Take two neighboring local tensors that differ in only one patient's entry, run the Appendix A.1 calculation for the Lipschitz constant $L = \\|(A^\\top A)*(C^\\top C)+\\gamma I\\|_F$, and compare the resulting sensitivity $\\Delta_2(f)=2\\tau L\\eta$; if the two runs give different noise scales, the claimed $(\\varepsilon,\\delta)$-differential privacy of Theorem 4.1 does not follow from the stated calibration, because the noise is then a function of the private data.","tokens_in":17841,"feed_emoji":"🏥","tokens_out":9547,"duration_ms":94605,"temperature":0.7,"pith_summary":"DPFact is designed to answer a concrete practical question: can independent hospitals jointly learn clinical phenotypes from electronic health records without pooling raw data and without leaking patient information through shared intermediate results? The paper claims yes, by combining collaborative tensor factorization with calibrated Gaussian noise and zero-concentrated differential privacy. Instead of sending patient-level data, each hospital sends only perturbed feature factor matrices to a semi-trusted server, and a structured $\\ell^2$,1 penalty lets the model capture both phenotypes that are common across hospitals and phenotypes specific to one hospital's population. The paper reports that this privacy-preserving method converges to lower reconstruction error, needs less communication than the federated tensor-factorization baseline, and still discovers clinically meaningful shared and site-specific phenotypes. If the claim holds, it would give multi-site health-data consortia a practical way to do computational phenotyping under a formal privacy guarantee.","feed_headline":"Hospitals can mine shared phenotypes without exposing patient data","feed_subtitle":"Adds calibrated noise to shared tensor factors, giving a formal privacy guarantee with less communication.","key_machinery":"The load-bearing machinery is the pairing of elastic averaging SGD with zCDP-based Gaussian output perturbation. Local sites run τ passes of permutation SGD, update the patient factor A[t] via proximal gradient with $\\ell^2$,1 soft-thresholding, and update the feature factors B[t] and C[t] with an elastic pull γ toward the global factors. Before upload, each feature factor is perturbed with noise from $\\mathcal{N}(0, \\Delta_2^2/(2\\rho))$, where the sensitivity is taken as $\\Delta_2(f) = 2\\tau L\\eta$ and L is the Lipschitz constant of the local objective gradient, computed as the Frobenius norm of $(A^{[t]\\top}A^{[t]})*(C^{[t]\\top}C^{[t]})+\\gamma I$ in Appendix A.1. The server aggregates the noisy factors into the global B and C via a gradient update. Privacy accounting relies on serial composition across the two feature factor matrices per epoch and parallel composition across sites, converting the zCDP budget into a standard (ε,δ)-DP guarantee at convergence.","core_discovery":"The paper's central claim is that DPFact—a collaborative tensor factorization built on elastic averaging SGD with Gaussian output perturbation—can decompose horizontally partitioned EHR tensors into shared and site-specific computational phenotypes under a formal differential-privacy guarantee, and that under strict privacy budgets it is more accurate and communication-efficient than the leading federated tensor-factorization baseline. Each site runs τ local passes, updates its patient factor matrix with a proximal step for $\\ell^2$,1 regularization, and sends only perturbed versions of the two feature factor matrices to a semi-trusted server; the patient factor matrix is never shared. The privacy analysis uses zero-concentrated differential privacy and parallel composition to obtain Theorem 4.1: Algorithm 1 is (ε,δ)-differentially private when the per-epoch, per-factor budget is $\\rho = \\varepsilon^2/(8E\\log(1/\\delta))$, where E is the number of epochs until convergence. The experimental section reports lower RMSE and communication cost than the federated baseline and a centralized ALS baseline, and phenotype discovery that includes patterns specific to the neonatal ICU.","pith_inferences":["An extension not pursued in the paper: the same collaborative structure applies to any horizontally partitioned multi-way dataset—medical imaging, sensor networks, or retail—where shared and site-specific latent factors are meaningful.","A consequence the authors do not spell out: the l2,1 proximal step gives a built-in diagnostic, since a site whose patient-factor column is driven to zero is effectively reporting that a phenotype is absent in that population, which could be read as a population-health comparison across sites.","A testable extension: vary the per-epoch privacy budget adaptively during training, allocating more budget early when gradients are large and less later, rather than fixing one ρ for all epochs.","A neighboring direction: replace the zCDP composition with Rényi differential privacy accounting, which could tighten the final (ε,δ) conversion for the same noise scale."],"forward_implications":["A multi-site consortium could run phenotyping without raw EHR transfer; only noisy feature factor matrices would leave each hospital.","The total privacy loss can be fixed in advance: choosing a per-epoch budget ρ and knowing the number of epochs E gives an (ε,δ) guarantee before training starts.","The same run produces both global phenotypes and site-specific ones, because the l2,1 penalty can switch off a phenotype at any site.","Communication cost stays bounded by the two feature factor matrices per round, which is why DPFact reports lower byte cost than an ADMM-style federated tensor-factorization baseline.","The privacy/utility trade-off is tunable: larger budgets give factor match scores closer to the non-private model while retaining a formal guarantee."],"supporting_citations":[{"why":"Defines the federated tensor-factorization baseline (TRIP) that DPFact is compared against on accuracy and communication cost.","marker":"[20]"},{"why":"Supplies the zCDP definition, the Gaussian mechanism proposition, and the serial composition rule used in the privacy proof.","marker":"[4]"},{"why":"Gives the per-pass sensitivity expression Δ2(f)=2τLη for SGD-based optimization that anchors the noise calibration.","marker":"[29]"},{"why":"Introduces elastic averaging SGD, the optimization scheme DPFact uses for local updates and communication.","marker":"[34]"},{"why":"Provides the foundational definitions of (ε,δ)-differential privacy and the Gaussian mechanism.","marker":"[8]"},{"why":"Introduces concentrated differential privacy, which the paper converts to (ε,δ)-DP via Proposition 2.8.","marker":"[9]"},{"why":"Provides the MIMIC-III intensive-care dataset used in the evaluation of accuracy and phenotype discovery.","marker":"[17]"},{"why":"Supplies the ICD-9 code selection rule and the constrained tensor factorization perspective behind phenotype interpretability.","marker":"[19]"},{"why":"States the parallel composition theorem for zCDP used to sum privacy across sites in the proof of Theorem 4.1.","marker":"[33]"}],"fun_headline_variants":["DPFact: private collaborative phenotyping without sharing patient data","Hospitals learn shared phenotypes with formal privacy guarantee","Calibrated noise yields private, efficient tensor factorization for health","Private tensor factorization: share insights, not patient records","Differential privacy bridges hospitals for joint phenotyping"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The formal privacy guarantee rests on the noise scale being a fixed public quantity, but the paper computes it from learned factor matrices, which depend on the very patient records being protected.","fun_headline_variants_meta":{"raw":{"variants":["DPFact: private collaborative phenotyping without sharing patient data","Hospitals learn shared phenotypes with formal privacy guarantee","Calibrated noise yields private, efficient tensor factorization for health","Private tensor factorization: share insights, not patient records","Differential privacy bridges hospitals for joint phenotyping"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000208,"raw_usage":{"total_tokens":1410,"prompt_tokens":955,"completion_tokens":455,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":571,"completion_tokens_details":{"reasoning_tokens":377}},"tokens_in":571,"tokens_out":455,"duration_ms":4846,"temperature":1.0,"reasoning_tokens":377,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T10:59:28.695823+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take two neighboring local tensors that differ in only one patient's entry, run the Appendix A.1 calculation for the Lipschitz constant $L = \\|(A^\\top A)*(C^\\top C)+\\gamma I\\|_F$, and compare the resulting sensitivity $\\Delta_2(f)=2\\tau L\\eta$; if the two runs give different noise scales, the claimed $(\\varepsilon,\\delta)$-differential privacy of Theorem 4.1 does not follow from the stated calibration, because the noise is then a function of the private data.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the federated tensor-factorization baseline (TRIP) that DPFact is compared against on accuracy and communication cost."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the zCDP definition, the Gaussian mechanism proposition, and the serial composition rule used in the privacy proof."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Gives the per-pass sensitivity expression Δ2(f)=2τLη for SGD-based optimization that anchors the noise calibration."},{"cited_title":"turns off","cited_arxiv_id":null,"evidence_quote":"Introduces elastic averaging SGD, the optimization scheme DPFact uses for local updates and communication."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the foundational definitions of (ε,δ)-differential privacy and the Gaussian mechanism."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the MIMIC-III intensive-care dataset used in the evaluation of accuracy and phenotype discovery."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the ICD-9 code selection rule and the constrained tensor factorization perspective behind phenotype interpretability."},{"cited_title":"Differentially Private Model Publishing for Deep Learning","cited_arxiv_id":"1904.02200","evidence_quote":"States the parallel composition theorem for zCDP used to sum privacy across sites in the proof of Theorem 4.1."}],"review_version":1}