{"id":"7f15538a-1226-4e07-a3a4-20056a6b47c8","arxiv_id":"2411.14351","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"low","formal_verification":"none","parameter_count":3,"one_line_summary":"An optimal attack on Gaussian conditional inference is a weighted quadratic program whose convexity can be read off from eigenvalue bounds, with a Bayesian expectation version for attackers with partial knowledge.","lead":"A new attack framework corrupts the input evidence of multivariate Gaussian models so that conditional predictions are badly wrong while the corrupted data still looks plausible. It reduces the attacker's problem to quadratic programming, giving both complete-knowledge and Bayesian partial-knowledge versions.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Properties 4 and 5 use eigenvalues of Σ[ZZ] where the objective contains Σ^{-1}[ZZ]; a 1D counterexample shows the stated concavity criterion fails, so the central eigenvalue characterization is not correct as written.","rationale":"The reader's weakest assumption concerns the detection-risk model (Section 2.3), but my stress-test found a more central and more concrete defect: the sufficient eigenvalue conditions that constitute a main theoretical contribution are wrong as stated. The reduction of the KL disruption objective to the quadratic form φ1(z) is derived correctly, and the grey-box expectation machinery in Property 6 is also sound; however, Properties 4 and 5 are used throughout the paper to decide whether the attacker's problem is concave, convex, or neither, and to bound the weight u1 in Equations (2)–(3). Because the eigenvalues of Σ^{-1}[ZZ] are reciprocals of the eigenvalues of Σ[ZZ], the stated conditions do not characterize the objective. The error is easily demonstrated with a one-dimensional counterexample, so it is not merely a notational ambiguity. The paper should be revised to correct the eigenvalue conditions, re-derive the weight bounds, and re-examine the empirical claims in Figure 1 and the applications that rely on the convexity classification. This warrants a major revision rather than rejection, since the core framework and most derivations remain intact and the fix appears local.","tokens_in":21388,"tokens_out":5606,"duration_ms":54778,"concrete_test":"Recompute the convexity classification for the 1D case |Z| = 1 with Q = 1, Σ[ZZ] = 4, u1 = u2 = 0.5, and |φ*_1| = |φ*_2| = 1. The exact matrix is w1 Q − w2 Σ^{-1}[ZZ] = 0.5 − 0.5/4 = 0.375, so the objective is strictly convex; Property 4 as written gives 0.5 − 0.5·4 = −1.5 ≤ 0 and declares it concave. If this counterexample reproduces, replace ζ_n with 1/ζ_n in Properties 4–5, Equations (2)–(3), and recompute Figure 1 and the convexity assertions in the three applications.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central theoretical claim relies on Properties 4 and 5, which give sufficient eigenvalue conditions for the white-box quadratic objective to be concave or convex. As written, both properties are incorrect because they treat the eigenvalues of −w2 Σ^{-1}[ZZ] as −w2 ζ_m, where {ζ_m} are introduced as the eigenvalues of Σ[ZZ] (Section 3.1, before Property 4). The eigenvalues of −w2 Σ^{-1}[ZZ] are −w2 / ζ_m, not −w2 ζ_m. Consequently, Weyl's inequalities in Properties 4 and 5 should use w1 ρ_m − w2 / ζ_n, and Equations (2) and (3) should use 1/ζ_n in place of ζ_n. The error is not cosmetic: it changes which weight regimes are classified as concave or convex. For a one-dimensional example with Q = 1, Σ[ZZ] = 4, u1 = u2 = 0.5, and |φ*_1| = |φ*_2| = 1, the true quadratic matrix is w1 Q − w2 Σ^{-1}[ZZ] = 0.5 − 0.5/4 = 0.375 > 0, so the objective is strictly convex. Yet Property 4's criterion checks w1 ρ_1 − w2 ζ_1 = 0.5 − 2 = −1.5 ≤ 0 and declares the objective concave. Thus, as stated, the sufficient conditions misclassify the problem, undermining the claimed characterization of when the attacker's problem is an easy convex QP versus a hard nonconvex one, and the bounds in Equations (2)–(3) and the empirical overcoverage analysis in Figure 1 inherit the error. The reduction of the attack to a quadratic program (Property 1) and the Wishart expectation formulas (Property 6) appear sound; the defect is localized to the eigenvalue conditions, which would need correction and re-derivation of all downstream solver-selection claims.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper formalizes an attacker's problem of corrupting evidence variables to disrupt a decisionmaker's conditional inference in a multivariate Gaussian model, while keeping the corrupted evidence plausible under the marginal density of the observed variables. The attacker's objective is a weighted combination of the KL divergence between the true and corrupted conditional distributions and a log-ratio plausibility penalty; the paper shows in Property 1 that this objective reduces to a quadratic function, yielding a quadratic program (WB) in the white-box setting and a stochastic quadratic program (GB) in the grey-box setting. Structural properties are developed to characterize when the quadratic objective is convex or concave (Properties 4 and 5), closed-form expectations are derived for a normal-inverse-Wishart prior (Property 6), and solution methods based on CPLEX, sample average approximation, and stochastic gradient ascent variants are proposed. The framework is demonstrated on three applications: a real-estate ZHVI example, a Lending Club loan-interest regression, and a linear Gaussian state-space model for object tracking.","tokens_in":21817,"tokens_out":5266,"duration_ms":43926,"significance":"The paper addresses an under-studied and practically important problem: adversarial corruption of conditional Gaussian inference. The reduction of the two-objective attack to a quadratic program is elegant and correctly derived, and the Wishart-based expectation formulas for the grey-box setting are valuable and correct. The three applications, with publicly available code, demonstrate broad applicability and provide useful benchmarks. However, the paper's central structural characterization of the objective's convexity (Properties 4 and 5) contains a mathematical error that changes which weight regimes are classified as convex, concave, or indefinite; this error also affects Equations (2) and (3) and the empirical overcoverage analysis in Figure 1. Because these properties are load-bearing for the paper's guidance on solution methods and its narrative of problem difficulty, the manuscript requires a substantial correction and re-verification of the affected results before it can be accepted.","major_comments":[{"comment":"The proofs of Properties 4 and 5 incorrectly identify the eigenvalues of −w2Σ^{-1}[ZZ] as {−w2ζ_m}, where {ζ_m} are defined as the eigenvalues of Σ[ZZ]. Since the eigenvalues of the inverse are the reciprocals of the eigenvalues of the original matrix, the eigenvalues of −w2Σ^{-1}[ZZ] are {−w2/ζ_m}. Consequently, Weyl's inequalities in Properties 4 and 5 should involve w1ρ_m − w2/ζ_n rather than w1ρ_m − w2ζ_n, and Equations (2) and (3) should replace ζ_n with 1/ζ_n in the appropriate places. The error is not cosmetic: for a one-dimensional example with Q = 1, Σ[ZZ] = 4, u1 = u2 = 0.5, and |φ*1| = |φ*2| = 1, the true quadratic matrix is w1Q − w2Σ^{-1}[ZZ] = 0.5 − 0.5/4 = 0.375 > 0, so the objective is strictly convex, yet Property 4's criterion computes w1ρ_1 − w2ζ_1 = 0.5 − 2 = −1.5 ≤ 0 and incorrectly declares the objective concave. The bounds in Equations (2) and (3) and the overcoverage computation in Figure 1 inherit this error and must be recomputed with the reciprocal eigenvalues.","section":"Section 3.1, Properties 4 and 5"},{"comment":"The proof of Property 6 contains a displayed formula with an apparent typographical error: the Schur complement is written as \"Λ[ZZ] − Λ^T[YZ]Λ^{-1}[YY]Λ[YY]\", which does not have matching dimensions and is not the Schur complement of Λ[YY] in Λ. It should read Λ[ZZ] − Λ[ZY]Λ^{-1}[YY]Λ[YZ] (or equivalently Λ[ZZ] − Λ^T[YZ]Λ^{-1}[YY]Λ[YZ]). The final expectation formula for E[Q] is correct, but the proof's displayed equation should be corrected for mathematical rigor.","section":"Section 4.1, Property 6 proof"},{"comment":"The stochastic gradient r_j is defined as \"2(w1Q_j − w2Σ^{-1}[ZZ])z + w1v + 2w2Σ^{-1}[ZZ]µ[Z]µ[Z]\", where µ[Z] appears twice. The correct gradient of w1ϕ1,j(z) + w2ϕ2,j(z) requires only one factor of µ[Z], i.e., the last term should be 2w2Σ^{-1}[ZZ]µ[Z]. As written, the formula would initialize an extra outer product or duplicated vector, potentially misleading any implementation of the SGA methods.","section":"Section 4.2.2, SGA gradient formula"}],"minor_comments":[{"comment":"The initial distributions are introduced as Y1,0, Y2,0, ˙Y1,0, ˙Y2,0, but the second distribution is printed as \"˙Y1,0∼N(1, 0.0625)\", which should be \"˙Y2,0∼N(1, 0.0625)\".","section":"Section 5.3.1, initial distributions"},{"comment":"The OpenIntro reference contains a typo: \"Retreived\" should be \"Retrieved\".","section":"References"},{"comment":"The sentence \"However, if u−1 < u1 < u+1, determining convexity of the objective function requires further analysis\" is correct only after the reciprocal-eigenvalue correction; as printed it refers to the incorrect bounds.","section":"Section 3.1, statement after Eq. (3)"}],"recommendation":"major_revision","confidential_remarks":"The central QP reduction and the Wishart expectation results are sound, and the paper is within scope for the journal. However, the eigenvalue-characterization error in Properties 4 and 5 is load-bearing for the paper's claims about the difficulty of the attacker's problem and for the guidance on solution methods. The error is local and correctable, so I recommend major revision rather than rejection; the authors should fix the reciprocal-eigenvalue issue, re-derive Equations (2) and (3), and recompute the affected parts of Figure 1 and the application-dependent convexity assessments (e.g., the reported u−1 and u+1 values in Sections 5.1.1 and 5.2.1)."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear colleague,\n\nThe paper claims a new and practical formulation for adversarial attacks on Gaussian conditional inference, and mostly it delivers: the attack objective—maximizing KL divergence between true and corrupted conditionals while penalizing evidence improbability—reduces cleanly to a quadratic program, with a grey-box version under a normal-inverse-Wishart prior. Property 1 is elegant, and Property 6 gives genuine closed forms. The three applications show breadth. That is real work and worth a serious look.\n\nThe problem is in Properties 4 and 5. They characterize convexity of the white-box quadratic using eigenvalues zeta_m of Sigma_ZZ, but the objective contains Sigma^{-1}_ZZ; the relevant eigenvalues are 1/zeta_m, not zeta_m. The stress-test 1D example is right: with Q=1, Sigma_ZZ=4, and equal weights, the objective matrix is 0.375>0, strictly convex, while Property 4's criterion calls it concave. This is not a typo. It changes which weight regimes are classified as convex, concave, or neither, and the u^-_1/u^+_1 bounds in Equations (2)-(3), the overcoverage analysis in Figure 1, and the solver-selection claims in the applications all inherit the error. They need to be re-derived.\n\nElsewhere the paper is reasonable. The detection-risk model (marginal density ratio) is a defensible first cut, not a universal model of anomaly detection, and the paper does not pretend otherwise. The empirical demonstrations are illustrative; they lack repeated-run error bars for the stochastic methods and the code is not pinned to a commit. Those are minor next to the eigenvalue issue.\n\nI would send this to peer review. The core contribution—the QP reduction with Bayesian extension—is sound and novel, and the eigenvalue error is localized enough that a careful revision can fix it. A good referee should catch it; the paper then needs a corrected convexity analysis before publication.","headline":"The QP reduction is real, but the convexity conditions in Properties 4 and 5 use the wrong eigenvalues; the weight-regime classification needs re-derivation before the paper can be trusted.","tokens_in":22336,"tokens_out":3162,"would_cite":false,"duration_ms":28740,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["90C20","90C15","62H10","62F15"],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper shows that an attacker who wants to disrupt conditional inference on a multivariate Gaussian while staying plausible solves a single quadratic program in the white-box case and a stochastic quadratic program in the grey-box…","keywords":["adversarial machine learning","evasion attacks","stochastic programming","quadratic programming","multivariate normal","conditional inference","Gaussian Bayesian network","state-space models"],"falsifier":"Take a small multivariate Gaussian with one unobserved variable and two observed variables, fix the true evidence $z'$, the covariance, and a box-shaped feasible region; enumerate all feasible $z$ on a fine grid, compute the true KL divergence and the log-ratio plausibility penalty directly, and compare the grid optimum with the solution of the white-box quadratic program (Problem WB). If the quadratic-program solution or the concavity/convexity predicted by Properties 4 and 5 does not match the grid results, the reduction or its structural characterization fails.","tokens_in":21186,"feed_emoji":"🎯","tokens_out":9814,"duration_ms":81178,"temperature":0.7,"pith_summary":"An attacker who corrupts the observed variables of a multivariate Gaussian to derail a decisionmaker's conditional inference faces two goals: maximize the damage to the posterior distribution of the unobserved variables, and keep the corrupted evidence looking plausible. This paper claims that both goals can be combined into one quadratic objective in the corrupted vector. In the white-box case, maximizing the KL divergence between true and corrupted conditionals plus a plausibility penalty is exactly a quadratic program; in the grey-box case, with the attacker holding a prior over the model parameters, the same objective is a stochastic quadratic program. The paper derives eigenvalue conditions that say when this objective is concave, convex, or neither, and shows in three applications (real estate values, loan interest rates, object tracking) that the resulting attacks shift posterior estimates substantially while beating a random-noise baseline. If the reduction is right, the attacker's problem is computationally characterized, and Gaussian-based decision systems can be studied and defended as systems whose vulnerability is governed by a few spectral quantities.","feed_headline":"Attacks on Gaussian inference collapse to one quadratic program","feed_subtitle":"Corrupting a Gaussian's observed variables becomes one quadratic objective, and eigenvalue bounds say whether it is easy or hard to solve.","key_machinery":"The workhorse is the quadratic-form identity for conditional KL divergence: $D_{\\mathrm{KL}}(P_{Y|z'} \\Vert P_{Y|z}) = \\frac{1}{2}(z^T Q z + v^T z + c)$, where $Q = \\Lambda^T_{[YZ]} \\Lambda^{-1}_{[YY]} \\Lambda_{[YZ]}$ is the precision-weighted cross-information matrix, a positive semidefinite matrix built from the canonical (precision) form of the Gaussian. Its role is to convert distributional disruption into a vector-space objective. Combined with the plausibility term $\\phi_2(z) = -z^T \\Sigma^{-1}_{[ZZ]} z + 2 z^T \\Sigma^{-1}_{[ZZ]} \\mu_{[Z]}$, the attacker's task becomes the quadratic program in Problem WB; the Hessian $w_1 Q - w_2 \\Sigma^{-1}_{[ZZ]}$ is what Properties 4 and 5 analyze through Weyl's eigenvalue inequalities. In the grey-box setting, the same machinery carries over with $\\mathbb{E}[Q]$ and $\\mathbb{E}[\\Sigma^{-1}_{[ZZ]}]$, which under a normal-inverse-Wishart prior have closed forms via Schur complements of the Wishart distribution.","core_discovery":"For a multivariate Gaussian $P_{YZ}$ with $Y$ unobserved and $Z$ observed, corrupting $z'$ to $z$ changes the posterior $Y|z$; the paper's central discovery is that the KL divergence $D_{\\mathrm{KL}}(P_{Y|z'} \\Vert P_{Y|z})$ collapses to $\\frac{1}{2}(z^T Q z + v^T z + c)$, where $Q = \\Lambda^T_{[YZ]} \\Lambda^{-1}_{[YY]} \\Lambda_{[YZ]}$ and $v = 2(\\Lambda^T_{[YZ]}\\mu_{Y|z'} - \\Lambda^T_{[YZ]}\\Lambda^{-1}_{[YY]}\\eta_{[Y]})$, so disruption is a quadratic function of $z$. Adding the plausibility penalty (the log-ratio of the marginal density of $Z$ at $z$ versus at its mode) yields the white-box attack $\\max_{z\\in\\mathcal{Z}} z^T(w_1 Q - w_2 \\Sigma^{-1}_{[ZZ]}) z + z^T(w_1 v + 2 w_2 \\Sigma^{-1}_{[ZZ]}\\mu_{[Z]})$, and the grey-box attack is the same quadratic under an expectation over the prior. The authors prove $Q$ is positive semidefinite and $\\Sigma^{-1}_{[ZZ]}$ is positive definite, so the combined Hessian $w_1 Q - w_2 \\Sigma^{-1}_{[ZZ]}$ determines difficulty; Properties 4 and 5 give sufficient eigenvalue conditions, via Weyl's inequalities, for concavity and convexity. In the three applications, the attacks materially alter the decisionmaker's modal estimates — e.g., the Arizona ZHVI attack changes the four-county modal estimate from $(0.98, 0.45, 1.09, 0.41)$ to $(0.88, 0.75, 0.77, 0.48)$ under the white-box attack — while keeping corrupted values inside the declared feasible region, and they outperform the random-noise baseline on the objective.","pith_inferences":["Editorial inference: the same quadratic reduction applies to any feasible set $\\mathcal{Z}$ that is a polytope or convex body, so the framework extends to $\\ell_p$-ball attacks (the epsilon-neighborhood idea mentioned in the conclusion) as a limiting case of the plausibility penalty.","Editorial inference: if a decisionmaker uses a detection statistic that is not a function of the marginal density of $Z$ alone, such as a joint anomaly detector, robust scatter, or human review, the plausibility guarantee may fail; the paper's own choice of the marginal log-ratio as the detection proxy is the load-bearing simplification.","Editorial inference: the concavity/convexity eigenvalue conditions suggest an implicit defensive lever: by choosing model parameterizations that push the eigenvalues of $Q$ relative to $\\Sigma^{-1}_{[ZZ]}$ into the neither-convex-nor-concave regime, a decisionmaker can make the attacker's optimization problem harder; the paper does not propose this defense.","Editorial inference: the qualitative difference between the white- and grey-box attacks in the state-space example, despite the attacker's prior being centered on the true parameters, indicates that hiding model parameters can be an effective defense even against a well-informed adversary, because $\\mathbb{E}[Q] \\neq Q$."],"forward_implications":["The attacker's optimal corruption is found by one quadratic program in the white-box setting, so the search is over vectors in the feasible region $\\mathcal{Z}$ rather than over distributions; the objective function is fully specified by $Q$, $v$, $w_1$, $w_2$, and $\\Sigma^{-1}_{[ZZ]}$.","The eigenvalue conditions of Properties 4 and 5 give a spectral test: if all shifted eigenvalues of $w_1 Q - w_2 \\Sigma^{-1}_{[ZZ]}$ are non-positive the problem is concave and easy; if all are non-negative it is convex and generally NP-hard; otherwise it is neither.","In the grey-box setting with a normal-inverse-Wishart prior, $\\mathbb{E}[Q]$ and $\\mathbb{E}[\\Sigma^{-1}_{[ZZ]}]$ have closed forms, so the same spectral analysis and the same solution methods apply to the expected objective.","Sample average approximation converges to the true grey-box optimum as the number of samples $J$ grows, and stochastic gradient variants approach the same solution with more tuning, so the grey-box problem is tractable in practice.","In the three applications, the attacks shift modal posterior estimates and achieve large KL divergences relative to the random-noise baseline, showing that Gaussian conditional inference is concretely vulnerable to this kind of corruption."],"supporting_citations":[{"why":"Supplies the canonical-form Gaussian representation and the Gaussian Bayesian network recursion that the KL reduction and the regression/state-space joint constructions rely on.","marker":"(Koller & Friedman, 2009)"},{"why":"Provides the adversarial-example baseline and the fast gradient sign method that the paper contrasts with and benchmarks against.","marker":"(Goodfellow et al., 2014)"},{"why":"Supplies the Bayesian white- and grey-box adversarial framework that the attacker models build on.","marker":"(Rios Insua et al., 2023)"},{"why":"Supplies the sample average approximation and stochastic gradient ascent methods used to solve the grey-box problem.","marker":"(Powell, 2019)"},{"why":"Supplies convex quadratic programming solution methods used when the white-box objective is concave.","marker":"(Bazaraa et al., 2013)"},{"why":"Supplies concave minimization methods used when the white-box objective is convex.","marker":"(Pardalos & Rosen, 1986)"},{"why":"Supplies the nonconvex quadratic programming complexity and methods relevant to the neither-convex-nor-concave case.","marker":"(Pardalos, 1991)"},{"why":"Supplies the Schur-complement property of Wishart matrices used to compute $\\mathbb{E}[Q]$ and $\\mathbb{E}[\\Sigma^{-1}_{[ZZ]}]$ under a normal-inverse-Wishart prior.","marker":"(Ouellette, 1981)"}],"fun_headline_variants":["Gaussian inference attacks collapse to a single quadratic program","One quadratic program is all it takes to disrupt Gaussian inference","Quadratic programming is the key to attacking Gaussian inference","Attack Gaussian inference with one quadratic program","How to break Gaussian inference: a single quadratic program"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that an attack is considered undetectable exactly when the corrupted evidence is probable under the marginal distribution of the observed variables, measured by the log-ratio of its density to the marginal mode; if a decisionmaker instead uses a joint anomaly detector, robust estimators, or human review, the plausibility guarantee may fail.","fun_headline_variants_meta":{"raw":{"variants":["Gaussian inference attacks collapse to a single quadratic program","One quadratic program is all it takes to disrupt Gaussian inference","Quadratic programming is the key to attacking Gaussian inference","Attack Gaussian inference with one quadratic program","How to break Gaussian inference: a single quadratic program"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000706,"raw_usage":{"total_tokens":3318,"prompt_tokens":1217,"completion_tokens":2101,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":833,"completion_tokens_details":{"reasoning_tokens":2027}},"tokens_in":833,"tokens_out":2101,"duration_ms":13276,"temperature":1.0,"reasoning_tokens":2027,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T15:16:38.023569+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a small multivariate Gaussian with one unobserved variable and two observed variables, fix the true evidence $z'$, the covariance, and a box-shaped feasible region; enumerate all feasible $z$ on a fine grid, compute the true KL divergence and the log-ratio plausibility penalty directly, and compare the grid optimum with the solution of the white-box quadratic program (Problem WB). If the quadratic-program solution or the concavity/convexity predicted by Properties 4 and 5 does not match the grid results, the reduction or its structural characterization fails.","supporting_citations":[{"cited_title":", & author Friedman, N","cited_arxiv_id":null,"evidence_quote":"Supplies the canonical-form Gaussian representation and the Gaussian Bayesian network recursion that the KL reduction and the regression/state-space joint constructions rely on."},{"cited_title":", author Naveiro, R","cited_arxiv_id":null,"evidence_quote":"Supplies the Bayesian white- and grey-box adversarial framework that the attacker models build on."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the sample average approximation and stochastic gradient ascent methods used to solve the grey-box problem."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies convex quadratic programming solution methods used when the white-box objective is concave."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies concave minimization methods used when the white-box objective is convex."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the nonconvex quadratic programming complexity and methods relevant to the neither-convex-nor-concave case."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the Schur-complement property of Wishart matrices used to compute $\\mathbb{E}[Q]$ and $\\mathbb{E}[\\Sigma^{-1}_{[ZZ]}]$ under a normal-inverse-Wishart prior."}],"review_version":1}