{"id":"5d237c4b-5812-4d2a-99f5-a6dce801e490","arxiv_id":"2411.16207","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"A random vortex pixel-swirling scheme keeps ResNet and ViT training accuracy high on scrambled images, but the supporting information-content theorem is defined into existence and the reported correlation is not supported by the paper's own table.","lead":"The paper proposes a distance-based measure of image information and a \"Random Vortex Transformation\" that scrambles images while leaving them trainable by neural networks. The measure ignores pixel values, and the key theorem is enforced by the definition of the post-transform information function, so the theoretical support is largely circular.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem III.1's decrease is manufactured by Eq. (6), an unvalidated transformation-dependent definition; the measure is content-blind, so the correlation with accuracy is not evidence for a true information framework.","rationale":"The reader's weakest_assumption correctly identifies Eq. (6) as the linchpin. Our independent reading confirms that the proof of Theorem III.1 proceeds by substituting Eq. (6) and expanding the sum; the decrease is literally the squared difference that Eq. (6) introduces. The test above is decisive because it exposes that the 'information content' of an image is not an intrinsic quantity: any image, transformed or not, has the same Mneig under the paper's own base definition, and only the special definition for transformed images produces a number below 100%. This means the theoretical contribution is a tautology relative to its definitions, and the empirical support (the claimed positive correlation) is weakened because the Ypsilon axis is not independent of the hypothesis being tested. The reported accuracy numbers for the vortex transformation may be plausible and the method may work as a data augmentation, but the central information-content framework and the theorem built on it do not stand. Therefore the verdict of REJECT is unchanged.","tokens_in":17192,"tokens_out":10842,"duration_ms":232066,"concrete_test":"Compute Mneig(P*) for a vortex-transformed image P* using the paper's own base definition in Eqs. (4)-(5), i.e., without applying Eq. (6). Because mneig depends only on the coordinate grid and the grid is unchanged, this calculation must return the same value as Mneig(P), giving Ypsilon(P*) = 100%. If it does, the reported information loss in Table I arises solely from the transformation-specific redefinition in Eq. (6), confirming the concern.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing flaw is Eq. (6), which defines post-swap neighbor information as m* = [1 - (m_old - m_new)] * m_old. In the proof of Theorem III.1 (Section III-B), this specific form expands to the squared term (gamma1 - gamma2)^2, so the claimed 'decrease or unchanged' is an algebraic consequence of the definition, not an empirical or information-theoretic property. The paper never justifies Eq. (6) from Eq. (4), from a limiting argument, or from any standard measure of information (e.g., mutual information, entropy, SSIM). Every reported Ypsilon value in Table I is computed with Eq. (6), so the validation is circular. Furthermore, mneig in Eq. (4) depends only on Euclidean distances between coordinates, making Mneig(P) in Eq. (5) identical for all images of the same size; applying Eq. (5) directly to a transformed image (ignoring Eq. (6)) yields Ypsilon = 100%. Thus the measure does not reflect image content, and the claimed correlation between Ypsilon and accuracy loss is not a property of the images but of the arbitrary transformation-dependent redefinition.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a framework for measuring image information content based on pairwise pixel-neighbor information, defines a remaining-information ratio Υ, proves a \"principle of verisimilitude\" theorem stating that swapping any two pixels decreases or preserves total information, and introduces Random Vortex Transformation (RVT), a coordinate-based encryption method meant to preserve neighbor information while making images unrecognizable to humans. Experiments train ResNet-18 and ViT on MNIST, Fashion-MNIST, and CIFAR-10 under original, vortex-encrypted, and randomly permuted data, reporting small accuracy drops for RVT and a claimed positive correlation between information loss and accuracy loss.","tokens_in":17468,"tokens_out":5019,"duration_ms":49817,"significance":"If the framework were valid, it would offer a theoretical basis for training on encrypted images and a general tool for image quality and encryption evaluation. The empirical observation that models can train on vortex-transformed images with modest accuracy loss is interesting, and the authors provide code and a random-permutation baseline. However, the central theoretical result is manufactured by the definition in Eq. (6), the information measure ignores pixel values, and the claimed accuracy-information correlation is contradicted by the paper's own Table I. Because these issues affect the main claims rather than presentation, the paper's significance is not established.","major_comments":[{"comment":"Equation (6) defines the post-transformation neighbor information as m*_neig = [1 - (m_neig(old) - m_neig(new))] * m_neig(old) without derivation from Eq. (4), from a limiting argument, or from any standard information measure. In the proof of Theorem III.1, Eqs. (9)-(11), this specific algebraic form is exactly what expands into the squared term (γ1 - γ2)^2, so the theorem's conclusion that information decreases or remains unchanged is an artifact of the definition. Since every Υ value in Table I is computed using Eq. (6), the empirical validation is circular.","section":"Section III-A, Eq. (6)"},{"comment":"The function m_neig(Pij, Pst) depends only on normalized Euclidean distance between coordinates and does not depend on pixel values. Consequently, M_neig(Pij) in Eq. (5) is identical for all images of the same size. Because Section V-B2 explicitly discards the pixel-value term Mpix, the reported Υ measures only coordinate displacement, not image content. Indeed, applying Eq. (5) directly to a transformed image without the modification in Eq. (6) would yield Υ = 100% for any permutation, so the reported information loss is entirely an artifact of Eq. (6).","section":"Section III-A, Eqs. (4)-(5)"},{"comment":"The claimed positive correlation between information-loss rate and accuracy-loss rate is not supported by the paper's own numbers. For ResNet-18, MNIST has information loss 4.75% and accuracy loss 0.31%; Fashion-MNIST has information loss 9.96% and accuracy loss 1.27%; but CIFAR-10 has the smallest information loss (2.62%) and the largest accuracy loss (5.24%). The same inversion occurs for ViT. Thus the statement that the decrease in accuracy is \"roughly proportional\" to the loss of information content is contradicted by Table I.","section":"Table I and Section V-B2"},{"comment":"The \"Principle of Verisimilitude\" is introduced as a requirement in Section III-A and treated as a premise rather than a proven consequence. Theorem III.1 proves only a monotonicity property of the quantity defined by Eq. (6); it does not show that the original image has maximal information content in any independent sense. The conclusion is therefore an input to the framework, not a result derived from it.","section":"Section III-B, Principle of Verisimilitude"}],"minor_comments":[{"comment":"The text says CIFAR-10 images are \"much smaller than the images in CIFAR-10\" when it appears to mean much smaller than the ImageNet images in the original ResNet-18 implementation.","section":"Section V-A2"},{"comment":"The bullet states that MNIST-Vortex accuracy is only \"0%\" lower than Origin, while Table I reports decreases of 0.31% and 0.32%; the exact values should be used.","section":"Section V-B1"},{"comment":"Equations (20)-(22) use (i′, j′) for the vortex center, but Eq. (17) defines (i′, j′) as the transformed coordinates; this notational conflict should be resolved, for example by using (i0, j0) for the center.","section":"Eqs. (20)-(22)"},{"comment":"The paper does not specify whether the coordinate map defined by Eq. (17) is injective or bijective; if two pixels can map to the same location, the transformation is not a permutation and its relation to Theorem III.1 is unclear.","section":"Eq. (17)"},{"comment":"The reported accuracies and Υ values appear to come from single runs without error bars or multiple seeds; at least a statement of variance or repeated trials is needed to support the claimed accuracy differences.","section":"Experimental results"},{"comment":"The MNIST dataset is described as handwritten digits from 1 to 10, but the standard labels are 0 to 9.","section":"Section V-A1"}],"recommendation":"reject","confidential_remarks":"I agree with the stress-test assessment: the central theorem is true only by construction, and the validation is circular because Eq. (6) is used to compute every Υ value in Table I. The table also contradicts the claimed correlation. These are load-bearing problems that would require redesigning the information measure and re-examining the theoretical claims, rather than local fixes. The RVT empirical results, if presented as an engineering observation with error bars and analysis of the transformation's bijectivity, might form a separate, more modest contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know two things. The practical trick in this paper—training on images scrambled by the random vortex transformation—is real and checkable, and the reported accuracies are plausible. The theory wrapped around it is not: the central theorem is manufactured by Eq. (6), and the information measure never looks at pixel values, so it is not an information measure at all.\n\nWhat is genuinely new: the vortex construction itself. The idea of rotating pixels along concentric circles while keeping local neighborhoods largely intact is concrete, the code is public, and the numbers (99.2 to 98.9 on MNIST, 92.8 to 87.6 on CIFAR-10 with ResNet-18) are the kind a reader can quickly verify. Comparing against random pixel permutation is the right control, and the gap between the two makes the case that the vortex is preserving something useful.\n\nWhere it falls apart. Eq. (6) defines post-swap neighbor information as [1 - (m_old - m_new)] * m_old. Expanding the proof of Theorem III.1 turns exactly that factor into the squared term (γ1 - γ2)^2. The theorem says information decreases because the definition was written to make it decrease. Nothing in Eq. (4), or in any standard notion of information, justifies Eq. (6). Worse, Mneig(Pij) is a sum of a function of coordinate distances only, so M(P) is identical for every image of the same dimensions. The Υ values in Table I are, in effect, properties of the coordinate grid, not of the image content. The claimed accuracy-information correlation is contradicted by Table I itself: MNIST loses 4.75% of Υ but only 0.31% accuracy, while CIFAR-10 loses 2.62% of Υ but 5.24% accuracy.\n\nThe empirical sections also have soft spots. No error bars, no multiple seeds, no comparison to earlier learnable-encryption or input-perturbation methods, and reference [35] is the only nod to a non-empty literature. The security claim is asserted without analysis.\n\nBottom line: the vortex transform is a plausible empirical contribution trapped inside a framework that does not hold up. As written, the main claims—the theorem and the information-loss correlation—are not defensible. I would desk reject the current version, but I would encourage a resubmission as an empirical paper on vortex obfuscation for privacy-preserving training, without Υ and with proper baselines and variability reporting.","headline":"The vortex scramble is a real empirical trick, but the theory is a tautology and the information measure does not actually measure image content.","tokens_in":17941,"tokens_out":6464,"would_cite":false,"duration_ms":69672,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Swapping any two pixels weakly reduces a distance-weighted measure of image information, and vortex encryption built on this lets neural nets train on scrambled images with under 6.5% accuracy loss.","keywords":["image information content","random vortex transformation","image encryption","neighboring pixel information","privacy-preserving training","encrypted-data learning","ResNet","Vision Transformer"],"falsifier":"Take a single-color image and swap any two pixel positions. The image is unchanged visually and to a classifier, but the framework's neighbor-information rule depends only on pixel coordinates, so the reported remaining-information fraction $\\Upsilon$ will generally drop below 100%. A measure that reports information loss where no observable change occurs would falsify the claim that $\\Upsilon$ captures image information content or predicts trainability.","tokens_in":16957,"feed_emoji":"🌀","tokens_out":13260,"duration_ms":118309,"temperature":0.7,"pith_summary":"Vision systems treat images as arrays of pixels, but this paper argues that the information a network actually uses lives in the distance-weighted relationships between pixel pairs, not in isolated pixel values. It defines an image's information content as the sum, over all pixels, of a nonlinear function of how far each pixel is from every other pixel, and it proves that swapping the positions of any two pixels can only reduce or leave unchanged that total. On that basis it designs a Random Vortex Transformation, which rotates pixels along concentric circles around a random center with a bounded random twisting function, so the encrypted image looks scrambled to a human eye while nearby pixels stay nearby. Training ResNet and Vision Transformer models on the encrypted versions of MNIST, Fashion-MNIST, and CIFAR-10 costs only 0.3% to 6.5% accuracy compared with training on the originals, whereas random permutation collapses accuracy to 29% to 56%. The paper offers the positive correlation between its computed information loss and the accuracy loss as evidence that the measure tracks what learning needs.","feed_headline":"Scrambled vortex images train neural nets within 6.5% accuracy loss","feed_subtitle":"A distance-based information measure shows why neighbor-preserving vortex encryption keeps models learnable","key_machinery":"The load-bearing object is the neighbor-information pair: the distance-decay function $m_{\\mathrm{neig}}(P_{ij},P_{st}) = 1 - 1/(1+e^{6-18\\tilde d(P_{ij},P_{st})})$, which depends only on the normalized pixel distance $\\tilde d$, and the post-transformation residual rule $m^*_{\\mathrm{neig}}(P_{i'j'},P_{s't'}) = [1 - (m_{\\mathrm{neig}}(P_{ij},P_{st}) - m_{\\mathrm{neig}}(P_{i'j'},P_{s't'}))]\\,m_{\\mathrm{neig}}(P_{ij},P_{st})$. Substituting this rule into the sum over pixel pairs turns a two-pixel swap into a sum of squared differences $(\\gamma_1-\\gamma_2)^2$, which is what forces the total information to fall or stay flat. The Random Vortex Transformation is then the coordinate map in Eq. (17), whose bounded random twist $f$ makes large displacement of nearby pixels unlikely, so the encrypted image's neighbor-information sum stays close to the original.","core_discovery":"The central claim is that image information content has a well-defined, measurable form: for each pixel, sum a Z-shaped function $1 - 1/(1+e^{6-18\\tilde d})$ of its normalized distance to every other pixel, and call the total the image's information content. With one additional rule for how much neighbor information survives a pixel move, the paper proves Theorem III.1, that swapping any two pixels weakly decreases the total. It then constructs the Random Vortex Transformation, $i' = d\\cos(\\theta+(R-d)f(d))$, $j' = d\\sin(\\theta+(R-d)f(d))$, with a bounded-derivative random $f$, to encrypt images while keeping each pixel near its old position. The experimental claim is that deep networks trained on such encrypted images stay within 0.3% to 6.5% of original-data accuracy, and that the computed remaining-information fractions ($\\Upsilon \\approx 90$--97% for vortex, $\\approx 67$% for random permutation) correlate with the measured accuracy losses.","pith_inferences":["The paper's neighbor-information function never looks at pixel intensities, only at coordinates; as a result $\\Upsilon$ measures rearrangement of the grid, and any claim that it captures semantic content would need independent calibration.","The evidence for a positive correlation between information loss and accuracy loss is limited to two transformation types per dataset; sweeping vortex strength continuously would test whether $\\Upsilon$ orders transformations monotonically by learnability.","If $\\Upsilon$ is accepted, it offers a cheap pre-training screen: compute the information-retention rate of any candidate encryption transform and predict its accuracy budget before running a single epoch.","The paper's security claim is human-perceptual rather than cryptographic; translating it into an adversary model (how many random vortex parameters must be guessed to undo the transform) is left open and would be needed to use RVT in real privacy settings."],"forward_implications":["Any transformation that displaces pixels only mildly, in the sense of keeping normalized distances small, will produce encrypted images that deep classifiers can still learn, giving a design rule for encryption-then-training systems.","Random permutation is the negative control: it collapses accuracy to 29%--56% and $\\Upsilon$ to about 67%, confirming that preserved neighbor relationships, not raw pixel values, are what carry trainable information.","Because RVT does not require decryption for use, it fills a gap that homomorphic encryption cannot, which is training nonlinear models such as ResNet and ViT on protected data.","Stacking several vortex transformations is cheap and degrades $\\Upsilon$ slowly, so the scheme can be strengthened by composition without leaving the accuracy budget."],"supporting_citations":[{"why":"Supplies the MNIST dataset and the CNN formulation of neighbor-based image features that motivates the framework.","marker":"[1]"},{"why":"ResNet is one of the two architectures trained on encrypted images in the experiments.","marker":"[4]"},{"why":"Vision Transformer is the other architecture trained on encrypted images.","marker":"[5]"},{"why":"Transformer attention provides the global pixel-relationship viewpoint the information framework extends.","marker":"[6]"},{"why":"Chaos-based image encryption is the prior paradigm whose goal of maximal disruption RVT explicitly inverts.","marker":"[19]"},{"why":"Privacy homomorphisms establish the baseline limitation that encrypted data usually cannot feed nonlinear machine learning.","marker":"[33]"},{"why":"Fully homomorphic encryption is the costly alternative that RVT avoids by keeping images trainable without decryption.","marker":"[34]"},{"why":"Cited as the closest prior work on learning from protected images, supporting the paper's claim that this direction is nearly unexplored.","marker":"[35]"},{"why":"Fashion-MNIST is the second benchmark dataset used for the accuracy and information-loss comparisons.","marker":"[36]"},{"why":"CIFAR-10 is the three-channel benchmark dataset where the accuracy drop reaches the 6.5% upper end.","marker":"[37]"}],"fun_headline_variants":["Encrypted images still train nets, info loss under 7%","Vortex-encrypted images train ResNets within 6.5%","Random vortex keeps images learnable for AI","Image info measure proves vortex encryption preserves learning","Train on scrambled images: accuracy drop only 6.5%"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole framework hinges on the untested claim that the paper's formula for 'remaining neighbor information' after a pixel move — $m^*_{\\mathrm{neig}} = [1 - (m_{\\mathrm{old}} - m_{\\mathrm{new}})]\\,m_{\\mathrm{old}}$ — actually describes how much information survives; if that rule is arbitrary, the theorem and the correlation with accuracy loss collapse.","fun_headline_variants_meta":{"raw":{"variants":["Encrypted images still train nets, info loss under 7%","Vortex-encrypted images train ResNets within 6.5%","Random vortex keeps images learnable for AI","Image info measure proves vortex encryption preserves learning","Train on scrambled images: accuracy drop only 6.5%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000223,"raw_usage":{"total_tokens":1486,"prompt_tokens":1004,"completion_tokens":482,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":620,"completion_tokens_details":{"reasoning_tokens":398}},"tokens_in":620,"tokens_out":482,"duration_ms":5007,"temperature":1.0,"reasoning_tokens":398,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T13:22:48.077909+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a single-color image and swap any two pixel positions. The image is unchanged visually and to a classifier, but the framework's neighbor-information rule depends only on pixel coordinates, so the reported remaining-information fraction $\\Upsilon$ will generally drop below 100%. A measure that reports information loss where no observable change occurs would falsify the claim that $\\Upsilon$ captures image information content or predicts trainability.","supporting_citations":[{"cited_title":"Deep residual learning for image recognition,","cited_arxiv_id":null,"evidence_quote":"ResNet is one of the two architectures trained on encrypted images in the experiments."},{"cited_title":"An image is worth 16x16 words: Trans- formers for image recognition at scale,","cited_arxiv_id":null,"evidence_quote":"Vision Transformer is the other architecture trained on encrypted images."},{"cited_title":"On data banks and privacy homomorphisms,","cited_arxiv_id":null,"evidence_quote":"Privacy homomorphisms establish the baseline limitation that encrypted data usually cannot feed nonlinear machine learning."},{"cited_title":"Gentry, A fully homomorphic encryption scheme , 2009","cited_arxiv_id":null,"evidence_quote":"Fully homomorphic encryption is the costly alternative that RVT avoids by keeping images trainable without decryption."},{"cited_title":"Learnable privacy-preserving anonymiza- tion for pedestrian images,","cited_arxiv_id":null,"evidence_quote":"Cited as the closest prior work on learning from protected images, supporting the paper's claim that this direction is nearly unexplored."}],"review_version":1}