{"id":"c73cf98d-77e1-4220-8e2d-476e8b0def77","arxiv_id":"2411.16458","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Reconstruction from group-invariant networks collapses toward the orbit-average input, and two modified methods (SAME-GD, deep image prior) reduce this collapse in preliminary MNIST experiments.","lead":"This paper studies how to reconstruct training images from neural networks that are built to ignore reflections and rotations. It shows standard reconstruction methods collapse toward symmetric average images, and proposes two fixes that recover sharper results in early experiments.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The printed KKT loss in Eq. (3) omits the parameter gradient, making it dimensionally invalid; this prevents the reported KKT-based experiments and proposed SAME-GD/DIP improvements from being verified against the stated margin-maximization objective.","rationale":"The strongest central claim has two parts: conventional reconstruction methods fail for invariant networks by gravitating to symmetric inputs, and the proposed SAME-GD and DIP methods improve reconstruction quality. The second part is entirely built on the KKT objective: Table 1 reports KKT, KKT+SAME-GD, and KKT+DIP numbers, and the proposed methods are only evaluated in combination with KKT. If Eq. (3) is not the true optimized objective, then these numbers cannot be reproduced from the paper and the claimed improvements are not tied to the stated theory. The paper's own Lemma 3 indicates the intended objective must involve ∇_θ φ, so the omission is likely a typo rather than a fundamental error; however, without code or a corrected equation, the reader cannot distinguish a harmless typesetting mistake from a substantive misspecification. The stationarity assumption for symmetrized ReLU networks is also asserted rather than verified, compounding the gap between Lyu-Li margin-maximization theory and the experiments. Proposition 2 and the stabilizer-nesting argument are logically sound as far as they go, and the experimental phenomenon is plausible, so this is not a rejection-level flaw; but it is the most load-bearing point because it sits directly under the main quantitative evidence and the proposed-method results. The reader's conditional verdict already captures this risk: the paper should be accepted only after Eq. (3) is corrected and the KKT experiments are re-run or released with the corrected objective.","tokens_in":8014,"tokens_out":11860,"duration_ms":120274,"concrete_test":"Re-run the smallest reported configuration (MNIST, binary odd/even, n=50, reflection group |G|=2) with the corrected loss L_rec = ||θ − Σ_i λ_i y_i ∇_θ φ(x_i; θ)||, using the same symmetrized two-hidden-layer ReLU network, m=1000 candidates, and the reported DSSIM evaluation. If the corrected objective reproduces the Table 1 KKT row (0.464) and the orbitope concentration near V^G, then the omitted ∇_θ is a typographical error and the phenomenon stands; if it does not reproduce those values, the KKT-based results and all downstream SAME-GD/DIP comparisons are not valid as stated. The same re-run should also verify numerically that the trained parameters satisfy the KKT stationarity condition for the symmetrized network.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 2 and Appendix B define the KKT reconstruction loss as L_rec = ||θ − Σ_i λ_i y_i φ(x_i; θ)|| (Eq. 3), where φ(x; θ) is the scalar network output. This is not the KKT stationarity condition θ = Σ_i λ_i y_i ∇_θ φ(x_i; θ) from margin-maximization theory (Lyu & Li, 2020; Haim et al., 2022): the printed expression subtracts scalars from a p-dimensional parameter vector and omits the parameter gradient of φ. Lemma 3 in Appendix C proves G-invariance of ∇_θ φ, which is exactly the quantity needed for the loss to be invariant, confirming the intended objective must contain ∇_θ φ. Thus either the formal statement is wrong and the KKT experiments as described are not reproducible, or the experiments used an unstated corrected objective. Because Table 1 and the SAME-GD/DIP modifications are all evaluated on top of the KKT objective, the central empirical claim that conventional methods converge to symmetric inputs and that the proposed methods improve reconstruction is not verifiably anchored to the margin-maximization reconstruction method. Section 3.1 further asserts without proof that trained symmetrized ReLU networks meet the KKT conditions, so both the stationarity assumption and the loss formula need verification.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies the reconstruction of training data from group-invariant neural networks. It formalizes the reconstruction problem for invariant models, proves basic invariance properties of reconstruction objectives, and shows that gradient descent iterates on such objectives are equivariant and have nested stabilizers. The central empirical claim is that conventional activation maximization and KKT-based reconstruction methods converge to highly symmetric inputs, typically near the group average, yielding poor reconstructions. The paper then proposes two heuristics, SAME-GD and a deep-image-prior parameterization, and reports preliminary MNIST and CIFAR-10 experiments suggesting that these can improve reconstruction quality.","tokens_in":8312,"tokens_out":5003,"duration_ms":50171,"significance":"If the findings hold, this is a useful first investigation of a realistic and privacy-relevant setting: reconstructing data from networks that are invariant under finite groups. The formal problem definition and the stabilizer-nesting result for gradient descent (Proposition 2) are conceptually clean and provide a plausible explanation for the observed convergence to orbit averages. The proposed methods are heuristic but could open a useful direction. The paper does not appear to be circular: the main qualitative prediction follows from the theory rather than from fitting the model to the data. However, the manuscript as printed contains a dimensionally invalid KKT objective, an unverified KKT-stationarity assumption for the trained symmetrized networks, and a table that does not support one of the main claims about SAME-GD. These issues are load-bearing and need to be fixed before the empirical claims can be verified.","major_comments":[{"comment":"The printed KKT reconstruction objective is dimensionally invalid: L_rec = ||θ − Σ_i λ_i y_i φ(x_i; θ)|| subtracts scalar network outputs from the parameter vector θ. The KKT stationary condition of the margin-maximization problem in Eq. (2) is θ = Σ_i λ_i y_i ∇_θ φ(x_i; θ), so the printed formula omits the parameter gradient ∇_θ φ. Lemma 3 in Appendix C proves G-invariance of ∇_θ φ, which is exactly the quantity needed for the loss to be invariant, confirming that the intended objective contains the gradient. Because Table 1 and the SAME-GD/DIP variants are evaluated on top of this objective, the experiments as described are not reproducible from the printed equations. The authors should correct Eq. (3) and explicitly state whether the experiments used the corrected objective with ∇_θ φ.","section":"Section 2 / Appendix B, Eq. (3)"},{"comment":"The paper asserts that 'in most cases the training of (homogeneous) invariant neural networks is conducted in a way that the conditions of both methods (AM and KKT-based) are met,' but no proof or verification is provided for the symmetrized ReLU networks used in Appendix E. The KKT-based reconstruction method requires convergence of gradient flow to a KKT point of the margin-maximization problem, which is a nontrivial assumption. The authors should either verify the stationary condition numerically on the trained models (for example, by computing the relative KKT residual) or weaken the claim to state that the method is applied heuristically. Without this, the KKT reconstructions are not anchored to the stated margin-maximization theory.","section":"Section 3.1"},{"comment":"The text states that SAME-GD yields 'notably improved reconstructions,' but Table 1 does not support this uniformly. For CIFAR-10 the KKT+SAME-GD column is worse than vanilla KKT on both training-set sizes (0.369 ± 0.000 vs 0.346 ± 0.001 for n=50; 0.370 ± 0.007 vs 0.371 ± 0.001 for n=100). For MNIST with group size 8 the improvements are very small (0.465 vs 0.471 and 0.469 vs 0.471). The paper should report the comparisons with error bars, state which differences are significant, and adjust the claim to the actual results, or explain the configurations in which SAME-GD does and does not help.","section":"Table 1 / Section 4"},{"comment":"The central empirical claim is that conventional methods 'gravitate toward symmetric inputs' on which the group acts trivially, but the paper never quantifies this directly. Table 1 reports only DSSIM structural dissimilarity, and Figure 5 is a qualitative histogram of reconstruction locations on discretized orbitopes. The authors should add a quantitative symmetry measure, for example ||x − ḡx||/||x|| or the size of the stabilizer of the reconstruction, and report its distribution across methods. This would make the main phenomenon directly testable rather than inferred from image quality and a qualitative figure.","section":"Section 3.3 / Figure 5"}],"minor_comments":[{"comment":"Part (ii) states Stab_G(x_{t−1}) ⊆ Stab_G(x_t), meaning that stabilizers can grow as optimization progresses, so points become more symmetric; the accompanying text saying that stabilizers 'may become more restrictive' is backwards and should be reworded.","section":"Section 3.2, Proposition 2"},{"comment":"The proof of Lemma 3 contains a typo: the right-hand side should be (f(g·x; θ+εe_i) − f(g·x; θ))/ε, not (f(g·x; θ+εe_i) − f(x; θ))/ε.","section":"Appendix C, Eq. (4)"},{"comment":"The inner-product derivation contains a stray dot in the expression '<g^{-1}∇L(g·x), ·g^{-1}·h>' and should be cleaned up.","section":"Appendix D, proof of Lemma 5"},{"comment":"In the x_prev update, 'xprev ← β_t x_t + (1−β_t)∇L(x_t)' mixes a point and a gradient; the paper should specify the intended gradient with respect to x and clarify that ∇L(x_t) is used as a direction, not as a coordinate.","section":"Algorithm 1 / Appendix F"},{"comment":"Figure 3 is referenced in Section 3.3 but appears only after Appendix D in the submitted layout; the figure should be placed with its first citation.","section":"Figure 3"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is an extended abstract, and the authors are transparent about the preliminary nature of the results. The Eq. (3) issue is likely a typesetting typo, but it is load-bearing because all experiments are built on that objective. The lack of quantitative evidence for the main 'gravitation to symmetric inputs' phenomenon and the contradiction in Table 1 for SAME-GD also need to be addressed. I do not see a circularity problem, and the theoretical observation in Proposition 2 is a useful contribution. With a corrected KKT objective, a verification of the stationarity assumption, and an honest reporting of the experimental claims, the paper would be much stronger."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThis is the first paper I've seen that asks what data-reconstruction attacks do to group-invariant networks, and that alone makes it worth a look. The formal setup is clean: they define orbit-aware evaluation, prove that GD steps are equivariant and that stabilizers nest, and then show empirically that standard AM and KKT methods drift toward the orbit average. Proposition 2 is elementary but correct, and the orbitope concentration plots in Figure 5 are genuinely suggestive. The two proposed fixes—SAME-GD's memory term and DIP reparameterization—are reasonable, and KKT+DIP does produce visibly asymmetric reconstructions on MNIST.\n\nThe soft spots are real but mostly fixable. The printed KKT objective in Eq. (3) and Appendix B omits the parameter gradient: it reads θ − Σ λ_i y_i φ(x_i; θ), which subtracts scalars from a parameter vector. The correct stationarity condition from Lyu & Li is θ − Σ λ_i y_i ∇_θ φ(x_i; θ). Lemma 3 in Appendix C proves invariance of ∇_θ φ, which is exactly what you'd need for the loss to be invariant, so the authors clearly had the right quantity in mind. But as printed, the formal definition is dimensionally invalid, and the experiments cannot be reproduced from the paper as written. That's a serious typo in a methods section.\n\nSecond, the text claims SAME-GD 'notably improves' reconstruction, but Table 1 shows SAME-GD worse than vanilla KKT on both CIFAR-10 rows (0.369 vs 0.346 and 0.370 vs 0.371, where lower DSSIM is better). The gain only appears on MNIST. So the claim is overstated.\n\nThird, Section 3.1 asserts without evidence that symmetrized ReLU networks meet the KKT stationarity condition. That may be true, but it needs a proof or at least a verification. Minor: no code or hyperparameter details, and the scope is small groups (≤8) and binary image tasks. The authors acknowledge this in the appendix.\n\nOverall, the central phenomenon—invariant networks draw reconstruction toward symmetric inputs—is plausible and supported by the experiments. The paper is a solid extended abstract, not a full NeurIPS submission. A serious referee could work through it and request the fixes above. I'd send it out rather than desk-reject, but with the expectation that the KKT loss gets corrected and the empirical claims aligned with the table.","headline":"Worth engaging: first study of reconstruction attacks on invariant nets, with a nice stabilizer-nesting observation, but the printed KKT loss is missing a gradient and SAME-GD's gains don't show up in the CIFAR-10 rows.","tokens_in":8803,"tokens_out":2352,"would_cite":true,"duration_ms":22013,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Standard reconstruction methods applied to group-invariant networks converge to symmetric orbit averages, and two symmetry-aware modifications improve reconstruction quality.","keywords":["group-invariant neural networks","data reconstruction","activation maximization","KKT reconstruction","gradient descent equivariance","orbitope","deep image prior","privacy attacks"],"falsifier":"Train a two-layer symmetrized ReLU network on MNIST with a two-element reflection group, run KKT reconstruction with many random seeds, and compute the stabilizer of each final reconstruction together with its distance to the orbit average; if a large fraction of reconstructions are not fixed by the reflection and lie far from the average, the paper's claim that reconstructions gravitate to $V^G$ is contradicted.","tokens_in":7843,"feed_emoji":"🕵️","tokens_out":7132,"duration_ms":62297,"temperature":0.7,"pith_summary":"Reconstructing training data from a neural network gets harder when the network is invariant to a group of transformations such as reflections or rotations. This paper argues that conventional reconstruction objectives—activation maximization and KKT-based reconstruction—are themselves group-invariant, and gradient descent on such objectives cannot reach arbitrary points: the update is equivariant and the stabilizer of the iterate only grows, so reconstructions drift toward symmetric inputs on which the group acts trivially, typically the average over the orbit. Experiments on MNIST and CIFAR-10 with groups of size 2 to 8 confirm this drift, measured by group-invariant DSSIM. The paper then introduces two modifications, a memory-enhanced gradient update (SAME-GD) and a deep-image-prior parameterization, that break the symmetry pull and improve reconstruction quality. If the account is right, invariant models are substantially harder to invert naively, and future reconstruction attacks must be designed to break symmetry explicitly.","feed_headline":"Group invariance collapses naive data reconstruction","feed_subtitle":"Standard inversion returns orbit averages; SAME-GD and deep image prior break the symmetry pull.","key_machinery":"The load-bearing objects are the orbit of an input under a finite orthogonal group, the orbitope (the convex hull of that orbit), and the invariant subspace $V^G$ of points fixed by every group element. Proposition 2 is the main mechanism: for a $G$-invariant objective, one gradient descent step is $G$-equivariant, and $\\mathrm{Stab}_G(x_{t-1}) \\subseteq \\mathrm{Stab}_G(x_t)$, so iterates cannot decrease their symmetry and are drawn to the orbit average, the point with the largest stabilizer. SAME-GD deliberately violates this nesting by aggregating the current point with a previous point from which the orbit average has been removed, while deep image prior replaces direct optimization over pixels by optimization over a randomly initialized CNN whose natural-image prior breaks the symmetry bias.","core_discovery":"The central claim is that group invariance, not network capacity or dataset size, is what makes standard reconstruction methods collapse. For any finite orthogonal group $G$, if the reconstruction loss is $G$-invariant, then each gradient-descent step is $G$-equivariant and the stabilizer of the current iterate is nested inside the stabilizer of the next, so optimization can only move toward points with larger symmetry; the fixed points of this dynamics lie in the invariant subspace $V^G$, and the orbit average is the natural attractor. The paper proves this in two propositions and shows empirically that reconstructions from AM and KKT objectives concentrate near group averages on orbitopes. It reports that increasing the group size or training set size worsens the effect, and that KKT-based reconstruction beats activation maximization but still fails. Its proposed fixes, SAME-GD and deep image prior, both improve standard error metrics while producing asymmetric, piecewise-smooth reconstructions, especially when combined with the KKT objective.","pith_inferences":["The stabilizer-nesting argument applies beyond reconstruction: any gradient-based inversion or latent-space search over a symmetry-invariant objective will inherit the same drift toward fixed points, so the result predicts similar collapse in equivariant generative models.","Because the orbit average is a natural attractor, an invariant network leaks the orbit average but hides in-orbit details; a practical privacy implication is that group invariance acts as an accidental defense against naive attacks, though an adversary who knows the group can still recover the orbit.","SAME-GD removes the group-average component from a stored previous iterate, which suggests a principled design: any update that decreases the stabilizer of the current point should improve reconstruction, and quantifying how much symmetry breaking is needed per group size would be a direct follow-up."],"forward_implications":["Invariant models are harder to invert with off-the-shelf reconstruction: both AM and KKT return images close to the orbit average, with DSSIM around 0.46–0.49 on MNIST for groups of size 2–8.","Reconstruction quality degrades as the group or training set grows, so larger symmetry groups provide stronger accidental protection against naive attacks.","The KKT objective is a better starting point than activation maximization, and combining it with deep image prior gives the best reported reconstructions.","Evaluation of reconstruction attacks on invariant models should use a group-invariant metric such as min-over-orbit DSSIM to fairly compare across group transformations."],"supporting_citations":[{"why":"Introduces the KKT-based reconstruction objective that the paper applies to invariant networks and uses as its main baseline.","marker":"Haim et al., 2022"},{"why":"Establishes the margin-maximization KKT condition for homogeneous networks, which the KKT reconstruction method relies on.","marker":"Lyu and Li, 2020"},{"why":"Provides the directional-convergence result supporting the use of the KKT condition for gradient-trained homogeneous networks.","marker":"Ji and Telgarsky, 2020"},{"why":"Introduces activation-maximization model inversion, one of the two standard methods tested against invariant networks.","marker":"Fredrikson et al., 2015"},{"why":"Extends activation-maximization inversion to background-knowledge alignment, motivating the AM baseline used here.","marker":"Yang et al., 2019"},{"why":"Supplies the deep image prior that the paper repurposes to break symmetry in reconstruction.","marker":"Ulyanov et al., 2020"},{"why":"Defines the DSSIM metric used to evaluate reconstruction quality under group transformations.","marker":"Baker et al., 2023"},{"why":"Defines orbitopes, the convex hulls used to characterize where invariant reconstructions concentrate.","marker":"Sanyal et al., 2011"}],"fun_headline_variants":["Symmetry breaks data reconstruction","Invariance dooms naive reconstruction","Group invariance ruins inversion","Symmetry forces reconstructions to averages","Group invariant nets foil data recovery"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The KKT-based reconstruction results assume the trained invariant network is homogeneous and sits exactly at a margin-maximizing stationary point, so its weights are a weighted sum of gradients at the true training inputs, $\\theta = \\sum_i \\lambda_i y_i \\nabla_\\theta \\phi(x_i; \\theta)$; the paper asserts this holds for the symmetrized ReLU networks but does not verify it.","fun_headline_variants_meta":{"raw":{"variants":["Symmetry breaks data reconstruction","Invariance dooms naive reconstruction","Group invariance ruins inversion","Symmetry forces reconstructions to averages","Group invariant nets foil data recovery"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000206,"raw_usage":{"total_tokens":1362,"prompt_tokens":875,"completion_tokens":487,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":491,"completion_tokens_details":{"reasoning_tokens":433}},"tokens_in":491,"tokens_out":487,"duration_ms":5309,"temperature":1.0,"reasoning_tokens":433,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T13:05:29.722568+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a two-layer symmetrized ReLU network on MNIST with a two-element reflection group, run KKT reconstruction with many random seeds, and compute the stabilizer of each final reconstruction together with its distance to the orbit average; if a large fraction of reconstructions are not fixed by the reflection and lie far from the average, the paper's claim that reconstructions gravitate to $V^G$ is contradicted.","supporting_citations":[{"cited_title":"Gradient descent maximizes the margin of homogeneous neural networks","cited_arxiv_id":null,"evidence_quote":"Establishes the margin-maximization KKT condition for homogeneous networks, which the KKT reconstruction method relies on."},{"cited_title":"Directional convergence and alignment in deep learning","cited_arxiv_id":null,"evidence_quote":"Provides the directional-convergence result supporting the use of the KKT condition for gradient-trained homogeneous networks."},{"cited_title":"Orbitopes","cited_arxiv_id":null,"evidence_quote":"Defines orbitopes, the convex hulls used to characterize where invariant reconstructions concentrate."}],"review_version":1}