{"id":"0b5e7067-8e46-47be-802d-9abf074f0626","arxiv_id":"2411.17035","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"The paper proposes a multivariate all-pass filtering method and an m-LIP privacy measure for releasing multiple time series; the method preserves correlations, but the privacy guarantee has a serious inversion gap.","lead":"This paper proposes a way to release several related time series at once while keeping the correlations within and between the series almost unchanged. The method is aimed at statistical agencies that want safe public data, but its privacy measure does not currently justify the safety claim.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The privacy guarantee is defined for the single contemporaneous output Y_t, but every S-MAP filter is invertible at each frequency; an adversary with the full released series and the filter can recover X nearly exactly, so m-LIP values near 1 do not establish privacy for a batch release.","rationale":"The reader's weakest assumption is the load-bearing issue. The construction in Section 2 is mathematically sound: for a fixed positive-definite spectral density S, filters of the form Ψ(z) = S_+(λ) U(z) S_+(λ)^{-1} with unitary U satisfy S_Y = S_X, so second-order utility is preserved in the population. The Bauer factorization and cepstral parameterization are also standard. The problem is that the privacy half of the trade-off is evaluated against the wrong adversary. Equations (8)-(10) derive the reduction in prediction error from adding the current output Y_t to the attacker's information {Z_t}; Proposition 1 and Definition 3 make this explicit by using only Var[Y_t | {Z_t}] and Cov[X_t, Y_t | {Z_t}], that is, averages of spectral blocks that do not involve Y_{t-k} for k ≠ 0. But the release is the entire series {Y_t}, and the filter is invertible at every frequency. Consequently an adversary who knows Ψ can undo the masking. This is not an 'outside current consensus' objection about the strength of differential privacy; it follows algebraically from equations (1)-(5). The paper's silence on whether Ψ is a secret key makes the gap sharper. If the authors adopted a secret randomized key and redefined the measure to condition on all released Y_s, the framework might be salvageable, but as written the headline claim of 'achieving privacy utility balance' is not established. I would keep the reader's REJECT, crediting the utility-preservation component as genuine and potentially reusable.","tokens_in":17241,"tokens_out":10593,"duration_ms":113023,"concrete_test":"Reproduce the Section 5.1.1 VAR(1) simulation (T = 2000, r = 1), release the full filtered series {Y_t}, and treat the filter Ψ_r as known to the attacker, since the paper does not declare it secret. Compute the linear predictor of interior X_t from all released Y_s and Z_s, equivalently evaluating the full conditional spectral density S_{X|Y,Z}(λ) = S_{X|Z} - S_{X|Z}Ψ^*(ΨS_{X|Z}Ψ^*)^{-1}ΨS_{X|Z}; report the normalized mean squared error of the recovered interior X_t. If the recovery error is near zero while the reported m-LIP is near 1, the m-LIP measure overstates privacy for the full released process.","verdict_should_be":"REJECT","load_bearing_attack":"Definition 3 / equation (10) measures privacy as the incremental predictive power of the single contemporaneous output vector Y_t after conditioning on {Z_t}: m-LIP uses Cov[X_t, Y_t | {Z_t}] Var[Y_t | {Z_t}]^{-1} Cov[Y_t, X_t | {Z_t}]. But the released object is the whole process {Y_t}, not Y_t alone. The paper never states that the filter Ψ is secret. If Ψ is known, then because every filter in the class (5) is nonsingular at each frequency, the full conditional spectral density is S_{X|Y,Z}(λ) = S_{X|Z} - S_{X|Z}Ψ^*(ΨS_{X|Z}Ψ^*)^{-1}ΨS_{X|Z} = 0 pointwise, assuming S_{X|Z} is positive definite. Hence Var[X_t | {Y_s}, {Z_s}] = 0 in the Gaussian/linear-prediction sense: an attacker who observes the full released series and knows the filter recovers X_t exactly. m-LIP can still be near 1 because Y_t alone may have small contemporaneous correlation with X_t (for example, a filter that approximates a delay), so the values in Table 1 do not quantify disclosure risk for the released process. If the design intends Ψ to be a secret key, the paper must state that and analyze key secrecy; it does neither. The mathematics of Sections 2 and 3 is internally coherent, but the central privacy claim rests on a threat model that does not match the data product.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a privacy-preserving method for multivariate time series based on multivariate all-pass (MAP) filtering. The authors extend the univariate FLIP method to the multivariate setting by constructing a class of S-MAP filters parameterized through spectral factorization and matrix cepstral representations. They define a multivariate linear incremental privacy (m-LIP) measure and choose the filter to maximize this measure while preserving second-order utility (autocovariance and cross-covariance structure). The method is illustrated on simulated VAR, VARMA, and ARCH-type processes and on U.S. Census Bureau QWI employment data. The mathematical construction of the S-MAP filters and the derivations of the spectral-domain formulas are coherent and technically solid as far as they go.","tokens_in":37,"tokens_out":6576,"duration_ms":123451,"significance":"The paper addresses a genuine gap: existing privacy mechanisms for multivariate time series generally preserve marginal properties but not cross-series dependence, and no formal privacy-utility framework for such data appears to be available. The S-MAP filter class and the use of spectral factorization are novel and could be useful building blocks. However, the central contribution is a privacy guarantee, and that guarantee is not established by the m-LIP measure as defined. The paper's numerical results demonstrate that the method preserves second-order utility and that the m-LIP values can be high, but they do not demonstrate privacy against an adversary who observes the entire released series. If the privacy definition were corrected or the threat model specified, the method might have value, but as it stands the main claim is unsupported.","major_comments":[{"comment":"The m-LIP measure conditions on the single contemporaneous vector Y_t only, not on the entire released process {Y_t}. This is explicit in the paper: 'we focus on the sensitivity of X_t given the new information Y_t over the available information {Z_t}.' However, the mechanism releases the whole filtered series {Y_t} (Section 4.5), and an attacker observing the batch release would have all of {Y_t}. Conditioning on Y_t alone does not bound the incremental information contained in the full released series: an attacker can form predictions of X_t from all Y_s, not just Y_t. The paper gives no argument that Var[X_t | Y_t, Z] bounds Var[X_t | {Y_s}, Z], and in fact the inequality does not hold in general.","section":"Section 3.2, Definition 3 (Eq. (10))"},{"comment":"Every filter in the proposed class F_S is invertible at every frequency, since Ψ(z) = S^+(λ)U(z)S^+(λ)^{-1} with U(z) unitary. Consequently, an adversary who knows the filter and observes the full released series {Y_t} can recover the original sensitive series {X_t} essentially exactly by applying the inverse filter. The manuscript never states whether the filter is intended to be kept secret, and it does not analyze the secrecy of the filter or the information about the filter that the released data themselves may leak. Thus the privacy values reported in Section 5 (e.g., m-LIP near 0.99 in Table 1) do not quantify the disclosure risk of the actual data product, which is the entire filtered series. This undermines the abstract's claim of achieving a 'privacy utility balance.'","section":"Section 2.2, Eq. (5)"},{"comment":"The empirical evaluation reports m-LIP values and utility measures, but no attack-based evaluation against an adversary who observes the whole released series and either knows the filter or attempts to estimate it. Given the invertibility of the filters, a natural evaluation would be to apply the inverse filter to the released series and measure the discrepancy between the recovered series and the original. The absence of such an evaluation is not a mere presentation issue; it reflects the fact that the privacy measure used to guide and justify the method does not match the batch-release threat model.","section":"Section 5, Tables 1 and 2"}],"minor_comments":[{"comment":"The notation in (5), 'Ω_k ∈ S_n' for all k, is inconsistent with the earlier development, which states Ω_k = -Ω'_{-k} and that only Ω_0 is skew-symmetric; the condition should be stated as Ω_0 ∈ S_n and Ω_{-k} = -Ω'_k for k > 0.","section":"Section 2.2, Eq. (5)"},{"comment":"The sentence 'use this same spectral density to generate optimum one-sided h− ahead forecasts for h − 0, 1, . . . , M' contains typographical errors; it should refer to h = 0, 1, ..., M.","section":"Section 4.5"},{"comment":"The caption states 'The y-axis is employment count (in units of 10^5)', but the axis labels range from 2.8 to 3.6, which are consistent with units of 10^5. The parenthetical is therefore redundant, and the figure would be clearer if the axis label indicated 'Employment count (×10^5)'.","section":"Figure 7"},{"comment":"The column header 'error' in Table 2 is unexplained; it should be labeled 'VAR(1) with ARCH(1) error' or similar for consistency with the text.","section":"Table 2"},{"comment":"Reference [5] is incomplete, lacking a journal name and volume/page information. Reference [7] is cited as 'accessed in 2022 and 2023' but the text says data were retrieved on January 28, 2024; the access date should be consistent.","section":"References"}],"recommendation":"reject","confidential_remarks":"The manuscript builds on the authors' own FLIP paper, and the main novelty is the multivariate extension of the filter class and the m-LIP measure. The mathematical construction is correct, but the central privacy claim fails because the measure evaluates only the contemporaneous released value Y_t, while the released product is the whole filtered series. Since the filters are invertible, an attacker with knowledge of the filter can recover the original series exactly. This is not a small omission: the threat model needs to be redefined, the filter secrecy analyzed, and the privacy measure re-derived for the full release. Those changes would substantially alter the scope and conclusions of the paper. I therefore recommend rejection, rather than major revision, although I would be open to re-evaluating a genuinely revised version that addresses this fundamental issue."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the S-MAP filter class and the m-LIP measure are real extensions, not relabeled old results. The matrix all-pass derivation in Sections 2 and 3 is coherent, and the optimization over cepstral coefficients is a workable way to search the filter space. The simulations and the QWI application show that autocorrelations and cross-correlations are preserved after filtering, which is exactly the utility property the paper promises. I think the mathematical core is worth taking seriously.\n\nThe soft spot is the privacy guarantee, and it is load-bearing. m-LIP conditions on the contemporaneous output Y_t given the auxiliary process {Z_t}; it does not condition on the full released process {Y_s}. But the release is the whole series. Every filter in the class (5) is invertible at each frequency, so an attacker who observes {Y_t} and knows the filter can recover {X_t} essentially exactly. The paper never states whether the filter is secret. If the design intends the filter to be a secret key, that must be said explicitly and the key-secrecy question must be analyzed. Without that, the privacy values near 1 in Table 1 do not quantify disclosure risk for the actual data product. I don't think this is a minor oversight; it is the main claim of the paper.\n\nA few smaller issues. The real-data section reports no privacy numbers at all, only utility plots, so the privacy-utility balance is not demonstrated on the data most relevant to the Census Bureau use case. There is no comparison with other privacy mechanisms, such as noise addition or differential privacy variants, so the claimed gap-filling is asserted rather than shown. The notation in Definition 3 is also harder to read than it needs to be, and the proof of Result 1 is omitted, though it is indeed straightforward.\n\nWho gets value from this paper? Researchers working on all-pass filtering as a perturbation family, and methodologists at statistical agencies who need to preserve second-order structure in protected time series. The paper is not ready for publication as a privacy mechanism, but the S-MAP filter construction could be repurposed under a more honest threat model, for example with a secret filter key or with privacy defined for the full released stretch.\n\nI would send this to peer review rather than desk-reject it. The mathematics deserves a serious referee, and the central privacy flaw is the kind of thing a good referee can force the authors to confront. My expectation is major revision at best, but the kernel is worth engaging with.","headline":"The multivariate all-pass filter algebra is a genuine extension and the cepstral parameterization is clean, but the privacy claim only protects one time point at a time: anyone who knows the filter can reconstruct the full released series.","tokens_in":83,"tokens_out":2979,"would_cite":true,"duration_ms":95996,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["62M10","62M15","68P27"],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that a certain class of matrix all-pass filters preserves all second-order structure of a multivariate time series, and that maximizing a multivariate incremental-privacy criterion over that class attains the best…","keywords":["multivariate time series privacy","all-pass filter","linear incremental privacy","spectral factorization","cepstral representation","privacy-utility trade-off","cross-correlation preservation","positive definite spectral density estimation"],"falsifier":"Simulate a bivariate VAR(1), compute the m-LIP value from (14), and separately compute the conditional variance of $X_t$ given the entire released trajectory $\\{Y_s\\}$; if the full-trajectory disclosure can remain large while m-LIP approaches one, the claimed privacy-utility balance is not established. A simpler check: if the filter is treated as public, applying its inverse to a released realization recovers $X$ exactly.","tokens_in":16977,"feed_emoji":"🔒","tokens_out":11990,"duration_ms":103979,"temperature":0.7,"pith_summary":"The paper proposes a formal privacy mechanism for multivariate time series that does not destroy the data's dependence structure. It extends the univariate FLIP method to vector-valued series, where filters are matrices and multiplication does not commute. The central claim is that, for a target series with known positive definite spectral density $S$, the filter class $\\{\\Psi(z)=S_{+}(\\lambda)U(z)S_{+}(\\lambda)^{-1} : U(z)=\\exp(\\sum_k \\Omega_k z^k),\\ \\Omega_k \\text{ skew-symmetric}\\}$ contains non-identity filters satisfying $\\Psi S \\Psi^* = S$, so the filtered series has exactly the same autocovariances and cross-covariances as the original. Selecting $U$ to maximize the m-LIP measure (14) is claimed to give the best privacy achievable at that level of utility. If this is right, a data agency could release privatized multivariate series whose second-order properties, including cross-series dependence, remain usable for downstream analysis.","feed_headline":"One filter hides multivariate series while keeping its correlations","feed_subtitle":"Matrix filters scramble the data while preserving autocovariance and cross-covariance, and privacy is then optimized.","key_machinery":"The central object is the spectral-density-relative all-pass filter, $\\Psi(z)=S_{+}(\\lambda)U(z)S_{+}(\\lambda)^{-1}$, named $S$-MAP (S-multivariate all-pass), together with the cepstral parameterization $U(z)=\\exp(\\sum_{k=-r}^{r}\\Omega_k z^k)$ with $\\Omega_{-k}=-\\Omega_k'$ and $\\Omega_0$ skew-symmetric. The square-root conjugation is what makes the filter preserve $S$ exactly, while the unitary cepstral factor supplies a finite-dimensional smooth parameter space for optimization. The m-LIP criterion (14) turns privacy into a scalar in $[0,1]$, and the numerical optimization over the free entries of the cepstral matrices selects the filter that maximizes it.","core_discovery":"Given a spectral density $S$ assumed positive definite, an $S$-MAP filter has the form $\\Psi(z)=S_{+}(\\lambda)U(z)S_{+}(\\lambda)^{-1}$, where $S_{+}$ is a spectral square root of $S$ and $U$ is unitary. Because $\\Psi$ is a conjugate-similarity of a unitary matrix at each frequency, the relation $\\Psi(z)S(\\lambda)\\Psi(z)^*=S(\\lambda)$ holds, so the output process has the same spectral density, equivalently the same autocovariance function, as the input. Universal all-pass filters beyond the identity do not exist in the matrix case, so the class is indexed by the target spectral density rather than being filter-only. Privacy is scored by the multivariate Linear Incremental Privacy measure $\\mathrm{m-LIP}(\\Psi,S_{X|Z})=1-\\det\\big(\\langle S_{X|Z},\\Psi\\rangle\\langle\\Psi S_{X|Z},\\Psi\\rangle^{-1}\\langle\\Psi,S_{X|Z}\\rangle\\big)/\\det\\langle S_{X|Z}\\rangle$, which records how much a single filtered observation $Y_t$ adds to an attacker's ability to predict $X_t$ given auxiliary information $Z$. The paper's claim is that maximizing this criterion over a finite cepstral truncation of the filter class, using an estimated spectral density, yields the optimal privacy-utility balance: privacy values close to one and realized utility close to one in the simulations and in the QWI employment data.","pith_inferences":["The m-LIP value is an incremental privacy score for a single contemporaneous observation $Y_t$; it is not by itself a bound on disclosure from the entire released trajectory $\\{Y_t\\}$, so a full-trajectory attack is the natural stress test for the method.","Every filter in the proposed class is invertible at each frequency, so an attacker who knows the filter and has the full released series can undo the transformation; the paper leaves filter secrecy unspecified, and the practical guarantee depends on that choice.","A single-stage trend-invariant version of the MAP filter, which the authors flag as future work, would remove the detrending error that the current two-stage implementation inherits."],"forward_implications":["If the central claim is correct, agencies can release multivariate series whose autocovariances $\\Gamma(h)$ and cross-covariances at every lag match the original, so second-order analyses on the released data agree with analyses on the original.","The released series preserves cross-series dependence information, a feature that univariate privacy mechanisms cannot provide.","The curator can tune the privacy-utility trade-off through the cepstral truncation order $r$, with more parameters giving more flexibility at greater computational cost.","In finite samples the guarantee becomes approximate because the spectral density must be estimated, and the paper measures that loss with the normalized Frobenius discrepancy, with the loss shrinking as the sample size grows."],"supporting_citations":[{"why":"Introduces the univariate FLIP method and the LIP privacy measure that this paper generalizes to the multivariate setting.","marker":"[21]"},{"why":"Supplies the cepstral representation of multivariate filters used to parameterize the unitary factor with skew-symmetric coefficients.","marker":"[14]"},{"why":"Gives the frequency-domain relation between input and filtered spectra and the linear prediction formulas behind Proposition 1.","marker":"[6]"},{"why":"Provides the flat-top taper positive-definite spectral density estimator used to make the implementation feasible.","marker":"[27]"},{"why":"Provides the Bauer spectral factorization algorithm used to obtain the square-root factor $S_{+}$.","marker":"[5]"},{"why":"Summarizes the recursive block-Toeplitz computation that makes Bauer's factorization practical.","marker":"[22]"},{"why":"Supplies the AGMsDR nonlinear nonconvex optimization algorithm used to solve the m-LIP maximization problem.","marker":"[25]"},{"why":"Defines the Frobenius discrepancy of spectral densities from which the realized utility measure RUM is built.","marker":"[24]"}],"fun_headline_variants":["Filter hides multivariate series, keeps all correlations","Matrix filter scrambles data, preserves its covariance","Privacy for time series without losing utility: MAP filter","New filter balances privacy and utility in multivariate data","MAP filtering: private time series, intact structure"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that measuring privacy one released time point at a time, conditional on auxiliary information, captures the real disclosure risk of releasing the whole filtered series, even though the filter is invertible and an attacker with the full series and the filter could undo it.","fun_headline_variants_meta":{"raw":{"variants":["Filter hides multivariate series, keeps all correlations","Matrix filter scrambles data, preserves its covariance","Privacy for time series without losing utility: MAP filter","New filter balances privacy and utility in multivariate data","MAP filtering: private time series, intact structure"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000178,"raw_usage":{"total_tokens":1308,"prompt_tokens":967,"completion_tokens":341,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":583,"completion_tokens_details":{"reasoning_tokens":270}},"tokens_in":583,"tokens_out":341,"duration_ms":4220,"temperature":1.0,"reasoning_tokens":270,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T12:39:34.981380+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Simulate a bivariate VAR(1), compute the m-LIP value from (14), and separately compute the conditional variance of $X_t$ given the entire released trajectory $\\{Y_s\\}$; if the full-trajectory disclosure can remain large while m-LIP approaches one, the claimed privacy-utility balance is not established. A simpler check: if the filter is treated as public, applying its inverse to a released realization recovers $X$ exactly.","supporting_citations":[{"cited_title":"McElroy, A","cited_arxiv_id":null,"evidence_quote":"Introduces the univariate FLIP method and the LIP privacy measure that this paper generalizes to the multivariate setting."},{"cited_title":"Holan, T","cited_arxiv_id":null,"evidence_quote":"Supplies the cepstral representation of multivariate filters used to parameterize the unitary factor with skew-symmetric coefficients."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Gives the frequency-domain relation between input and filtered spectra and the linear prediction formulas behind Proposition 1."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the flat-top taper positive-definite spectral density estimator used to make the implementation feasible."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the Bauer spectral factorization algorithm used to obtain the square-root factor $S_{+}$."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Summarizes the recursive block-Toeplitz computation that makes Bauer's factorization practical."},{"cited_title":"Nesterov, A","cited_arxiv_id":null,"evidence_quote":"Supplies the AGMsDR nonlinear nonconvex optimization algorithm used to solve the m-LIP maximization problem."},{"cited_title":"S McElroy and A","cited_arxiv_id":null,"evidence_quote":"Defines the Frobenius discrepancy of spectral densities from which the realized utility measure RUM is built."}],"review_version":1}