{"id":"f81e4109-b941-47d0-b868-3cae9ff18027","arxiv_id":"2411.17287","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"freda is a privacy-preserving federated domain adaptation method for regression, achieving near-centralized accuracy on DNA methylation age prediction via federated Gaussian Process training.","lead":"This paper introduces freda, a federated domain adaptation method for regression that trains Gaussian Process feature models on private, distributed data using randomized encoding and secure aggregation. Evaluated on DNA methylation age prediction, freda reaches accuracy close to the centralized wenda method while keeping source and target data decentralized.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 'complete data privacy' claim is unsupported: the aggregator sees full cross-client and source-target Gram matrices, which encode pairwise distances and can leak sensitive biological information, so the privacy pillar of the central claim is overstated.","rationale":"The reader's weakest assumption concerns the equivalence of local hyperparameter averaging and global marginal likelihood maximization in Section 5.1.1. That is a real technical weakness, but it targets an approximation that the empirical results could still support; the method could be reframed as approximate federated GP training without collapsing the accuracy comparison to centralized wenda. The privacy overclaim is more directly connected to the central claim because 'privacy-preserving' and 'complete data privacy' appear in the title, abstract, and conclusion, and the protocol itself reveals Gram matrices to the aggregator. I therefore flag the privacy claim as the single most load-bearing issue. I partially agree with the reader: the same privacy concern is noted in the reader's rationale but is not selected as the weakest assumption. The verdict remains CONDITIONAL because the issue is addressable by rephrasing the privacy guarantee and adding a leakage analysis; no change to the reader's verdict is needed.","tokens_in":91,"tokens_out":11938,"duration_ms":274461,"concrete_test":"Run the FLAKE protocol on a small slice of the DNAm source data (e.g., 50 samples, 100 features). Have the aggregator compute the Gram matrix G from the masked inputs, then perform an eigendecomposition to recover a coordinate matrix X' with X' X'^T = G. Compute the pairwise Euclidean distance matrix from X' and compare it to the distance matrix of the original standardized data. If the maximum absolute difference is below 1e-6, the aggregator has recovered the full inter-sample geometry, directly contradicting the claim that it 'cannot infer any information regarding the local datasets.' This would require replacing 'complete data privacy' with a qualified statement about Gram-matrix leakage.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 5.1.2 has each source and target client send masked data x'_p to the aggregator, which then computes the Gram matrices G_pq = x_p x_q^T (Eq. 5). Section 6.1.2 concedes that the aggregator sees these Gram matrices and defends privacy by noting that 'there are infinitely many possible source data matrices that would result in the same K and K*.' That defense is insufficient: the Gram matrix determines all pairwise inner products and Euclidean distances exactly, so the aggregator obtains a complete geometric fingerprint of the data. For DNA methylation data, pairwise similarities are sensitive statistics that can enable membership inference or linkage to public cohorts. The abstract and conclusion repeatedly claim 'complete data privacy,' but the protocol does not establish this: zero-sum masking hides individual contributions to sums, not the aggregate Gram matrix, and the semi-honest threat model in Section 6 does not imply that releasing Gram matrices is harmless. Since privacy is one of the two pillars of the central claim, this overstatement is load-bearing: the method may still be useful, but the headline claim must be weakened to something like 'no raw data sharing under semi-honest assumptions, with residual Gram-matrix leakage.'","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes freda, a federated unsupervised domain adaptation method for regression on high-dimensional, small-scale biological data. It trains per-feature Gaussian process regressors across source clients using a combination of secure aggregation and the FLAKE masking scheme to compute Gram matrices and predictive means without sharing raw samples. The target client derives feature weights from predictive confidence scores, and source clients federatively train weighted elastic nets with a regularization parameter selected using tissue-similarity side information. On DNA methylation age prediction, freda reports a full-target MAE of 5.41 +/- 0.44 for 2 and 4 source clients, compared with 5.31 +/- 0.29 for centralized wenda-pn, and it mitigates the cerebellum distribution shift better than the non-adaptive en-ls baseline. The paper claims complete data privacy and positions freda as the first privacy-preserving federated UDA method for regression in this setting.","tokens_in":17094,"tokens_out":8614,"duration_ms":81394,"significance":"The paper addresses a real gap: most federated domain adaptation methods target image classification, while biological data are high-dimensional, small-sample, and distributed. The proposed protocol is concrete, the arithmetic in Eq. (5) for masked Gram matrix computation is coherent, and the authors release code for reproducibility. If the privacy and model-equivalence claims were properly qualified and the supervision requirement resolved, the work would be a useful contribution to privacy-preserving biomedical machine learning. However, the current manuscript overstates both the privacy guarantee and the unsupervised nature of the method, and the central equivalence between averaging local GP hyperparameters and global optimization is unproven.","major_comments":[{"comment":"The claim that averaging locally optimized GP hyperparameters via secure aggregation yields the same result as maximizing the marginal likelihood over the entire source domain 'as if' data were centralized is not justified. The pooled GP marginal likelihood contains cross-client covariance blocks K_ij = sigma_p^2 X_{s_i} X_{s_j}^T that no local likelihood in Eq. (4) ever sees; the argmax of an average of local objectives is not generally the argmax of the pooled objective. This is load-bearing because the resulting hyperparameters determine the feature-model predictive distributions (Eq. 2), which in turn drive the confidence scores and feature weights in Eqs. (6)-(8). Please provide either a proof under stated assumptions, an empirical comparison against centralized GP hyperparameter optimization on the same data, or a sensitivity analysis showing that the downstream MAE is robust to this approximation.","section":"5.1.1"},{"comment":"The privacy analysis in Section 6.1.2 concedes that the aggregator sees the Gram matrices G_pq = x_p x_q^T for all client pairs, but it defends this by noting that infinitely many source matrices could produce the same Gram matrix. That defense is insufficient: a Gram matrix reveals all pairwise Euclidean distances and inner products, which can constitute a sensitive geometric fingerprint for DNA methylation data and may enable membership or linkage attacks. The abstract, introduction, and conclusion repeatedly claim 'complete data privacy,' but the protocol does not establish this under the stated semi-honest model. Since privacy is one of the two central contributions, the claim should be weakened to something like 'no raw data sharing under semi-honest assumptions, with residual Gram-matrix and aggregate-statistic leakage,' or the protocol must be modified to hide the Gram matrices from the aggregator.","section":"6.1.2 and Eq. (5)"},{"comment":"The method as described is not unsupervised: the target client selects lambda by evaluating MAE on a labeled subset X_t1 of target domains, explicitly 'assuming that the corresponding labels are available.' This contradicts the paper's title and framing as unsupervised domain adaptation, and it also puts the empirical comparison to wenda-pn on unequal footing if wenda-pn selects lambda without target labels. Please either provide a variant of the lambda-selection procedure that uses no target labels, or explicitly reframe the contribution as semi-supervised or weakly supervised domain adaptation and adjust the claims accordingly.","section":"5.3.1"}],"minor_comments":[{"comment":"The notation for the left inverse is dimensionally inconsistent: with M in R^{d x P} and L_p in R^{P x d}, the product L_p M is P x P, so the identity should be I_P, not I_d. Please correct this and clarify that (M M^T)^{1/2} is symmetric in the derivation of Eq. (5).","section":"5.1.2"},{"comment":"The preprocessing section says dimensionality reduction reduces 466,094 features to 12,980, but does not state the selection criterion used. Please specify the exact feature-filtering or selection procedure so that the experiments are fully reproducible.","section":"2.2"},{"comment":"The weighting parameter k is chosen as k=3 based on experiments on the same target evaluation data. This is a form of test-set tuning; please either fix k a priori, use a separate validation split, or report sensitivity across k values so the headline MAE is not seen as optimized on the test set.","section":"2.4.3"},{"comment":"The partition of target indices into X_t1 and X_t2 is described with set-like notation, but these are subsets of domain indices, not data matrices. Please clarify the notation and state explicitly how many domains are used for fitting versus evaluation.","section":"5.3.1"},{"comment":"Reference [23] has a garbled author list and malformed affiliation formatting; please regenerate it from the publisher metadata.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper has a useful idea and a reproducible implementation, but the 'complete data privacy' and 'unsupervised' claims are currently stronger than the protocol and experiments support. I would be willing to review a revision that tempers these claims, adds an empirical check of the GP hyperparameter averaging step, and clarifies the label requirement in lambda selection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: real method paper, with a correct federated GP arithmetic and honest empirical performance for 2 and 4 clients, but the privacy claim in the abstract is overstated and the hyperparameter-averaging justification is wrong. Read it for the protocol, not for the 'complete privacy' headline.\n\nWhat is actually new: this is the first combination of FLAKE-style masked Gram-matrix computation with secure aggregation to train Gaussian Process feature models across clients, for regression domain adaptation. Eq. 5 checks out: the masks cancel and the aggregator does recover exact cross-products. The feature-weighting and lambda-selection machinery transfers wenda to a distributed setting without breaking it. They also share code, which is a real plus.\n\nSoft spots, in order of size. First, the complete-data-privacy claim. The aggregator sees every cross-client Gram matrix G_pq and the source-target K*, i.e. exact pairwise inner products and hence distances. That is a geometric fingerprint of the data, not a harmless statistic. The 'infinitely many matrices' defense is technically true but misses the point: pairwise similarities in DNA methylation data can support membership inference or linkage to public cohorts. 'Complete privacy' is not established. The protocol does protect raw data from direct sharing, but the residual leakage of the Gram matrices has to be acknowledged.\n\nSecond, Section 5.1.1 says averaging locally optimized GP hyperparameters is 'as if' the joint marginal likelihood had been maximized over pooled data. That is false in general, because the joint kernel contains cross-client blocks the local objective never sees. It may be a fine heuristic — the results say so — but it is not an equivalence. Soften the claim.\n\nThird, the 'unsupervised' framing is loose. Lambda selection in Section 5.3.1 requires labels on a subset of target tissues. This is inherited from wenda-pn, but the abstract should not call it unsupervised without qualification. Minor: k=3 is chosen on test tissues, which is a mild selection leak, though it does not drive the main comparison since all methods use the same k.\n\nWho this is for: researchers in federated domain adaptation, privacy-preserving kernel methods, and bioinformatics with distributed methylation data. The paper deserves a serious referee: the protocol is novel, the evaluation is real, and the issues are fixable in revision. I would send it out, with instruction to temper the claims and disclose the Gram-matrix leakage.","headline":"Real federated GP method with honest results, but the 'complete privacy' and 'unsupervised' claims overstate what the protocol actually delivers.","tokens_in":17637,"tokens_out":3770,"would_cite":true,"duration_ms":34879,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A privacy-preserving federated method trains Gaussian process feature models without sharing raw data and reports accuracy comparable to the centralized wenda baseline on DNA methylation age prediction.","keywords":["federated domain adaptation","unsupervised domain adaptation","regression","Gaussian process","privacy-preserving machine learning","secure aggregation","randomized encoding","DNA methylation age prediction"],"falsifier":"Take the 1,866 source samples with their client splits, maximize the Gaussian process marginal likelihood jointly on all pooled data for one feature, and compare the resulting hyperparameters with the secure-aggregated average of the locally optimized values; if they differ materially and the corresponding feature weights diverge from wenda's, the 'as if centralized' claim fails. A second check is to rerun the reported experiments with fixed random seeds and compare freda's per-feature weights to wenda-pn's weights on the same training data, since equal MAE alone does not establish that the federated feature models reproduce the centralized ones.","tokens_in":16637,"feed_emoji":"🧬","tokens_out":7702,"duration_ms":66713,"temperature":0.7,"pith_summary":"The paper claims that privacy-preserving federated unsupervised domain adaptation for regression is feasible on small, high-dimensional biological datasets by training Gaussian process feature models across institutions without sharing raw data. This matters because existing federated domain adaptation relies on deep learning and targets classification, which fits image-scale data poorly and leaves regression on tabular biomedical data unsupported. On DNA methylation age prediction, freda reports a full-target mean absolute error of 5.41±0.44 with two or four source clients, close to the centralized wenda-pn result of 5.31±0.29, and 5.81±0.24 with eight clients, while claiming complete data privacy. The enabling insight is that the Gram matrices and predictive mean of a Gaussian process can be computed from masked data through randomized encoding, so feature dependencies can be modeled without pooling samples.","feed_headline":"Federated privacy method matches centralized DNA age prediction","feed_subtitle":"freda trains Gaussian process feature models across institutions without sharing raw DNA methylation data.","key_machinery":"The central object is the federated Gaussian process feature model: for each feature $f$, a GP predicts $f$ from all other features and returns a predictive distribution $\\mathcal{N}(K_*K^{-1}y,\\, K_{**} - K_*K^{-1}K_*^\\top)$. The argument hangs on two privacy devices that make the required matrices computable in the clear. FLAKE supplies random masking matrices $M$ whose left-inverses cancel, so the aggregator can compute the Gram matrix $x_p x_q^\\top$ from masked data and build $K$ and $K_*$; randomized encoding lets the aggregator mask the intermediate product $K_*K^{-1}$ with a random matrix $C$, have each source client multiply its slice by its local feature column, and let the target client unmask with $C^{-1}$. These devices convert the pairwise computations that normally require pooled data into masked sums, which is what allows Gaussian process training to run federated.","core_discovery":"The paper's central claim is that freda is the first method to make federated, privacy-preserving unsupervised domain adaptation work for regression on small-scale, high-dimensional biological data. It federates each component of the wenda-style pipeline: each source client optimizes Gaussian process hyperparameters locally and secure aggregation averages them; the aggregator computes the required Gram matrices from FLAKE-masked data; randomized encoding lets the target client recover the predictive mean without seeing any source feature column; and weighted elastic nets are trained federatively with lambda values chosen by the target client from tissue similarity side information. On the age prediction benchmark with 1,866 training samples split across 2, 4, or 8 clients and 1,001 unlabeled target samples, freda achieves MAE 5.41±0.44 (2 and 4 sources) and 5.81±0.24 (8 sources) on the full target set, compared with 5.31±0.29 for centralized wenda-pn and 6.34±1.21 for the non-adaptive en-ls baseline. The paper interprets these results as showing that full data privacy does not cost predictive accuracy in this setting.","pith_inferences":["The federated hyperparameter shortcut is unlikely to match the true joint Gaussian process: local marginal likelihoods never see covariance between samples on different clients, so the averaged hyperparameters and the centralized ones can diverge even when the reported MAE is close.","A direct comparison of freda's per-feature weights with wenda's centralized weights on the same data would reveal whether the two methods are actually learning the same dependency structure or merely arriving at similar predictions through different weights.","The privacy guarantee is limited to the semi-honest setting and adds no differential privacy noise, so feature weights and Gram matrices may still leak statistical information if several clients or the aggregator collude with auxiliary public data.","A practical constraint suggested by the eight-client result is that fragmentation reduces effective sample size per client; methods that pool information more aggressively, such as sharing summary statistics, might scale to more parties without the same accuracy drop."],"forward_implications":["Institutions holding DNA methylation or similar tabular biomedical data can collaborate on regression tasks without transferring raw samples to a central site.","Gaussian process feature modeling, previously considered impractical in federated settings because of pairwise Gram computations, becomes available as a building block for privacy-preserving pipelines.","The method reproduces the main benefit of centralized wenda on the hardest target tissue (cerebellum) with two or four source clients, correcting the systematic underprediction of the non-adaptive baseline.","With eight source clients, accuracy degrades to 5.81±0.24 but still beats the centralized non-adaptive baseline, suggesting the method tolerates fragmentation better than non-adaptive alternatives.","The same four-phase structure extends to multiple target tissues by training separate feature-weight vectors and lambda values per tissue, so the approach is not tied to a single target domain."],"supporting_citations":[{"why":"Provides the wenda method and its prior-knowledge lambda selection, the centralized baseline freda must match.","marker":"[20]"},{"why":"Supplies the age transformation and the non-adaptive en-ls baseline used for comparison.","marker":"[21]"},{"why":"Supplies the FLAKE randomized masking scheme that lets the aggregator compute Gram matrices without seeing raw data.","marker":"[37]"},{"why":"Supplies the zero-sum masked secure aggregation used for hyperparameter averaging and federated weighted elastic net training.","marker":"[38]"},{"why":"Provides the Gaussian process regression formulas for the predictive distribution and marginal likelihood that the feature models rely on.","marker":"[35]"},{"why":"Provides the confidence measure that turns each feature's predictive distribution into the feature weights used for adaptation.","marker":"[39]"},{"why":"Supplies the GTEx tissue similarity side information used by the target client to predict optimal lambda values.","marker":"[23]"},{"why":"Supplies the TCGA DNA methylation and age data included in the benchmark.","marker":"[18]"},{"why":"Supplies the GEO DNA methylation and age data included in the benchmark.","marker":"[19]"}],"fun_headline_variants":["Privacy-preserving federated model rivals centralized DNA age prediction","Federated GP matches centralized DNA age accuracy without sharing data","First federated regression domain adaptation for private DNA age","No raw data, no accuracy loss: federated GP for DNA age prediction"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method assumes that averaging the Gaussian process settings each institution finds on its own data gives the same result as fitting one Gaussian process on all the data pooled together, even though the pooled model would see connections between samples at different institutions that no local fit ever sees.","fun_headline_variants_meta":{"raw":{"variants":["Privacy-preserving federated model rivals centralized DNA age prediction","Federated GP matches centralized DNA age accuracy without sharing data","First federated regression domain adaptation for private DNA age","No raw data, no accuracy loss: federated GP for DNA age prediction"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000665,"raw_usage":{"total_tokens":3049,"prompt_tokens":973,"completion_tokens":2076,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":589,"completion_tokens_details":{"reasoning_tokens":2005}},"tokens_in":589,"tokens_out":2076,"duration_ms":14102,"temperature":1.0,"reasoning_tokens":2005,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T12:16:42.534135+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take the 1,866 source samples with their client splits, maximize the Gaussian process marginal likelihood jointly on all pooled data for one feature, and compare the resulting hyperparameters with the secure-aggregated average of the locally optimized values; if they differ materially and the corresponding feature weights diverge from wenda's, the 'as if centralized' claim fails. A second check is to rerun the reported experiments with fixed random seeds and compare freda's per-feature weights to wenda-pn's weights on the same training data, since equal MAE alone does not establish that the federated feature models reproduce the centralized ones.","supporting_citations":[{"cited_title":"Bioinformatics 35(14), 154–163 (2019)","cited_arxiv_id":null,"evidence_quote":"Provides the wenda method and its prior-knowledge lambda selection, the centralized baseline freda must match."},{"cited_title":"Genome biology 14, 1–20 (2013)","cited_arxiv_id":null,"evidence_quote":"Supplies the age transformation and the non-adaptive en-ls baseline used for comparison."},{"cited_title":"International journal of neural systems 14(02), 69–106 (2004)","cited_arxiv_id":null,"evidence_quote":"Supplies the FLAKE randomized masking scheme that lets the aggregator compute Gram matrices without seeing raw data."},{"cited_title":"In: 2023 5th IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA), pp","cited_arxiv_id":null,"evidence_quote":"Supplies the zero-sum masked secure aggregation used for hyperparameter averaging and federated weighted elastic net training."},{"cited_title":"2 3 4 Castel Stephane E","cited_arxiv_id":null,"evidence_quote":"Supplies the GTEx tissue similarity side information used by the target client to predict optimal lambda values."}],"review_version":1}