{"id":"dc8a9bca-5702-4bb9-8a17-f2a2aa2c7742","arxiv_id":"2412.00687","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":2.0,"correctness_risk":"high","formal_verification":"none","parameter_count":5,"one_line_summary":"A ResNet variant with group normalization, trained with federated averaging, gradient clipping, and secure aggregation, reaches about 97.8% accuracy on BloodMNIST under a claimed differential privacy budget.","lead":"This paper combines federated learning, differential privacy, and secure aggregation to train a medical image classifier on BloodMNIST, reporting accuracy close to a non-private baseline. It is a quick look at stacking standard privacy tools for a medical imaging benchmark, though the evidence is thin.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The claimed (epsilon, delta)-DP guarantee is unsubstantiated: no noise scale, no privacy accountant, and no composition analysis is provided for the 50-round FedAvg protocol, so the central 'strict data confidentiality' claim cannot be verified.","rationale":"The reader's weakest-assumption analysis identified the same load-bearing concern: the differential privacy budget is asserted without being derived, and no noise scale or accounting method is reported. My review confirms this is the central issue. Every part of the contribution — DPResNet, SecAgg+, and the accuracy comparison — is in service of a framework claimed to be privacy-preserving. If the (epsilon, delta) guarantee is unsupported, the framework's defining property is unverified. The accuracy results may be reproducible, and replacing BatchNorm with GroupNorm is a reasonable architectural choice for DP, but these positive aspects do not repair the missing privacy analysis. Other weaknesses, such as the inconsistent client-count description (Section 3.2 says N in {5,10}, Section 4 uses 10 and 20 clients), the unusual data-partition description, and the lack of error bars, also undermine the comparison to FEDMIC, but they are secondary to the missing accounting. The verdict should remain REJECT because the central claim is not supported; if the authors provide the missing noise scale and a valid privacy-accounting calculation, a conditional resubmission could be reconsidered.","tokens_in":5669,"tokens_out":4649,"duration_ms":46810,"concrete_test":"Obtain the missing noise scale sigma from the authors or from the training configuration, then run an independent RDP or moments-accountant calculation for the reported protocol: 20 clients, clipping norm C = 7, E = 3 local epochs, 50 global rounds, at delta = 1.9e-4, with and without subsampling assumptions. If the accountant yields epsilon greater than 6.0, the claimed privacy guarantee is false. If the authors cannot supply sigma or a reproducible accounting script, the claim is not auditable and should not be accepted as stated.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that the framework maintains strict data confidentiality at (epsilon = 6.0, delta = 1.9e-4) while surpassing FEDMIC. That claim is not derivable from the manuscript. Equation (3) defines the noisy update as g_clipped + N(0, sigma^2 I), but sigma is never reported. No privacy accountant (RDP, moments accountant, or explicit composition theorem) is used to translate the clipping norm, noise scale, number of clients, E = 3 local epochs, and 50 global rounds into an overall (epsilon, delta). The stated epsilon/delta appears simply declared rather than computed. The distinction between per-round, per-client local DP and the privacy guarantee of the final released global model is also not established. Because the privacy guarantee is the central contribution, this gap is load-bearing: if the cumulative privacy cost of 150 local steps per client under the actual noise scale exceeds the claimed budget, the headline result stops being a privacy-preserving result even if the accuracy numbers are reproducible. The absence of error bars and code is secondary; the missing privacy accounting is the decisive barrier to accepting the central claim.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a federated learning framework for medical image classification that combines FedAvg, local differential privacy via gradient clipping and Gaussian noise, and SMPC-based secure aggregation (SecAgg+). It introduces DPResNet, a ResNet-9 variant with GroupNormalization and no max-pooling, and evaluates it on BloodMNIST across 10 and 20 clients, reporting accuracies of 97.78% and 96.89% under DP+SecAgg. The authors claim these results are close to non-private models and surpass PriMIA and FEDMIC while maintaining strict data confidentiality at (epsilon=6.0, delta=1.9e-4).","tokens_in":5916,"tokens_out":4723,"duration_ms":39070,"significance":"If fully substantiated, the combination of local DP with a privacy-friendly ResNet variant and secure aggregation could be a useful practical recipe for privacy-preserving medical imaging. The paper identifies a relevant problem and makes sensible architecture choices (GroupNorm over BatchNorm, no max-pooling). However, the central privacy claim is not verified: no noise scale, no privacy accounting, and no composition analysis are provided, and the accuracy results are single runs without error bars or statistical comparison. The significance of the work therefore cannot be assessed at present; the paper is more a system sketch than a validated contribution.","major_comments":[{"comment":"The claimed (epsilon = 6.0, delta = 1.9e-4)-DP guarantee is unsupported. Equation (3) defines the noisy update with Gaussian noise N(0, sigma^2 I), but sigma is never reported. No privacy accounting method (RDP, moments accountant, or explicit composition theorem) is used to translate the clipping norm C, noise scale, number of clients, E = 3 local epochs, and 50 global rounds into an overall (epsilon, delta). The stated privacy budget appears simply declared. The distinction between per-round local DP (as applied to individual updates) and the privacy guarantee of the final released global model is not established. Because the paper's headline claim is 'strict data confidentiality', this missing accounting is a load-bearing gap that makes the central result unverifiable.","section":"Section 3.2, Eq. (3)"},{"comment":"The number of clients is inconsistent. Section 3.2 states the framework is evaluated with N in {5, 10} clients, while Section 4 and Table 1 report experiments with 10 and 20 clients. This contradiction prevents the reader from reproducing the setup and makes the comparison to FEDMIC (which used 20 clients) ambiguous.","section":"Section 3.2 vs Section 4"},{"comment":"All reported accuracies are single numbers without error bars, repeated seeds, or statistical significance tests. The claimed advantage over FEDMIC is 96.89% vs 96.33%, a 0.56 percentage-point difference that is within plausible run-to-run variance for federated training. Without specifying the learning rate, optimizer, batch size, noise scale, or data partitioning details, the claim that the method 'surpasses' FEDMIC is not empirically supported.","section":"Section 4, Table 1"},{"comment":"Equation (5) states the overall objective 'subject to (epsilon, delta)-DP constraints', but the paper provides no feasibility argument or derivation showing how the training protocol satisfies these constraints. It is also unclear whether the DP guarantee is local (each client's update is private) or global (the final model is private), and how SecAgg+ interacts with the DP guarantee. The DPResNet architecture description is too brief to evaluate: replacing BatchNorm with GroupNorm and removing max-pooling is motivated, but no ablation or analysis of its effect on privacy or utility is provided.","section":"Section 3.1, Eq. (5)"}],"minor_comments":[{"comment":"The phrase 'Secure SMPC' is redundant because SMPC already stands for Secure Multi-Party Computation.","section":"Section 3.1"},{"comment":"The paper does not mention code availability or provide a link to the implementation, which further hinders reproducibility.","section":"Overall"},{"comment":"For a fair comparison, the baselines PriMIA and FEDMIC should be evaluated under the same client sizes and protocol; PriMIA is only listed for 10 clients and FEDMIC only for 20, so the 'surpassing' claim is based on comparisons across different setups.","section":"Table 1"}],"recommendation":"reject","confidential_remarks":"The paper is not ready for journal publication. The central privacy guarantee is unsubstantiated, the experimental protocol is inconsistent, and the performance claims are not statistically grounded. The manuscript reads as a preliminary report rather than a complete research paper. I would be willing to reconsider a revised version that provides a rigorous privacy accounting, error bars, and a consistent experimental setup."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is exactly what it looks like: a standard stack of FedAvg, local DP-SGD (clip + Gaussian noise), and SecAgg+ applied to BloodMNIST, with a small ResNet tweak. The DPResNet change—GroupNorm instead of BatchNorm, no pooling—is a sensible thing to do for DP training, but it is not a new architectural idea; it is the standard fix. So the contribution is a routine engineering combination on a public benchmark, not a new result. That is fine as a reproducibility or application note, but the paper does not position itself that way.\n\nWhat it does well: the writing is clear, the related work is relevant, and the experimental setup (non-IID partitioning, three configurations) is reasonable. The results are also in a plausible range, close to but slightly below the non-private baseline. So the accuracy story is not suspicious in itself.\n\nThe soft spots are serious and load-bearing. The biggest one: the paper claims (epsilon=6.0, delta=1.9e-4)-DP but never reports the noise scale sigma, never mentions a privacy accountant, and never performs composition analysis over 50 rounds with 3 local epochs. Equation (3) just declares that Gaussian noise is added. That means the central claim of \"strict data confidentiality\" cannot be verified. This is not a minor omission; it is the point of the paper. Second, Section 3.2 says N in {5,10} clients, but Section 4 reports results for 10 and 20 clients—a direct internal contradiction. Third, there are no error bars or repeated seeds, and no code or detailed hyperparameters (optimizer, learning rate, local batch size). With a 0.56% difference over FEDMIC, run-to-run variance could easily flip the comparison. The baseline matching is also unclear: PriMIA and FEDMIC use different architectures and data partitions, so the \"surpassing\" claim is not well supported.\n\nI agree with the stress-test note: the missing privacy accounting is the decisive flaw. If the authors supplied the noise scale, the accounting method, and the resulting cumulative budget, the paper would become a solid empirical application note. Without those, the privacy claim is unsupported.\n\nThis is not ready for peer review in its current form. A serious editor should desk-reject it and invite the authors to resubmit with the privacy accounting, code, and repeated trials. For a reading group, it is a good example of why reporting sigma and the accountant matters, but not a paper I would build on.","headline":"A clear, well-written combination of FedAvg, DP-SGD, and SecAgg+ on BloodMNIST, but the central privacy guarantee is asserted rather than derived, and the empirical claims lack error bars and code.","tokens_in":6423,"tokens_out":1707,"would_cite":false,"duration_ms":17281,"reading_group":"no","serious_thinker":"yes","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that a federated medical imaging model with differential privacy and secure aggregation hits 96.89% accuracy on a blood-cell benchmark, within one point of non-private training.","keywords":["federated learning","differential privacy","secure aggregation","secure multi-party computation","medical imaging","ResNet","BloodMNIST","group normalization"],"falsifier":"Run the training pipeline with the actual noise scale used in Eq. (3), apply a standard privacy-composition accountant over 50 rounds and 3 local epochs per client, and compare the resulting $\\epsilon$ at $\\delta=1.9\\times10^{-4}$ with the claimed 6.0; if no $\\sigma$ is reported or recoverable, the privacy claim is not reproducible.","tokens_in":5476,"feed_emoji":"🩸","tokens_out":13789,"duration_ms":113461,"temperature":0.7,"pith_summary":"This paper tries to establish that privacy-protecting federated training need not cost much accuracy in medical imaging. It combines three safeguards — keeping data on hospital devices, adding differentially private noise to each local update, and aggregating updates through a secure multi-party protocol — and shows on the BloodMNIST blood-cell benchmark that the fully protected model reaches 96.89% accuracy with 20 clients, within one percentage point of the same architecture trained without privacy protections. The reason to care is that this is the configuration a real hospital consortium would want: no raw images leave the institutions, individual updates are hidden even from the coordinating server, and the accuracy gap to non-private training is small. The paper also introduces DPResNet, a ResNet-9 variant with group normalization and no max pooling, as the architecture change that keeps model quality high under noise.","feed_headline":"Private federated model hits 96.89% accuracy on blood-cell images","feed_subtitle":"Differential privacy plus secure aggregation costs less than one accuracy point versus non-private training.","key_machinery":"The machinery is a three-layer privacy stack. Each client clips its local gradient to norm $C=7$ and adds Gaussian noise, following Eq. (3), to turn the update into a $(\\epsilon,\\delta)$-differentially private message. Those noisy updates are combined by SecAgg+, a secure multi-party aggregation protocol that prevents the coordinating server from seeing any individual update and tolerates client dropouts down to a four-share reconstruction threshold. The model itself is DPResNet, a ResNet-9 variant that replaces batch normalization with group normalization (32 groups per layer) and removes max pooling; the paper presents this architecture choice as the element that keeps accuracy high when noise is injected. Federated averaging from FedAvg ties the rounds together.","core_discovery":"The paper's central claim is that a federated medical-imaging classifier can run under both local differential privacy and secure multi-party aggregation and still land within about one percentage point of its non-private counterpart. On the BloodMNIST benchmark with 20 non-IID clients, the fully private configuration (clipping norm $C=7$, declared $\\epsilon=6.0$ and $\\delta=1.9\\times10^{-4}$, and secure aggregation) reaches 96.89% accuracy, versus 97.77% for the same model without privacy protections and 96.33% for the state-of-the-art comparison method. With 10 clients the numbers are 97.78% private versus 98.76% non-private. The authors attribute the small gap largely to DPResNet, a ResNet-9 variant that replaces batch normalization with group normalization and removes max pooling, which they argue makes the architecture better suited to differentially private training.","pith_inferences":["Beyond the paper: the GroupNorm-for-BatchNorm swap should transfer to centralized differentially private training on other image datasets, because the incompatibility of batch statistics with per-example noise is a general obstacle.","Beyond the paper: instrumenting the training loop with a standard privacy-composition accountant and reporting the resulting budget as a function of the noise scale would turn the declared $\\epsilon=6.0$ into an auditable number.","Beyond the paper: the edge over the state-of-the-art method rests on one dataset and one split; repeated runs across other medical image benchmarks would show whether the margin is stable."],"forward_implications":["Hospital consortia can train a blood-cell classifier without uploading raw images, with the reported accuracy loss held under one percentage point.","The DPResNet design — group normalization instead of batch normalization, no max pooling — is the component the paper credits for keeping accuracy high under differential-privacy noise.","Secure aggregation keeps individual updates hidden from the coordinating server and survives client dropouts as long as enough shares are present.","Applications that need a tighter privacy budget than $\\epsilon=6.0$ should expect a larger accuracy penalty, so the reported one-point gap is tied to the chosen privacy parameters."],"supporting_citations":[{"why":"supplies the DP-SGD recipe of gradient clipping plus Gaussian noise that the paper applies locally at each client.","marker":"[1]"},{"why":"supplies the FedAvg aggregation rule that defines how local updates are combined into the global model.","marker":"[18]"},{"why":"supplies the SecAgg+ protocol that lets the server aggregate updates securely while tolerating client dropouts.","marker":"[4]"},{"why":"supplies the pioneering federated medical-imaging baseline whose privacy-preserving accuracy the framework must exceed.","marker":"[10]"},{"why":"supplies the current state-of-the-art comparison at 96.33% accuracy that the fully private framework claims to beat.","marker":"[23]"}],"fun_headline_variants":["96.89% private accuracy, <1% gap to plain model","DPResNet: private federated model with 96.89% accuracy","Privacy costs <1% accuracy on federated blood-image model","BloodMNIST: private model within 1 point of non-private"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the advertised privacy budget of $\\epsilon=6.0$ with $\\delta=1.9\\times10^{-4}$ is actually delivered by the training run; the paper gives a clipping norm but no noise scale and no accounting method to back that number.","fun_headline_variants_meta":{"raw":{"variants":["96.89% private accuracy, <1% gap to plain model","DPResNet: private federated model with 96.89% accuracy","Privacy costs <1% accuracy on federated blood-image model","BloodMNIST: private model within 1 point of non-private"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001796,"raw_usage":{"total_tokens":7033,"prompt_tokens":863,"completion_tokens":6170,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":479,"completion_tokens_details":{"reasoning_tokens":6093}},"tokens_in":479,"tokens_out":6170,"duration_ms":37878,"temperature":1.0,"reasoning_tokens":6093,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T05:06:02.787690+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the training pipeline with the actual noise scale used in Eq. (3), apply a standard privacy-composition accountant over 50 rounds and 3 local epochs per client, and compare the resulting $\\epsilon$ at $\\delta=1.9\\times10^{-4}$ with the claimed 6.0; if no $\\sigma$ is reported or recoverable, the privacy claim is not reproducible.","supporting_citations":[{"cited_title":"Secure single-server aggregation with (poly) logarithmic overhead","cited_arxiv_id":null,"evidence_quote":"supplies the SecAgg+ protocol that lets the server aggregate updates securely while tolerating client dropouts."}],"review_version":1}