{"id":"c558706a-ffbd-4bf1-8d1b-507ca7b618da","arxiv_id":"2412.01141","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":2,"one_line_summary":"LP-GCN is a federated GNN recommendation framework designed to replicate centralized training exactly, but its privacy guarantee is weakened by gradient information sent to the server.","lead":"This paper proposes a federated graph neural network method that claims to match the accuracy of a centralized recommender by completing both forward and backward graph convolution across decentralized user data. It uses encrypted item IDs and fake items to hide interactions, but the protocol's gradient transmissions may reveal which items are real.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The privacy guarantee is broken: in Algorithm 5/6 clients transmit gradients only for real items, so the server can identify real interactions and reverse the virtual-item obfuscation.","rationale":"I focused on what must be true for the central claim to hold: the server must not be able to identify real user-item interactions when it observes encrypted IDs and gradient traffic. The reader's weakest_assumption identifies exactly this point, and I find it confirmed in the protocol text. In Algorithm 5 line 7, Algorithm 6 lines 7 and 12, and Algorithm 9 line 8, clients transmit gradients only for their real items; virtual-item gradients are deliberately excluded in Section 4.4/4.5. Thus the server can use the pattern of which encrypted item IDs receive gradients from which client to infer real interactions, and because shared-key encryption makes ciphertexts linkable, it can reconstruct a large part of the bipartite graph. This is not a subtle statistical attack; it is a direct consequence of the message flow. The same exclusion is necessary for the losslessness proof, since aggregating dummy virtual gradients would change Eq. (16)/(24), so the two advertised properties are in tension as written. I therefore agree with the reader's REJECT verdict. I do not see a separate load-bearing flaw in the lossless forward/backward propagation argument; if the privacy issue is addressed in a revision, the equivalence analysis may be salvageable. For completeness, the promised code being unavailable weakens the empirical equivalence claim, but the privacy leak is sufficient to reject the current manuscript. The concrete test above would settle the privacy question deterministically: a protocol trace on a small dataset should show that the server's observed gradient-receiving item set matches the real interaction set, confirming the attack.","tokens_in":40108,"tokens_out":8435,"duration_ms":81289,"concrete_test":"Run a white-box protocol trace of Algorithms 4-6 on a small dataset (e.g., ML100K with alpha=5 virtual items per client) and log exactly the server-side messages. For each client u, let Obs(u) be the set of encrypted item IDs for which the server receives a gradient from u in Algorithm 5 line 7 or Algorithm 6 lines 7/12, after removing explicitly sampled negative items. Compare Obs(u) with I_u \\ tilde I_u. If they are equal for any client, the server reconstructs all non-convolution interactions and, knowing tilde I_u, recovers I_u. Repeat with alpha=0 as a control. The same conclusion should also be derived analytically from the algorithm text, since the protocol trace is deterministic.","verdict_should_be":"REJECT","load_bearing_attack":"The paper's central claim has two parts: lossless graph convolution and privacy preservation. The lossless proof (Appendix A) is plausible, but the privacy half fails as specified. Virtual-item obfuscation is secure only if the server cannot tell which uploaded item IDs are real. In Section 4.4, Algorithm 5 line 7, each client sends the last-layer ordinary item-embedding gradients only for I_u \\ tilde I_u, i.e., its real items. Likewise Algorithm 6 lines 7 and 12 send per-layer ordinary-item gradients only for I_u, and Section 4.4 explicitly states that gradients related to virtual items are excluded. The server therefore receives, for each client u, gradient messages exactly for the item IDs corresponding to u's real interactions that are not u's own convolution-items; because the server itself assigned convolution-item roles, it can recover the rest. Since identical item IDs encrypt to identical ciphertexts under the shared key S, the server can link these messages across clients and reconstruct the real user-item interaction graph, without any collusion. This contradicts Section 5.1's claim that the server cannot reconstruct interaction data. Moreover, this exclusion is load-bearing for losslessness: adding random gradients for virtual items would corrupt the aggregate in Eq. (16)/(24), so the protocol cannot be trivially patched without changing the equivalence claim. The privacy-preserving component of the central claim is therefore unsupported as written.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes LP-GCN, a federated GNN-based recommendation framework whose central claim is twofold: (1) losslessness, i.e., its graph convolution process, including both forward and backward propagation, is equivalent to a centralized non-federated counterpart and therefore achieves identical recommendation performance; and (2) privacy preservation, achieved by combining hybrid-encrypted item IDs with virtual-item obfuscation so that the server cannot reconstruct users' interactions. The paper presents algorithms for initialization, forward propagation, loss construction, and backward propagation; a theoretical equivalence proof in Appendix A; and experiments on Gowalla, Yelp2018, and Amazon-Book showing that LP-GCN (LightGCN+) matches the centralized LightGCN+ and outperforms existing federated baselines.","tokens_in":40396,"tokens_out":4764,"duration_ms":45872,"significance":"The losslessness property, if established, would be a meaningful advance: existing GNN-based federated recommendation methods (P-GCN, FedPerGNN, etc.) are known to incur a performance gap relative to centralized training, and a provably lossless federated protocol would close that gap. The paper also ships a proof sketch and a small equivalence experiment, and it identifies a concrete weakness of P-GCN's incomplete backward propagation. However, the privacy half of the central claim is not merely unproven but is contradicted by the protocol as written: the server can identify which item IDs correspond to real interactions from the pattern of gradient transmissions. Since both losslessness and privacy preservation are load-bearing claims, the contribution as stated is not established.","major_comments":[{"comment":"The privacy guarantee fails as written because clients transmit gradients only for their real items. In Algorithm 5 line 7, each client sends gradients {g_i^L(u) : i in I_u \\ tilde I_u}, and in Algorithm 6 ordinary clients send gradients for i in I_u and convolution-clients send gradients for i in I_\\tilde u \\setminus \\tilde I_\\tilde u. Section 4.4 explicitly states that gradients related to virtual items are excluded from aggregation (Eq. (16) and Eq. (24)). Since item IDs are encrypted deterministically under the shared key S, the server sees, for each client, exactly which encrypted item IDs carry gradients. An item is real iff the server receives a gradient for it from at least one client (other than its convolution-client, or including it via Eq. (17)). Thus the server can label every virtual item as virtual and every non-convolution real item as real, and because the server itself assigned the convolution-item roles, it can recover the full user-item interaction graph. This directly contradicts the Section 5.1 claim that the server cannot reconstruct interaction data, and it voids the virtual-item obfuscation. The exclusion of virtual gradients is also required for losslessness, so the protocol cannot be trivially patched by sending dummy virtual gradients without breaking the equivalence proof. This is a load-bearing error in the privacy half of the central claim.","section":"Section 4.4–4.5, Algorithm 5 lines 7–8, Algorithm 6 lines 7, 12, and 14, Eq. (16) and Eq. (24)"},{"comment":"The losslessness proof is incomplete with respect to initialization and training-pair sampling. Appendix A.1 states that equivalence holds 'when the same random seed is used for embedding initialization,' but the paper does not specify how the same seed is shared across all clients and the centralized baseline without revealing it to the server, nor how the federated protocol guarantees that all clients and the server initialize with the same seed. More importantly, Appendix A.3 asserts that the local training pairs P_u are the same as the centralized pairs, but for the BPR instantiation in Algorithm 9 the server samples negative items (line 1) and the proof never establishes that this sampling produces exactly the same negative items as the centralized BPR sampler. Because BPR negative sampling is randomized and affects every gradient, this gap is load-bearing for the claimed equivalence of the instantiated model.","section":"Appendix A, Sections A.1–A.3; Section 4.9, Algorithm 9"},{"comment":"The experimental evidence for losslessness is weak and non-reproducible as presented. RQ1 is evaluated only on ML100K, a small dataset, with training loss and metrics shown in Fig. 10; the text claims that 'the final user embeddings and item embeddings are identical,' but that claim is not supported by a reported comparison, and the code is not released (the GitHub link is marked 'available after paper acceptance'). The proof gaps in Appendix A make this one-dataset, unreleased experiment an insufficient substitute for a rigorous verification of the strong equivalence claim.","section":"Section 6.3.1, Fig. 10, and Section 6.2"}],"minor_comments":[{"comment":"The 'comprehensive performance' formula is informal: the scores Acc, Pri(lambda_1), and Eff(lambda_2) are not defined operationally, and the parameter dependencies on alpha and k are stated only qualitatively.","section":"Section 4.7, Eq. (28)"},{"comment":"The notation for convolution-client/item roles is inconsistent: the paper uses \\tilde u \\tilde i, \\tilde u_i, and \\tilde u_{\\tilde i} interchangeably, which makes the already intricate proof harder to follow.","section":"Notation throughout Algorithms 3–6 and Appendix A"},{"comment":"There is a typo, 'lossles' instead of 'lossless', in the paragraph explaining why FedGRec and PerFedRec are not included as baselines.","section":"Section 6.2"},{"comment":"The paper does not discuss that the server can observe the number of items (real plus virtual) per client, so if alpha is public the server learns |I_u|, which is itself a privacy leak that is not addressed in Section 5.1.","section":"Section 4.2, Algorithm 2, lines 10–13"}],"recommendation":"reject","confidential_remarks":"The privacy flaw identified in the major comments is, in my view, disqualifying: the virtual-item obfuscation is reversed by the gradient transmission pattern, and this cannot be fixed without substantially changing the protocol and reworking the losslessness proof. The losslessness proof also has honest gaps (seed sharing, negative-sample consistency) that would require real additional work to close. The paper's own internal evidence (one small offline equivalence experiment, no released code) is insufficient to compensate. I would encourage the authors to consider whether a secure aggregation step or a different mechanism for hiding which items receive gradients could be incorporated, and to revisit the proof assumptions."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the paper has a genuinely new and useful idea—completing backward propagation in a federated GNN recommender—and the Appendix A equivalence argument is a real step-by-step derivation, not a recycled claim. That part deserves credit. But the other half of the central claim, privacy preservation, does not survive the protocol as written. The server sees which client sends a gradient for which encrypted item ID, and Algorithm 5 deliberately excludes virtual items from those gradients. For any item with more than one interaction, the server can therefore distinguish real items from virtual decoys and reconstruct the interaction graph. This is not a subtle gap; it is stated in Section 4.4 and then contradicted by the Section 5.1 analysis. The stress-test note is correct. Because the gradient exclusion is load-bearing for losslessness, you cannot simply add decoy gradients without redoing the equivalence proof.\n\nWhere credit is due: the embedding-synchronization mechanism is clean, the proof compares the federated operations directly with the centralized equations, and the RQ1 equivalence experiment on ML100K is the right kind of check. The performance tables are consistent with the lossless claim, though code is promised only after acceptance, so I cannot independently verify the identical embeddings. The positioning against P-GCN is fair, and the literature coverage looks adequate.\n\nSoft spots beyond privacy: the BPR instantiation is under-specified. In Algorithm 9, the server samples negative items without knowing which encrypted IDs are real for a given user, so it can sample items the user has actually interacted with as negatives. The proof in Appendix A also assumes a common random seed for initialization, but the paper does not explain how that seed is coordinated across clients. Both are fixable; the privacy leak is not.\n\nWho should read this: people working on federated GNN recommendation, especially those building on P-GCN. The lossless backward mechanism is worth understanding even if this submission is not acceptable as is.\n\nRecommendation: I would send a revised version to referees—the core idea deserves scrutiny—but as submitted, the privacy claim is contradicted by the protocol, so I would not accept it in current form.","headline":"The lossless forward/backward construction is a real contribution and the proof is largely sound, but the privacy half is contradicted by the protocol as written: gradients are sent only for real items, letting the server undo the virtual-item obfuscation.","tokens_in":40892,"tokens_out":3126,"would_cite":false,"duration_ms":32873,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that its federated framework LP-GCN makes graph convolution—both forward and backward propagation—exactly equivalent to the centralized, non-federated version, so recommendation performance is identical while user data…","keywords":["federated recommendation","graph neural network","graph convolution","privacy-preserving recommendation","lossless federated learning","item recommendation","virtual item obfuscation","embedding synchronization"],"falsifier":"Run LP-GCN with a semi-honest server on a small dataset, log the encrypted item IDs for which the server receives layer-$L$ gradients in Algorithm 5 line 7, and compare that set against the encrypted IDs each client uploaded during initialization; if they coincide with the real interactions (i.e., the virtual IDs are absent from gradient traffic), the obfuscation is undone and the interaction graph can be reconstructed, falsifying the privacy claim.","tokens_in":39881,"feed_emoji":"🛡️","tokens_out":8753,"duration_ms":75435,"temperature":0.7,"pith_summary":"This paper claims that the usual privacy-versus-accuracy trade-off in federated item recommendation is not inevitable: a graph convolution network can be trained with each user's interaction data kept on-device and still be exactly as accurate as a centralized model that sees the whole user-item graph. The construction, LP-GCN, assigns every item to a designated 'convolution-client' that computes that item's embedding at each layer and synchronizes it through the server to all other clients containing the item; backward propagation runs the same path in reverse, so the federated gradients are the centralized gradients. Privacy is layered on separately by encrypting item IDs with a shared key and having every user upload fake 'virtual' items alongside real ones, so the server cannot tell which edges of the global graph are real. The authors prove the equivalence by comparing every phase of training with the centralized update equations, and verify it by showing that LP-GCN and its centralized backbone produce overlapping training and ranking curves. If the claim is right, federated GNN-based recommendation can match non-federated accuracy without injecting noise, a guarantee none of the existing methods provides.","feed_headline":"Federated GNN matches centralized recommender accuracy","feed_subtitle":"A shared-key and virtual-item design lets each item's embedding be computed once, so privacy noise no longer degrades top-K ranking.","key_machinery":"The load-bearing mechanism is embedding synchronization through designated convolution-clients. Each item is assigned to exactly one client (its convolution-item owner); that owner computes the item's embedding at layer $l+1$ from its own layer-$l$ embedding and the layer-$l$ user embeddings of all neighboring users, which the server relays (encrypted with a shared key) from the clients that own them. The computed item embedding is then sent back through the server to every other client that has interacted with that item, so one item has one identical embedding everywhere—matching the centralized graph. Backward propagation is its reverse: clients send gradient pieces for ordinary items and for neighboring users' embeddings to the server, which aggregates them exactly as the centralized chain rule sums partial derivatives, and feeds the sums back to the responsible clients. Privacy is carried by two auxiliary mechanisms: hybrid encryption of item IDs (an asymmetric handshake distributes a symmetric shared key to clients but not the server) and virtual-item obfuscation, where each client adds fake item IDs so the server's global graph cannot be mapped to real interactions.","core_discovery":"On its own terms, the paper's discovery is that a federated GNN recommender can be made lossless: every forward convolution and every gradient back-propagation step in LP-GCN is algebraically the same function as in the centralized model, so with the same random seed and the same sampled training pairs the federated training trajectory coincides with the centralized one. The mechanism is a designated-owner scheme: each item is marked as a convolution-item on one client, that client gathers the neighboring user embeddings through the server, computes the item's next-layer embedding, and broadcasts it to all clients that contain the item; gradient computation is the mirror image, with server-side aggregation of item gradients and neighboring-user gradient pieces exactly reproducing the centralized chain rule. The lossless claim is proven by comparing initialization, forward propagation, loss construction, local gradients, and backward propagation formulas with the centralized equations, and verified by the observation that LP-GCN(LightGCN) and LightGCN produce overlapping training-loss and ranking curves. On the three large datasets, LP-GCN instantiated with LightGCN+ attains exactly the same recall@20 and NDCG@20 as centralized LightGCN+, and outperforms the prior federated methods.","pith_inferences":["The privacy argument would be testable end-to-end: an honest-but-curious server that records which encrypted item IDs appear in gradient messages could, in principle, unmask the virtual items, because clients only send gradients for real items; a privacy-preserving variant would send dummy gradients for virtual items too.","The losslessness equivalence is conditioned on identical randomness; in practice a deployment comparing a federated system with a centralized baseline needs to fix the same random seed and the same sampled training pairs, otherwise the two curves will diverge by sampling noise.","The framework's synchronization pattern suggests a recipe for other graph models: any convolution that is a sum over neighbors can be computed once at a designated node and synchronized; extending this to attention-weighted convolutions would require the same neighbor lists to be available to the designated owner, which the current encrypted-ID protocol already provides.","A natural next experiment would be to instantiate LP-GCN with a heavier backbone than LightGCN+ and check the same curve overlap: the proof is generic, so exact equivalence should hold there too."],"forward_implications":["Any GNN-based recommendation model whose update has the same aggregation form as LightGCN can be federated losslessly with LP-GCN, giving the same embeddings and predictions as its centralized version.","Federated recommendation can reach the accuracy of centralized training, so the performance gap documented for existing federated GNN methods is not an inherent cost of privacy.","The backward-propagation completion is what makes the difference: P-GCN already has lossless forward propagation, but its incomplete gradient propagation is why it still underperforms centralized LightGCN+.","Communication cost is kept linear in the size of each client's local item set plus the neighboring-user sets of its convolution-items, and choosing a smaller set of convolution-clients reduces the cost per client.","The framework inherits the backbone's training needs: with BPR loss, the server must sample negative items and send their embeddings, so losslessness requires the same negative sampling to be used in the centralized run."],"supporting_citations":[{"why":"The main predecessor and baseline; it achieves lossless forward propagation but incomplete backward propagation, defining the gap LP-GCN fills and supplying the datasets and evaluation protocol.","marker":"[15]"},{"why":"LightGCN is the backbone model whose centralized training dynamics LP-GCN must reproduce exactly to establish losslessness.","marker":"[13]"},{"why":"FedPerGNN is the first GNN-based federated recommendation baseline that uses encrypted item IDs with a third-party server; it represents the privacy-and-performance trade-off the paper targets.","marker":"[49]"},{"why":"FISM motivates the item-based user-embedding construction used in the LightGCN+ backbone instantiated by LP-GCN.","marker":"[19]"},{"why":"Supplies the semi-honest threat model and the generic federated-recommendation framework to which LP-GCN is compared.","marker":"[31]"},{"why":"FedMF documents that gradients can leak user embeddings in federated matrix factorization, which motivates the encryption and gradient-protection design.","marker":"[6]"}],"fun_headline_variants":["Lossless federated GNN hits centralized accuracy","Federated GNN without the performance drop","Privacy-preserving GNN that's lossless","Federated graph convolution with zero loss","Exact match to centralized GNN recommendation"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The privacy guarantee depends on the server never learning which uploaded item IDs are real and which are fake virtual items, and the protocol sends gradients only for real items—so if the server can correlate gradient traffic with the encrypted IDs, the virtual-item obfuscation gives no protection.","fun_headline_variants_meta":{"raw":{"variants":["Lossless federated GNN hits centralized accuracy","Federated GNN without the performance drop","Privacy-preserving GNN that's lossless","Federated graph convolution with zero loss","Exact match to centralized GNN recommendation"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000489,"raw_usage":{"total_tokens":2435,"prompt_tokens":1004,"completion_tokens":1431,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":620,"completion_tokens_details":{"reasoning_tokens":1362}},"tokens_in":620,"tokens_out":1431,"duration_ms":10980,"temperature":1.0,"reasoning_tokens":1362,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T04:39:08.386980+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run LP-GCN with a semi-honest server on a small dataset, log the encrypted item IDs for which the server receives layer-$L$ gradients in Algorithm 5 line 7, and compare that set against the encrypted IDs each client uploaded during initialization; if they coincide with the real interactions (i.e., the virtual IDs are absent from gradient traffic), the obfuscation is undone and the interaction graph can be reconstructed, falsifying the privacy claim.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The main predecessor and baseline; it achieves lossless forward propagation but incomplete backward propagation, defining the gap LP-GCN fills and supplying the datasets and evaluation protocol."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"LightGCN is the backbone model whose centralized training dynamics LP-GCN must reproduce exactly to establish losslessness."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"FedPerGNN is the first GNN-based federated recommendation baseline that uses encrypted item IDs with a third-party server; it represents the privacy-and-performance trade-off the paper targets."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"FISM motivates the item-based user-embedding construction used in the LightGCN+ backbone instantiated by LP-GCN."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the semi-honest threat model and the generic federated-recommendation framework to which LP-GCN is compared."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"FedMF documents that gradients can leak user embeddings in federated matrix factorization, which motivates the encryption and gradient-protection design."}],"review_version":1}