{"id":"65923680-12df-4d02-b414-47458fb02214","arxiv_id":"2412.08177","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":6,"one_line_summary":"SecureNT is a network-monitoring protection scheme that injects fake-delay noise to prevent topology inference while aiming to preserve measurement utility for trusted users.","lead":"SecureNT adds shaped noise to end-to-end network measurements to hide the real topology from attackers while letting trusted operators still monitor link health. The paper's own experiments show protection performance only on par with the existing AntiTomo method, despite claiming superiority in the abstract.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The trusted-user utility claim is unsupported: Eq. (5) adds non-invertible noise to the only measurements, and no key or removal procedure lets the trusted user recover Y, so the claimed 7–10% F1 drop has no mechanism behind it.","rationale":"I agree with the reader's weakest-assumption identification. The load-bearing point is not merely that hyperparameters are missing or writing is poor; it is that the core mechanism described in §4.1 cannot deliver the paper's second half of the central claim (utility for trusted users) as written. The trusted user and the attacker receive the same Ytilde and the same description of M; no information asymmetry is defined. Without an information asymmetry, either the noise is removable by anyone (destroying privacy) or by no one (destroying utility). The empirical utility section does not resolve this because it never specifies what the trusted-user monitoring algorithm receives. The source code availability is a point in the paper's favor, and a direct code inspection would settle the question. Since the claimed separation is the foundation of the contribution, and since the paper's own privacy numbers show SecureNT is comparable to, not better than, AntiTomo, the REJECT verdict stands.","tokens_in":8782,"tokens_out":4491,"duration_ms":45296,"concrete_test":"On one topology (e.g., GANET), use the released code to produce Ytilde via Eq. (5)/Algorithm 1. Give a trusted user R and full knowledge of the algorithm but no extra secret, and require them to estimate X from Ytilde, e.g., by minimizing ||Ytilde - R X|| or by running the CLINK/RangeTomo pipeline of §5.3. Also let an attacker who knows the algorithm do the same without R. If the trusted user's F1/NRMSE is statistically indistinguishable from the attacker's, or if no denoising step exists in the code, the claimed 7–10% utility loss cannot be attributed to a real privacy-utility separation.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The abstract's central claim is that the same modified measurements Ytilde can hide topology from an attacker who lacks R and remain accurate for a trusted user who knows R. In §4.1, Eq. (5) defines Ytilde = Y + alpha * M(R'X', R I), and the paper states that both trusted and untrusted users work with 'the same measurement data.' No subsequent step gives the trusted user a way to recover Y or compensate for the injected noise: there is no decryption, no secret key, no denoising procedure, and no derivation that a tomography algorithm run on Ytilde with known R yields Xhat_t close to X. Eq. (7) lists ||Xhat_t - X|| as an objective, but Algorithm 1 only projects the fake distribution R'X' toward the reference R I; it is not shown to optimize Eq. (7) or to create a signal that a trusted user can invert. If the noise is public, an attacker who knows the algorithm can also subtract it, collapsing the privacy guarantee; if it is secret, the paper never says how the trusted user obtains it. The evaluation's utility numbers are therefore empirical outcomes of running CLINK/RangeTomo on corrupted measurements, not evidence of a designed privacy-utility separation. The paper's own privacy results also undercut 'superior': SecureNT similarity is 78.2/77.7 vs AntiTomo's 77.8/77.4, i.e. comparable or slightly worse.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents SecureNT, a framework that modifies end-to-end network measurements with the goal of preventing topology inference attacks while preserving the usefulness of the measurements for trusted network monitoring. The proposed mechanism constructs a fake topology (R′, X′), computes fake measurements R′X′, and injects noise into the true measurements as Ytilde = Y + α M(R′X′, R I), where M is the Protection Computing Module implemented by Algorithm 1 via iterative gradient descent with projection toward a reference distribution. The evaluation uses four Topology Zoo networks, compares against AntiTomo and Proto, and measures topology similarity under MPL inference, congestion-detection F1 with CLINK, and link-performance similarity with RangeTomo. The paper claims \"superior privacy protection\" and only a 7–10% F1 drop for trusted users.","tokens_in":9122,"tokens_out":5275,"duration_ms":53645,"significance":"The privacy–utility trade-off in network tomography is a real and timely problem, and the paper addresses it with a plausible threat model and standard benchmarks. Strengths include public source code, evaluation on multiple real-world topologies, and comparison against two protection baselines and three inference/monitoring algorithms. If the mechanism worked as claimed, the framework would be a practical contribution. However, the current manuscript does not establish the two central claims: the privacy gain over AntiTomo is marginal or slightly negative in the reported numbers, and the utility preservation for trusted users has no described mechanism because the injected noise is not invertible and no removal procedure is provided. The contribution is therefore currently at best incremental, and the load-bearing gaps need to be addressed before the paper can be accepted.","major_comments":[{"comment":"The trusted-user utility claim is unsupported: Eq. (5) defines Ytilde = Y + α M(R′X′, R I) and the text states that trusted and untrusted users work with the same measurement data, but the paper never specifies how a trusted user recovers or compensates for the injected noise. There is no decryption key, denoising step, or derivation showing that tomography performed on Ytilde with known R yields Xhat_t close to X. Consequently, the F1 and NRMSE results in Section 5.3 are unexplained empirical outcomes rather than evidence of a designed privacy–utility separation.","section":"§4.1, Eq. (5); §4.2, Algorithm 1"},{"comment":"The claim of \"superior privacy protection\" is contradicted by the paper's own results. SecureNT's average similarity is 78.2% versus AntiTomo's 77.8% on smaller networks and 77.7% versus 77.4% on larger ones; since a lower similarity score means better protection, AntiTomo is slightly better in both settings. The body text correctly describes SecureNT as \"comparable\" to AntiTomo, but the abstract and conclusion claim superiority. The authors should either provide statistically significant evidence of improvement or revise the claim to comparability.","section":"Abstract; §5.2, Figure 3"},{"comment":"The objective in Eq. (7) is not connected to Algorithm 1. The equation involves minimizing ||Y′−Y|| − λ1 d(G,G′) + λ2 ||Xhat_t − X||, but Algorithm 1 only performs projected gradient descent on ||Y − R I||. No derivation maps λ1, λ2, d(·,·), or Xhat_t to the update rule, and d(G,G′) depends on the attacker's inferred topology, which the algorithm never models. Thus the three claimed objectives are not actually optimized by the proposed mechanism.","section":"§4.2, Eq. (7)"},{"comment":"The fake-topology and smoothing construction is underspecified. Eq. (6) calls M(R′X′, R I), but R is |P|×|L| and I ∈ R^{|L′|}, so the reference R I is only defined if |L| = |L′|, which is nowhere stated or justified. Algorithm 1 also takes an \"initial distribution Y\" and \"target distribution RI\" but never defines the loss L(·,·), the projection step beyond renormalization, or how the two input distributions A and B mentioned in the text map to the algorithm's inputs. A precise formulation is needed before the mechanism can be reproduced or analyzed.","section":"§4.1, Eqs. (4)–(6)"}],"minor_comments":[{"comment":"The manuscript contains many typos and formatting artifacts (e.g., \"proctection computng moduel\", \"malicuous\", \"futher\", \"Giventhesechallenges\", garbled font codes in Figures 2 and 3, and the stray \"Mec.\" in Table 1), which suggests the paper has not been carefully proofread.","section":"Throughout"},{"comment":"The operator ⨀ is used for both additive and non-additive metrics, and the same symbol appears in Eq. (4) without stating which operation is used in the experiments; please specify that all experiments use delay (summation) and define the operation in each context.","section":"§3.1, Eq. (1)"},{"comment":"The quantities G0, G1, and G2 in the similarity metric are described only verbally as graph edit costs; please provide formal definitions so that the similarity measure is reproducible.","section":"§3.2, Eq. (3)"},{"comment":"The network name is spelled \"CHINANET\" in Table 1 but \"CHAINET\" in the Figure 3 caption; please make the naming consistent.","section":"§5.1, Table 1 and Figure 3"},{"comment":"The hyperparameters η, Tmax, and γ are not specified and no sensitivity analysis is reported; please add the values used in the experiments or point to the relevant code parameters.","section":"§4.2, Algorithm 1"},{"comment":"In the NRMSE formula, y[m] is used for both the true and the inferred link performance; please rename one of the signals to avoid confusion.","section":"§5.3, NRMSE"}],"recommendation":"reject","confidential_remarks":"The paper appears to be an early draft. The central contribution is not established: the utility-preservation mechanism has no formal basis, and the reported results do not support the \"superior\" privacy claim relative to AntiTomo. I would encourage the authors to substantially rework the manuscript, including a formal and testable separation between the attacker's and trusted user's access to the modified measurements, and to recalibrate their claims to the actual empirical outcomes."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear colleague,\n\nThis one is a reject, and the reason sits right in the paper's central claim. SecureNT adds noise to end-to-end measurements to hide topology, then says trusted users can still monitor link performance from the same corrupted measurements. But there is no mechanism for the trusted user to recover the original signal. Eq. (5) defines Ytilde = Y + alpha M(R'X', R I), and the paper says both trusted and untrusted users work with the same measurement data. No secret key, no denoising step, no derivation shows how a tomography algorithm run on Ytilde can give accurate link performance. Algorithm 1 only matches a fake distribution to a reference; it does not create an invertible signal. So the 7–10% F1 drop numbers in Section 5.3 are just empirical outcomes of running CLINK/RangeTomo on corrupted inputs, not evidence of a designed privacy–utility separation.\n\nWhat is new: the combination of path-length-aware fake delays (x'_j = c/l'_j + 1) and an iterative distribution-matching module is not in AntiTomo or Proto. The paper ships code (on Gitee), and the experiments use real topologies and NS-3. That is real work.\n\nWhat else is soft. The abstract claims 'superior privacy protection,' but Figure 3 shows SecureNT at 78.2/77.7 similarity versus AntiTomo's 77.8/77.4—slightly worse, not better. The objectives in Eq. (7) are never connected to Algorithm 1; there is no derivation. The evaluation tests only one inference algorithm (MPL), so 'resilient to various inference techniques' is unsupported. Several hyperparameters (alpha, lambda1, lambda2, c, convergence threshold) are not reported, which hampers reproduction. The writing is also noticeably sloppy—'proctection computing moduel,' garbled figure text, an incomplete sentence about 'malicuous' probes.\n\nWho gets value: someone working on topology obfuscation might read this as a failed but instructive attempt at privacy-preserving tomography. The core problem—how to give trusted users utility without leaking topology to attackers—is important, but this paper does not solve it.\n\nMy recommendation: send it to a serious referee, not because the paper is close to acceptable, but because the problem matters and the missing trusted-user mechanism is exactly what expert feedback should target. A referee should ask the authors to specify and prove how a trusted user recovers accurate link performance from Ytilde; without that, the paper should be rejected.","headline":"A novel obfuscation combination with no mechanism for trusted-user recovery—the paper's main claim doesn't hold up, but the problem is worth a referee's attention.","tokens_in":9678,"tokens_out":4114,"would_cite":false,"duration_ms":41775,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"SecureNT claims that fake-topology noise can hide real network structure from inference while keeping measurements usable for monitoring.","keywords":["network tomography","topology obfuscation","privacy-utility trade-off","noise injection","routing matrix","congestion detection","link performance inference"],"falsifier":"Give a trusted user only the modified measurements $\\tilde{Y}$ and the true routing matrix $R$, then run the paper's CLINK and RangeTomo evaluations. If the congestion-detection F1 or the inference similarity falls substantially below the reported 7-10 percent degradation, or matches the attacker's error, the utility claim fails; the paper's Eqs. (5)-(6) contain no denoising step to be tested.","tokens_in":8537,"feed_emoji":"🛡️","tokens_out":8819,"duration_ms":87346,"temperature":0.7,"pith_summary":"This paper claims that network operators can protect their topology from inference attacks by adding noise to end-to-end measurements, where the noise is shaped to mimic a fake topology, and that the same modified measurements remain accurate enough for trusted users to monitor link congestion and performance. The proposed framework, SecureNT, is intended to be lightweight enough for real-time protection, avoiding the expensive per-measurement optimization of earlier obfuscation methods. On four real network topologies, it keeps attacker-inferred topology similarity around 78-79 percent, comparable to the strongest baseline, while preserving congestion-detection F1-scores within 7-10 percent of unmodified measurements. If the claim holds, an organization could share or publish tomography measurements without revealing its network structure and without giving up its own monitoring capability.","feed_headline":"Fake-topology noise hides networks without breaking monitoring","feed_subtitle":"SecureNT lets trusted users keep congestion detection within 7-10 percent of baseline while attackers see a decoy.","key_machinery":"The load-bearing mechanism is the path relation-based noise injection, centered on the paper's protection computing module $M$. The routing matrix $R$ records which links each end-to-end path traverses, and the real topology is encoded entirely in it. The module takes two inputs: fake path measurements $R'X'$ computed from a fake routing matrix and fake link delays, and a reference set of path delays $R\\mathbf{1}$ built from the real routing matrix applied to an all-ones vector. It scales one distribution to match the other's sum, then alternates gradient descent on the L2 loss with a projection that preserves the sum, iterating until the loss falls below a threshold. The adjusted noise $\\delta_y^{adj}$ is scaled by $\\alpha$ and added to the true measurements, which is what the paper identifies as the source of both real-time protection and the privacy-utility trade-off.","core_discovery":"The central discovery is that a topology-hiding perturbation can be constructed from a fake routing matrix rather than from expensive topology-search optimization: choose a plausible fake topology, derive fake path delays from it, and run a fast distribution-matching step that reshapes this fake noise to the scale and shape of the real measurements. The paper argues that the resulting modified measurements $\\tilde{Y}=Y+\\alpha M(R' X', R\\mathbf{1})$ mislead topology inference attacks while leaving trusted tomography algorithms accurate. In the evaluation, the protection is stable as probe counts grow to 1800, and trusted-user congestion detection (CLINK) and continuous inference (RangeTomo) degrade only mildly relative to the unprotected baseline.","pith_inferences":["Implicit in Eqs. (5)-(6) is an access assumption the paper never states: a trusted user must know either the original measurements $Y$ or the noise parameters ($\\alpha$, $R'$, and the output of $M$) to undo the perturbation; otherwise the utility results need a separate denoising argument.","Because the attacker and the trusted user share the same $\\tilde{Y}$, the framework's privacy-utility split ultimately rests on the attacker's ignorance of $R$; an adversary who learns a few real path-link relations may be able to subtract the reference term and expose the real topology.","A natural stress test beyond the paper's evaluation is to attack with deep-learning tomographers rather than MPL, since the paper claims resilience to future inference approaches without evaluating any neural method.","The L2 projection in $M$ could be replaced by other distribution distances, for example Wasserstein or KL, to see whether the same protection is achievable with less noise, a comparison the paper does not run."],"forward_implications":["Operators can apply protection online as measurements arrive, because the modification is a scaling plus a short gradient-projection loop rather than a full optimization over topologies.","Trusted users can keep their existing monitoring stack: CLINK-style congestion detection and RangeTomo-style performance inference run on the protected measurements with only a 7-10 percent F1 reduction.","The protection does not wear out with attacker effort: topology similarity stays near 78-79 percent as probe count rises from 200 to 1800.","Choosing a different fake routing matrix $R'$ gives the operator a tunable knob to trade privacy strength against measurement fidelity without changing the monitoring workflow.","The result extends to at least four real networks of different sizes and path counts, so it is not confined to one small testbed."],"supporting_citations":[{"why":"Supplies the primary obfuscation baseline whose topology-similarity and utility results SecureNT is compared against.","marker":"[11]"},{"why":"Supplies the second protection baseline (Proto) and the comparison for topology similarity and measurement utility.","marker":"[6]"},{"why":"Provides the four real-world network topologies used in the numerical evaluation.","marker":"[9]"},{"why":"Provides the CLINK congestion-detection algorithm used to measure trusted-user utility via F1-scores.","marker":"[14]"},{"why":"Provides the RangeTomo algorithm used to evaluate continuous link-performance inference accuracy.","marker":"[21]"},{"why":"Provides the maximum-likelihood topology inference method used as the attacker's inference algorithm in the attack evaluation.","marker":"[2]"}],"fun_headline_variants":["Decoy topology shields networks from inference attacks","SecureNT spoofs topology, keeps monitoring accurate","Fast fake-topology defense masks network structure","Obfuscating topology without losing monitoring utility","Topology privacy via decoy paths, monitoring intact"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The trusted user can recover accurate link performance from deliberately perturbed measurements knowing only the real routing matrix $R$, even though the paper describes no step that removes or inverts the injected noise.","fun_headline_variants_meta":{"raw":{"variants":["Decoy topology shields networks from inference attacks","SecureNT spoofs topology, keeps monitoring accurate","Fast fake-topology defense masks network structure","Obfuscating topology without losing monitoring utility","Topology privacy via decoy paths, monitoring intact"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00034,"raw_usage":{"total_tokens":1829,"prompt_tokens":852,"completion_tokens":977,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":468,"completion_tokens_details":{"reasoning_tokens":906}},"tokens_in":468,"tokens_out":977,"duration_ms":9475,"temperature":1.0,"reasoning_tokens":906,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T18:06:54.798156+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Give a trusted user only the modified measurements $\\tilde{Y}$ and the true routing matrix $R$, then run the paper's CLINK and RangeTomo evaluations. If the congestion-detection F1 or the inference similarity falls substantially below the reported 7-10 percent degradation, or matches the attacker's error, the utility claim fails; the paper's Eqs. (5)-(6) contain no denoising step to be tested.","supporting_citations":[{"cited_title":"Antit- omo: Network topology obfuscation against adversarial tomography-based topol- ogy inference","cited_arxiv_id":null,"evidence_quote":"Supplies the primary obfuscation baseline whose topology-similarity and utility results SecureNT is compared against."},{"cited_title":"Proto: Proactive topology obfuscation against adversarial network topology inference","cited_arxiv_id":null,"evidence_quote":"Supplies the second protection baseline (Proto) and the comparison for topology similarity and measurement utility."},{"cited_title":"Nguyen, Nickolas Falkner, Rhys Bowden, and Matthew Roughan","cited_arxiv_id":null,"evidence_quote":"Provides the four real-world network topologies used in the numerical evaluation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the CLINK congestion-detection algorithm used to measure trusted-user utility via F1-scores."},{"cited_title":"Range to- mography: combining the practicality of boolean tomography with the resolution of analog tomography","cited_arxiv_id":null,"evidence_quote":"Provides the RangeTomo algorithm used to evaluate continuous link-performance inference accuracy."},{"cited_title":"Maximum likelihood network topology identification from edge-based unicast measurements","cited_arxiv_id":null,"evidence_quote":"Provides the maximum-likelihood topology inference method used as the attacker's inference algorithm in the attack evaluation."}],"review_version":1}