{"id":"7d5f3255-2435-4e42-bd3f-75eafc742ad8","arxiv_id":"2412.08534","paper_version":2,"verdict":"REJECT","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":6,"one_line_summary":"Citadel++ claims to protect dataset, model, and code confidentiality, user-level differential privacy, and execution integrity in collaborative training using VM-level trusted execution environments and enhanced DP-SGD.","lead":"Citadel++ is a system for collaborative machine learning that lets a model owner train on private datasets it never sees, while dataset owners keep both their data and individual user privacy protected. It combines hardware security enclaves, differential privacy, and OS sandboxing, and reports order-of-magnitude speedups over cryptographic baselines.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Collusion-resistant DP claim is under-specified and unproven: §4.2 fixes only the sum of the DP-masks, §7/§8.2 assert rather than prove the colluding-adversary guarantee, and the omitted mask distribution can make the claim false (e.g., m_i = ξ/n lets a colluding adversary recover the honest…","rationale":"The reader's weakest assumption and my stress-test converge: the central privacy claim is the collusion-resistant DP guarantee, and the paper nowhere proves it for the mechanism that is actually released to the model updating component. In good faith, the engineering contributions (TEE sandboxing, integrity, performance) are credible and not the issue; the issue is the formal privacy promise. I looked for a way to rescue the claim. One could imagine a correlated mask distribution that gives each m_i full-scale noise while keeping the sum at σ-scale, and for a single honest owner the pair (g_i+m_i, g_i+ξ) may collapse to g_i+ξ when the colluding masks are known. But the paper does not provide that distribution, and the equal-split instantiation of the stated sum constraint is catastrophically insecure, showing that the under-specification is not a harmless omission. The formal appendix does not fill the gap: it proves standard DP-SGD accounting and a noise-correction bound, but no theorem about the colluding adversary's view of the per-owner masked gradients. The apparent error in Theorem 5's σ_total formula reinforces that the appendix was not carefully checked. Therefore the central claim is not established, and the reader's REJECT verdict stands unchanged.","tokens_in":32883,"tokens_out":15683,"duration_ms":172766,"concrete_test":"Pin down the mechanism: ask the authors to state the exact joint distribution of (m_1,...,m_n) used by the admin component (Sec 4.2 currently fixes only their sum). Then instantiate the colluding-adversary view for n=2 and n=3 with one honest owner: the adversary observes all masked gradients, the aggregate, and the true gradients/masks of the colluding owners. Compute the privacy loss of this full view via PLRV/numerical accounting at the paper's σ and target δ=1e−5, using the stated mask distribution. If no distribution is supplied, or if the supplied distribution yields per-owner ε larger than central DP-SGD (or permits exact recovery of g_i, as the equal-split m_i=ξ/n does), the Sec 8.2 claim is falsified. If a correlated distribution is supplied, this accounting settles whether full per-owner DP is actually achieved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Sec 8.2 claims that with up to n−1 colluding dataset owners, each non-colluding owner is protected by the full DP-SGD noise. The load-bearing condition is the privacy of the per-owner masked release in the colluding adversary's view, but the paper never analyzes that view. §4.2 specifies only the sum of the masks, Σ_i m_i = ξ ~ N(0, σ²C²I); it does not specify the joint distribution of (m_1,...,m_n). The marginal distribution of the honest owner's mask m_i is exactly what protects g_i when the adversary isolates g_i+m_i, because the model updating component receives every masked gradient and, with colluding owners, knows the other true gradients and masks. §7 says the guarantees 'extend' to collusion without stating a theorem for this mechanism; Appendices A.1-A.2 are standard DP-SGD/PLRV accounting and never model this release. The omission is not benign: the natural equal-split instantiation m_i=ξ/n gives the adversary both a_i=g_i+ξ/n (from the per-owner release) and g_i+ξ (from the aggregate minus known colluding parts), from which g_i is recovered exactly. A secure scheme would need a correlated mask distribution (e.g., m_i=ξ/n+η_i with zero-sum η_i) plus a proof that the conditional distribution of m_i given the colluding masks and released aggregate still provides σ-scale noise; neither is present. The noise-correction appendix also has an apparent accounting slip (Theorem 5 defines σ_total as a sum of inverse variances), which further undermines confidence that the formal analysis was validated.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"Citadel++ is a collaborative ML training system that combines VM-level TEEs (AMD SEV-SNP, Intel TDX, NVIDIA H100) with a DP-based privacy barrier to protect dataset, model, and code confidentiality, and individual privacy. The privacy barrier consists of DP-masking, dynamic gradient clipping, and DP noise correction. The paper also contributes sandboxing of untrusted training code via OS namespaces and integrity enhancements for Confidential Containers. Experiments show the system is competitive with non-confidential FL and much faster than cryptographic baselines.","tokens_in":33303,"tokens_out":32095,"duration_ms":305174,"significance":"The system-level engineering is substantial: the paper demonstrates a full implementation with GPU TEE support, sandboxing, and integrity mechanisms, and the performance evaluation is careful and extensive. If the privacy claims held, Citadel++ would be an important practical step toward confidential collaborative learning with DP guarantees. However, the central privacy claims are not yet rigorously established: the DP-masking scheme is under-specified, the adversary's full view is not modeled, and the noise-correction privacy formulas contain algebraic errors. These issues are load-bearing because the paper's main novelty over prior TEE-based systems is its privacy barrier.","major_comments":[{"comment":"The DP-masking mechanism is under-specified and the privacy analysis does not model the adversary's actual view. The paper fixes only the sum of masks, Σ_i m_i = ξ ~ N(0, σ²C²I), and Section 7's accounting (with Appendices A.1-A.2) covers only the aggregated output Σ_i g_i + ξ. However, the model updating component receives each per-handler value g_i + m_i individually, and the model owner may collude with up to n-1 dataset owners who can reveal their true gradients g_j and, from the observed g_j + m_j, their masks m_j. Section 8.2 asserts without proof that the non-colluding owner's g_i remains protected by the full DP noise. This is false for a natural instantiation: if m_i = ξ/n for all i, one colluding owner's mask reveals ξ, and then the adversary obtains m_i and solves for g_i exactly from g_i + m_i. If instead the masks are i.i.d. with variance σ²C²/n, each per-handler release carries only noise σC/√n, which is weaker than the claimed DP-SGD noise σC unless the composition of per-handler releases is explicitly accounted for. The paper must specify the exact joint distribution of (m_1,...,m_n) and provide a DP analysis of the entire view (g_1+m_1,...,g_n+m_n, Σ_i(g_i+m_i)), including the colluding-adversary case, before the central privacy claim can be evaluated.","section":"Sec. 4.2, Sec. 7, Sec. 8.2"},{"comment":"The composition formula for T Gaussian mechanisms is algebraically incorrect. Eq. (6) reads δ(ε) = Φ(-εσ√T + √T/(2σ)) - e^ε Φ(-εσ√T - √T/(2σ)); the correct expression, obtained by composing T mechanisms each with sensitivity 1 and noise scale σ, is Φ(-εσ/√T + √T/(2σ)) - e^ε Φ(-εσ/√T - √T/(2σ)). The same reciprocal error appears in Theorem 5, where σ_total = sqrt(T/\\tilde{σ}² + n_g/σ_g²) is defined as the standard deviation of the resulting PLRV but is then used in the Gaussian CDF in place of the reciprocal of the effective noise scale. The resulting formula is dimensionally inconsistent, so the privacy numbers for the noise-correction mechanism (Section 10.1, Figure 8, Appendix A.3.3) are not reliable. The proof of Theorem 5 also does not use the histogram sensitivity √2 stated in Section 4.3, so the σ_total definition is inconsistent with the mechanism's stated sensitivity.","section":"Appendix A.3.1, Eq. (6) and Thm. 5"},{"comment":"The abstract and Section 1 claim that Citadel++ 'matches the model utility of standard central DP-SGD mechanisms,' but the experiments never compare against a central DP-SGD baseline. Figure 5 shows accuracy for different ε values against a non-private upper bound only; Figure 8 compares DP-GD with and without noise correction. Without a DP-SGD reference curve and without error bars over multiple runs, the utility-parity claim is not empirically substantiated. Since this is one of the paper's headline contributions, the evaluation should include a direct DP-SGD comparison and report variability across seeds.","section":"Sec. 10.1, Figs. 5 and 8"}],"minor_comments":[{"comment":"The notation 'Σ_{i=1}^n m_i = N(0, σ²C²I)' is mathematically imprecise; the left-hand side is a random variable, so the expression should read 'Σ_i m_i ~ N(0, σ²C²I)'.","section":"Sec. 4.2"},{"comment":"The statement that 'Noise correction further prevents attackers from correlating noise across iterations' is not analyzed in the collusion context; Appendix A.3.3 considers sequences of updates but does not connect to the colluding-adversary model of Section 8.2.","section":"Sec. 8.2"},{"comment":"The text says 'we launched one admin, one model handling, and four data handling components'; for consistency with the rest of the paper, 'model handling' should be 'model updating'.","section":"Appendix B"},{"comment":"The legend labels 'ε = 50', etc., should specify that these are privacy budgets; the caption currently does not define the parameter.","section":"Fig. 5 caption"}],"recommendation":"major_revision","confidential_remarks":"The systems contributions (TEE-based sandboxing, integrity mechanisms, GPU support, performance evaluation) are solid and could survive a major revision. The main risk is the privacy barrier: the current manuscript does not provide a provably correct DP-masking scheme and contains algebraic errors in the noise-correction analysis. I recommend the editor require the authors to specify the mask distribution, provide a full DP analysis of the per-handler releases under both the single-adversary and colluding-adversary views, correct the formulas in Appendix A.3.1, and add DP-SGD baselines. If the collusion-resistance claim cannot be formally established, the paper should be published (if at all) without that claim."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Bottom line: this is a substantial systems paper with a missing proof at the center of its privacy story. The engineering is real: VM-level TEEs with sandboxing via namespaces, integrity extensions for Confidential Containers, GPU TEE integration, and a solid-looking performance evaluation. The new mechanisms - noisy-histogram dynamic clipping and negative-correlation noise correction - are interesting, and the 543x/113x speedups over crypto baselines are credible given the implementation. I also found the threat model and the baseline choices fair; Citadel was adapted to SEV-SNP, and Pencil's OOM cases are reported.\n\nThe soft spot is not minor. Section 4.2 specifies only that the DP-masks sum to ξ ~ N(0, σ²C²I). It never specifies the joint distribution of the m_i, and Section 8.2 asserts, without a proof, that an honest owner stays protected when the model owner colludes with up to n-1 dataset owners. That is the load-bearing claim, and the natural implementation m_i = ξ/n is broken: an adversary who sees g_h + ξ/n and the aggregate can solve for g_h exactly. A secure scheme needs a correlated mask distribution (e.g., zero-sum per-owner noise around ξ/n) plus a formal argument that the conditional distribution of the honest mask still provides σ-scale noise. Neither is in the paper. The appendix has a genuine error too: Theorem 5 defines σ_total as the standard deviation of the resulting PLRV and then plugs it into the Gaussian-mechanism formula as if it were the noise scale; the arguments should be reciprocals. That needs to be reworked, along with the composition that includes the histogram noise.\n\nMinor: the accuracy plots in §10.1 have no error bars, and the dynamic-clipping percentile r is a free parameter with no sensitivity analysis.\n\nI would not accept the paper in this form. But I would send it to serious peer review: the engineering is substantial, the problem is important, and the privacy analysis is repairable either by adding the missing proof or by honestly weakening the collusion claim to what the current mechanism actually provides. I would not cite the privacy result yet, but the systems design is worth following.","headline":"Strong TEE-based system with a real privacy hole at the center: the collusion-resistance claim is unproven and a natural mask choice breaks it.","tokens_in":33821,"tokens_out":6439,"would_cite":false,"duration_ms":65495,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Even n-1 colluding owners can't strip DP privacy","keywords":["differential privacy","DP-SGD","trusted execution environment","confidential computing","gradient masking","collaborative learning","federated learning","sandboxing"],"falsifier":"Construct the adversarial view explicitly: give the colluding parties their masks and all masked gradients, then compute the hockey-stick divergence between neighboring datasets for the remaining owner's contribution. If the released aggregate plus the $n-1$ known masks lets an attacker recover the noise $\\xi$, or any function with sensitivity larger than the DP-SGD bound, with better-than-Gaussian accuracy, the collusion claim is false; measuring that divergence numerically for any concrete mask distribution settles it.","tokens_in":32741,"feed_emoji":"🔐","tokens_out":4868,"duration_ms":47668,"temperature":0.7,"pith_summary":"This paper argues that collaborative machine learning can simultaneously protect three things that are usually in tension: the confidentiality of the training data, the confidentiality of the model and its training code, and the differential privacy of individual users whose data appears in the dataset. The proposed system, Citadel++, runs each party's component inside VM-level trusted execution environments and inserts a privacy barrier between data handling and model updating. The barrier adds random masks whose sum is exactly the Gaussian noise of DP-SGD, so the aggregated update carries the same privacy guarantee as central DP-SGD. The paper further claims that this guarantee survives worst-case collusion: even if the model owner and up to $n-1$ dataset owners share everything they see, the remaining dataset owner's data is still protected by the full noise.","feed_headline":"Even n-1 colluding owners can't strip DP privacy","feed_subtitle":"Citadel++ masks gradients with shared noise so the aggregate stays DP-SGD-private under worst-case collusion.","key_machinery":"The load-bearing object is the differentially private masking scheme: masks are drawn so their sum is one Gaussian sample of scale $\\sigma C$, matching the central DP-SGD noise; each handler adds its mask before release and the updater aggregates, so the released aggregate is DP-SGD's update. Two supporting mechanisms carry the argument: dynamic gradient clipping, where a noisy histogram of gradient norms selects the clipping bound each round with per-bin $\\ell_2$-sensitivity at most $\\sqrt{2}$, and DP noise correction, where iteration $t+1$ adds $\\xi_{t+1}-\\lambda\\xi_t$, so short sequences of per-iteration gradients are harder to denoise while the final model's noise is unchanged. The sandbox with network, filesystem, and IPC isolation is what forces the untrusted training code to output only through this barrier.","core_discovery":"Citadel++'s central claim is that differential privacy for individual data records can be enforced by construction in a collaborative training session, without trusting or inspecting the model owner's code. The construction: a trusted admin component generates $n$ masks $m_1,\\ldots,m_n$ whose sum $\\sum_i m_i = \\xi$ is a single Gaussian draw $\\mathcal{N}(0,\\sigma^2 C^2 I)$; data handler $i$ sends the masked gradient $g_i + m_i$, and the model updater's aggregate is $\\sum_i g_i + \\xi$, exactly the DP-SGD update. Consequently each individual masked gradient is uniformly random given the others, and the paper claims that collusion among the model owner and up to $n-1$ dataset owners does not reduce the DP noise protecting the non-colluding owner. Dynamic gradient clipping and a noise-correction step extend the same accounting without changing the final model's privacy-utility trade-off.","pith_inferences":["If the privacy-under-collusion claim is proved with a concrete mask distribution and composition analysis, the same masking construction could be reused as a drop-in secure-aggregation layer for federated learning without TEEs.","The noise-correction step is effectively a moving-average filter on the noise, which suggests a family of higher-order correction schemes that shrink per-iteration privacy loss further at the cost of more complex accounting.","Using the paper's own formulas for bounded-length update sequences, one could tune $\\lambda$ adaptively to maximize per-iteration privacy for a fixed final-model privacy budget.","The sandboxing results imply that the main cost of containing malicious code is the boundary between the trusted service container and the untrusted handler, not the TEE itself."],"forward_implications":["A model owner can offer proprietary training code without showing it to data owners, and data owners can keep their datasets encrypted at rest and in use inside TEEs.","The final model's accuracy matches central DP-SGD at the same $(\\varepsilon,\\delta)$ budget, because the aggregate gradient distribution is identical.","Per-iteration gradients are protected against reconstruction and membership-inference attacks, since each released gradient is individually masked.","Citadel++ can run on GPU TEEs and match non-confidential federated learning speed, with reported speedups of up to 543x on CPU and 113x on GPU over cryptographic baselines."],"supporting_citations":[{"why":"Defines DP-SGD, the baseline mechanism whose gradient clipping and Gaussian noise the masking scheme replicates.","marker":"[1]"},{"why":"Supplies the prior collaborative-training architecture and the security baseline that Citadel++ extends with DP masking, sandboxing, and integrity.","marker":"[134]"},{"why":"Provides the confidential-container runtime that Citadel++ builds on for VM-level TEE deployment and sandboxing.","marker":"[24]"},{"why":"Gives the numerical composition method for privacy loss random variables used in the DP accounting.","marker":"[48]"},{"why":"Provides tight FFT-based privacy accounting used to evaluate the composed DP guarantees.","marker":"[70]"},{"why":"Supplies dominating-pair and characteristic-function accounting that combines the Gaussian mechanisms in the proof.","marker":"[139]"},{"why":"Documents the attestation-coverage gap of current VM-level TEEs that motivates the integrity enhancements.","marker":"[129]"},{"why":"Provides the block-device snapshotter that binds container image integrity to the attestation report via dm-verity.","marker":"[91]"}],"fun_headline_variants":["Citadel++ enforces DP even when n-1 owners collude","Mask sum guarantees DP under worst-case collusion","Citadel++: DP privacy without trusting model code","Shared noise keeps DP intact against colluding owners","Masks make DP-SGD enforce privacy by construction"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The guarantee that a non-colluding data owner stays private when the model owner and $n-1$ dataset owners collude is asserted without a formal proof or a specified mask distribution: the paper does not analyze the adversary who sees all masked gradients and knows the masks of $n-1$ colluding owners.","fun_headline_variants_meta":{"raw":{"variants":["Citadel++ enforces DP even when n-1 owners collude","Mask sum guarantees DP under worst-case collusion","Citadel++: DP privacy without trusting model code","Shared noise keeps DP intact against colluding owners","Masks make DP-SGD enforce privacy by construction"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000166,"raw_usage":{"total_tokens":1269,"prompt_tokens":974,"completion_tokens":295,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":590,"completion_tokens_details":{"reasoning_tokens":217}},"tokens_in":590,"tokens_out":295,"duration_ms":4204,"temperature":1.0,"reasoning_tokens":217,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T17:47:24.407205+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Construct the adversarial view explicitly: give the colluding parties their masks and all masked gradients, then compute the hockey-stick divergence between neighboring datasets for the remaining owner's contribution. If the released aggregate plus the $n-1$ known masks lets an attacker recover the noise $\\xi$, or any function with sensitivity larger than the DP-SGD bound, with better-than-Gaussian accuracy, the collusion claim is false; measuring that divergence numerically for any concrete mask distribution settles it.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies dominating-pair and characteristic-function accounting that combines the Gaussian mechanisms in the proof."},{"cited_title":"SNPGuard: Remote Attestation of SEV-SNP VMs Using Open Source Tools","cited_arxiv_id":"2406.01186","evidence_quote":"Documents the attestation-coverage gap of current VM-level TEEs that motivates the integrity enhancements."},{"cited_title":"https: //techcommunity.microsoft.com/blog/linuxandopensourceblog/ inside-look-how-azure-linux-powers-confidential-containers-on- aks/3981296","cited_arxiv_id":null,"evidence_quote":"Provides the block-device snapshotter that binds container image integrity to the attestation report via dm-verity."}],"review_version":1}