{"id":"6e6ab017-1539-4152-b06a-89acf729145c","arxiv_id":"2412.11496","paper_version":2,"verdict":"ACCEPT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"For a user-helper-master network with straggling links and up to T colluding helpers, the optimal user-to-helper and helper-to-master rates are both 1/(N_r - T), and secure aggregation is impossible when N_r is at most T.","lead":"This paper computes the exact communication rates for a privacy-preserving hierarchical aggregation network, where users send gradients to a master through an intermediate layer of helpers. If correct, it pins down the minimum overhead needed to keep individual gradients secret while tolerating dropped links and colluding helpers.","discovery_kind":"first_principles","skeptic_critique":{"model":"deepseek-v4-flash","headline":"No significant objection identified: the achievability and converse proofs are internally consistent, and the trusted-third-party helper randomness is an explicit model assumption rather than a hidden gap.","rationale":"The reader's verdict is ACCEPT with moderate confidence, and I agree. The weakest assumption identified by the reader, the trusted third party that generates helper-side randomness, is indeed the main practical caveat. However, it is explicitly part of the system model in Section II (before eq. (3)), so it does not make the theorem internally inconsistent or the proof circular. I examined the achievability scheme's security arguments in detail: Lemma 1's independence and rank claims are valid; Lemma 2's entropy bound correctly accounts for the fact that a colluding helper receiving masked messages does not know the senders' randomness; and the master-security proof legitimately enlarges the colluding set to size T for an upper bound. The converse bounds are standard and use the security constraints correctly. The proof of Lemma 3 contains a step that looks like a reversed data-processing inequality, but when the independence of other users' messages and helper randomness from (W_k, X_{k,N_k}) is accounted for, the two conditional entropies are equal, so the conclusion I(W_k; X_{k,N_k}) = L stands. The N_r <= T infeasibility proof is a clean contradiction. No parameter fitting, circular self-citation, or unstated technical assumption that affects the theorem was found. The finite-field-size extension is deferred but standard and does not change the rate in q-ary units. Therefore the appropriate verdict remains ACCEPT, and no adjustment is needed.","tokens_in":19798,"tokens_out":50999,"duration_ms":443259,"concrete_test":"Run a symbolic linear-algebra check on the small instance K=2, N=4, N_r=3, T=1 over F_7: verify that the three masked messages received by helper 3 for user 2 span a 3-dimensional subspace of the 5 unknowns (W_{2,1}, W_{2,2}, F_2, Q_{3,1}, Q_{3,2}), that the recovery combination for X_{2,3} cancels the Q terms as in (13c), and that the mutual information identity (15d) evaluates to zero. This directly tests the load-bearing security step.","verdict_should_be":"UNCHANGED","load_bearing_attack":"I checked the central load-bearing steps and did not find a substantive correctness flaw. The trusted-third-party assumption in Section II is explicit and standard in this literature; it limits applicability if no such setup exists, but it does not undermine the claimed rate region for the stated model. The security proofs are the most delicate part, and they hold up: in Lemma 2, the masked inter-helper messages are protected because the receiving helper does not know the sender's stored randomness, and the entropy accounting correctly caps the joint message space at N_r symbols per destination. The apparent reversed inequality in the proof of Lemma 3 is not an error: the extra conditioning variables are independent of (W_k, X_{k,N_k}), so both sides equal H(W_k | X_{k,N_k}). The converse lower bounds are standard entropy arguments using the security constraints, and the N_r <= T infeasibility proof is a valid contradiction between correctness and helper security. The finite-field-size deferral is also standard. Overall, the central claim is credible as stated.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper formulates a hierarchical secure coded gradient aggregation problem in which K users communicate with a master through N helpers, with at least N_r non-straggling links per user and at least N_r surviving helpers to the master, and with up to T colluding helpers and any number of colluding users. The main result, Theorem 1, states that the optimal rate region is empty when N_r <= T, and is given by R_X >= 1/(N_r-T) and R_Y >= 1/(N_r-T) when N_r > T. The achievability proof constructs explicit Vandermonde-based user encodings and helper-side randomness, and derives matching converse bounds from the correctness and security constraints. The paper also proves the infeasibility of the N_r <= T case and presents a worked example with K=2, N=4, N_r=3, T=1.","tokens_in":19963,"tokens_out":26701,"duration_ms":240132,"significance":"If the result holds, it provides a sharp, parameter-free characterization of the optimal communication rates for a natural hierarchical variant of secure coded gradient aggregation. The paper's strengths are the explicit construction, the matching converse, and the infeasibility result, all of which are presented without fitted parameters and with a concrete toy example that verifies the algebra. The main limitations are the explicit assumption of a trusted third party that distributes helper-side randomness and the deferral of the small-field-size case to [7]; both are standard in this literature and are stated in the model, so they restrict applicability rather than invalidate the claimed rate region for the stated model.","major_comments":[{"comment":"The proof of Lemma 2 applies Lemma 1 to the set N_k union T \\ {t} in order to evaluate H(Z_{N_k union T \\ {t}, t}) - H(Z_{T \\ {t}, t}) as (N_r - |T|)l. Since |N_k| >= N_r, this set can have cardinality larger than N_r-1, and Lemma 1 does not apply in that regime; for example, with N_r=3, T={4}, and N_k={1,2,3}, the set has size 3, which exceeds N_r-1=2. The displayed equality is therefore not justified by Lemma 1 as written. This step is load-bearing because Lemma 2 is used directly in the proof of security against helpers. The underlying claim appears repairable: for a fixed receiver t, the variables Z_{n,t} are linear functions of a common Q_t through the matrix S_t \\tilde G, which has rank N_r-1, so the entropy difference should be computed by a rank argument rather than by Lemma 1. Please supply this argument explicitly.","section":"Section IV-D, Eq. (40c)"}],"minor_comments":[{"comment":"Remark 1 says the infeasibility threshold is 'the number of potentially colluding users', but T denotes the number of colluding helpers; Remark 2 states 'When N_r < T' where the subsequent discussion only makes sense for N_r > T. Both should be corrected.","section":"Section III, Remarks 1 and 2"},{"comment":"The proof assumes q >= N + N_r and defers the small-field case to [7]. The statement of Theorem 1 should either include this condition explicitly or state that the result holds for a sufficiently large finite field; otherwise the theorem as stated is stronger than what is proved in the manuscript.","section":"Section IV-B, field-size discussion"},{"comment":"The displayed equation writes the helper-side variables as Z_{1,n}, ..., Z_{N,n}, while Eq. (25) defines M_{n,i} = X_{k,n} + Z_{n,i}. The first and second indices of Z should be aligned consistently, and the matrix concatenation [G_n, \\tilde G] should be defined explicitly as horizontal concatenation.","section":"Equation (22)"},{"comment":"The model requires a trusted third party that generates and distributes the helper-side randomness Z_n. This is an explicit assumption, but the paper should state in the conclusions that the achievability result depends on this trusted setup and that the rates are not realized without it.","section":"Section II and VI"},{"comment":"The headings 'Security Againist Helpers' and 'Security Againist the Master' contain typos; they should read 'Security Against Helpers' and 'Security Against the Master'.","section":"Headings, Section IV-A"}],"recommendation":"major_revision","confidential_remarks":"The central capacity result is credible and the construction is elegant, but the proof of Lemma 2 contains a gap in the application of Lemma 1 that is load-bearing for the security proof. The gap appears fixable with a rank argument, so I recommend major revision rather than rejection. The paper is within scope for the journal and, once the lemma proof is repaired, should be a solid contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this paper gives the first exact rate region for hierarchical secure coded gradient aggregation with straggling links on both hops, inter-helper communication, and collusion constraints. The result is clean: rates 1/(N_r - T) on both user-helper and helper-master links when N_r > T, and infeasibility when N_r <= T. I checked the main steps and the proofs hold up.\n\nWhat's genuinely new is the model itself. Prior hierarchical secure aggregation work either neglected straggling helper-to-master links or didn't allow inter-helper communication, and none had a capacity characterization with security constraints. The Vandermonde-based upload with an extended Vandermonde for helper sharing is a real construction, not a repackaging. The toy example (K=2,N=4,N_r=3,T=1) verifies the algebra and makes the scheme readable. The converse is standard entropy accounting but correctly pinned to the security constraints; the N_r <= T contradiction argument is valid.\n\nThe soft spots are minor and mostly explicit in the paper. The achievability scheme assumes a trusted third party to generate and distribute helper-side randomness Z_n. That's a real applicability limitation if no such setup exists, but it's stated plainly and is standard in this literature. The finite-field-size extension is deferred to [7]; again standard, but the paper should ideally include the argument. Lemma 2's proof is compressed; the entropy accounting is right, but a referee should ask for a few more intermediate steps. None of these touch the central claim.\n\nThe citation pattern looks fine: relevant prior work on hierarchical gradient coding and secure aggregation is cited, and the comparisons to prior non-secure and secure hierarchical works are accurate. I saw no self-citation circularity or fitted parameters.\n\nWho it's for: people working on information-theoretic secure aggregation or coded gradient aggregation. It's a subfield result, not a paradigm shift, but it resolves the model exactly, which is what this community values. It deserves a serious referee; I'd send it out. If I were working in this area I'd cite it.","headline":"Solid information-theoretic capacity result for a new hierarchical secure aggregation model; the paper earns a serious referee.","tokens_in":20477,"tokens_out":1609,"would_cite":true,"duration_ms":14574,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["94A62","94A15"],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper proves that the optimal rate region for hierarchical secure coded gradient aggregation is the set of pairs $(R_X,R_Y)$ satisfying $R_X \\geq 1/(N_r-T)$ and $R_Y \\geq 1/(N_r-T)$ when $N_r>T$, and is empty otherwise.","keywords":["secure aggregation","coded gradient aggregation","hierarchical federated learning","straggling communication links","Vandermonde matrix","information-theoretic security","capacity region","colluding helpers"],"falsifier":"Find any valid scheme for $N_r \\leq T$ satisfying both the correctness constraint and the two security constraints, or for $N_r > T$ a scheme with either $R_X < 1/(N_r-T)$ or $R_Y < 1/(N_r-T)$; either would contradict Theorem 1. A simpler check is to simulate the proposed scheme for small parameters and test whether a coalition of $T$ helpers can recover any gradient information, which would expose a flaw in the masking argument.","tokens_in":19601,"feed_emoji":"🔒","tokens_out":8517,"duration_ms":73250,"temperature":0.7,"pith_summary":"The paper asks how much communication is required to securely sum $K$ private gradients in a user-helper-master hierarchy where some links straggle and up to $T$ helpers may collude. It proves that when the resilience threshold $N_r$ exceeds $T$, both the user-to-helper and helper-to-master rates have the same optimal value, $1/(N_r-T)$ gradient symbols per transmitted symbol; when $N_r \\leq T$, no scheme exists at all. This matters because it gives a precise information-theoretic capacity statement for a privacy-preserving federated-learning architecture, showing that the price of security is set by the difference between surviving links and colluding helpers, not by the number of users.","feed_headline":"Rate 1/(Nr−T) is optimal for hierarchical secure aggregation","feed_subtitle":"When surviving links outnumber colluding helpers, both link types must spend 1/(Nr−T) of the gradient size.","key_machinery":"The encoding is carried by two structured matrices. Each user multiplies its $L/(N_r-T)$ gradient parts and $T$ randomness parts by a globally known $N \\times N_r$ Vandermonde matrix $V$, producing one message per helper. Each helper $n$ forms a decoding matrix $S_n = V G_n^{-1}$, where $G_n$ is an $N_r \\times N_r$ Vandermonde matrix built from helper-specific and extra evaluation points; the rows of $S_n$ let a helper reconstruct a missing user message from linear combinations sent by other helpers. Helper-side randomness $Z_n$, generated by a trusted third party, is inserted through an extended Vandermonde matrix with a zero first row, so that the randomness masks inter-helper traffic without changing the aggregate the master decodes. The rate follows because every user and every helper sends exactly $l = L/(N_r-T)$ symbols.","core_discovery":"The central discovery is a complete capacity characterization of the hierarchical secure coded gradient aggregation problem with $K$ users, $N$ helpers, resiliency threshold $N_r$, and at most $T$ colluding helpers. Theorem 1 states that the optimal rate region is empty when $N_r \\leq T$, and is exactly $\\{(R_X,R_Y): R_X \\geq 1/(N_r-T), R_Y \\geq 1/(N_r-T)\\}$ when $N_r > T$. Security is information-theoretic: any set of at most $T$ colluding helpers learns nothing about the gradients beyond what colluding users already know, and the master learns nothing beyond the desired sum and the colluding users' knowledge. The proposed scheme achieves these rates exactly, and the matching converse proves that no lower rates are possible.","pith_inferences":["The same $1/(N_r-T)$ law suggests a general design principle for multi-layer secure aggregation: each layer must spend one symbol per unit of information for every surplus non-colluding path it needs, a pattern that might extend to deeper hierarchies.","The reliance on a trusted third party for helper-side randomness is the main obstacle to direct deployment; investigating whether pairwise masks or public-key setups can replace it while preserving the same rates is a natural next step.","A concrete way to stress-test the result is to simulate the scheme for small parameters and verify empirically that the mutual information between gradients and the view of any $T$ colluding helpers is zero, and that the converse bound is tight."],"forward_implications":["If the paper is right, the per-link privacy overhead in a two-layer secure aggregation network is pinned down: each user must send at least $1/(N_r-T)$ of the gradient size to each helper, and each helper must send the same fraction to the master.","Secure aggregation becomes impossible whenever the adversary can collude with as many helpers as the resilience threshold; no amount of coding or randomness can restore feasibility in this model.","The optimal rates do not grow with the number of users $K$, so the scheme scales gracefully as more users join the hierarchy.","Because the achievability proof does not rely on the uniformity or independence of the gradients, the same rates are achieved for arbitrary gradient distributions, including non-uniform real-world models."],"supporting_citations":[{"why":"Supplies the information-theoretic secure aggregation model with user dropouts and the field-size extension method invoked when $q$ is small.","marker":"[7]"},{"why":"Introduces the hierarchical coded gradient aggregation problem with straggling links that this paper extends with security constraints.","marker":"[26]"},{"why":"Establishes the tradeoff between user-to-helper and helper-to-master communication in hierarchical coded gradient aggregation, the baseline for the two-rate region.","marker":"[28]"},{"why":"Provides layered MDS-code constructions for hierarchical aggregation, a precursor to the extended-Vandermonde helper-sharing step.","marker":"[29]"}],"fun_headline_variants":["Optimal rate 1/(Nr−T) for secure gradient aggregation","Secure aggregation capacity: 1/(Nr−T) per link","When Nr>T, capacity is 1/(Nr−T) per link","Hierarchical secure aggregation hits capacity at 1/(Nr−T)"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The achievability scheme requires a trusted third party to generate and distribute the helper-side randomness $Z_n$; if no such trusted setup exists, the proposed scheme cannot be executed and the claimed optimal rates are not realized.","fun_headline_variants_meta":{"raw":{"variants":["Optimal rate 1/(Nr−T) for secure gradient aggregation","Secure aggregation capacity: 1/(Nr−T) per link","When Nr>T, capacity is 1/(Nr−T) per link","Hierarchical secure aggregation hits capacity at 1/(Nr−T)"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001122,"raw_usage":{"total_tokens":4656,"prompt_tokens":923,"completion_tokens":3733,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":539,"completion_tokens_details":{"reasoning_tokens":3655}},"tokens_in":539,"tokens_out":3733,"duration_ms":24062,"temperature":1.0,"reasoning_tokens":3655,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T14:51:30.086498+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Find any valid scheme for $N_r \\leq T$ satisfying both the correctness constraint and the two security constraints, or for $N_r > T$ a scheme with either $R_X < 1/(N_r-T)$ or $R_Y < 1/(N_r-T)$; either would contradict Theorem 1. A simpler check is to simulate the proposed scheme for small parameters and test whether a coalition of $T$ helpers can recover any gradient information, which would expose a flaw in the masking argument.","supporting_citations":[{"cited_title":"Hier- archical coded gradient aggregation for learning at the edge,","cited_arxiv_id":null,"evidence_quote":"Introduces the hierarchical coded gradient aggregation problem with straggling links that this paper extends with security constraints."},{"cited_title":"Coded gradient aggregation: A tradeoff between communication costs at edge nodes and at helper nodes,","cited_arxiv_id":null,"evidence_quote":"Establishes the tradeoff between user-to-helper and helper-to-master communication in hierarchical coded gradient aggregation, the baseline for the two-rate region."},{"cited_title":"Hierarchical coded gradient aggregation based on layered mds codes,","cited_arxiv_id":null,"evidence_quote":"Provides layered MDS-code constructions for hierarchical aggregation, a precursor to the extended-Vandermonde helper-sharing step."}],"review_version":1}