{"id":"9b8291bd-91be-47f0-aadb-81d506c6c098","arxiv_id":"2412.16251","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":5,"one_line_summary":"Know2Vec is a black-box model retrieval proxy that encodes models via decision-boundary probes and aligns query tasks to model vectors, reporting improved retrieval accuracy.","lead":"Know2Vec turns neural network models into vectors by probing them with outside images, then matches a user's query task to the most suitable model without seeing model internals. The paper reports better retrieval accuracy than existing methods on image classification model zoos, but its theoretical justification for using arbitrary probe data is flawed.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Lemma 1's proof does not establish that arbitrary probe datasets recover the KRM; the Mean Value Theorem step only provides derivative identities, not the offset relation in Eq. (12).","rationale":"The reader's weakest_assumption focuses on Lemma 1's invalid derivation, specifically that Eq. (12) does not follow from the Mean Value Theorem and that arbitrary probes may not lie near training centroids. My stress-test concurs: the proof's assumption that probe samples exist with decision values arbitrarily close to 1 and −1 is not guaranteed, and even if such samples exist, the MVT step yields no quantitative bound connecting input-space offsets to output-space differences. The theoretical guarantee is what distinguishes Know2Vec from purely empirical retrieval heuristics; without it, the method's claim to 'prove in theory that it is feasible to obtain model information with randomly selected probes' (Key Contributions) collapses. The experimental results could still be valuable as an empirical finding, but the paper frames the theoretical proof as a key contribution, and the proof is not salvageable by minor editing. The appendix's Assumption 1 only strengthens the differentiability conditions; it does not address the missing correspondence between probe and training samples. Therefore the rejection is appropriate, though a corrected proof (e.g., bounding the reconstruction error under Lipschitz continuity and covering assumptions) would make a resubmission viable.","tokens_in":17543,"tokens_out":965,"duration_ms":10737,"concrete_test":"Construct a simple binary classifier (e.g., a linear or ReLU network) with known training centroids xa, xb and known boundary sample xb_a. Sample an external probe dataset that does not contain points near xa, xb, or xb_a (e.g., drawn from a shifted distribution far from the training distribution). Compute b_a_hat = zb_a − za + σ + σa using the recipe of Eq. (12), where σ and σa are computed by numerically inverting the model's decision function along the path from probe to training points. Measure the relative error ||b_a_hat − (xb_a − xa)|| / ||xb_a − xa||. If the error is large (e.g., >50%) for a well-conditioned model, Lemma 1 fails to establish probe-based KRM recovery; this directly tests the theorem's central assertion.","verdict_should_be":"REJECT","load_bearing_attack":"The central theoretical claim is Lemma 1: perturbation vectors in KRM can be obtained from external probe datasets. The proof (Proof 1, Eqs. (5)–(12)) assumes that for the target model there exist probe samples za, zb whose decision values are δ(w*za+b)=1−λ1 and δ(w*zb+b)=−1+λ2 with negligible λ1,λ2, and a probe boundary sample zb_a with value −λ3. This is an existential assumption about the probe dataset: it must contain samples arbitrarily close to the training centroids and to the decision boundary. The proof then invokes the Mean Value Theorem to assert that zb_a = xb_a + σ and xa = za + σa, and concludes rb_a = zb_a − za + σ + σa. But the Mean Value Theorem only guarantees existence of a point where the derivative equals a difference quotient; it does not relate σ to the outputs or guarantee that the offset between probe and training samples preserves the KRM vector. Even if σ and σa are 'small' in output space, they are not shown to be small in input space; a model with steep decision boundaries can have tiny output changes over large input displacements, so the reconstructed rb_a can be arbitrarily far from the true perturbation vector. The appendix (Assumption 1, Lemma 2) restricts to a differentiable approximation, but the same gap remains: approximating δ locally does not make external probe samples coincide with training centroids. Without this lemma, the method's premise that training datasets can be replaced by arbitrary probe datasets is unproven, and the entire black-box vectorization relies on an empirical correlation that the paper does not isolate. This is the load-bearing weakness: the theoretical foundation for probe-based KRM is invalid as stated, so the claimed proof of feasibility for black-box model knowledge extraction does not hold.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Know2Vec, a black-box proxy for neural network retrieval. It first constructs a Knowledge Representation Matrix (KRM) for each candidate model from decision-boundary perturbation vectors, using external probe datasets rather than the model's training data. These KRMs are encoded as graphs and embedded via a bidirectional LSTM architecture; query tasks are embedded by averaging per-class features and feeding them through another LSTM. A learned alignment space, trained with a cross-entropy consistency loss and a cosine-margin spatial alignment loss, matches query vectors to model vectors at inference. Experiments on NNR and SF-MTE benchmarks report superior retrieval accuracy and transferability correlation over several baselines, together with ablations on architecture choices, loss functions, and probe datasets. The central theoretical claim is Lemma 1, which purports to prove that perturbation vectors in the KRM can be obtained from external datasets.","tokens_in":17871,"tokens_out":5846,"duration_ms":51065,"significance":"If the claims were established, Know2Vec would be a practically useful, privacy-preserving model retrieval method: it requires only black-box access to models, avoids training-data disclosure, and reports strong results across diverse tasks. The paper contains a substantial experimental effort, comparisons with many baselines, visualizations, and an available code repository. However, the theoretical foundation is not sound as written: the proof of Lemma 1 contains an algebraic inconsistency and uses the Mean Value Theorem in a way that does not establish the required input-space relation. The empirical results are also reported without error bars or significance tests, so the claimed advantages are not yet fully supported. Given that the proof of probe-based KRM replacement is a load-bearing contribution, the manuscript is not ready for publication in its current form, although the empirical approach may be salvageable after substantial revision.","major_comments":[{"comment":"The proof of Lemma 1 does not establish that perturbation vectors can be recovered from external probe samples. The Mean Value Theorem only guarantees the existence of a point where the derivative equals a difference quotient; it does not imply that the input offset σ = z_b^a - x_b^a is small, nor does it relate σ to the output differences λ1, λ2, λ3. Moreover, Eq. (12) is algebraically inconsistent with the preceding definitions: from z_b^a = x_b^a + σ and x_a = z_a + σ_a, the identity is r_b^a = z_b^a - z_a - σ - σ_a, not z_b^a - z_a + σ + σ_a. For a network with steep or curved decision boundaries, small output differences can correspond to arbitrarily large input displacements, so the reconstructed r_b^a is not shown to approximate the true KRM vector.","section":"Lemma 1, Proof 1, Eq. (12)"},{"comment":"The proof assumes the existence of selected probe samples z_a and z_b with δ(w·z_a+b)=1-λ1 and δ(w·z_b+b)=-1+λ2 for arbitrarily small λ1, λ2, and a boundary probe z_b^a with value -λ3. This is an existential condition on the probe dataset: the probes must contain samples arbitrarily close in output space to the training centroids and to the decision boundary. The paper does not show that randomly selected probes satisfy this condition, and in the NNR experiments the probes are drawn from the Know2Vec training set rather than from the target model's training set. Without this assumption, the reconstructed KRM is not guaranteed to represent the model's knowledge, so the central claim that 'it is feasible to obtain model information with randomly selected probes' (Key Contributions) is unsupported.","section":"Lemma 1, Proof 1; 'Using probe datasets instead of training datasets'"},{"comment":"All experimental results are reported as single-point estimates without error bars, confidence intervals, or significance tests. The claimed 1.72% improvement over the suboptimal baseline in Table 1 and the correlation differences in Table 2 may be within the noise of a single run, especially given the lack of repeated training runs with different random seeds and the small number of SF-MTE downstream tasks (four datasets). The paper should report means and standard deviations over multiple seeds, and ideally a paired significance test across tasks, before the superiority claims can be accepted.","section":"Experiments, Tables 1-4"}],"minor_comments":[{"comment":"The exact algorithm for generating boundary samples from probe datasets is deferred to reference (Tian et al. 2023) without being reproduced; since boundary sample generation is central to KRM construction, the paper should specify the procedure or include the relevant code excerpt.","section":"Appendix, 'Implementation of External Probe Datasets'"},{"comment":"The ablation results are presented without variance information, so it is unclear whether differences such as 94.82% versus 93.53% are statistically meaningful.","section":"Ablation Study, Tables 3 and 4"},{"comment":"The margin value of 0.4 and the balancing coefficient α=1 are fixed without sensitivity analysis; a brief study of these hyperparameters would strengthen the alignment-loss discussion.","section":"Eq. (15) and Eq. (16)"},{"comment":"The appendix acknowledges that ReLU is not differentiable at zero, but the proof of Lemma 2 still relies on differentiability of δ without explaining how the non-differentiable points are handled for actual networks; this should be clarified.","section":"Appendix, 'Assumption 1'"},{"comment":"The reference to 'Mobile-Net(?)' contains an unresolved citation placeholder and should be corrected.","section":"Appendix, 'Implementation Details of the Kaggle Model Zoo'"},{"comment":"The notation [s_i * I(l_i = k)] mixes sample and indicator notation; the intended element-wise multiplication should be defined explicitly.","section":"Problem Formulation, Eq. (13)"}],"recommendation":"reject","confidential_remarks":"The empirical direction is interesting and the paper contains a large amount of experimental work, but the proof of Lemma 1 is not merely incomplete—the stated identity is algebraically wrong and the Mean Value Theorem argument does not provide the needed input-space guarantee. This is the theoretical basis for the central claim that arbitrary probe datasets can replace training data, so the current submission cannot be recommended. A resubmission that removes or substantially weakens this theoretical claim, adds rigorous statistical evaluation, and fully specifies probe and boundary-sample construction might be viable. The paper may also benefit from more careful positioning relative to Tian et al. (2023), whose theorem is imported without checking that its conditions hold for the external-probe setting."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Know2Vec is an empirically strong black-box model retrieval pipeline whose headline theoretical claim does not survive contact with the algebra. The engineering is the real contribution: they take Tian et al.'s knowledge representation matrix, build a graph from centroids and boundary samples, encode it with inner-outer LSTMs, and align query and model vectors with a margin-based cosine loss. That combination is new, and it shows. On the NNR benchmark they beat TANS and every static/dynamic SF-MTE baseline on R@1, and on SF-MTE their Pearson/Spearman correlations are consistently the best. The ablations (architecture, loss, probe source) are decent, and the Ptrain result—95.25% with real training data vs 94.82% with external probes—actually supports their practical claim that alternative datasets are nearly as good.\n\nThe soft spot is exactly the reader's stress test. Lemma 1's proof is invalid. The Mean Value Theorem only gives a derivative identity; it does not establish the offset relation between probe samples and training centroids. And Eq. (12) is algebraically inconsistent with the proof's definitions: with σ = z_ba − x_ba and σa = x_a − z_a, the right-hand side is not x_ba − x_a. The existence assumption—that arbitrary probe datasets contain samples arbitrarily close to the training centroids and the boundary—is asserted, not proved. So the claim 'prove in theory that it is feasible to obtain model information with randomly selected probes' is not supported. That is a load-bearing weakness because the paper explicitly sells the proof as a key contribution. It is not fatal to the empirical method; the retrieval results stand on their own, but the theoretical framing needs to be corrected or downgraded to a conjecture.\n\nOther concerns are proportionally minor. No error bars, no multiple seeds, and some setup details are under-specified (boundary sample generation, exact probe composition, truncated model list). The circularity concern from the reader is largely a non-issue: training the alignment space with a retrieval objective and evaluating on held-out tasks is standard supervised learning, not circularity.\n\nMy recommendation: send it to peer review. The empirical contribution is real and useful for people working on model selection, transferability estimation, and privacy-preserving model services. A serious referee should require the authors to fix Lemma 1 or reframe the paper as an empirical method without the 'proven in theory' claim. With that change, I'd be comfortable seeing it published.","headline":"Know2Vec is an empirically strong black-box model retrieval pipeline whose theoretical justification (Lemma 1) does not hold up; it deserves peer review with a demanded fix.","tokens_in":18415,"tokens_out":5053,"would_cite":false,"duration_ms":42451,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Know2Vec claims a black-box proxy can vectorize neural network knowledge from random probe samples and align it with query tasks, achieving superior retrieval accuracy while preserving model privacy.","keywords":["neural network retrieval","black-box proxy","model vectorization","knowledge consistency","knowledge representation matrix","decision boundary samples","source-free transferability estimation","model zoo"],"falsifier":"Take a simple binary classifier with known centroid samples x_a, x_b and boundary sample x_b^a. Sample a probe dataset from a different distribution (e.g., random noise or another domain), compute the quantities in Eq. (12) using probes that the model does not score near plus or minus one, and check whether the resulting r_b^a matches the true r_b^a within tolerance. If it does not, the reconstruction claimed in Lemma 1 fails. Empirically, retrieving models with probe datasets deliberately drawn far from decision boundaries should collapse the reported 94.82% top-1 accuracy if the claim is false.","tokens_in":17335,"feed_emoji":"🧠","tokens_out":6093,"duration_ms":45426,"temperature":0.7,"pith_summary":"The paper proposes Know2Vec, a black-box proxy for retrieving the most suitable pre-trained neural network for a given query task without access to model parameters or training data. It aims to prove that a model's decision knowledge can be captured through its responses to probe samples, encoded into vectors, and aligned with query-task vectors in a learned embedding space. If true, model-marketplace users could find a good model by submitting only a small labeled dataset, while model owners keep weights and training data private. The paper reports top-1 retrieval accuracy of 94.82%, outperforming statistical, dynamic, and LLM-based baselines, and offers a theoretical lemma (Lemma 1) claiming random probe datasets can substitute for the model's own training centroids.","feed_headline":"Black-box model zoo retrieval hits 94.8% top-1 accuracy","feed_subtitle":"Random probes encode a model's decision knowledge into vectors that align with query tasks for accurate retrieval.","key_machinery":"The load-bearing object is the Knowledge Representation Matrix (KRM), whose rows are perturbation vectors r_b^a = x_b^a - x_a between class centroid x_a and decision-boundary sample x_b^a. Lemma 1 is the mechanism that lets Know2Vec use arbitrary probe datasets instead of training data: it claims probes with decision values near plus or minus one reconstruct the KRM offsets up to small $\\sigma$ terms. The KRM is then organized into a directed graph set G_Phi per class, and an inner-outer bidirectional LSTM encoder converts G_Phi into the model vector h, while a class-mean LSTM converts the query into t. Cosine similarity with a margin of 0.4 in a supervised alignment space finally ranks models.","core_discovery":"Know2Vec treats knowledge as what a model has learned from its training data, and claims this knowledge is encapsulated by the Knowledge Representation Matrix (KRM): for every class pair, the perturbation vector from a class centroid to a decision-boundary sample. Since training centroids are usually unavailable, Lemma 1 asserts that external probe samples close to the centroids' decision values can be used to reconstruct the same perturbation vectors up to small offsets. The KRM is expanded into per-class directed graphs, and an inner-outer bidirectional LSTM encodes these graphs into a model vector h. Query tasks are encoded by averaging class samples and running a bidirectional LSTM over class means, producing vector t. A supervised alignment space, trained with a model-embedding consistency loss and a cosine-margin spatial alignment loss, makes cosine distance between t and h rank the best model; the paper reports superior retrieval accuracy against state-of-the-art baselines on both neural network retrieval and source-free transferability estimation tasks.","pith_inferences":["If the probe-substitution proof is unsound, the method may still work empirically because the supervised alignment loss and the model-index classification loss could be absorbing probe-domain noise; this would make the result a learned heuristic rather than a proven black-box characterization.","A stronger benchmark would swap probe datasets between retrieval and training time and measure robustness; the paper's own ablation of training versus alternative probes hints that probe choice matters less than claimed, but only on a narrow set.","The boundary-sample vectors double as a model signature, so the framework suggests a natural extension to model fingerprinting and intellectual-property protection."],"forward_implications":["Model marketplace users can retrieve a fine-tune-ready model by submitting only a small labeled query task, without uploading full data or requiring white-box model access.","Model owners can keep parameters and training data private while remaining searchable through a probe-based index.","If Lemma 1 holds for arbitrary probes, the proxy generalizes to any model zoo regardless of the models' original training domains.","The same vector space supports both retrieval (top-k accuracy) and transferability ranking (Pearson and Spearman) in one framework.","The learned proxy can be precomputed offline, making online query-time retrieval nearly instant while large-language-model selection remains slow and weak."],"supporting_citations":[{"why":"Supplies Theorem 1, the claim that training knowledge is representable by the knowledge representation matrix of decision-boundary perturbation vectors, which Know2Vec builds on.","marker":"Tian et al. 2023"},{"why":"DNNR, the pioneering neural-network-retrieval method that vectorizes models with litmus images; Know2Vec positions against it and shares the vectorized retrieval goal.","marker":"Zhong, Qian, and Zhang 2021"},{"why":"TANS, the cross-modal alignment baseline and benchmark source; Know2Vec's query-model alignment space is compared with it and its Kaggle hub methodology is reused.","marker":"Jeong et al. 2021"},{"why":"Model Spider, the vectorization-based source-free transferability estimation baseline and the pretrained-model zoo construction used for transferability experiments.","marker":"Zhang et al. 2023"},{"why":"H-Score, a statistical source-free transferability method used as a baseline for retrieval and correlation comparisons.","marker":"Bao et al. 2019"},{"why":"LEEP, a standard transferability measure used as a baseline and as the source of the Pearson and Spearman evaluation protocol.","marker":"Nguyen et al. 2020"}],"fun_headline_variants":["Know2Vec: Find the right neural net by aligning knowledge","Model zoo retrieval via black-box knowledge alignment","Turning model decisions into searchable vectors","Your task, matched to the model that truly knows it"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole scheme rests on Lemma 1's assumption that arbitrary probe datasets contain samples the model scores arbitrarily close to its training-centroid values, so that perturbation vectors computed from probes match those computed from real training centroids.","fun_headline_variants_meta":{"raw":{"variants":["Know2Vec: Find the right neural net by aligning knowledge","Model zoo retrieval via black-box knowledge alignment","Turning model decisions into searchable vectors","Your task, matched to the model that truly knows it"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000728,"raw_usage":{"total_tokens":3286,"prompt_tokens":994,"completion_tokens":2292,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":610,"completion_tokens_details":{"reasoning_tokens":2231}},"tokens_in":610,"tokens_out":2292,"duration_ms":15249,"temperature":1.0,"reasoning_tokens":2231,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T11:21:37.732789+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a simple binary classifier with known centroid samples x_a, x_b and boundary sample x_b^a. Sample a probe dataset from a different distribution (e.g., random noise or another domain), compute the quantities in Eq. (12) using probes that the model does not score near plus or minus one, and check whether the resulting r_b^a matches the true r_b^a within tolerance. If it does not, the reconstruction claimed in Lemma 1 fails. Empirically, retrieving models with probe datasets deliberately drawn far from decision boundaries should collapse the reported 94.82% top-1 accuracy if the claim is false.","supporting_citations":[{"cited_title":"M.; Liu, G.; and Wang, C","cited_arxiv_id":null,"evidence_quote":"Supplies Theorem 1, the claim that training knowledge is representable by the knowledge representation matrix of decision-boundary perturbation vectors, which Know2Vec builds on."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"DNNR, the pioneering neural-network-retrieval method that vectorizes models with litmus images; Know2Vec positions against it and shares the vectorized retrieval goal."},{"cited_title":"Task-Adaptive Neural Network Search with Meta-Contrastive Learning","cited_arxiv_id":"2103.01495","evidence_quote":"TANS, the cross-modal alignment baseline and benchmark source; Know2Vec's query-model alignment space is compared with it and its Kaggle hub methodology is reused."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Model Spider, the vectorization-based source-free transferability estimation baseline and the pretrained-model zoo construction used for transferability experiments."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"H-Score, a statistical source-free transferability method used as a baseline for retrieval and correlation comparisons."},{"cited_title":"V.; Hassner, T.; Seeger, M","cited_arxiv_id":null,"evidence_quote":"LEEP, a standard transferability measure used as a baseline and as the source of the Pearson and Spearman evaluation protocol."}],"review_version":1}