{"id":"3a7d4673-9c67-47cb-9111-85581633e446","arxiv_id":"2412.17110","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A privacy-aware DeepJSCC scheme with adversarial training reduces leakage of private image attributes to colluding or independent eavesdroppers while preserving high reconstruction quality.","lead":"This paper trains a neural network that sends images to a legitimate receiver over noisy wireless channels while using adversarial training to stop multiple eavesdroppers from guessing private image attributes. It reports better image quality and lower attribute leakage than earlier DeepJSCC baselines on CIFAR-10, CelebA and Kodak.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Reported privacy leakage is measured by the very adversary class used in training; Eq. (13) is a lower bound on true mutual information, so stronger eavesdroppers could leak more than the paper claims.","rationale":"The reader's weakest assumption correctly identifies the core risk: privacy is quantified with the same adversarial network family used in training, so the reported mutual information is a lower bound on true leakage. This is the most load-bearing concern because the paper's headline contribution is a privacy-utility trade-off, and all privacy claims are mediated by Eq. (13). The concern is not a fundamental refutation: the paper explicitly claims protection against adversarially-trained eavesdroppers, and the proposed framework may still be useful. But without an independent leakage estimate, the numerical privacy gains cannot be certified. The Eq. (8) issue reinforces the need for code and an exact loss specification. The reader already reached CONDITIONAL with moderate confidence; this stress-test supports that verdict rather than moving it. Credit is due for the breadth of experiments, multiple channel models, benchmarks, and ablations, but no code or trained checkpoints are released, which is exactly what would make the proposed concrete test feasible.","tokens_in":20682,"tokens_out":5039,"duration_ms":51069,"concrete_test":"Using the released CIFAR-10 checkpoints (or retraining with the same hyperparameters), freeze Alice's encoder and compute an independent leakage estimate from held-out z_i: (i) train a ResNet-18 classifier on z_i -> S from scratch; (ii) train a decoder z_i -> image and classify that reconstruction; (iii) estimate I(S;Z) with a non-parametric estimator (e.g., KSG) on the same features. Compare the resulting adversarial accuracy and MI against Fig. 6(a) and Eq. (13). If the independent classifier accuracy exceeds the reported adversarial accuracy by more than a few points, or the MI estimate is materially higher, the claimed privacy improvement is an artifact of adversary capacity. Separately, re-derive Eq. (8) as H(bar_p_L, q), retrain, and check whether the reported losses and metrics change materially.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that the scheme 'restrains' eavesdroppers, and the numerical privacy gains in Fig. 6(a), rest on Eq. (13), which approximates I(S_i; Z_i^k) as H(S_i) - H(q_{Theta_E,i}, epsilon_{s_i}), where q is the same adversarial classifier family optimized in Eq. (9). From the variational identity in Eq. (2), I(S;Z) = H(S) + max_q E[log q]; a particular trained q gives only a lower bound on leakage. Thus the reported values are an upper bound on privacy, not a certificate: a richer adversary (deeper network, joint modeling across colluding Eves, or reconstruct-then-classify) can achieve strictly higher accuracy and higher I than reported. The paper partially acknowledges this by limiting claims to 'adversarially-trained' eavesdroppers and listing advanced strategies as future work, but the headline comparison of mutual information leakage vs. benchmarks treats Eq. (13) as the privacy metric, making the evaluation dependent on the fixed adversary capacity. A secondary but related issue: Eq. (8) is written as H(q_{Theta_E,i}, bar_p_L), which under the paper's own convention H(p,q) = -E_p[log q] is the constant log L; the intended objective must be H(bar_p_L, q) (or an equivalent formulation). This does not invalidate the method, but the printed loss cannot be implemented as stated.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a privacy-aware DeepJSCC scheme for image transmission from a legitimate transmitter-receiver pair to Bob in the presence of multiple eavesdroppers. The authors formulate a multi-objective optimization that trades reconstruction distortion against mutual-information leakage to the eavesdroppers, then implement the encoder, decoder, and adversarial classifiers with DNNs and train them in an alternating minimax fashion. Experiments on CIFAR-10, CelebA, and Kodak compare the scheme with prior DeepJSCC and secure-communication baselines, reporting SSIM, adversarial accuracy, and a mutual-information leakage metric under AWGN, Rayleigh, and Nakagami-m channels.","tokens_in":20973,"tokens_out":6597,"duration_ms":64694,"significance":"If the training objective were implemented as intended, the paper would offer a practical, data-driven privacy-utility trade-off for DeepJSCC with multiple colluding or non-colluding eavesdroppers, without assuming known source statistics. The experimental coverage is broad: multiple datasets, multiple eavesdroppers, common and distinct secrets, several channel models, and ablation studies on the loss hyperparameters. The architectural modifications (GDN/IGDN layers, SSIM in the distortion) appear sensible and the generalization test to Kodak is a useful addition. However, the central training and evaluation equations contain a systematic cross-entropy order error that makes the printed objectives non-implementable, and the reported privacy metric is a variational lower bound rather than a certificate of privacy. These issues are load-bearing for the main claims.","major_comments":[{"comment":"Under the paper's own convention H(p,q) = -E_p[log q], the ALC term H(q_{Theta_E,i}(s|z), \\bar p_L) equals log L, because \\bar p_L is the uniform distribution. Thus the adversarial likelihood compensation term in Eq. (8) is a constant, independent of all trainable parameters, and training with this loss reduces to distortion-only training. Since ALC is described as the mechanism that confuses the eavesdroppers, this is a load-bearing error. The intended objective appears to be H(\\bar p_L, q_{Theta_E,i}) (or equivalently KL(q||uniform)), and the equation and all experiments depending on it need to be corrected or re-run.","section":"Section III-C, Eq. (8)"},{"comment":"The adversary loss in Eq. (9) and the mutual-information estimator in Eq. (13) use H(q_{Theta_E,i}, epsilon_{s_i}). With epsilon_{s_i} as a one-hot vector and the paper's definition H(p,q) = -E_p[log q], this quantity is infinite whenever q places any probability on a class other than the true label, so it cannot be the implemented cross-entropy loss. The standard classification cross-entropy is H(epsilon_{s_i}, q_{Theta_E,i}) = -log q_{Theta_E,i}(s_i|z_i). As printed, both the adversary update and the leakage evaluation are not implementable; the arguments of H must be reversed throughout.","section":"Section III-B, Eq. (9) and Section IV, Eq. (13)"},{"comment":"Even after correcting the cross-entropy order, the quantity H(S_i) - H(epsilon_{s_i}, q_{Theta_E,i}) is a variational lower bound on I(S_i; Z_i^k), not an equality, unless q_{Theta_E,i} equals the true posterior p_{S_i|Z_i^k}. Because the classifier used for evaluation is trained within the same adversary family used in the minimax game, the reported 'information leakage' is an upper bound on privacy, not a lower bound: a richer adversary (deeper network, joint processing across colluding Eves, or reconstruct-then-classify) could obtain strictly higher leakage. The paper should either report an independent MI estimator or state explicitly that the metric is a variational lower bound for the trained adversary class and evaluate against a held-out stronger adversary to support the claim that eavesdroppers are 'restrained'.","section":"Section IV, Eq. (13)"}],"minor_comments":[{"comment":"The minimax formulation in Eq. (6) is written as 'minimize L(Omega_A, Omega_B, Theta_E,1, ...)' even though the adversary parameters are maximized inside the loss; it should be written as min over (Omega_A, Omega_B) and max over Theta_E,i to match the described alternating game.","section":"Section III-B, Eq. (6)"},{"comment":"Remark 5 states that higher values of w favor utility and lower values prioritize privacy, but the surrounding text and Fig. 8 show the opposite: larger w gives lower leakage and lower utility. This should be corrected.","section":"Section IV-B, Remark 5"},{"comment":"The colluding ensemble combination is first written with coefficients phi_i, but the text then says 'omega_i's are learned'; please unify the notation.","section":"Section IV-A, colluding setup description"},{"comment":"The comparison against reference [15] uses DeepJSCC-f, which has a feedback link; the paper should clarify whether the benchmark uses feedback, since otherwise the comparison is not apples-to-apples for a one-shot transmission system.","section":"Section IV-A, Fig. 6"},{"comment":"There is a typo: 'Depp-JSCC' should be 'DeepJSCC'.","section":"Section II-A"}],"recommendation":"major_revision","confidential_remarks":"The intended method is plausible and the experimental apparatus is substantial, but the printed equations for the central training objective and the privacy metric are not implementable as stated, and the reported MI is only a variational lower bound. These are fixable in principle, but the authors need to correct the cross-entropy order, re-run or confirm the experiments with the corrected loss, and reframe the leakage claims. The paper is within scope for this journal once these issues are addressed."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is a solid empirical extension of the single-Eve privacy-aware DeepJSCC line to a more realistic multiple-Eve setting. The new bits are genuine: colluding and non-colluding Eves, per-Eve private attributes, Rayleigh/Nakagami/AWGN channels, and an SSIM-based distortion term. The experimental package is the main asset—CIFAR-10, CelebA, Kodak generalization, ablations over the privacy weight and SSIM weight, and a clear minimax training procedure. The authors are also honest about their assumptions (known sensitive attributes and Eve channel models) and about the limits of their evaluation. This is a legitimate step beyond [16] and [17], not a rehash.\n\nThe soft spots are real but addressable. First, Eq. (8) as written is constant: under the paper's own convention H(p,q)=-E_p[log q], the term H(q, bar_p_L) equals log L. The intended objective is clearly H(bar_p_L, q), which pushes the adversary's output toward uniform. Second, the reported mutual information leakage in Eq. (13) is computed with the same class of adversarial DNN used in training. That gives a lower bound on true leakage, not a certificate. A stronger Eve—deeper network, joint processing across colluding Eves, or reconstruct-then-classify—could do strictly better than the numbers in Fig. 6(a). The paper hedges by saying \"adversarially-trained eavesdroppers\" in places, but the abstract and figures invite a stronger reading. For a journal version, I'd want an independent leakage estimator or at least a stronger-adversary ablation, not just the training adversary's cross-entropy. Third, no code or data are released, so the 20%/10% improvements over benchmarks can't be checked; that's not fatal, but it matters for a paper whose claims are empirical.\n\nWho is this for? Researchers working on secure or private semantic communications, or on DeepJSCC variants. They'll find the multi-Eve setup and fading-channel generalization useful. The paper deserves a serious referee: the idea is plausible, the experiments are suggestive, and the flaws are fixable. My recommendation: send it to review with a request to fix Eq. (8), clarify the ordering in Eq. (13), add an independent leakage evaluation against a stronger adversary, and consider releasing code. With those changes, it would be a solid contribution.","headline":"A useful, well-executed empirical extension of single-Eve privacy-aware DeepJSCC to multiple colluding/non-colluding eavesdroppers and fading channels, but the reported privacy numbers are lower bounds measured by the adversary family it was trained against, and Eq. (8) has a notation typo that makes the printed loss constant.","tokens_in":21526,"tokens_out":2215,"would_cite":true,"duration_ms":22778,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["94A15","94A29"],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper proposes a privacy-aware DeepJSCC system in which a single training loss combining MSE, SSIM, and an adversarial cross-entropy term keeps image reconstruction faithful while preventing multiple eavesdroppers from inferring…","keywords":["DeepJSCC","joint source-channel coding","privacy funnel","wiretap channel","adversarial neural networks","information leakage","structural similarity index","privacy-utility trade-off"],"falsifier":"Train the proposed encoder on CIFAR-10 or CelebA, then evaluate an eavesdropper that is not limited to the paper's DNN architecture, for example a much larger transformer-based classifier or one that first reconstructs the image and then classifies the private attribute, and compare its accuracy and mutual-information estimate at the same wiretap SNR. If the stronger eavesdropper's accuracy rises substantially above the reported adversarial accuracy, the claimed privacy level would not hold for arbitrary adversaries.","tokens_in":20519,"feed_emoji":"🔐","tokens_out":8672,"duration_ms":69625,"temperature":0.7,"pith_summary":"The paper tries to establish that a data-driven joint source-channel coding system can keep image reconstruction accurate for a legitimate receiver while denying multiple eavesdroppers access to designated private attributes, without assuming known or i.i.d. source statistics. It generalizes the privacy-funnel and wiretap-coding ideas into a multi-objective loss trained as a minimax game: Alice and Bob minimize distortion plus the eavesdroppers' ability to classify the secret, while each eavesdropper tries to maximize that ability. Experiments on CIFAR-10 and CelebA report that the scheme restrains adversarially trained eavesdroppers for both colluding and non-colluding settings and for common or distinct secrets, with better SSIM and lower mutual-information leakage than earlier DeepJSCC baselines. If correct, this makes privacy-aware wireless image transmission practical in non-asymptotic, unknown-statistics settings where classical information-theoretic guarantees do not apply.","feed_headline":"Trained codec hides image secrets from multiple eavesdroppers","feed_subtitle":"The same DeepJSCC backbone suppresses attribute leakage without knowing source or channel statistics.","key_machinery":"The load-bearing mechanism is the adversarial likelihood compensation (ALC) training objective, Eq. (8): $$L_{AB}^{\\text{ALC}} = \\frac{1}{N_T}\\sum_{j=1}^{N_T}\\left(d(u_j,\\hat{u}_j) + \\frac{1}{M}\\sum_{i=1}^{M} w_i H\\left(q_{\\Theta_{E,i}}($s_i^{{(j)}}$|$z_i^{{(j)}}$), \\bar{p}_L\\right)\\right),$$ with distortion $d(u,\\hat{u}) = \\Delta_{\\text{MSE}} + \\alpha\\Delta_{\\text{SSIM}}$. The cross-entropy term is the variational surrogate for the mutual-information leakage $I(S_i;Z_i^k)$ used in the paper's objective, and ALC replaces the one-hot target with the uniform distribution so that training pushes each eavesdropper's softmax output toward equiprobable guesses. This single formula, trained in alternation with the adversarial classifiers, is what carries the privacy-utility trade-off.","core_discovery":"The central discovery is that privacy can be engineered into a DeepJSCC pipeline entirely through the loss function. The legitimate encoder-decoder is trained to minimize a distortion term $\\Delta_{\\text{MSE}} + \\alpha\\Delta_{\\text{SSIM}}$ plus a weighted adversarial cross-entropy term; rather than encouraging the eavesdropper's predicted posterior to match the true one-hot label, adversarial likelihood compensation drives it toward the uniform distribution $\\bar{p}_L$, maximizing the adversary's uncertainty. The eavesdroppers are trained in alternation to minimize cross-entropy to the true secret, forming a GAN-like minimax game. The paper reports that this restrains adversarial accuracy, lowers the mutual-information leakage estimate, and still yields high SSIM at the legitimate receiver, with the privacy-utility trade-off tunable through the weight $w$.","pith_inferences":["A consequence the paper leaves implicit is that the reported leakage numbers are tied to the specific adversarial DNN family used in training; a stronger eavesdropper that first reconstructs the image and then classifies the private attribute could extract more information than the reported mutual-information estimates suggest.","The uniform-posterior push of ALC is a general privacy mechanism, so one could test whether the same loss transfers to other sensitive attributes, such as identity, location, or medical markers, and to other modalities such as video or audio.","Because the minimax game is played under complete information about each side's strategy, an asymmetric-information adversary using reinforcement learning or meta-learning could behave differently; the paper itself lists this as a future direction, and a natural test would be to measure leakage against such an adversary."],"forward_implications":["If the central claim holds, the same DeepJSCC backbone can be made privacy-aware for multiple eavesdroppers simply by changing the training loss, without adding encryption, steganography, or extra processing modules.","The scheme generalizes across channel models: trained on Rayleigh fading, it retains similar performance on AWGN and Nakagami-$m$ links, so the privacy guarantee does not require exact knowledge of the channel statistics.","The privacy-utility trade-off is controllable through the scalar weight $w$, letting a network designer choose an operating point on the SSIM-versus-leakage curve.","Colluding eavesdroppers that combine their individual logits gain some accuracy, but the reported gain saturates as the wiretap SNR grows, suggesting a structural limit on what the adversaries can extract.","With $w=0$, the same architecture approaches lossless reconstruction, which isolates the reported cost of privacy to roughly a 15% SSIM reduction in the tested settings."],"supporting_citations":[{"why":"supplies the adversarial-network secure DeepJSCC baseline and the adversarial likelihood compensation idea that this paper extends to multiple eavesdroppers.","marker":"[16]"},{"why":"provides the generative privacy-aware wiretap formulation and variational leakage approximation that the multi-eavesdropper framework builds on.","marker":"[17]"},{"why":"establishes the DeepJSCC paradigm and the bandwidth-compression setup for wireless image transmission.","marker":"[14]"},{"why":"provides a main benchmark architecture and training framework that the proposed scheme compares against.","marker":"[15]"},{"why":"introduces the privacy funnel optimization problem that the paper generalizes to multi-eavesdropper image transmission.","marker":"[29]"},{"why":"supplies the GDN/IGDN normalization blocks used in Alice's and Bob's neural architectures.","marker":"[27]"},{"why":"gives the asymptotic wiretap privacy-utility trade-off that motivates the non-asymptotic data-driven relaxation.","marker":"[28]"},{"why":"supports interpreting the variational lower bound on leakage as sample-wise cross-entropy in adversarial training.","marker":"[32]"}],"fun_headline_variants":["Privacy-aware DeepJSCC: one loss blinds multiple eavesdroppers","Adversarial loss tricks multiple eavesdroppers into seeing nothing","DeepJSCC privacy via loss: quality stays, secrets stay hidden","No stats? No problem: adversarial loss hides image attributes","Colluding eavesdroppers fail against privacy-tuned DeepJSCC"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the eavesdropper's trained classifier is a faithful stand-in for any possible eavesdropper, and that Alice knows which attributes each adversary wants and what channels they see; a stronger or different eavesdropper could extract more than the reported numbers.","fun_headline_variants_meta":{"raw":{"variants":["Privacy-aware DeepJSCC: one loss blinds multiple eavesdroppers","Adversarial loss tricks multiple eavesdroppers into seeing nothing","DeepJSCC privacy via loss: quality stays, secrets stay hidden","No stats? No problem: adversarial loss hides image attributes","Colluding eavesdroppers fail against privacy-tuned DeepJSCC"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001049,"raw_usage":{"total_tokens":4410,"prompt_tokens":953,"completion_tokens":3457,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":569,"completion_tokens_details":{"reasoning_tokens":3369}},"tokens_in":569,"tokens_out":3457,"duration_ms":24823,"temperature":1.0,"reasoning_tokens":3369,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T05:47:50.181420+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train the proposed encoder on CIFAR-10 or CelebA, then evaluate an eavesdropper that is not limited to the paper's DNN architecture, for example a much larger transformer-based classifier or one that first reconstructs the image and then classifies the private attribute, and compare its accuracy and mutual-information estimate at the same wiretap SNR. If the stronger eavesdropper's accuracy rises substantially above the reported adversarial accuracy, the claimed privacy level would not hold for arbitrary adversaries.","supporting_citations":[{"cited_title":"Adversarial networks for secure wireless communications,","cited_arxiv_id":null,"evidence_quote":"supplies the adversarial-network secure DeepJSCC baseline and the adversarial likelihood compensation idea that this paper extends to multiple eavesdroppers."},{"cited_title":"Privacy-aware communica- tion over a wiretap channel with generative networks,","cited_arxiv_id":null,"evidence_quote":"provides the generative privacy-aware wiretap formulation and variational leakage approximation that the multi-eavesdropper framework builds on."},{"cited_title":"Deep joint source- channel coding for wireless image transmission,","cited_arxiv_id":null,"evidence_quote":"establishes the DeepJSCC paradigm and the bandwidth-compression setup for wireless image transmission."},{"cited_title":"DeepJSCC-f: Deep joint source-channel coding of images with feedback,","cited_arxiv_id":null,"evidence_quote":"provides a main benchmark architecture and training framework that the proposed scheme compares against."},{"cited_title":"From the information bottleneck to the privacy funnel,","cited_arxiv_id":null,"evidence_quote":"introduces the privacy funnel optimization problem that the paper generalizes to multi-eavesdropper image transmission."},{"cited_title":"Density modeling of images using a generalized normalization transformation,","cited_arxiv_id":null,"evidence_quote":"supplies the GDN/IGDN normalization blocks used in Alice's and Bob's neural architectures."},{"cited_title":"On joint coding for watermarking and encryption,","cited_arxiv_id":null,"evidence_quote":"gives the asymptotic wiretap privacy-utility trade-off that motivates the non-asymptotic data-driven relaxation."},{"cited_title":"Privacy-preserving adversarial networks","cited_arxiv_id":null,"evidence_quote":"supports interpreting the variational lower bound on leakage as sample-wise cross-entropy in adversarial training."}],"review_version":1}