{"id":"5420f94b-925c-422f-b3d3-2727b82cb952","arxiv_id":"2412.17658","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"For a two-encoder blind semantic communication model, the paper shows the best disclosed-data utility lies between H(f(X)|S) - H(S|f(X)) + epsilon and H(f(X)|S) + epsilon, up to task-related correction terms.","lead":"This paper derives upper and lower bounds on the privacy-utility trade-off for a semantic communication setup where two separate encoders handle the source and the private data. The results give a recipe for designing disclosed data that limits leakage of sensitive attributes while preserving task-relevant information.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 1 as stated is false for ε>H(S): L1_h(ε)=H(f)-H(S)+ε can exceed the absolute upper bound H(f) on h_ε, so the missing condition 0≤ε≤H(S) is a load-bearing gap.","rationale":"The paper's central claim is Theorem 1, a two-sided bound on h_ε(P_{S,f(X)}). The upper bound is elementary and valid for all ε. The lower bound is the load-bearing part: it is where the paper invokes [17, Theorem 2], EFRL/ESFRL, and the exact-leakage randomized-response construction. The reader's weakest-assumption flag about exact leakage equality is reasonable, but the more fundamental and self-contained problem is that the theorem states 'for any 0≤ε' while L1_h(ε) is affine in ε with slope 1 and h_ε is absolutely bounded by H(f). For ε>H(S), L1_h exceeds H(f), making the claimed lower bound impossible. This does not depend on any unverified property of [17] or Warner's randomized response; it is a direct contradiction using only I(U;f)≤H(f). It also explains why the numerical experiment nearly reaches H(S) and why the authors apply [·]^+ to L2: without an ε cap, the lower bound would cross an information-theoretic ceiling. The most likely resolution is that the authors intended the standard range 0≤ε≤H(S), in which case the theorem should be restated with that condition and the numerical sweep should stop at H(S). The reader's verdict of CONDITIONAL therefore remains appropriate: the core transfer argument may be salvageable, but the theorem as written is false. Agreement with the reader is partial because both identify the lower-bound derivation from [17] as the fragile point, but the specific failure mode identified here is the missing ε domain, not the exact-leakage equality.","tokens_in":8900,"tokens_out":15318,"duration_ms":143654,"concrete_test":"Use the two-bit counterexample: S uniform binary independent of f(X) uniform binary, ε=2 bits. Since I(U;S)≤H(S)=1≤2, the privacy constraint is vacuous and h_ε=H(f)=1 bit, while L1_h(ε)=2 bits. If the authors instead intend ε∈[0,H(S)], rerun the MNIST experiment with ε capped at H(S)≈0.325 nats and verify that the plotted L1(ε) never exceeds H(f(X)); this will settle whether the theorem statement or only its ε domain needs correction.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The most load-bearing issue is not the transfer of [17, Theorem 2] itself, but the unrestricted domain of ε in Theorem 1. For every U, I(U;f(X)) ≤ H(f(X)), hence h_ε(P_{S,f(X)}) ≤ H(f(X)) for every ε. Yet L1_h(ε)=H(f|S)-H(S|f)+ε = H(f)-H(S)+ε, using the identity H(f|S)-H(S|f)=H(f)-H(S). If ε>H(S), then L1_h(ε)>H(f), so the claimed lower bound max{L1_h,L2_h} ≤ h_ε is impossible. Concretely, let S and f(X) be independent uniform binary random variables with H(S)=H(f)=1 bit, and set ε=2 bits. The constraint I(U;S)≤2 is vacuous because I(U;S)≤H(S)=1≤2; taking U=f(X) gives I(U;f)=H(f)=1 and I(U;S)=0≤2, so h_ε=1 bit. But L1_h=1-1+2=2 bits, contradicting (6). The formulas also define α=ε/H(S), which silently presumes 0≤ε≤H(S) and H(S)>0. This condition is absent from the theorem statement and from the numerical experiment: with S indicating presence of digit 5 in MNIST, H(S)≈0.325 nats while the plot sweeps ε to 0.35 nats. Fixing the theorem to state 0≤ε≤H(S) is necessary; with that restriction the lower bounds may indeed follow from [17], but as written the central claim is false.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies a semantic communication system with two separate encoders: encoder 1 observes the source X and designs a semantic f(X) for a task h(X), without access to private data S; encoder 2 observes S and f(X) and outputs disclosed data U, without access to the task. The privacy-utility trade-off is h_epsilon(P_{S,f(X)}) = sup_{P_{U|S,f(X)}: I(U;S)<=epsilon} I(U;f(X)), and the user utility is I(U;h(X)). The main result, Theorem 1, gives upper and lower bounds on h_epsilon and on I(U;h(X)), with lower bounds obtained from the Extended Functional Representation Lemma and the Extended Strong Functional Representation Lemma imported from the authors' earlier work [17]. The paper also states a corollary involving common information, a corollary giving a task-independent upper bound, and a numerical MNIST experiment comparing the bounds.","tokens_in":9252,"tokens_out":10534,"duration_ms":91246,"significance":"If correct, the results provide computable, parameter-free bounds for a meaningful two-encoder privacy scenario and the underlying mechanisms are constructive. The upper bound H(f(X)|S)+epsilon is simple and the lower bounds are stated in closed form. However, the mathematical novelty beyond the authors' prior work [17] is modest: the main technique is a direct application of previously established lemmas to the pair (S,f(X)). The central theorem as stated is false on part of its claimed domain, and several proof details are not rigorous. The scenario itself is relevant to semantic communication with privacy constraints, and the numerical comparison is useful, so the paper is worth revising.","major_comments":[{"comment":"The statement 'For any 0 <= epsilon' is false for epsilon > H(S). Since I(U;f(X)) <= H(f(X)) for every U, we always have h_epsilon(P_{S,f(X)}) <= H(f(X)). But L1_h(epsilon) = H(f(X)|S) - H(S|f(X)) + epsilon = H(f(X)) - H(S) + epsilon, so for epsilon > H(S) the claimed lower bound exceeds H(f(X)). For example, if S and f(X) are independent uniform binary variables and epsilon = 2 bits, then h_epsilon = H(f(X)) = 1 bit while L1_h(epsilon) = 2 bits, contradicting (6). The theorem must be restricted to 0 <= epsilon <= H(S), with H(S) > 0 so that alpha = epsilon/H(S) is defined. This also affects the numerical experiment in Section IV, where H(S) is approximately 0.325 nats but epsilon is swept to 0.35 nats; the sweep should be limited to the valid range or the statement amended.","section":"Section III, Theorem 1, Eqs. (6)-(8)"},{"comment":"Equation (4) is not consistent: the left-hand side is I(f(X);U), but the right-hand side is the standard expansion for I(h(X);U), with h(X) appearing in all three entropy/conditional terms. The proof then says 'Using (4) we have I(U;f(X)) = ...' and concludes I(U;h(X)) <= epsilon + H(f(X)|S), which does not follow from (4) as written. The upper bound in (6) is correct and can be proved directly from the identity I(U;f(X)) = I(U;S) + H(f(X)|S) - H(f(X)|U,S) - I(U;S|f(X)) <= I(U;S) + H(f(X)|S). Please replace Eq. (4) with the correct identity and rewrite the proof of the upper bounds accordingly.","section":"Section III, Eq. (4) and proof of Theorem 1"},{"comment":"The lower bounds are imported from [17, Theorem 2] through the sentence 'Using the same arguments in [17, Theorem 2]', without stating the hypotheses under which the EFRL/ESFRL constructions achieve leakage exactly epsilon for the pair (S,f(X)). Since L1_h and L2_h are increasing in epsilon, if the imported construction only yields I(U;S) < epsilon, the claimed lower bounds at level epsilon do not automatically follow. The proof should either state the precise lemma from [17] being invoked and verify that its conditions (discrete alphabets, finiteness, range of epsilon, etc.) hold for the pair (S,f(X)), or provide the construction directly. As written, the lower-bound half of Theorem 1 is not self-contained.","section":"Section III, proof of Theorem 1, Eqs. (13)-(15)"},{"comment":"The final inequality in the proof of Corollary 2, H(f(X)|S) + H(h(X)|f(X)) <= H(h(X)) + gamma_2 - gamma_1, is not a consequence of (1) and (2); in general it is false. The claimed bound is nevertheless true vacuously because I(U;h(X)) <= H(h(X)) and gamma_2 >= gamma_1, so the right-hand side of (20) is at least H(h(X)). Please replace the argument with a correct proof or explicitly note that the bound is trivial.","section":"Section III, Corollary 2 proof"}],"minor_comments":[{"comment":"In Eq. (2), h(f(X)) should presumably be H(f(X)) (the entropy of the semantic), since h is used elsewhere for the task function; the current notation conflates entropy with the task function and is confusing.","section":"Section II, Eq. (2)"},{"comment":"In the final substitution step, the text says 'substituting U by U* in (17) we have I(bar{U};h(X)) >= ...', but the left-hand side should be I(U*;h(X)), not I(bar{U};h(X)). Please fix this typo.","section":"Section III, proof of Theorem 1"},{"comment":"The paper states that the MNIST data set has |X| = 6000 images; the MNIST training set contains 60000 images. Please correct this number or clarify the subsample used.","section":"Section IV"},{"comment":"The label 'Lekagae matrix' in the figure should be 'Leakage matrix'.","section":"Fig. 1"},{"comment":"The proof of Corollary 1 is only a reference to [17, Theorem 3 and Proposition 3]; please state the common-information condition explicitly or provide the argument so that the corollary is understandable without consulting the prior paper.","section":"Section III, Corollary 1"}],"recommendation":"major_revision","confidential_remarks":"The paper is built almost entirely on the authors' own prior work [17]; the novel element is the two-blind-encoder formulation, but the technical content is largely a re-statement of bounds from [17] for the pair (S,f(X)). The false epsilon-domain in Theorem 1 is a load-bearing error and must be fixed before publication. If the authors correct the domain restriction and clean up the proof of Eq. (4) and Corollary 2, the remaining contribution may be publishable as an application-oriented information theory paper. I do not see grounds for rejection, but the revision should be checked carefully for similar domain issues in the imported constructions."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the paper extends the FRL/SFRL privacy bounds to a two-encoder blind setup, which is a real and sensible extension. But the main theorem has a genuine hole: it claims lower bounds for all eps ≥ 0, and for eps > H(S) the lower bound L1_h(eps) can exceed H(f(X)), which is an absolute ceiling on h_eps. That kills the theorem as stated.\n\nWhat's new: prior work [17] had an encoder with direct access to all variables and f(X)=X. Here encoder 1 only sees X and chooses a semantic f(X), encoder 2 sees S and f(X) but not the task, and the user's utility is I(h(X);U). That's a more realistic model, and the paper gives clean formulas for upper and lower bounds plus a simple MNIST numerical check. The EFRL/ESFRL approach is appropriate.\n\nSoft spots:\n\n1. The eps domain. The theorem says any 0 ≤ eps, but alpha = eps/H(S) and the randomized-response construction only make sense for 0 ≤ eps ≤ H(S). More concretely, L1_h(eps) = H(f|S) - H(S|f) + eps = H(f) - H(S) + eps. For eps > H(S), this exceeds H(f), yet h_eps ≤ H(f) always because I(U;f) ≤ H(f). Example: S and f independent uniform bits, eps = 2. Then the constraint is vacuous, U=f gives h_eps=1, but L1=2. So the missing condition is load-bearing.\n\n2. Equation (4) writes h(X) in places that should be f(X); the proof later uses the correct identity, so it's likely a typo, but it's confusing.\n\n3. Corollary 2's proof seems to replace H(f(X)) by gamma2 without justification. I don't see how (1)-(2) imply the stated bound unless there's a missing constraint.\n\n4. The lower bound proof imports [17, Theorem 2] wholesale, including the exact I(U;S)=eps claim, without showing the randomized response works for (S, f(X)) in this two-encoder setting. Probably fixable, but the paper is not self-contained.\n\nBottom line: the core idea is good and the paper deserves referee time, but it needs major revision before the claims are rigorous. I'd send it out, but I wouldn't cite it in its current form.","headline":"The blind two-encoder setup is genuinely new, but Theorem 1 is false as stated because it omits the eps ≤ H(S) condition.","tokens_in":9787,"tokens_out":4404,"would_cite":false,"duration_ms":36154,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["94A15","94A17","68P27"],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper's central result is that the privacy-utility trade-off for a task-blind privacy encoder is bracketed by explicit entropy expressions $\\max\\{L^1_h(\\epsilon),L^2_h(\\epsilon)\\} \\le h_\\epsilon(P_{S,f(X)}) \\le H(f(X)|S)+\\epsilon$.","keywords":["private semantic communication","blind encoders","privacy-utility trade-off","Functional Representation Lemma","Strong Functional Representation Lemma","common information","mutual information","randomized response"],"falsifier":"Run the linear-programming computation of $h_\\epsilon(P_{S,f(X)})$ on a small finite joint distribution where $S$ is not a function of $f(X)$ and compare the exact value with $\\max\\{L^1_h(\\epsilon),L^2_h(\\epsilon)\\}$; one instance with exact $h_\\epsilon$ below the max disproves Theorem 1's lower bound. Alternatively, implement the EFRL/ESFRL mechanism for that distribution and measure $I(U;S)$ from samples; if it is not $\\epsilon$ to within simulation error, the inherited construction fails for the present setting.","tokens_in":8701,"feed_emoji":"🔐","tokens_out":9110,"duration_ms":77246,"temperature":0.7,"pith_summary":"This paper studies a statistical privacy layer in semantic communication that is 'blind' in two ways: the first encoder sees the source but not the private data, and the second encoder sees the private data and a semantic summary but not the user's task. The central claim is that the best privacy-utility trade-off $h_\\epsilon(P_{S,f(X)})=\\sup\\{I(f(X);U):I(U;S)\\le\\epsilon\\}$ is bracketed by explicit entropy expressions, $\\max\\{L^1_h(\\epsilon),L^2_h(\\epsilon)\\}\\le h_\\epsilon(P_{S,f(X)})\\le H(f(X)|S)+\\epsilon$, and that the user's utility $I(h(X);U)$ lies in an interval of the same width plus $H(h(X)|f(X))$. The lower bounds come from constructive extended Functional Representation Lemma mechanisms, so they are achievable by a finite alphabet code rather than an abstract limit. A designer who trusts these bounds can certify privacy and utility from entropies alone, without solving the optimization over channels. The paper's numerical MNIST example shows the lower and upper utility bounds can be within about $1.4$ nats when the semantic is tightly coupled to the task.","feed_headline":"Two blind encoders still hit tight privacy-utility bounds","feed_subtitle":"Theorem brackets how much task-relevant data a privacy filter can disclose when it cannot see the task.","key_machinery":"The argument rests on two constructive information-theoretic tools: the Extended Functional Representation Lemma (EFRL) and the Extended Strong Functional Representation Lemma (ESFRL), taken from the paper's earlier work [17]. These lemmas produce a channel output $\\bar U$ (or $\\tilde U$) that keeps $I(\\bar U;f(X))$ large for a prescribed small $I(\\bar U;S)=\\epsilon$, with the randomized-response technique of Warner [34] used to hit the leakage target exactly. The derivation also uses the identity $I(f(X);U)=I(S;U)+H(f(X)|S)-I(U;S|f(X))-H(f(X)|S,U)$, plus the Markov-chain expansions of $I(U;h(X),f(X))$, to convert a bound on semantic privacy into a bound on task utility. Common information, in the sense of Wyner [35], is the sharper condition that makes the upper bound tight without requiring $S$ to be a function of $f(X)$.","core_discovery":"On the paper's own terms, the discovery is that separating the encoder into a privacy-unaware semantic designer and a task-unaware privacy filter does not destroy the information-theoretic control of the trade-off. Theorem 1 states that for any discrete semantic $f(X)$ satisfying constraints (1)–(2), the value of the privacy-utility trade-off obeys the sandwich (6), with $L^1_h(\\epsilon)=H(f(X)|S)-H(S|f(X))+\\epsilon$ and $L^2_h(\\epsilon)=H(f(X)|S)-\\alpha H(S|f(X))+\\epsilon-(1-\\alpha)(\\log(I(S;f(X))+1)+4)$, where $\\alpha=\\epsilon/H(S)$. For the user's utility the theorem gives $\\max\\{L^1(\\epsilon),L^2(\\epsilon),L^3(\\epsilon)\\}\\le I(h(X);U)\\le H(f(X)|S)+\\epsilon+H(h(X)|f(X))$, with $L^1,L^2,L^3$ defined in (10)–(12). The upper bound is attained when the private $S$ is a deterministic function of $f(X)$; Corollary 1 widens this to equality of common information and mutual information between $S$ and $f(X)$, and Corollary 2 removes the dependence on the chosen semantic by bounding $I(U;h(X))\\le\\epsilon+\\gamma_2-\\gamma_1+H(h(X))$. The proof route is the identity chain (4)–(5), the EFRL/ESFRL constructions from [17], and the randomized-response step of [34].","pith_inferences":["A natural next step the paper leaves open is to combine these EFRL/ESFRL bounds with the separation-technique lower bounds of [33]; the resulting lower bracket would likely be tighter but more complex.","The finite-alphabet assumption is likely load-bearing: the exact-leakage equality and the log term are proven for discrete alphabets, so extending to Gaussian or continuous semantic sources would require rechecking (15).","One could stress-test the task-blind assumption by giving encoder 2 a coarse description of the task; the utility bounds should interpolate between the present bounds and the full-access design of [4].","An empirical protocol follows directly: on any labeled dataset, compute the entropies of $(S,f(X),h(X))$, predict the achievable utility interval, train a real privacy mechanism, and see whether the measured $I(h(X);U)$ lands inside the interval; any miss identifies either a suboptimal mechanism or a violated assumption."],"forward_implications":["A designer can certify that no privacy mechanism can disclose more than $H(f(X)|S)+\\epsilon$ nats of the semantic to a user, and that the EFRL/ESFRL constructions disclose at least the computed $L^1_h$ or $L^2_h$ nats.","When $H(S|f(X))=0$ or common information equals mutual information, the trade-off is exactly $H(f(X)|S)+\\epsilon$, so the semantic can be sized precisely from the residual uncertainty about it given the private data.","The user-utility lower bounds $L^1(\\epsilon)$ and $L^2(\\epsilon)$ are computable from entropies alone and are achieved by simple mechanisms, making the result a practical design recipe rather than an existence proof.","The semantic-free bound $I(U;h(X))\\le\\epsilon+\\gamma_2-\\gamma_1+H(h(X))$ lets a designer evaluate the privacy cost of a task before choosing the semantic $f(X)$.","In the MNIST example, the width of the utility interval is $H(h(X)|f(X))+H(f(X)|h(X))\\simeq 1.4$ nats, so for highly correlated semantic/task pairs the bounds are a tight design target."],"supporting_citations":[{"why":"Supplies the Extended FRL/SFRL lemmas, the constants, and the proof template for the lower bounds $L^1_h$ and $L^2_h$.","marker":"[17]"},{"why":"Provides the randomized response construction used to make the disclosed data hit the leakage target $I(U;S)=\\epsilon$ exactly.","marker":"[34]"},{"why":"Defines the common information criterion used in Corollary 1 to extend exactness of the upper bound beyond deterministic-function cases.","marker":"[35]"},{"why":"Defines the perfect-privacy secret-dependent function that this setting generalizes, with bounds later strengthened in [17].","marker":"[16]"},{"why":"Introduces the semantic communication with privacy constraints model that the present paper extends by splitting the encoder into two blind parts.","marker":"[4]"}],"fun_headline_variants":["Separate blind encoders still hit tight bounds","Blind encoder split keeps privacy-utility tight","Two blind encoders, tight privacy-utility bound","Splitting blind encoders preserves trade-off tightness","Blind to task or privacy, bounds stay tight"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the lower-bound construction inherited from [17] achieves leakage exactly $\\epsilon$ for the pair $(S,f(X))$ through the randomized-response step of [34], including the constant term $\\log(I(S;f(X))+1)+4$; if that exact-leakage equality (15) fails, the lower bounds $L^1_h$ and $L^2_h$ do not follow as stated.","fun_headline_variants_meta":{"raw":{"variants":["Separate blind encoders still hit tight bounds","Blind encoder split keeps privacy-utility tight","Two blind encoders, tight privacy-utility bound","Splitting blind encoders preserves trade-off tightness","Blind to task or privacy, bounds stay tight"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000286,"raw_usage":{"total_tokens":1761,"prompt_tokens":1106,"completion_tokens":655,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":722,"completion_tokens_details":{"reasoning_tokens":580}},"tokens_in":722,"tokens_out":655,"duration_ms":6305,"temperature":1.0,"reasoning_tokens":580,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T05:17:11.915354+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the linear-programming computation of $h_\\epsilon(P_{S,f(X)})$ on a small finite joint distribution where $S$ is not a function of $f(X)$ and compare the exact value with $\\max\\{L^1_h(\\epsilon),L^2_h(\\epsilon)\\}$; one instance with exact $h_\\epsilon$ below the max disproves Theorem 1's lower bound. Alternatively, implement the EFRL/ESFRL mechanism for that distribution and measure $I(U;S)$ from samples; if it is not $\\epsilon$ to within simulation error, the inherited construction fails for the present setting.","supporting_citations":[{"cited_title":"Secrecy by design with appli- cations to privacy and compression,","cited_arxiv_id":null,"evidence_quote":"Defines the perfect-privacy secret-dependent function that this setting generalizes, with bounds later strengthened in [17]."},{"cited_title":"Semantic communications with privacy constraints,","cited_arxiv_id":null,"evidence_quote":"Introduces the semantic communication with privacy constraints model that the present paper extends by splitting the encoder into two blind parts."}],"review_version":1}