{"id":"83b8fecc-70ba-480c-90b2-03095f784731","arxiv_id":"2501.03119","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A topology inference attack on decentralized federated learning reconstructs the overlay network from pairwise model similarity, reaching F1 around 0.85 in supervised settings and 0.60 to 0.67 when no labels or datasets are available.","lead":"Decentralized federated learning lets participants train models without a central server, but this paper shows that the trained models themselves leak the peer-to-peer network structure: connected nodes end up with unusually similar model weights. The authors build supervised and unsupervised inference attacks that reconstruct the topology from model behavior alone, and their experiments map when the attack succeeds.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Section 3's convergence argument is invalid: P in Eq. (2) is row-stochastic with spectral radius 1, not <1, so P^T does not vanish; topology may be unidentifiable at convergence, and the paper never tests T beyond rounds = nodes.","rationale":"The reader's weakest assumption was the data-similarity confound. That is a real concern, but the IID experiments assign data to nodes independently of the random synthetic topologies, so in those controlled settings pairwise data similarity is exchangeable across edge and non-edge pairs; the observed separation then already indicates a topology-driven signal. The more fundamental problem is internal to the paper's own theory. Section 3 claims that P has spectral radius <1 and that ||P^T|| -> 0, which is false for the row-stochastic aggregation matrix defined in Eq. (2). The correct behavior is that P^T converges to a consensus projection, so asymptotically all node models coincide and topology information in final model similarities vanishes. The paper's experimental design stops training at T = number of nodes without justifying that this is still in the informative transient, and it never studies how attack accuracy depends on T. This does not destroy the empirical finding: the attack may well succeed during realistic, non-converged training, and the code and multi-dataset evaluations are substantial support. But the central claim as stated is overbroad, and the theoretical section needs correction and an explicit identifiability condition. Since these are fixable with additional experiments and revision, the conditional verdict remains appropriate; no change to the reader's verdict is needed.","tokens_in":22321,"tokens_out":8018,"duration_ms":85283,"concrete_test":"On a fixed 20-node ER(0.5) CIFAR10 DFL system, rerun the SC2 and SC4 attacks with T = N/2, N, 2N, 5N, 10N, and 20N instead of the rule 'rounds = number of nodes' (Sec. 6.1C), holding all other settings fixed. If EDGEPRE and INFERGAT F1 decay toward the edge-density prior as T grows, the claimed 'analyzing only models can accurately infer topology' must be qualified to the finite mixing transient; if F1 remains flat, the topology signal persists and the Section 3 spectral-radius error is less damaging to the empirical claim.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing issue is the theoretical basis for the claim that model behavior leaks topology. Eq. (2) defines P = D^{-1}(A+I), which is row-stochastic by construction. For a connected graph with self-loops, P is irreducible and aperiodic, so its spectral radius is exactly 1, not <1 as Section 3 asserts. Consequently the bound ||P^T M0|| <= ||P^T|| ||M0|| -> 0 is false; P^T converges to a rank-one consensus/projection matrix rather than to zero. In the T -> infinity limit all nodes' models coincide (up to the local-update term), so pairwise cosine similarity carries no edge information and the topology is information-theoretically unidentifiable from the final models. The attack therefore can only operate during a finite mixing transient, but the paper evaluates all experiments at an arbitrary stopping rule, 'rounds = number of nodes' (Sec. 6.1C), and provides no characterization of how attack F1 varies with T or mixing time. If the signal disappears as T grows, the central claim must be qualified; if it persists, the Section 3 proof still needs correction. This is a correctness risk in the motivation and a missing identifiability condition in the claim.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies privacy leakage of the overlay topology in Decentralized Federated Learning (DFL). It introduces a taxonomy of topology inference attacks based on attacker knowledge, proposes two attack mechanisms—EDGEPRE, an MLP-based edge classifier trained with partial edge labels (SC1/SC2), and INFERGAT, an unsupervised GAT-based adjacency reconstructor (SC3/SC4)—and evaluates them across six datasets and a range of synthetic and real-world topologies. The central claim is that the DFL overlay topology can be accurately inferred from node models alone, with Table 1 reported as quantitative support (EDGEPRE F1 around 0.79–0.89 in SC1/SC2; INFERGAT AUC around 0.76–0.81 in SC4).","tokens_in":22546,"tokens_out":9319,"duration_ms":74880,"significance":"If the central claim holds, the paper identifies a novel and practically relevant privacy risk in DFL systems and provides a useful taxonomy plus a publicly available codebase. The evaluation is broad in terms of datasets and topologies, and the supervised results are consistent and fairly strong. However, the theoretical motivation in Section 3 contains a mathematical error, the reported superiority of INFERGAT is contradicted by Table 1 in SC3, and several experimental parameters (label budget, training length, threshold baselines) are not reported. These issues currently prevent the paper from being accepted as is.","major_comments":[{"comment":"Equation (6) is incorrect: the aggregation matrix P = D^{-1}(A+I) defined in Eq. (2) is row-stochastic, so its spectral radius is exactly 1, not less than 1, and ||P^T M0|| does not tend to 0 as T grows; P^T converges to a rank-one consensus/projection operator. Consequently the statement that \"the impact of individual updates diminishes\" and the convergence argument based on ||P^{T-t}|| -> 0 are unsupported. Because this is the stated theoretical basis for why topology leaves traces in models, the paper must either derive the correct asymptotics (e.g., how the local-update terms P^{T-t}δ_t encode topology through the mixing dynamics) or explicitly restrict the attack claim to finite training horizons. As written, this is a load-bearing error in the motivation.","section":"Section 3"},{"comment":"All experiments fix the number of communication rounds at \"rounds = number of nodes\", with no variation of T. Given that the topology signal may be a finite-transient effect (as the corrected analysis of Section 3 would show, and as the current invalid proof was trying to argue), the paper needs to report attack F1/AUC as a function of T, e.g., from a few rounds to several times the number of nodes, along with a measure of mixing. Without this, the central claim is only established for one arbitrary stopping rule and cannot be separated from the convergence phase of DFL training.","section":"Section 6.1C"},{"comment":"The text states that \"INFERGAT ranks best in SC3–SC4 across all datasets\", but Table 1 contradicts this for SC3. In SC3, KMeans achieves higher F1 than INFERGAT on ImageNet10 (0.792 vs 0.765), Malware (0.779 vs 0.664), MNIST (0.754 vs 0.657), and SVHN (0.907 vs 0.769), and GMM exceeds INFERGAT on MNIST (0.864 vs 0.657). The claim should be corrected to specify where INFERGAT is actually best, and the comparisons should be accompanied by significance or consistency tests.","section":"Section 6.3, Table 1"},{"comment":"The supervised attack is trained on \"a small set of labeled node pairs\", but the paper never reports the number or fraction of labeled edges used for EDGEPRE in SC1/SC2, nor how performance varies with the label budget. Since the threat model assumes partial edge knowledge, the feasibility of the attack depends directly on this quantity. In addition, no threshold-based baseline on the chosen metric matrix is reported: in SC2/SC4, a simple threshold on cosine similarity (and in SC1/SC3 on relative loss) would quantify how much EDGEPRE/INFERGAT add beyond direct metric thresholding. This baseline is especially needed because INFERGAT's objective in Eq. (14) reconstructs the input metric matrix X, so the comparison separates the learned representation from the raw metric signal.","section":"Section 5.2.1 and Table 1"},{"comment":"The selection of cosine similarity as the attack feature relies on the separation between edge and non-edge distributions, but this separation may be driven by similarity of local data distributions rather than by direct communication. The non-IID experiment in Fig. 4 shows a performance drop, but it does not control for data similarity independent of topology. The paper should include a null-model experiment (e.g., the same data partition with a randomly reshuffled topology, or a data-only similarity predictor) to isolate the marginal signal contributed by the DFL aggregation process, and to characterize when the attack is really exploiting topology rather than data similarity.","section":"Section 6.2 and 7.2"}],"minor_comments":[{"comment":"The phrase \"solely from model behavior\" is stronger than what SC1 and SC3 assume, since those scenarios use local datasets to compute relative loss; please qualify the claim.","section":"Abstract and Section 4"},{"comment":"The notation alternates between M_t and \\tilde M_t without a clear derivation of Eq. (5) from Eqs. (3)–(4); please clarify the recursion.","section":"Section 3, Eq. (5)"},{"comment":"The metric called \"Relative Entropy\" is actually cross-entropy, as it uses true labels y_k(x); rename or redefine it.","section":"Section 5.1, Eq. (9)"},{"comment":"The choice of \"rounds = number of nodes\" is given no justification; a sentence explaining the rationale, or an ablation over training length, would help.","section":"Section 6.1C"},{"comment":"The caption contains a typo in the axis label (\"VLAUE\"), and the term \"normalized value\" should specify which normalization is applied.","section":"Figure 1"},{"comment":"The experimental section does not report hyperparameters (e.g., number of GAT layers/heads, hidden sizes, training epochs, learning rates) for EDGEPRE and INFERGAT; please include them for reproducibility.","section":"Section 5.2 and 6.1"},{"comment":"Many entries have AUC exactly 0.500 and near-constant F1 (e.g., Logistic and BGRL), suggesting degenerate predictions; a brief discussion of these baselines would improve interpretation.","section":"Table 1"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The first thing to know: this is the first systematic treatment I've seen of inferring a DFL overlay topology from the trained models alone, and the empirical core is believable. The supervised attack, EDGEPRE, gets F1 around 0.85-0.89 across six datasets; the unsupervised INFERGAT gets AUC 0.76-0.80 with F1 0.60-0.67. That second number does not support the abstract's 'accurately infer,' but it is clearly above all the baselines they compare against.\n\nWhat the paper does well: the scenario taxonomy is useful, the metric selection is principled (relative loss and cosine similarity separate edge pairs from non-edges), and the evaluation is broad—six datasets, synthetic and 27 real-world topologies, plus non-IID and DP mitigation tests. Code is released. The DP result (F1 drops ~23%) is a nice sanity check.\n\nThe soft spots. The stress-test note is right: Section 3's convergence argument is invalid. P = D^{-1}(A+I) is row-stochastic, so its spectral radius is 1, not <1. P^T does not vanish; it converges to a rank-one consensus matrix. The bound in Eq. (6) is false. That matters because the theoretical motivation for the attack is that topology leaves a persistent trace in the models. In the limit, all models converge (up to local updates), so the trace is only present during a finite mixing transient. The paper fixes rounds = number of nodes and never reports how attack F1 varies with T. The empirical results are still evidence at that specific T, but the central claim needs either a corrected proof, a characterization of the transient, or an explicit 'this is a finite-time attack' framing.\n\nThree smaller gaps. They never report the number or fraction of labeled edges used to train EDGEPRE. They omit a simple threshold baseline on the cosine-similarity matrix, which would likely be strong in SC2 and SC4. And the non-IID test shows degradation but does not isolate the data-similarity confound: two unconnected nodes with similar local data will look connected because their models are similar. That is a genuine limitation of the attack, not a fatal one.\n\nBottom line: the paper deserves a serious referee. The core signal—connected nodes have more similar models—is simple but the attack formulation, taxonomy, and breadth of evaluation make it a useful contribution to DFL security. I would send it to review with a request for major revision: fix Section 3, add the T-sweep and threshold baseline, and report the labeling budget.","headline":"A worthwhile empirical attack paper whose convergence proof is wrong; the supervised results are strong, the unsupervised ones are moderate, and the theory must be fixed before publication.","tokens_in":23073,"tokens_out":2569,"would_cite":true,"duration_ms":23975,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper attempts to establish that the peer-to-peer topology of a decentralized federated learning network can be inferred from the trained models alone, without raw data or network logs.","keywords":["decentralized federated learning","topology inference attack","model similarity","cosine similarity","graph neural networks","privacy leakage","edge classification","network topology inference"],"falsifier":"Fix a topology and a training setup, then give two non-adjacent nodes nearly identical local datasets while making adjacent nodes' data dissimilar. If pairwise cosine similarity for those non-edge pairs exceeds that of true edges, and EDGEPRE/INFERGAT F1 drops toward 0.5, the core signal is data similarity rather than communication topology; a sweep over data-overlap between non-adjacent pairs, with the graph held fixed, would settle the question.","tokens_in":22121,"feed_emoji":"🕸️","tokens_out":9566,"duration_ms":82638,"temperature":0.7,"pith_summary":"Decentralized federated learning (DFL) distributes model training over a peer-to-peer network, and this paper tries to establish that the network's overlay topology—which nodes exchange model updates with which—can be read off the trained models themselves. The point matters because topology is a sensitive asset: an adversary who knows it can target the central or best-connected nodes for poisoning or denial-of-service. The paper defines five attacker scenarios by how much model, dataset, and edge knowledge the adversary holds, selects pairwise similarity metrics that separate connected from unconnected nodes (cosine similarity between parameter vectors is the strongest), and builds two inference methods: a supervised edge classifier and an unsupervised graph reconstruction. Across six datasets, synthetic topologies, and 27 real-world communication topologies, the models recover the adjacency matrix with F1 around 0.79–0.89 when some edge labels are available, and with AUC around 0.76–0.81 when no labels or datasets are available.","feed_headline":"Model weights leak the hidden peer-to-peer graph in federated learning","feed_subtitle":"No raw data or network logs are needed: model similarities alone reconstruct the graph at AUC up to 0.81.","key_machinery":"The engine of the attack is the DFL aggregation identity $\\tilde{M}_t = P M_{t-1}$, with $P = D^{-1}(A+I)$ encoding the graph; expanding to $M_T = P^T M_0 + \\sum_{t=1}^T P^{T-t}\\delta_t$ shows that the adjacency structure enters every round through powers of $P$, so neighboring models converge toward each other while the initialization term decays. The observable that carries the inference is cosine similarity between model parameter vectors, chosen after distribution analysis showed it separates edge from non-edge pairs more cleanly than Euclidean similarity or curvature divergence. Two algorithms consume that signal: EDGEPRE, a supervised MLP edge classifier trained on partially labeled pairs, and INFERGAT, an unsupervised graph-attention encoder-decoder trained to reconstruct the pairwise similarity matrix.","core_discovery":"The central claim is that direct communication leaves an imprint in model parameters: each aggregation step multiplies the model matrix by the row-stochastic matrix $P = D^{-1}(A+I)$, so connected nodes repeatedly average each other's parameters and end up with models that point in similar directions. The paper shows experimentally that pairwise cosine similarity of final models separates the edge group from the non-edge group with little overlap, and that this signal suffices for topology reconstruction. Equipped with a few labeled edges, EDGEPRE—an MLP that classifies each node pair from concatenated features—recovers the full adjacency matrix at F1 $\\approx 0.79$–$0.89$ on six datasets. With no edge labels and no data access, INFERGAT—a graph-attention encoder trained to reconstruct the similarity structure—still reaches AUC $\\approx 0.76$–$0.81$ and F1 $\\approx 0.60$–$0.67$ in the weakest scenario. The paper also establishes that leakage increases with local overfitting and decreases with data heterogeneity and differential privacy, and that topology density helps unsupervised inference while network size hurts it.","pith_inferences":["A defense aimed specifically at the cosine-similarity gap—such as adding a small amount of calibrated noise to shared parameters or randomizing the aggregation weights—might break edge–non-edge separation more cheaply than global differential privacy; this follows from the mechanism but is not tested in the paper.","Under the aggregation dynamics in equation (5), changing the gossip schedule (asynchronous updates, randomized neighbor selection, or periodic topology rewiring) should change which parameter pairs resemble each other and likely weakens inference; this is an untested corollary of the paper's model.","The open Scenario 5, where the attacker sees only a subset of models, might be solvable with spectral or graph-prior techniques that estimate the missing parts of $P$ from observed rows; the paper acknowledges the scenario as future work.","The same pairwise similarity features could be used defensively as a topology-exposure audit: a federation operator can monitor cosine similarities between shared models to detect when its own topology has become inferable."],"forward_implications":["A DFL participant with partial knowledge of the graph can reconstruct the full overlay, so topology should be treated as confidential in any deployment where participants are not fully trusted.","Even in the weakest scenario considered—models only, no labels, no datasets—the graph is recoverable at AUC around 0.76–0.81, so hiding network metadata is not enough.","Denser topologies make unsupervised reconstruction easier and larger networks make it harder, giving operators a quantitative trade-off between connectivity and topology privacy.","Reducing local epochs, encouraging non-IID data splits, and applying differential privacy each lower attack performance, and these effects are large enough to serve as defense levers.","The inference signal persists across ring, star, random, and 27 real-world communication topologies, suggesting the result is structural rather than an artifact of one graph family."],"supporting_citations":[{"why":"Defines decentralized federated learning and the aggregation setting that the attack targets.","marker":"[2]"},{"why":"Establishes that DFL topology shapes model robustness and privacy, motivating why topology is a sensitive asset.","marker":"[7]"},{"why":"Surveys inference attacks on machine learning, grounding the premise that training traces leak sensitive information.","marker":"[18]"},{"why":"Serves as a supervised graph-based baseline that EDGEPRE is compared against in the evaluation.","marker":"[14]"},{"why":"Serves as a supervised link-prediction baseline in the edge classification experiments.","marker":"[34]"},{"why":"Serves as an unsupervised graph contrastive baseline in the topology reconstruction experiments.","marker":"[35]"},{"why":"Serves as an unsupervised graph representation baseline in the topology reconstruction experiments.","marker":"[29]"}],"fun_headline_variants":["Model weights leak the peer graph in decentralized FL","Peer topology inferred from model similarities alone","Model drift exposes the hidden graph in DFL","No logs needed: model parameters reveal federation topology"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The approach stands or falls on the assumption that similarity between two models is caused mainly by a direct communication link, rather than by the two nodes happening to hold similar local data.","fun_headline_variants_meta":{"raw":{"variants":["Model weights leak the peer graph in decentralized FL","Peer topology inferred from model similarities alone","Model drift exposes the hidden graph in DFL","No logs needed: model parameters reveal federation topology"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000539,"raw_usage":{"total_tokens":2601,"prompt_tokens":977,"completion_tokens":1624,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":593,"completion_tokens_details":{"reasoning_tokens":1567}},"tokens_in":593,"tokens_out":1624,"duration_ms":12709,"temperature":1.0,"reasoning_tokens":1567,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T21:53:51.423057+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Fix a topology and a training setup, then give two non-adjacent nodes nearly identical local datasets while making adjacent nodes' data dissimilar. If pairwise cosine similarity for those non-edge pairs exceeds that of true edges, and EDGEPRE/INFERGAT F1 drops toward 0.5, the core signal is data similarity rather than communication topology; a sweep over data-overlap between non-adjacent pairs, with the graph held fixed, would settle the question.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Establishes that DFL topology shapes model robustness and privacy, motivating why topology is a sensitive asset."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Surveys inference attacks on machine learning, grounding the premise that training traces leak sensitive information."},{"cited_title":"Hamilton, Z","cited_arxiv_id":null,"evidence_quote":"Serves as a supervised graph-based baseline that EDGEPRE is compared against in the evaluation."},{"cited_title":"Zhang and Y","cited_arxiv_id":null,"evidence_quote":"Serves as a supervised link-prediction baseline in the edge classification experiments."},{"cited_title":"Thakoor, C","cited_arxiv_id":null,"evidence_quote":"Serves as an unsupervised graph representation baseline in the topology reconstruction experiments."}],"review_version":1}