{"id":"c24b951f-59c6-438c-91d7-76134071f108","arxiv_id":"2501.04610","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"A peer-to-peer learning algorithm that aggregates neighbor models with weights inversely proportional to their loss on the worker's own data is claimed to be Byzantine-resilient with an arbitrary number of adversaries.","lead":"This paper proposes a loss-based adaptive aggregation rule for peer-to-peer distributed learning, where each worker weights neighbor models by how low their loss is on its own private data. The authors claim this makes learning resilient to an arbitrary number of malicious neighbors even with non-convex loss and non-iid data, and they provide convergence theory plus experiments on three classification tasks.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 1's 'arbitrary number of adversarial neighbors' claim is not supported: Eq. 7 leaves adversarial losses unbounded on the RHS, and an adversary that sends a low-loss model passes the N+_k filter and dominates aggregation.","rationale":"The paper's idea is intuitive and the empirical section suggests practical gains against the tested attacks, but the central claim is a formal resilience guarantee. The bottleneck is that the theorem's proof must control the effect of adversarial messages on the aggregation, and neither the stated assumptions nor the displayed equations do so. The reader's identified weakest assumption is exactly the point: the algorithm's trust signal is the loss of a neighbor's model on the worker's private data, and the paper never assumes or proves that an adversary cannot make this loss small. In fact, the proof as sketched has the additional problem that high-loss adversaries appear on the RHS of Eq. 7, so the stated bound cannot be finite for arbitrary Byzantine inputs. This is an internal correctness issue, not a disagreement with community norms. The proposed check, running a two-worker attack with a loss-minimizing adversary, would settle whether the vulnerability is real. Since the central claim is unsupported as stated, I maintain the REJECT verdict.","tokens_in":8499,"tokens_out":8520,"duration_ms":89755,"concrete_test":"On the released code, run Algorithm 1 on a two-worker graph for MNIST non-iid, with one worker Byzantine. At each round, the Byzantine worker sends the model that minimizes its estimate of r_k(·) on a surrogate set drawn from the same two-label distribution as worker k's private data, ensuring the model passes the N+_k threshold. Track the normal worker's worst-case test accuracy over 100 epochs. If this accuracy falls more than the Eq. 8 bound below the no-attack baseline, or if the normal worker's iterate tracks the adversary rather than its own local SGD, the 'arbitrary number of adversarial neighbors' claim is refuted. Also verify analytically whether Lemma 1's RHS remains finite under this adversary; if it does not, Theorem 1 cannot be derived from the stated assumptions.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Theorem 1 (Eq. 8) asserts that with aggregation weights (6), every normal worker converges to a bounded neighborhood of its optimum in the presence of an arbitrary number of adversarial neighbors. The proof rests on Lemma 1 (Eq. 7), but Eq. 7 is stated for weights (5) and contains, on its right-hand side, the term (1/|N_k|) sum_{l in N_k} E[r_k(hat w_l^t) - r_k(w*_k)] over all neighbors. If a Byzantine neighbor transmits a model with very large loss, this term is arbitrarily large, so Lemma 1 cannot yield a finite bound independent of the adversary. If the algorithm instead uses the thresholded set N+_k from (6), the high-loss adversary is simply excluded from the sum, but the paper gives no version of Lemma 1 for the restricted set, and the exclusion creates a new vulnerability: a Byzantine neighbor can transmit a model whose loss on worker k's private data is low (e.g., trained on a surrogate of the same distribution), which passes the threshold and receives high weight in (6). Assumptions 1-4 do not rule out such an adversary, and none of the experiments considers an adversary that optimizes its transmitted model against the victim's loss. Consequently, the central resilience claim is not established for the stated threat model.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a peer-to-peer distributed learning algorithm with a loss-based adaptive aggregation rule. Each worker evaluates the loss of its neighbors' models on its own private data and assigns aggregation weights inversely proportional to those losses, optionally restricted to neighbors that achieve no larger loss than the worker's own updated model. The authors claim convergence of the parameters of normal workers to a bounded neighborhood of optimality under non-convex loss and non-iid data distributions, even in the presence of an arbitrary number of adversarial neighbors. The theoretical analysis is presented as Lemma 1 and Theorem 1, with proofs deferred to a supplementary file. The evaluation covers three classification tasks (HAR, MNIST, Spambase) under four attack models (sign-flipping, arbitrary Byzantine, Fall-of-Empire, and A-little-is-enough) and compares against several baselines.","tokens_in":8713,"tokens_out":3471,"duration_ms":32638,"significance":"If the main claim were rigorously established, the paper would constitute a significant advance in Byzantine-resilient decentralized learning: current methods typically require the number of Byzantine workers to be below a constant fraction of the neighborhood size, whereas the paper claims resilience against an arbitrary number of adversarial neighbors under non-convex and non-iid conditions. The aggregation idea itself—using each worker's private data to assess similarity of neighbor models—is interesting and intuitively plausible. However, the manuscript as written does not establish this claim: the central theoretical statements are unsupported or incomplete, and the experiments never go beyond the standard Krum bound. The paper also provides reproducible code, which is a positive feature, but the missing error bars and the absence of an adaptive adversary that optimizes against the loss filter weaken the empirical evidence.","major_comments":[{"comment":"Equation (5) is asserted to be the solution of the optimization problem in (4), but no derivation is provided in the main text (the footnote points to supplementary material, which is not included). Moreover, the expression in (5) does not depend on w*_k except through the loss function, and it is not the standard solution for minimizing a Euclidean distance to w*_k under a simplex constraint. This is a load-bearing step because Lemma 1 and Theorem 1 rely on this particular weighting. The authors should provide a rigorous derivation or clearly state that (5) is a heuristic approximation.","section":"Sec. 3, Eq. (4)-(5)"},{"comment":"Lemma 1 is stated for aggregation weights (5), which use the full neighborhood N_k, including adversarial workers. The right-hand side of (7) contains the term E[r_k(hat w_l) - r_k(w*_k)] for every l in N_k. A Byzantine worker can transmit a model with arbitrarily large loss, making this term arbitrarily large and the bound vacuous. The theorem then switches to weights (6) based on the restricted set N+_k, but no analogue of Lemma 1 is provided for the restricted aggregation. Consequently, the proof of Theorem 1 is incomplete and does not establish a finite convergence bound independent of adversarial behavior.","section":"Sec. 4, Lemma 1 and Theorem 1"},{"comment":"The resilience claim implicitly assumes that an adversarial worker cannot transmit a model that achieves low loss on a normal worker's private data, since such a model would pass the N+_k filter in (6) and receive high weight. This assumption is not listed in Assumptions 1-4 and is not motivated. If an adversary can craft a low-loss model (e.g., by training on a surrogate of the same distribution or by exploiting knowledge of the victim's task), the proposed defense fails. The paper does not test such adversaries in the experiments. This is a substantive gap in the threat model, not a cosmetic issue.","section":"Sec. 4, Assumptions 1-4 and threat model"},{"comment":"The experiments do not support the \"arbitrary number of adversarial neighbors\" claim. For MNIST and Spambase, the settings use N=10 and F=3, which is exactly the Krum bound N >= 2F+3; for HAR, N=30 and F=13, also at the Krum bound. No experiments are reported with F exceeding this bound. Furthermore, the figures do not show error bars or multiple seeds, so the reported accuracies cannot be statistically distinguished. The claim of resilience beyond the standard Byzantine limit therefore remains unsupported empirically.","section":"Sec. 5, Experimental setup and Fig. 1-3"}],"minor_comments":[{"comment":"The notation \"rk(\\hat w_l) - 1\" appears to denote the inverse of the loss, but the formatting is ambiguous and could be confused with subtraction of 1. Please use a clear notation such as r_k(\\hat w_l)^{-1} or 1/r_k(\\hat w_l).","section":"Sec. 3, Eq. (5)"},{"comment":"The algorithm does not specify which dataset is used to compute the risk function r_i(\\hat w_l) for each neighbor. It should state explicitly that the worker uses its own private dataset S_i, which is central to the method's privacy rationale.","section":"Sec. 3, Algorithm 1"},{"comment":"The notation W*_s for a set of stationary points of the statistical risk is introduced, but later the paper refers to w*_k as the optimal parameters for worker k. The relationship between w*_k and W*_s should be clarified, since the loss function r_k is a finite-sample empirical risk, not the statistical risk R_k.","section":"Sec. 2, Assumption 1"},{"comment":"All figures report a single run without error bars. Please add confidence intervals or at least report the number of seeds and the variance across runs.","section":"Sec. 5, Figures"},{"comment":"The paper compares against average, medoid, and three variants of BRIDGE. It is unclear whether these are the most relevant state-of-the-art baselines for the setting; a discussion of additional recent methods, such as self-centered clipping, would strengthen the comparison.","section":"Sec. 5, Baselines"},{"comment":"The phrase \"an arbitrary number of adversarial neighbors\" is used as a contribution statement, but the theoretical analysis only shows a bounded gap that can grow linearly with the number of adversarial neighbors (via the sum in Eq. (7)). The authors should align the terminology with the actual result.","section":"Sec. 1, Introduction"}],"recommendation":"reject","confidential_remarks":"The manuscript does not include the supplementary material cited in the text, so the proofs of Lemma 1 and Theorem 1 are not available for review. From the main text alone, the theoretical argument contains a clear gap: Lemma 1 does not control adversarial losses, and Theorem 1 switches to a different aggregation rule without a matching lemma. The empirical evaluation is also limited to the Krum bound, which contradicts the paper's central claim. In its current form, the paper is not ready for publication. If the authors can supply a rigorous proof that handles low-loss adversaries and add experiments that go beyond the standard Byzantine-resilience bound, the work could merit reconsideration."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe short version: this is a useful empirical paper with an honest attempt at theory, but the headline claim—convergence with an arbitrary number of adversarial neighbors—does not hold as stated. The error is in the threat model, not the algebra.\n\nWhat's new: the loss-based adaptive aggregation rule, where each worker weights neighbors by the loss of their models on its own private data, is applied here to peer-to-peer learning with non-convex losses and non-iid data. The convergence analysis for this setting is new relative to the authors' prior work, and they back it with code and experiments on three tasks (HAR, MNIST, Spambase) against four attack families (sign-flip, Byzantine, FoE, ALIE). The empirical results are encouraging: the method outperforms the baselines, especially under ALIE. Credit where due: they state assumptions, they release a public GitHub repo, and the idea is simple enough to be plausible.\n\nWhere it goes soft. First, the central theorem says 'arbitrary number of adversarial neighbors,' and the proof sketch (Eq. 7) bounds the aggregated risk by the average of neighbor losses. An adversary can trivially send a model with arbitrarily large loss on the victim's data, so that bound is unbounded. If instead you rely on the thresholded set N+_k (Eq. 6) to drop high-loss neighbors, then an adversary who sends a model with low loss on the victim's data—say, trained on a surrogate distribution—passes the filter and gets high weight. Nothing in Assumptions 1–4 rules this out, and no experiment tests an adversary that optimizes its transmitted model against the victim's loss. So the claim of 'arbitrary' is not supported; the method might still be robust against the specific attacks tested, but not in the stated threat model.\n\nSecond, the derivation of Eq. 5 and the proofs of Lemma 1 and Theorem 1 are all in the supplementary, which is not included. That makes it impossible to check the core argument without chasing an external document. The paper should at least sketch the derivation and state the key lemma in the main text. Finally, the experiments show no error bars and only test the Krum bound (e.g., 3 of 10 workers, 13 of 30), which contradicts the 'arbitrary' framing.\n\nThe paper is not ready as is. The convergence analysis may be salvageable under a weaker threat model, and the empirical study is worth a serious look. I'd send it to review with the understanding that the authors need to either fix the arbitrary-adversary claim or reframe the contribution honestly, include the proofs, and add error bars. The code and data make it reproducible, which is a real plus.\n\nBottom line: worth a referee, not worth accepting now. If your group works on Byzantine-robust decentralized learning, the experiments are worth reading.","headline":"Plausible heuristic, solid empirical study, but the 'arbitrary adversary' convergence bound doesn't hold as stated—low-loss adversaries slip through the filter.","tokens_in":9259,"tokens_out":2856,"would_cite":false,"duration_ms":26190,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A peer-to-peer learning network can keep its normal workers converging even when every neighbor is malicious, provided each worker weights neighbor models by their loss on its own private data.","keywords":["distributed machine learning","peer-to-peer learning","resilient aggregation","Byzantine robustness","non-convex loss","non-iid data","adaptive aggregation"],"falsifier":"Run the algorithm with a single normal worker whose only neighbor is adversarial, where the adversary trains on a surrogate dataset with the same label distribution as the victim; if the normal worker's excess risk fails to remain bounded by $\\mu_k L M / (2m)$ or its accuracy degrades, the claim of resilience to an arbitrary number of adversarial neighbors is falsified.","tokens_in":8255,"feed_emoji":"🛡️","tokens_out":8295,"duration_ms":73703,"temperature":0.7,"pith_summary":"Peer-to-peer learning normally breaks down when some workers transmit poisoned model updates, and the problem gets harder when each worker's data is not identically distributed and the loss is non-convex. This paper introduces an aggregation rule in which each worker scores every neighbor's model by its loss on the worker's own private data, weights the models inversely to that loss, and only mixes in neighbors that beat the worker's own current loss. Under mild smoothness and local-convexity assumptions, the paper proves that every normal worker's expected excess risk stays bounded even if every neighbor is adversarial, with the bound proportional to the step size. The authors validate the method on three non-iid classification tasks under four attack models and report better worst-case accuracy than existing resilient gossip baselines.","feed_headline":"P2P learning converges even with unlimited malicious neighbors","feed_subtitle":"Loss-based weighting of neighbor models keeps non-convex, non-iid learning on track.","key_machinery":"The load-bearing mechanism is the adaptive aggregation rule (6): each worker computes $c^t(l,k) = (r_k(\\hat w_l^t))^{-1} / \\sum_{p \\in \\mathcal{N}_k^+} (r_k(\\hat w_p^t))^{-1}$ for neighbors whose risk on the worker's own data is no higher than the worker's own risk, and sets all other weights to zero. These weights are the closed-form solution to the constrained problem of minimizing the squared distance between the aggregated model and the worker's optimal model. The rule acts as a self-centered filter: a neighbor is influential only if its model performs well on the worker's private loss, and the proof shows that under local strong convexity this filtering keeps the expected risk gap bounded even when every neighbor is adversarial.","core_discovery":"The paper's central claim is Theorem 1: if each worker runs local SGD and then aggregates neighbor models with the loss-based weights (6), then under Assumptions 1–4 the parameters of every normal worker converge toward optimality and satisfy $\\lim_{t\\to\\infty} \\mathbb{E}[r_k(w_t^k) - r_k(w_k^*)] \\le \\mu_k L M / (2m)$ for a fixed step size $\\mu_k \\in (0, 1/(L a_k)]$, in the presence of an arbitrary number of adversarial neighbors. The bound is independent of how many neighbors are malicious and of the specific attack, because the aggregation is driven by each worker's own private loss rather than by any trust score or attack model. The paper argues that this combines arbitrary Byzantine tolerance with non-convex loss functions and non-iid data distributions in a way prior decentralized methods did not, without requiring workers to know which neighbors are attacked, to share gradients, or to start from identical initializations.","pith_inferences":["The paper never states the premise that an adversary cannot craft a model with low loss on a victim's private data; if an attacker can infer the victim's distribution and train on it, the inverse-risk weights would reward the attacker, and the arbitrary-adversary claim would fail.","The convergence proof is local: it assumes initialization inside the basin of a stationary point where local strong convexity holds, so the paper does not address how a worker escapes poor local minima or saddle points before that regime applies.","The empirical evaluation fixes the number of adversaries at the Krum bound (e.g., 3 of 10 or 13 of 30), so the 'arbitrary number' part of the claim is tested only theoretically; an experiment with more adversaries than normal workers would be a sharper stress test."],"forward_implications":["Normal workers' models converge toward a common model, so the network behaves as a coordinated ensemble rather than a collection of isolated learners.","The asymptotic optimality gap can be made arbitrarily small by choosing a smaller step size, at the cost of slower convergence.","The method requires no knowledge of which neighbors are attacked, no identical initialization across workers, and no extra gradient exchange beyond the model parameters.","The aggregation rule applies unchanged when data is iid, so it can serve as a drop-in replacement for the gossip averaging step in existing decentralized SGD algorithms.","Because the bound is independent of the number of adversarial neighbors, the resilience guarantee extends to arbitrary Byzantine and model-poisoning attacks of the types evaluated in the paper."],"supporting_citations":[{"why":"Supplies the standard optimization technique used to derive the closed-form inverse-risk aggregation weights from the distance-minimization problem.","marker":"[18]"},{"why":"Introduces the idea of using loss on a worker's own data to measure objective similarity and weight neighbors accordingly.","marker":"[19]"},{"why":"Provides the BRIDGE baseline for Byzantine-resilient decentralized gradient descent with non-convex losses, which the paper extends to non-iid data.","marker":"[10]"},{"why":"Represents the closest prior work handling non-iid data and non-convex losses, but with restrictive assumptions that the paper claims to remove.","marker":"[13]"},{"why":"Prior Byzantine-resilient decentralized algorithm that requires identical initialization and extra gradient exchange, motivating the paper's communication-light design.","marker":"[9]"},{"why":"Defines the foundational D-PSGD protocol whose local update and gossip aggregation structure the proposed algorithm builds on.","marker":"[20]"}],"fun_headline_variants":["Loss-based weights make P2P learning immune to any number of Byzantine peers","Unlimited malicious neighbors? This P2P algorithm still converges","Adaptive aggregation guarantees P2P convergence even under universal attack","Private loss weighting shields P2P learning from arbitrary adversarial workers","Non-convex non-iid? P2P adaptive aggregation still reaches optimum"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The resilience claim holds only if adversarial workers cannot produce model parameters that achieve low loss on a normal worker's private data, since the aggregation rule (6) gives high weight to any neighbor whose model has low loss on the worker's data.","fun_headline_variants_meta":{"raw":{"variants":["Loss-based weights make P2P learning immune to any number of Byzantine peers","Unlimited malicious neighbors? This P2P algorithm still converges","Adaptive aggregation guarantees P2P convergence even under universal attack","Private loss weighting shields P2P learning from arbitrary adversarial workers","Non-convex non-iid? P2P adaptive aggregation still reaches optimum"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000199,"raw_usage":{"total_tokens":1352,"prompt_tokens":907,"completion_tokens":445,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":523,"completion_tokens_details":{"reasoning_tokens":353}},"tokens_in":523,"tokens_out":445,"duration_ms":5063,"temperature":1.0,"reasoning_tokens":353,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T21:29:02.331346+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the algorithm with a single normal worker whose only neighbor is adversarial, where the adversary trains on a surrogate dataset with the same label distribution as the victim; if the normal worker's excess risk fails to remain bounded by $\\mu_k L M / (2m)$ or its accuracy degrades, the claim of resilience to an arbitrary number of adversarial neighbors is falsified.","supporting_citations":[{"cited_title":"John Wiley & Sons (2012)","cited_arxiv_id":null,"evidence_quote":"Supplies the standard optimization technique used to derive the closed-form inverse-risk aggregation weights from the distance-minimization problem."},{"cited_title":"Ad- vances in Neural Information Processing Systems 33, 18215–18225 (2020)","cited_arxiv_id":null,"evidence_quote":"Introduces the idea of using loss on a worker's own data to measure objective similarity and weight neighbors accordingly."},{"cited_title":"IEEE Transactions on Signal and Information Processing ove r Networks 8, 610–626 (2022)","cited_arxiv_id":null,"evidence_quote":"Provides the BRIDGE baseline for Byzantine-resilient decentralized gradient descent with non-convex losses, which the paper extends to non-iid data."},{"cited_title":"Advances in Neural Information Pr ocessing Systems 34, 25044– 25057 (2021)","cited_arxiv_id":null,"evidence_quote":"Prior Byzantine-resilient decentralized algorithm that requires identical initialization and extra gradient exchange, motivating the paper's communication-light design."},{"cited_title":"Advances in neural information processing system s 30 (2017)","cited_arxiv_id":null,"evidence_quote":"Defines the foundational D-PSGD protocol whose local update and gossip aggregation structure the proposed algorithm builds on."}],"review_version":1}