{"id":"8349ba8c-1bdf-4953-a69e-858576618333","arxiv_id":"2501.04940","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"Granular-ball image compression into graphs improves privacy and efficiency in federated learning, but the paper does not show the claimed accuracy is maintained.","lead":"This paper turns raw images into coarse graph structures before federated learning, so clients share fewer pixel details. The authors argue this cuts communication cost and blocks reconstruction attacks while keeping classification accuracy.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central utility claim is unverifiable as reported: the main text never gives accuracy for GrBFL or baselines, and Table 2's PEUM can be high even if accuracy is low.","rationale":"The reader's designated weakest assumption—purity monotonicity—is a genuine algorithmic gap: Eq. 6 purity is not globally monotone in rectangle expansion on natural images, so the two-dimensional binary search in Section 4.2 can return suboptimal rectangles. However, I do not think that is the most load-bearing issue for the abstract's central claim. The claim that GrBFL 'maintains robust utility, consistently outperforming' other FL methods is not supported by any reported accuracy. Table 2's PEUM is a composite metric; without Acc values, and with phi hand-tuned in Eq. 9, high PEUM does not imply high accuracy. Eq. 5's swapped bias/variance labels mean the theory supposedly justifying utility preservation is invalid as written. Thus, even granting the segmentation algorithm, the paper's headline trade-off claim rests on missing evidence. My recommended verdict is unchanged: REJECT, with the concrete requirement that the authors report per-method accuracy before the claim can be evaluated.","tokens_in":10367,"tokens_out":4628,"duration_ms":47805,"concrete_test":"Run the provided GitHub code end-to-end on MNIST, CIFAR-10, and CIFAR-100 with the paper's settings, recording test accuracy for GrBFL (GAT/GCN/GIN/GraphSage) and the CNNFL baselines (plain CNN, DP, LotteryFL). If GrBFL accuracy is not at least as high as the best baseline on every dataset, the 'consistently outperforming' claim fails. A cheaper first check: search the repository for the Acc values used to compute Table 2 and verify that the harmonic-mean entries are consistent with Eq. 10.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The abstract and conclusion claim that GrBFL 'maintains robust utility' and 'consistently outperforms' other FL methods, but Section 5 reports no accuracy numbers. Table 2 only reports PEUM = 1/(1/Acc + 1/CE + 1/Sp) (Eq. 10); since Acc is absent, a high PEUM does not establish utility. CE is defined with a free scaling factor phi = 3 x 10^6 (Eq. 9), and Sp saturates with MSE (Eq. 8), so the composite metric can be dominated by privacy and efficiency terms. The theoretical support for utility preservation in Eq. 5 is also internally mislabelled: the first term is variance and the second is bias, so the claim that removing redundant information leaves 'model bias' unchanged while reducing 'variance' is not a valid argument. If GrBFL's accuracy is below the CNNFL baselines, the central trade-off claim fails even if the segmentation and aggregation mechanisms work exactly as described.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes GrBFL, a federated image-classification framework that replaces raw client images with coarse granular rectangles, maps these rectangles to a graph, and trains GNNs under FedProx aggregation. It introduces a two-dimensional binary search segmentation algorithm based on a purity constraint, and defines privacy, communication-efficiency, and composite metrics (Sp, CE, PEUM). Experiments on MNIST, CIFAR-10, and CIFAR-100 are used to claim that GrBFL simultaneously improves privacy and efficiency while maintaining or outperforming baseline utility relative to CNNFL methods with DP and LotteryFL.","tokens_in":10564,"tokens_out":7537,"duration_ms":74715,"significance":"The idea of protecting federated learning at the input level through granular-ball computing is potentially interesting, because it couples privacy with communication savings without relying on trusted aggregation or added noise. The manuscript also makes its code public and evaluates several GNN backbones, which is useful for reproducibility. However, as submitted, the central utility claim is unsupported: no accuracy numbers are reported, the theoretical utility argument in Eq. (5) rests on a mislabeled bias/variance decomposition, and the privacy and efficiency metrics are defined in ways that make the headline results partly follow from construction. The direction may be worth exploring, but the current paper does not demonstrate the claimed trade-off.","major_comments":[{"comment":"The central utility claim is not supported because the paper never reports classification accuracy for GrBFL or any baseline. PEUM in Eq. (10) is the harmonic mean of Acc, CE, and Sp, yet Acc appears nowhere in the main text; a high PEUM can be produced by high Sp and CE even if accuracy is poor. The abstract's assertion of \"robust utility\" and \"consistently outperforming\" other FL methods therefore cannot be checked, and no accuracy table or supplementary pointer with these values is provided.","section":"§5.3, Table 2"},{"comment":"The decomposition of expected generalization error swaps bias and variance. The first term, EDk[(Fk - ED[Fk])^2], is the variance of the predictions, and the second term, (EDk[Fk] - y)^2, is the squared bias; the text labels them in reverse. The subsequent argument that removing redundant information leaves \"model bias\" unchanged while reducing variance relies on this mislabeling and is not a valid theoretical basis for the utility-preservation claim. The data-noise term is also not clearly defined, since yDk is not specified as a noisy label.","section":"§3.3, Eq. (5)"},{"comment":"The two-dimensional binary search segmentation algorithm relies on the assertion that purity is globally monotonic under rectangle expansion: \"as the granular rectangle expands in any direction, its purity consistently decreases.\" This property is not proved and is not generally true for natural images, because expanding a rectangle can absorb neighboring pixels that are more similar to the center than the current boundary, which would increase purity. Since the algorithm's logarithmic complexity and the claimed privacy-utility trade-off depend on this monotonicity, the authors need to prove it under the definition in Eq. (6) or provide direct validation that the search returns the intended rectangles.","section":"§4.2"},{"comment":"The privacy score Sp is defined directly from the reconstruction MSE. Because GrBFL deliberately discards pixel-level information, its reconstructed images will have large MSE by construction, so Sp is high even if an attacker recovers all available semantic content. This makes the privacy evaluation partly tautological. A meaningful privacy measure should quantify what an adversary can infer under the stated threat model, including attack iterations and knowledge of node-feature semantics, and should be reported together with reconstruction examples and MSE trajectories.","section":"§5.2, Eq. (8)"},{"comment":"The communication-efficiency metric CE depends on a free scaling factor phi, chosen as 3e6, and on raw time and traffic measurements that are never reported. Without a sensitivity analysis for phi or the raw values, the claim that GrBFL has \"significantly higher\" CE than CNNFL is not reproducible and could be an artifact of the chosen scaling. This is load-bearing for the efficiency contribution.","section":"§5.2, Eq. (9); §5.3"},{"comment":"The table that motivates the choice of FedProx lists five aggregation methods (FedAvg, SCAFFOLD, FedNova, FedProx) but displays only four accuracy values, and the accuracy for FedProx is not among them. The claim that FedProx \"performed better\" is therefore not supported by the displayed data.","section":"§4.3, Table 1"}],"minor_comments":[{"comment":"Figure 2 is described as validating the privacy theory, but no experimental procedure or data source is given; the figure appears illustrative rather than evidential.","section":"§3.2, Figure 2"},{"comment":"The statement that \"common 224x224 image data\" is reconstructed in 1ms lacks hardware, software, and measurement details, so the timing is not reproducible from the manuscript.","section":"§4.4"},{"comment":"The figure caption refers to a comparison of \"differential privacy performance\" while the surrounding text describes reconstruction attacks; the caption should be aligned with the actual experiment.","section":"§5.3, Figure 4"},{"comment":"The text refers to the \"purity of the constructed granular-receptacle\"; this appears to be a typo for \"granular rectangle,\" and the sensitivity analysis does not report numeric values.","section":"§5.3, Parameter Sensitivity"}],"recommendation":"reject","confidential_remarks":"The input-level granular-ball idea is interesting and the code release is a plus, but the submitted manuscript does not support its central claims: utility is never reported, the theoretical utility argument is mislabeled, the privacy metric is partly tautological, and the efficiency metric depends on an unreported scaling factor. These are load-bearing issues that would require substantial new experiments and corrected analysis, not a local revision. I would suggest the authors consider a new submission after addressing these points."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nYou should know this paper proposes a genuinely new angle: instead of adding noise to gradients or encrypting updates, it replaces raw images with coarse granular rectangles built into graphs and trains a GNN under FedProx. The combination of granular-ball representation, variance-constrained 2D binary search, and proximal aggregation is new, and the authors link to code. That is worth a look.\n\nWhat works: the segmentation algorithm is concrete and the complexity analysis is reasonable. Measuring privacy as reconstruction error (low similarity between original and reconstructed image) is a coherent operational choice. The communication efficiency metric is ad hoc but not crazy.\n\nThe soft spots are serious. The main text never reports accuracy for GrBFL or any baseline. Table 1, which motivates FedProx, has a column alignment error: five methods listed, four percentages. The only comprehensive metric, PEUM, is the harmonic mean of accuracy, communication efficiency, and privacy score, but without accuracy numbers a high PEUM could be dominated by the privacy and efficiency terms. That undercuts the abstract's claim of consistent outperformance.\n\nOn the theory side, Eq. 5 swaps the labels of bias and variance. The first term is variance, the second is bias squared. The utility argument depends on saying 'model bias remains unchanged' when they mean variance; that is not a minor typo because the rationale for removing redundant information relies on it. The privacy analysis in Section 3.2 is intuition, not a bound: it argues that a reconstruction attack produces less information when the input has less information, but no formal guarantee is given. The purity-monotonicity assumption for the binary search is asserted, not proven; if purity can rise when the rectangle absorbs similar pixels, the optimal rectangle is not found. That is a testable concern, not a fatal one.\n\nThe input-perspective novelty is also overstated: there are input-space defenses in FL (e.g., input perturbation, learned representations) that are not surveyed. Self-citation to the authors' earlier granular-ball graph paper is fine; the new contribution is the FL adaptation, not the representation itself.\n\nWho would get value: a researcher curious about whether coarse-grained representations can act as a cheap privacy lever. The paper is a solid idea in search of evidence. I would send it to a serious referee, but I would expect the review to demand (a) accuracy tables on all three datasets, (b) a corrected bias-variance derivation, and (c) a check of the monotonicity assumption. In current form, the central claim is not supported.\n\nMy recommendation: engage with it, but don't trust the conclusions until the numbers are out. It deserves review, not desk rejection.","headline":"Interesting input-level privacy angle for federated learning, but the utility claim is unverifiable without accuracy tables and the bias-variance swap in Eq. 5 undercuts the theory.","tokens_in":11074,"tokens_out":4372,"would_cite":false,"duration_ms":42075,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Replacing raw images with coarse granular-rectangle graphs before federated training can protect privacy and cut communication costs while preserving accuracy, this paper argues.","keywords":["federated learning","granular-ball computing","privacy protection","graph neural networks","reconstruction attack","image classification","communication efficiency","variance-constrained segmentation"],"falsifier":"Take a synthetic grayscale image with a small noisy patch surrounded by a uniform region and run the purity-based binary search: if expanding the rectangle first increases purity (for example by absorbing many pixels within the threshold), the search will stop at a suboptimal rectangle. A measurable failure is a purity-versus-size curve that rises over some interval, which directly contradicts the monotonicity assumption and would invalidate the claimed logarithmic segmentation.","tokens_in":10166,"feed_emoji":"🔒","tokens_out":6812,"duration_ms":63232,"temperature":0.7,"pith_summary":"This paper tries to establish that federated learning can be made more private and more efficient by changing the input data itself rather than by adding defenses to the model or its parameters. It proposes Granular-Ball Federated Learning (GrBFL), which converts each image into a graph of coarse rectangular blocks found by a variance-constrained two-dimensional binary search. A graph neural network trained on these graphs is claimed to withstand reconstruction attacks, reduce communication cost, and keep classification accuracy competitive with competing federated methods. The paper reports experiments on MNIST, CIFAR-10, and CIFAR-100 supporting that balance.","feed_headline":"Images become graphs to hide data in federated learning","feed_subtitle":"Granular-block inputs cut communication cost and blunt gradient-based reconstruction attacks, this paper reports.","key_machinery":"The load-bearing object is the granular-rectangle graph, in which each node is a rectangular image region described by its center, dimensions, and mean, variance, maximum, and minimum gray values, and edges connect overlapping rectangles. To build it, the paper uses a two-dimensional binary search segmentation driven by a purity constraint: starting from the lowest-gradient pixel, the algorithm grows a rectangle while purity (the fraction of pixels within a gray-level threshold of the center) stays above a bound. The purity function is asserted to be globally monotonic under expansion, which turns the search into a logarithmic procedure. The resulting graph compresses the image, hides exact pixel values from gradient-based attackers, and serves as compact input to a graph neural network.","core_discovery":"GrBFL's central claim is that coarse granularity is sufficient representation for federated image classification while being substantially harder to reconstruct from gradients. The paper argues that removing redundant pixels lowers variance and data noise in the generalization-error decomposition without changing model bias, so utility can be preserved; and that because reconstruction attacks recover information only from what is sent, less input information caps what an attacker can recover. Under a proximal-term aggregation scheme, the graph inputs are said to stabilize federated training and improve communication efficiency. The implemented system is reported to outperform feature-level and model-level privacy defenses on the tested datasets.","pith_inferences":["If the granular-decomposition idea transfers, the same graph reconstruction could apply to non-image grid data such as medical volumes or sensor arrays, though the paper only tests natural images.","The privacy benefit is measured empirically through reconstruction similarity; a formal guarantee would require combining the information-loss argument with a rigorous bound, which the paper does not derive.","A stronger attacker who knows the segmentation algorithm's threshold and node-feature semantics might invert coarse blocks back to approximate pixel distributions, so the practical privacy gain depends on keeping those details confidential.","The monotonic purity assumption can be tested independently on real image statistics; if it fails, segmentation could be replaced by exhaustive or dynamic-programming search without changing the graph representation."],"forward_implications":["Reconstruction attacks that work on raw-pixel federated learning recover less information when gradients come from granular-rectangle graphs.","Communication cost per federated round drops because each client transmits a smaller model and less input-dependent state.","Classification accuracy on MNIST, CIFAR-10, and CIFAR-100 is maintained or improved relative to CNN-based federated baselines.","The proposed privacy score and PEUM metric offer a single-number way to compare FL methods across privacy, efficiency, and utility."],"supporting_citations":[{"why":"supplies the deep-leakage reconstruction attack used as the privacy evaluation baseline.","marker":"[Zhu et al.(2019)]"},{"why":"supplies the proximal-term federated aggregation that stabilizes graph-model training in the framework.","marker":"[Li et al.(2020a)]"},{"why":"introduces graph-based granular-ball image representation that the framework adapts for input reconstruction.","marker":"[Shuyin et al.(2023)]"},{"why":"establishes granular-ball computing as a coarse-grained learning primitive the framework relies on.","marker":"[Xia et al.(2019)]"},{"why":"frames the no-free-lunch tradeoff among security, utility, and efficiency that the paper targets.","marker":"[Zhang et al.(2022)]"},{"why":"defines FedAvg, the base aggregation the proximal term modifies.","marker":"[McMahan et al.(2017)]"}],"fun_headline_variants":["Coarse image regions hide data in federated learning","Granular-ball computing: prune pixels, preserve privacy in federated learning","Graph-based coarse inputs bolster federated learning privacy and speed","GrBFL turns images into graphs to resist reconstruction attacks","Less pixel detail, stronger privacy: GrBFL for federated learning"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The segmentation algorithm assumes that growing a rectangular block in any direction can only make the block less pure, and this monotonicity is used without proof to justify the binary search.","fun_headline_variants_meta":{"raw":{"variants":["Coarse image regions hide data in federated learning","Granular-ball computing: prune pixels, preserve privacy in federated learning","Graph-based coarse inputs bolster federated learning privacy and speed","GrBFL turns images into graphs to resist reconstruction attacks","Less pixel detail, stronger privacy: GrBFL for federated learning"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000331,"raw_usage":{"total_tokens":1784,"prompt_tokens":825,"completion_tokens":959,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":441,"completion_tokens_details":{"reasoning_tokens":873}},"tokens_in":441,"tokens_out":959,"duration_ms":9904,"temperature":1.0,"reasoning_tokens":873,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T21:21:04.426704+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a synthetic grayscale image with a small noisy patch surrounded by a uniform region and run the purity-based binary search: if expanding the rectangle first increases purity (for example by absorbing many pixels within the threshold), the search will stop at a suboptimal rectangle. A measurable failure is a purity-versus-size curve that rises over some interval, which directly contradicts the monotonicity assumption and would invalidate the claimed logarithmic segmentation.","supporting_citations":[{"cited_title":"Deep leakage from gradients","cited_arxiv_id":null,"evidence_quote":"supplies the deep-leakage reconstruction attack used as the privacy evaluation baseline."},{"cited_title":"Granular ball computing classifiers for efficient, scalable and robust learning","cited_arxiv_id":null,"evidence_quote":"establishes granular-ball computing as a coarse-grained learning primitive the framework relies on."},{"cited_title":"No free lunch theorem for security and utility in federated learning","cited_arxiv_id":null,"evidence_quote":"frames the no-free-lunch tradeoff among security, utility, and efficiency that the paper targets."},{"cited_title":"Communication-efficient learning of deep networks from decentralized data","cited_arxiv_id":null,"evidence_quote":"defines FedAvg, the base aggregation the proximal term modifies."}],"review_version":1}