{"id":"90eb2553-0625-44fd-b556-3abd5c4450cd","arxiv_id":"2501.14309","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"BrainGuard applies personalized federated learning with layer-wise parameter mixing to reconstruct viewed images from multisubject fMRI, reporting top NSD scores while keeping raw brain data local.","lead":"BrainGuard is a new training method that lets several people's brain scans be used together to reconstruct the images they saw, without pooling the raw scan data in one place. If it works as claimed, it could make brain-computer interfaces more accurate while keeping sensitive neural data local.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The core 'privacy-preserving' claim is unsupported: the paper equates keeping raw fMRI local with guaranteed privacy, but the shared per-subject and global model parameters are trained directly on that fMRI and no threat model, differential privacy, secure aggregation, or leakage analysis is…","rationale":"The paper is clearly written and the federated training recipe may be practically useful, but the central advertised property is privacy preservation. The text moves directly from 'we do not aggregate raw fMRI' to 'thereby ensuring privacy preservation' without a formal argument, and federated learning does not automatically provide privacy when model parameters are shared. This is not an internal inconsistency; it is a missing proof for a core claim, and the paper's own limitation section does not acknowledge the gap. I agree with the reader's weakest assumption. The proposed membership-inference test is a concrete, standard way to check whether the shared parameters leak information about individual training trials. The empirical benchmark is also weakened by test-set hyperparameter selection of m in Table 3 and by the absence of error bars, but I do not elevate that above the privacy gap because the title and abstract promise privacy as a contribution. Since the reader already conditioned acceptance on substantiating or removing the privacy claim, my read does not change the verdict.","tokens_in":16260,"tokens_out":6416,"duration_ms":69156,"concrete_test":"Run a membership-inference probe on the actual trained BrainGuard models. After training on NSD subjects 1, 2, 5, and 7, give an honest-but-curious aggregator access to the per-subject parameters θ'_s and the global parameters θ_g. For each subject, take a held-out set of fMRI trials from that subject and an equal number of training trials; compute the local model's loss or output confidence on each trial and threshold it to predict membership. Report attack AUC across subjects. If AUC is clearly above chance, the shared parameters leak trial-level brain information and the 'ensuring privacy' claim is falsified. If AUC is at chance, the specific attack fails, but the privacy claim still needs an explicit threat model and a formal leakage bound before it can be called privacy-preserving.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's first contribution and its title rest on 'ensuring privacy preservation' (Abstract, §3.1). The only mechanism offered is that raw fMRI is never aggregated: individual models transmit their updated parameters to a global model, and the global model is a weighted sum of per-subject EMA-smoothed parameters. This does not by itself imply privacy. In the federated-learning threat model the paper implicitly adopts (honest-but-curious server, or other participants with access to the global model), model parameters can encode information about the training data. The paper provides no differential privacy guarantee, no secure aggregation, no analysis of how much of an individual's fMRI can be recovered from θ'_s or from the global θ_g, and no explicit threat model at all. Appendix H lists limitations but omits any privacy caveat, which suggests the property is assumed rather than established. Because the advertised novelty is privacy, not just reconstruction accuracy, the central claim is not established unless this gap is addressed.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes BrainGuard, a federated global-local training framework for multisubject fMRI-to-image reconstruction. Each subject trains a local model on their own fMRI; after local training, per-subject EMA-smoothed parameters are aggregated into a global model, and the global parameters are then re-integrated into local models through a hybrid synchronization strategy: foundational layers are retained, intermediate layers are overwritten by the global model, and advanced layers are fused with the global model using a Dynamic Fusion Learner (DFL) module whose per-layer aggregation weights are learned. Training uses MSE and SoftCLIP losses to align fMRI embeddings with CLIP image/text embeddings, and inference uses a frozen Versatile Diffusion model. The paper claims that this architecture preserves privacy because raw fMRI data is never aggregated, and reports state-of-the-art reconstruction metrics on the NSD dataset (e.g., PixCorr 0.313, Incept. 96.1%, CLIP 96.4% in Table 1).","tokens_in":16463,"tokens_out":3749,"duration_ms":35150,"significance":"If the results hold, the accuracy gains in Table 1 are modest but consistent across most metrics, and the framework is a plausible way to exploit cross-subject commonalities without centralizing raw fMRI. The authors release code, report ablations of the synchronization strategy, and use standard, well-defined losses, which makes the experimental contribution reproducible in principle. The architectural idea of layer-wise hybrid synchronization, borrowing from FedALA, is reasonable and clearly described. However, the paper's central and advertised contribution is privacy preservation, and that claim is currently asserted rather than established. The paper provides no threat model, no differential privacy guarantee, no secure aggregation, and no leakage analysis. The stress-test concern about the privacy claim is therefore valid and load-bearing. The reconstruction accuracy results may be defensible, but the first claimed contribution—privacy—requires either a formal privacy analysis or a substantial reframing of the claims.","major_comments":[{"comment":"The privacy-preservation claim is not established. The paper equates keeping raw fMRI local with 'ensuring privacy preservation' (Abstract, §3.1), but the only mechanism offered is that individual models transmit updated parameters θ'_s and the global model is formed as θ_g = Σ_s k_s θ'_s. These parameters are trained directly on the local fMRI and may encode information about the training data. No threat model is defined, no differential privacy guarantee is provided, no secure aggregation is used, and no analysis or experiment quantifies how much of an individual's fMRI could be recovered from θ'_s or θ_g. Because privacy is the first stated contribution and appears in the paper's title, this is a load-bearing gap. Appendix H lists limitations but omits any privacy caveat, suggesting the property is assumed rather than demonstrated. The authors should either add a formal privacy analysis with a concrete threat model and leakage evaluation, or substantially weaken the privacy claims.","section":"Abstract and §3.1; Appendix H"},{"comment":"The DFL layer count m is selected on the test set. Table 3 shows that m=8 is chosen as the 'optimal setting' based on test-set performance, and all reported results are single-run with no error bars or variance estimates. This makes the claimed benchmark improvements susceptible to overfitting to the test set and to optimization noise. Additionally, the m=8 row in Table 3 (Alex(2) 95.2%, Alex(5) 98.1%, Incept. 96.3%, CLIP 96.5%, SwAV 0.354) does not exactly match the corresponding BrainGuard results in Table 1 (Alex(2) 94.7%, Alex(5) 97.8%, Incept. 96.1%, CLIP 96.4%, SwAV 0.353) for what appears to be the same configuration. The authors should clarify which result is the final one, report standard deviations or confidence intervals, and use a validation split for selecting m.","section":"Table 3 and §C.1"},{"comment":"The comparison protocol for baselines is underspecified. The paper reports results for eight previous methods, but it does not state whether these numbers are recomputed under the same train/test split and inference protocol (including the retrieval-enhanced inference described in Appendix B) or taken from the original papers. If they are taken from the original papers, the comparison may not be apples-to-apples, especially because the retrieval mechanism can substantially affect high-level metrics. Please clarify how baseline numbers were obtained and, if possible, report results under a unified evaluation protocol.","section":"§4.1 and Table 1"}],"minor_comments":[{"comment":"The checkmark notation in Table 2 is ambiguous; the text says the first row is BrainGuard without the hybrid synchronization strategy, but the row labels for the checkmarked rows are not explicit. Please label each row clearly (e.g., 'none', 'Found.+Inter.', 'Found.+Inter.+Advan.').","section":"§4.2, Table 2"},{"comment":"The text states '31.3%, 33.0%' for PixCorr and SSIM, but these metrics are not percentages; they should be reported as 0.313 and 0.330 to avoid confusion with the percentage-based high-level metrics.","section":"§4.1, quantitative results text"},{"comment":"The retrieval-enhanced inference mechanism is described only in the appendix. Since it may significantly affect the reported metrics, it should be described in the main text or at least referenced explicitly when the reconstruction results are presented.","section":"Appendix B and §4.1"},{"comment":"There are typos: 'exiting' should be 'existing' in Section 1, and 'perserving' should be 'preserving' in the contribution list.","section":"Introduction"},{"comment":"The t-SNE visualization in Figure 2 is informal and not quantified. If the claim is that BrainGuard better aligns subject-specific embeddings, please provide a quantitative alignment metric or a more systematic analysis.","section":"Figure 2"}],"recommendation":"major_revision","confidential_remarks":"The privacy gap is the central issue. The reconstruction results may be publishable after the authors either provide a privacy analysis or recast the contribution as a collaborative training framework without privacy guarantees. I also note that the DFL module is explicitly taken from FedALA, so the novelty rests on the hybrid synchronization and the application domain; the current framing overstates the privacy contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick read: this is a sensible, clearly written application of personalized federated learning to fMRI-to-image reconstruction, and the reconstruction numbers are believable. The problem is the headline claim: 'privacy-preserving' is asserted, not established. If you read it as a federated training recipe, fine. If you read the privacy promise, it doesn't hold up.\n\nWhat's actually new: it's the first use of federated parameter sharing for multisubject brain decoding. The hybrid synchronization—low layers stay local, middle layers are overwritten by the global model, high layers are adaptively fused via a Dynamic Fusion Learner—is a reasonable inductive bias for fMRI's subject variability. The ablation in Table 2 shows each component helps. The NSD results are modest but consistent: PixCorr 0.313 vs MindEye's 0.309, Inception 96.1% vs 93.8%, and they beat their own Psychometry on most metrics. No error bars, but the gains are in the same direction everywhere, so I'd trust the trend, not the exact digits.\n\nSoft spots in order. First, the privacy claim. Keeping raw fMRI local is necessary but not sufficient. Model parameters are trained directly on sensitive data and can encode it; there is no threat model, no differential privacy, no secure aggregation, no leakage analysis. The abstract says 'thereby ensuring privacy preservation,' but nothing in the paper supports that word 'ensuring.' This is load-bearing because privacy is the first contribution. Second, the DFL layer count m=8 is selected from Table 3 on the test set, which flatters the headline numbers. Results are single-run. Third, the algorithm is FedAvg plus FedALA's dynamic fusion; the novelty is the application, not the mechanism. To their credit, they cite the source and the derivation is transparent; no equation reduces to a fitted result.\n\nI think the paper is worth reviewing as a systems/benchmark contribution, not as a privacy contribution. A serious referee should ask the authors to either add a concrete privacy analysis (even a heuristic leakage study) or drop 'privacy-preserving' from the title and abstract. I wouldn't cite this for privacy, but I'd point someone to it as a clean application of FL to brain decoding.\n\nRecommendation: send it to review with privacy as the major condition. Also bring it to the reading group if you want to discuss how 'privacy-preserving' gets used loosely in ML papers.","headline":"Federated brain decoding that works, but the privacy claim is unsupported.","tokens_in":17009,"tokens_out":2687,"would_cite":false,"duration_ms":24949,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"BrainGuard claims that a privacy-preserving global-local framework with hybrid synchronization reconstructs images from multisubject fMRI at state-of-the-art accuracy without ever sharing raw brain data.","keywords":["fMRI","image reconstruction","brain decoding","privacy-preserving machine learning","federated learning","multisubject modeling","hybrid synchronization","CLIP embeddings"],"falsifier":"An attacker with access to the shared per-subject EMA-smoothed parameters and the global model could try to reconstruct or match a subject's held-out fMRI responses via model inversion or membership inference; if the attacker succeeds beyond chance, the privacy claim is falsified. A concrete test is to train a linear probe on the shared parameters to classify which subject each parameter vector came from, or to attempt to recover binned voxel patterns from the parameters.","tokens_in":16038,"feed_emoji":"🧠","tokens_out":8213,"duration_ms":58767,"temperature":0.7,"pith_summary":"BrainGuard proposes a way to train one image-reconstruction model across multiple people's fMRI scans without ever pooling the raw brain data. Each subject keeps a private local model; a shared global model aggregates only EMA-smoothed model parameters, and a hybrid synchronization strategy decides which layers stay personal, which copy the global model, and which are adaptively blended. The paper reports state-of-the-art reconstruction quality on the Natural Scenes Dataset, including PixCorr 0.313, Inception 96.1%, and CLIP 96.4%, from a single training session across four subjects. The central claim is that privacy and multisubject generalization can be achieved together, and the hybrid layer-wise synchronization is what makes the trade-off work.","feed_headline":"Federated brain decoding reconstructs images without sharing fMRI","feed_subtitle":"BrainGuard's global-local training beats prior multisubject reconstruction on NSD while keeping raw brain data local.","key_machinery":"The load-bearing mechanism is the global-local collaborative training loop combined with a hybrid synchronization strategy. The loop runs three steps: each subject trains a private model on local fMRI; individual parameters are EMA-smoothed and aggregated into a global model with subject-size weights; then each local model is updated from the global model in a layer-dependent way. The hybrid strategy has three branches: retention (foundational layers are never updated from global), global alignment (intermediate layers are overwritten by global parameters), and adaptive tuning (advanced layers are fused element-wise via a Dynamic Fusion Learner, which learns blending weights $W_s^m$ in $[0,1]$ by gradient descent on the reconstruction loss). This design is what lets the model balance subject-specific neural signatures against cross-subject commonalities without centralizing data.","core_discovery":"BRAIN GUARD's central claim is that multisubject fMRI-to-image reconstruction can be made privacy-preserving without sacrificing accuracy: a global-local collaborative framework in which raw fMRI never leaves each subject, combined with a hybrid synchronization strategy, outperforms both subject-specific and centralized multisubject methods. The global model is formed by aggregating EMA-smoothed parameters from individual models with weights proportional to each subject's data size. The hybrid synchronization then transfers global knowledge back selectively: foundational layers are retained locally to preserve subject-specific neural signatures, intermediate layers are globally aligned to capture shared patterns, and advanced layers are adaptively fused through a Dynamic Fusion Learner that learns per-parameter blending weights. On the NSD benchmark, this yields state-of-the-art results across low-level and high-level metrics, e.g., PixCorr .313, SSIM .330, Alex(5) 97.8%, Incept. 96.1%, CLIP 96.4%, with lower distance metrics EffNet-B .624 and SwAV .353, improving on prior multisubject and subject-specific methods.","pith_inferences":["The privacy story is weaker than the phrase 'ensuring privacy preservation' implies: sharing EMA-smoothed model parameters can still leak information about the training data through model-inversion or membership-inference attacks, and the paper provides no differential privacy or secure aggregation analysis. A concrete attack experiment would clarify how much protection 'parameters only' actually ","The DFL layer-count ablation shows a sweet spot at eight aggregated layers rather than monotone gains, suggesting that lower global-model layers carry generic features while upper layers need subject-specific tuning; testing more network depths or fusion schedules could turn this heuristic into a design rule.","Because the global model is a weighted average of EMA-smoothed local parameters, its ability to capture intersubject commonalities is limited to what survives averaging; adding explicit alignment losses or clustering subjects might improve the global model further."],"forward_implications":["A single training session across subjects replaces per-subject training runs, so adding a new subject requires only local adaptation, not retraining all previous models.","The shared global model can be used as a starting point for new subjects with little data, potentially reducing the hours of fMRI needed for personalized decoding.","Because raw fMRI never leaves the local site, multisubject models can be trained across hospitals or labs that cannot share brain scans, enabling larger collaborative datasets.","The hybrid synchronization pattern offers a general recipe for other high-dimensional, subject-heterogeneous biosignals, as the paper itself notes for EEG and MEG."],"supporting_citations":[{"why":"Supplies the Natural Scenes Dataset (NSD) used for all experiments.","marker":"Allen et al. 2022"},{"why":"FedALA is the source of the Dynamic Fusion Learner and the adaptive local aggregation idea.","marker":"Zhang et al. 2023"},{"why":"CLIP embeddings define the target space that the fMRI predictors are trained to match.","marker":"Radford et al. 2021"},{"why":"MindEye is a strong baseline and provides the SoftCLIP loss used for training.","marker":"Scotti et al. 2023"},{"why":"MindBridge is the cross-subject baseline whose subject-specific embeddings are compared in t-SNE.","marker":"Wang et al. 2024"},{"why":"Psychometry is the omnifit multisubject baseline that BrainGuard claims to surpass.","marker":"Quan et al. 2024"},{"why":"Brain-Diffuser provides the retrieval-enhanced inference protocol that BrainGuard follows.","marker":"Ozcelik and VanRullen 2023"},{"why":"Versatile Diffusion is the frozen diffusion model used to turn predicted CLIP embeddings into images.","marker":"Xu et al. 2023"}],"fun_headline_variants":["BrainGuard: federated training for multisubject image reconstruction","Privacy-first brain decoding: reconstruct images without sharing fMRI","Multisubject brain decoding with no raw data exchange: BrainGuard","Hybrid synchronization boosts federated brain decoding accuracy"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The privacy guarantee rests on the unstated premise that sharing EMA-smoothed model parameters, rather than raw fMRI, is sufficient to keep sensitive brain data private, a premise the paper never verifies with privacy analysis or attacks.","fun_headline_variants_meta":{"raw":{"variants":["BrainGuard: federated training for multisubject image reconstruction","Privacy-first brain decoding: reconstruct images without sharing fMRI","Multisubject brain decoding with no raw data exchange: BrainGuard","Hybrid synchronization boosts federated brain decoding accuracy"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000976,"raw_usage":{"total_tokens":4167,"prompt_tokens":989,"completion_tokens":3178,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":605,"completion_tokens_details":{"reasoning_tokens":3110}},"tokens_in":605,"tokens_out":3178,"duration_ms":19639,"temperature":1.0,"reasoning_tokens":3110,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T15:15:09.878246+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"An attacker with access to the shared per-subject EMA-smoothed parameters and the global model could try to reconstruct or match a subject's held-out fMRI responses via model inversion or membership inference; if the attacker succeeds beyond chance, the privacy claim is falsified. A concrete test is to train a linear probe on the shared parameters to classify which subject each parameter vector came from, or to attempt to recover binned voxel patterns from the parameters.","supporting_citations":[{"cited_title":"J.; St-Yves, G.; Wu, Y.; Breedlove, J","cited_arxiv_id":null,"evidence_quote":"Supplies the Natural Scenes Dataset (NSD) used for all experiments."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"FedALA is the source of the Dynamic Fusion Learner and the adaptive local aggregation idea."},{"cited_title":"W.; Hallacy, C.; Ramesh, A.; Goh, G.; Agarwal, S.; Sastry, G.; Askell, A.; Mishkin, P.; Clark, J.; et al","cited_arxiv_id":null,"evidence_quote":"CLIP embeddings define the target space that the fMRI predictors are trained to match."},{"cited_title":"S.; Banerjee, A.; Goode, J.; Shabalin, S.; Nguyen, A.; Cohen, E.; Dempster, A","cited_arxiv_id":null,"evidence_quote":"MindEye is a strong baseline and provides the SoftCLIP loss used for training."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"MindBridge is the cross-subject baseline whose subject-specific embeddings are compared in t-SNE."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Psychometry is the omnifit multisubject baseline that BrainGuard claims to surpass."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Brain-Diffuser provides the retrieval-enhanced inference protocol that BrainGuard follows."}],"review_version":1}