{"id":"4edce75b-fe4f-40e1-af8f-a7a1d4d7d379","arxiv_id":"2502.02038","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"An FL scheme combining client grouping, gradient splitting, performance-based malicious detection, and threshold encryption aims to resist gradient inversion and poisoning attacks, claiming over 95% malicious-client localization accuracy.","lead":"SMTFL is a proposed federated learning system that hides client gradients from other clients and the server while detecting and removing clients that upload poisoned updates. It might interest engineers and researchers building privacy-preserving collaborative machine learning without a trusted coordinator, but the security arguments and experimental evidence contain significant gaps.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Section IV-B's detection rule is internally inconsistent: with threeva=6, any client with evai<6 is flagged malicious, so even a neutral epoch (evai=0) removes every client; the reported >95% detection rates cannot follow from the stated algorithm.","rationale":"The reader's verdict is REJECT, and I agree that the central claims are not supported. The reader's weakest_assumption focuses on the unstated labeled evaluation oracle; that is a serious gap. However, the more decisive problem is that the detection algorithm in Section IV-B, as formally written, cannot work at all. The threshold rule evai < threeva with threeva=6 and scores of at most +1 means any client whose cumulative score is not at least 6 is classified malicious; since scores start effectively at 0 and each epoch contributes at most +1, every client is removed almost immediately. This is not a missing detail but an internal inconsistency in the paper's own formalism. The reader did note the 'improvement assigned -1' inconsistency in the rationale, so there is partial agreement, but the reader did not elevate this to the primary weakest assumption. I have therefore made the scoring/threshold bug the load-bearing concern, with the performance oracle as a secondary issue. The concrete test is a minimal simulation that would settle the point definitively; if the authors respond by clarifying an initialization or a corrected comparison, the test would then shift to whether the corrected rule, together with the unspecified evaluation oracle, can actually produce the reported accuracy. Since this internal flaw independently supports rejection, the reader's REJECT verdict stands unchanged.","tokens_in":18838,"tokens_out":5472,"duration_ms":60797,"concrete_test":"Implement Equations (4) and (5) exactly as written in Section IV-B, with Table II's threeva=6, initial evai=0, and per-epoch scores from the three bullets (-1, 0, -1; optionally corrected to +1 for improvement). Simulate one training epoch for a single group of three clients under each of the three performance-change scenarios and evaluate the malicious predicate evai < threeva. If the predicate is true for evai=0 or evai=-1, the algorithm as specified classifies all clients as malicious in the first epoch, disproving the reported detection and false-positive rates. If the authors intended a different initialization or comparison (e.g., evai < -threeva), the paper must state it precisely and the experiments must be re-run under that corrected rule.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim—locating malicious clients with >95% accuracy and FPR <5%—rests entirely on the scoring rule in Section IV-B. As written, that rule is not merely underspecified; it is self-defeating. Each client accumulates evai as the sum of per-epoch scores, where the three cases assign -1, 0, and -1 (the third case, performance improvement, is assigned -1 in the text, despite the later sentence saying +1 helps mitigate false positives). A client is classified malicious when evai < threeva, with threeva=6 in Table II. Since scores are -1, 0, or +1, and evai is not given any positive initialization, after the first epoch every client has evai in {-1, 0, +1}, all of which are strictly less than 6. Even a client whose group produced no significant performance change receives evai=0, and 0 < 6 is true, so that client is immediately removed as malicious. Under the stated equations and parameters, the algorithm removes all clients in the first epoch, making the experimental results (100% localization, 0% false positives at threeva=6) impossible to reproduce. Correcting the apparent typo in the third bullet to +1 does not help: evai=0 after a neutral epoch still satisfies 0 < 6. The threshold comparison would need to be something like evai < -threeva, or evai must be initialized above threeva, or scores must accumulate differently; none of this is specified. This is a load-bearing internal inconsistency, not a missing parameter: it breaks the detection mechanism that the paper's main contribution depends on.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"SMTFL proposes a federated learning scheme that claims to protect gradient privacy and detect malicious clients without any trusted participant. Clients are grouped in triples and their gradients are split or masked locally so that no single client or the server can recover an individual gradient. To detect poisoning, the server evaluates the impact of each group's aggregated gradient on global model accuracy, assigns per-epoch scores to the group members, and removes clients whose cumulative score falls below a threshold. Detected poisoning gradients are then decrypted via threshold encryption and removed from the global model using federated unlearning. The paper reports over 95% malicious-client localization accuracy, a false positive rate below 5%, and near-restoration of model accuracy on four datasets and two models.","tokens_in":19174,"tokens_out":9587,"duration_ms":97256,"significance":"If the claims held, SMTFL would be a practical contribution to federated learning security: it addresses both gradient inversion and poisoning attacks without trusted participants, avoids noise injection, and avoids complex cryptographic aggregation. The paper has useful elements: experiments on four datasets, a comparison table with related work, and measurements of encryption/storage overhead. However, the central detection rule in Section IV-B is internally inconsistent and, as written, would remove all clients in the first epoch, making the headline claims impossible to reproduce. The paper also leaves unspecified the labeled evaluation data needed to measure global model performance. Until these load-bearing issues are resolved, the significance of the contribution is not established.","major_comments":[{"comment":"The detection rule is internally inconsistent and self-defeating. The three per-epoch scores are -1 (degradation), 0 (neutral), and -1 (improvement); with threeva=6, after the first epoch every client has evai in {-1, 0}, both of which are strictly less than 6, so the condition evai < threeva removes every client immediately. Even if the third bullet's -1 is corrected to the +1 mentioned later in the same section, a neutral client with evai=0 still satisfies 0 < 6. The reported detection rates in Table IV (e.g., 100% at threeva=6) therefore cannot be produced by the stated algorithm. This is a load-bearing inconsistency that invalidates the paper's central empirical claim.","section":"Section IV-B, Eqs. (4)-(5), Table II, Table IV"},{"comment":"The detection mechanism requires the server to measure Prek, the global model's performance, each epoch, but the paper never specifies the labeled evaluation data used for this measurement, its size, or who holds it. The threat model and Table VI explicitly state that SMTFL requires no clean data on the server ('Clean data in server ×'), so it is unclear whether the server has any data on which to measure accuracy. Without this performance oracle, the scoring rule cannot be instantiated, and the experimental results cannot be reproduced. The authors should either state the validation-set assumption explicitly or modify the threat model.","section":"Section IV-B and Section III"},{"comment":"The proof is not a formal security argument and is partially circular. For poisoning, it says 'the group's gradients will not be integrated into the global model' based on the Section IV-B rule, but the rule only assigns scores after the group gradient has been aggregated and its effect on the global model has been observed; Section IV-C even acknowledges that poisoning gradients are integrated before detection. For collusion, the deterrence argument assumes a semi-honest client values hiding its own gradient from the other colluders more than it values learning the target gradient; this is an unstated payoff assumption, not a consequence of the protocol. A precise adversary model or a game-theoretic statement is needed.","section":"Section V, Lemma 2"},{"comment":"The federated unlearning formula is underspecified. The weight omega_{c_j_mali} is never defined, and k is used as the epoch index throughout the paper but here denotes the number of malicious clients; the denominator m-k also mixes the total number of clients with the number of malicious clients. Without a definition of omega and consistent notation, the claim that the global model is 'nearly restored to its pre-attack state' is not supported by a well-defined update rule.","section":"Section IV-C, Eq. (9)"},{"comment":"The threshold tau for the allowable performance change is never assigned a value, although the scoring rule depends critically on comparing Prek-1 - Prek with tau. Table II lists threeva but not tau, and Section VI does not report tau for any experiment. This omission makes the detection experiments irreproducible even after the scoring-sign issue is fixed.","section":"Section IV-B and Table II"}],"minor_comments":[{"comment":"The word 'aviods' in the abstract is a typo and should be 'avoids'.","section":"Abstract"},{"comment":"The assignment of -1 in the performance-improvement scenario contradicts the immediately preceding sentence, which says no poisoning attack event is detected, and also contradicts the later note that assigning evak_i = 1 helps mitigate false positives. These statements need to be reconciled.","section":"Section IV-B, third bullet"},{"comment":"There are several typos and grammatical errors in this subsection, including 'Dataci_decryed' (should be 'Dataci_decrypted') and 'these clients has cooperating with cmali'. Please proofread carefully.","section":"Section IV-C, Eq. (7) and surrounding text"},{"comment":"The 'Stage' column in Table III is empty, and the table caption does not explain how the rows are grouped by attack method; the reader has to infer the attack type from the row labels. The table should be restructured or annotated.","section":"Section VI-B, Table III"},{"comment":"The caption refers to panels (A)-(D) and to the four transmission stages {g1_A, g2_A+epsilon_A, gA2_B, gA,B,C}, but the figure itself is not described in enough detail for the reader to map the reconstructed images to these stages.","section":"Fig. 5 caption"}],"recommendation":"major_revision","confidential_remarks":"The paper has a promising idea but the main detection algorithm as written is logically broken and the experiments are not reproducible. I chose major_revision rather than reject because the flaws are fixable in principle: the scoring sign and threshold condition can be corrected, the validation-data assumption can be stated explicitly, and the missing parameter values can be reported with re-run experiments. However, if the authors cannot produce a consistent detection rule and re-evaluate all claimed metrics under it, the paper should not be published. The manuscript also needs careful editing for notation consistency and English grammar."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the architecture is a genuine novelty — dynamic triples, gradient splitting with per-client epsilons, threshold-shared decryption, and unlearning — and the checks-and-balances intuition is worth a conversation. But Section IV-B, the detection rule that carries the experiments, is broken as written. The third scenario says no poisoning is detected yet assigns evak_i = -1; and with scores in {-1,0,-1} and threeva=6, every client's cumulative score after one epoch is below 6, so the rule removes everyone. The reported >95% localization / <5% FPR cannot come out of this algorithm unless there is a missing minus sign or an initialization. The paper also never says where the performance oracle Prek gets its labeled data, despite claiming the server collects no public data; without that oracle the whole detection mechanism has no input. Lemma 2's proof does not establish what it claims: in the described collusion, cB and cC can expose cA without exposing themselves; the checks and balances only hold if all three collude, and the proof cannot rule out two. Eq. (9) uses an undefined omega and is not a recognized unlearning rule. Experiments have no error bars, no code, no baselines, and some numbers (CIFAR-10 attacked accuracy above no-attack at 5% malicious) strain credibility.\n\nWhat should get credit: the paper correctly identifies that most prior work handles only one threat, and the combination of privacy and poisoning defense without trusted parties or heavy crypto is a reasonable thing to want. The dynamic grouping with intentional re-mixing is a sensible way to reduce false positives. The threshold-encryption storage design is standard but competently described.\n\nBottom line: this is a paper for a reading group that wants a cautionary example of how a plausible design can break at the scoring rule, not for someone building on it. I would not send it to peer review in its current form; the central claim is unsupported by the stated algorithm. If the authors fix the detection rule, specify the oracle, and release code, it might become a serious submission.","headline":"A genuinely novel combination of privacy and poisoning defenses, but the detection rule that carries the paper is self-defeating as written, so the reported 95% localization rates are unreproducible.","tokens_in":19713,"tokens_out":3606,"would_cite":false,"duration_ms":37642,"reading_group":"no","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"SMTFL claims federated learning can resist gradient-inversion and poisoning attacks without any trusted participant, using dynamic three-client groups, group-performance scoring, and consensus-decrypted unlearning.","keywords":["federated learning","secure aggregation","gradient inversion attack","poisoning attack","malicious client detection","federated unlearning","threshold encryption","untrusted participants"],"falsifier":"Run SMTFL exactly as specified but give the server no labeled evaluation data, then attempt label-flipping and random-update poisoning; if malicious clients are still located with the claimed accuracy, the performance-change mechanism is not the active ingredient, and if they are not, the unspecified oracle is confirmed as the load-bearing assumption.","tokens_in":18591,"feed_emoji":"🛡️","tokens_out":6395,"duration_ms":62011,"temperature":0.7,"pith_summary":"Federated learning normally has to choose between protecting client gradients with noise or encryption and defending the global model against poisoned updates; SMTFL claims to do both with no trusted participant. The scheme groups clients into dynamic triples, splits one client's gradient into two shares that hide the other gradients in the group, and sends only a combined group gradient to the server. Malicious clients are found by watching whether a group's aggregated gradient degrades the global model's performance, with clients accumulating negative scores until they pass a threshold and are removed. Each client's gradient history is encrypted and stored, and decryption requires consensus from many clients, after which a federated-unlearning step cancels the poisoner's contribution from the model. If the evaluation results hold, an FL system can keep training data private and the model correct even when the server and every client are curious or hostile.","feed_headline":"Group-of-three clients block gradient theft and poisoning attacks","feed_subtitle":"No trusted server or clean data needed; poisoners found at over 95%, honest false positives under 5%.","key_machinery":"The load-bearing mechanism is a dynamic group of exactly three clients acting as a mutual-checking unit. Within each triple, one client's gradient is split into two shares, and the other group members add their own gradients plus per-client negotiated perturbations, so the combined group gradient hides every individual gradient from every other participant while the server, knowing the perturbations, recovers only the group sum. The same triple then receives a unified performance-based score from the server's measurement of global-model accuracy change, and the cumulative score decides expulsion; threshold-encrypted storage of gradient shares, based on Shamir secret sharing with decryption requiring a threshold number of shares, plus a federated-unlearning correction is what lets the system erase a convicted client's historical influence.","core_discovery":"On its own terms, the paper establishes a secure-aggregation and poisoning-defense protocol for federated learning in which no participant—server or client—is trusted. Confidentiality comes not from noise or homomorphic encryption but from arranging clients in groups of three: one client's gradient is split, each group member receives an obfuscated share, and a single group gradient reaches the server, while the server's per-client perturbations let it recover only the sum. Integrity comes from evaluating each group by the global model's performance change after its gradient is applied; a group that causes a drop beyond a threshold gets negative scores, and a client whose cumulative score falls below a preset threshold is expelled. The paper further claims that the stored encrypted gradients of an expelled client can be decrypted under majority consensus and removed through federated unlearning, so model accuracy returns roughly to its pre-attack level. Across four image datasets and two models, it reports over 95 percent accuracy in locating malicious clients with honest-client false positives within 5 percent, under label-flipping, random-update, and PGD poisoning as well as gradient-inversion attacks.","pith_inferences":["Inference: the rational-collusion argument depends on each client valuing its own gradient secrecy above the gain from exposing a peer; a formal game-theoretic treatment or an adversarial client that accepts self-exposure would stress this premise.","Inference: performance-based group scoring will struggle whenever the server lacks a trustworthy labeled evaluation set; in practice the labeled data used to compute performance must come from somewhere, and its source is left unspecified, so a deployment would need a separate validation set.","Inference: the unlearning correction subtracts gradients as if the global gradient were a linear sum; with non-convex models and multi-step local updates, the actual influence of a poisoner may not cancel cleanly, so the restoration claim should be tested on models where updates interact nonlinearly.","Inference: the group-of-three design suggests a tunable trade-off between privacy and detection granularity; larger groups would hide gradients better but coarsen the blame assigned by performance scoring, so an extension could make group size adaptive to collusion risk."],"forward_implications":["Federated learning can be run with a semi-honest server and malicious clients simultaneously, closing a gap left by defenses that assume either a trusted server or a trusted majority of clients.","Because gradients are protected by splitting and regrouping rather than by noise, the global model need not pay the accuracy cost typical of differential-privacy defenses.","The server needs no public or clean dataset per client, removing a common requirement of poisoning defenses that bootstrap trust from server-held data.","A convicted client's past contributions are retroactively canceled from the model via stored encrypted gradients and federated unlearning, not merely ignored in future rounds.","Grouped aggregation changes training dynamics slightly, and the paper's measurements indicate comparable or slightly improved convergence relative to individual-client uploads."],"supporting_citations":[{"why":"Supplies the gradient-inversion attack that SMTFL's gradient-secrecy design must defeat.","marker":"[7]"},{"why":"Is the main trusted-server poisoning defense that SMTFL contrasts with because it requires the server to collect public data.","marker":"[14]"},{"why":"Is the prior approach addressing both input privacy and integrity, whose complexity SMTFL aims to avoid.","marker":"[18]"},{"why":"Defines federated unlearning, the technique SMTFL uses to erase a malicious client's historical gradients.","marker":"[19]"},{"why":"Provides the Shamir threshold secret sharing used to spread decryption power across clients.","marker":"[25]"},{"why":"Is used both as a Byzantine-robust aggregation baseline and as the random-update attack scenario.","marker":"[34]"},{"why":"Supplies the label-flipping poisoning setting and an anomaly-detection baseline.","marker":"[39]"},{"why":"Is the deep-leakage gradient-inversion method used to test whether reconstructed images remain unrecognizable.","marker":"[41]"},{"why":"Is the historical-gradient recovery approach whose per-client storage SMTFL compares against.","marker":"[42]"}],"fun_headline_variants":["Trios split gradients to block attacks in trust-free federated learning","No trusted party: group-of-three obfuscation defeats gradient and poison attacks","Group-of-three gradient splitting catches 95% of poisoners in federated learning","Federated learning without trust: trio obfuscation and unlearning defend models","Secure FL with no trusted server: trios obfuscate, unlearn poison"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole malicious-client detection mechanism assumes the server can measure the global model's performance on labeled evaluation data after every epoch, but the paper never states where that labeled data comes from, who supplies it, or how the performance thresholds are set; without that performance oracle, no group can even be scored.","fun_headline_variants_meta":{"raw":{"variants":["Trios split gradients to block attacks in trust-free federated learning","No trusted party: group-of-three obfuscation defeats gradient and poison attacks","Group-of-three gradient splitting catches 95% of poisoners in federated learning","Federated learning without trust: trio obfuscation and unlearning defend models","Secure FL with no trusted server: trios obfuscate, unlearn poison"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00023,"raw_usage":{"total_tokens":1526,"prompt_tokens":1031,"completion_tokens":495,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":647,"completion_tokens_details":{"reasoning_tokens":390}},"tokens_in":647,"tokens_out":495,"duration_ms":5310,"temperature":1.0,"reasoning_tokens":390,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-09T13:34:20.005847+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run SMTFL exactly as specified but give the server no labeled evaluation data, then attempt label-flipping and random-update poisoning; if malicious clients are still located with the claimed accuracy, the performance-change mechanism is not the active ingredient, and if they are not, the unspecified oracle is confirmed as the load-bearing assumption.","supporting_citations":[{"cited_title":"Agic: Approximate gradient inversion attack on federated learning,","cited_arxiv_id":null,"evidence_quote":"Supplies the gradient-inversion attack that SMTFL's gradient-secrecy design must defeat."},{"cited_title":"Eiffel: Ensuring integrity for federated learning,","cited_arxiv_id":null,"evidence_quote":"Is the prior approach addressing both input privacy and integrity, whose complexity SMTFL aims to avoid."},{"cited_title":"A blockchain-based shamir’s threshold cryptography scheme for data protection in industrial internet of things settings,","cited_arxiv_id":null,"evidence_quote":"Provides the Shamir threshold secret sharing used to spread decryption power across clients."},{"cited_title":"Auror: Defending against poisoning attacks in collaborative deep learning systems,","cited_arxiv_id":null,"evidence_quote":"Supplies the label-flipping poisoning setting and an anomaly-detection baseline."},{"cited_title":"Fedrecover: Recovering from poisoning attacks in federated learning using historical information,","cited_arxiv_id":null,"evidence_quote":"Is the historical-gradient recovery approach whose per-client storage SMTFL compares against."}],"review_version":1}