{"id":"5c1e923e-110b-4230-895c-7bfe56eaa741","arxiv_id":"2502.02720","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":1,"one_line_summary":"A risk-aware role-to-VM assignment problem using KL-divergence and mutual information as sensitive-property metrics is formulated, claimed NP-complete, and evaluated with two heuristics.","lead":"This paper assigns cloud roles to virtual machines to minimize the risk that attackers infer sensitive statistical patterns from shared data. It formulates the assignment as an optimization problem, claims NP-completeness, and tests two heuristics on check-in data.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The NP-completeness proof in Theorem 3.1 reduces TSP to RSPAP, but the constructed RSPAP objective is a sum of per-role maxima, not the TSP tour cost, so the reduction is invalid and the central theoretical claim is unsupported.","rationale":"The NP-completeness proof is the load-bearing component of the paper's central claim. The paper's contribution is explicitly framed as formulating RSPAP and showing it NP-complete, then proposing heuristics because of that hardness. If Theorem 3.1 is invalid, the problem might still be hard, but the paper provides no evidence of that; the heuristics are then presented without a proven need for approximation. The reader's weakest_assumption identifies exactly this invalid TSP reduction, and my reading of Eq. 5 and the constructed f confirms the mismatch: the RSPAP objective is a sum over roles of maxima of leakage probabilities to adjacent roles, whereas TSP cost is a sum over edges of a Hamiltonian cycle. Even after correcting the evident typo d_{i,i} to d_{i,j}, the objective is not preserved. The empirical evaluation is also weak, with no baselines, no error bars, and no reproducibility artifacts, but the theoretical flaw is sufficient on its own to reject the central claim. I therefore agree with the reader's REJECT verdict and recommend no change. I do credit the paper for using a real check-in dataset and a concrete risk model, but those do not repair the invalid NP-completeness argument.","tokens_in":19232,"tokens_out":3846,"duration_ms":35102,"concrete_test":"Independently re-derive the reduction for the smallest nontrivial case: n=3 roles and 3 VMs, with distance matrix h(A,B)=1, h(B,C)=2, h(A,C)=3, and f as defined in Theorem 3.1. Enumerate the two possible bijections and compute the RSPAP risk using Eq. 5; the resulting values are 8 for both bijections while the TSP tour cost is 6 for both tours. If the reduction cannot distinguish TSP tours, it cannot be a valid reduction. A second check: attempt to express the TSP tour cost as a sum of per-role maxima of incident edge weights for arbitrary distance matrices; the max-vs-sum structural mismatch shows no such expression exists in general.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim that RSPAP is NP-complete rests entirely on the TSP reduction in Theorem 3.1. That reduction is invalid. With f(A) defined as 1 only for adjacent role pairs and 0 otherwise, f({ri})=0, so g_i^A = |f(A)-f({ri})| is 1 exactly when A is an adjacent pair {ri, rj} and 0 otherwise. Consequently the RSPAP objective in Eq. 5 collapses to Risk = sum_{ri} max_{j adjacent to i} d_{I(ri), I(rj)}. This is not the TSP cycle cost sum_i d_{I(ri), I(r_{i+1})}: it takes, for each role, the maximum of the two incident leakage probabilities rather than the sum of both edge costs. Moreover, the reduction assumes a bijection between roles and cities/VMs but never states n=m; if m and n differ, the assignment I is not a permutation, so the TSP analogy fails. A concrete counterexample with n=3 cities and distances 1, 2, 3 shows the RSPAP objective is the same for both possible role-to-VM bijections (8) while the TSP cycle cost is the same for both tours (6), so the reduction cannot select a TSP-optimal tour. Thus Theorem 3.1 is unproven and the NP-completeness claim, a key contribution, is not established.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a risk-aware assignment of RBAC roles to virtual machines in multitenant cloud datacenters. It represents sensitive properties of a dataset using two information-theoretic measures (KL-divergence and mutual information), defines the Risk-aware Sensitive Property-driven Assignment Problem (RSPAP) with the objective in Eq. (5), claims that RSPAP is NP-complete via a reduction from TSP (Theorem 3.1), and introduces two heuristics, TDH and NBH, with a simulation study on a Gowalla check-in dataset. The paper concludes that TDH generally outperforms NBH in reducing the disclosure risk.","tokens_in":19499,"tokens_out":6542,"duration_ms":52675,"significance":"The topic is timely and the proposed sensitive-property profile is a concrete modeling idea, but the central theoretical and empirical claims are not currently established. The paper's strengths are its use of a real check-in dataset, the explicit complexity analyses of the two heuristics (Lemmas 4.1 and 4.2), and the attempt to connect vulnerability matrices with an information-theoretic disclosure measure. However, the NP-completeness proof in Theorem 3.1 is invalid as written, and the evaluation lacks independent baselines, error bars, and a fully specified vulnerability model. The comparison between TDH and NBH is an empirical result and not circular, but it is not sufficient by itself to support the paper's overall contribution.","major_comments":[{"comment":"The TSP reduction is invalid. With f(A)=1 only for adjacent role pairs {ri, rj} and f({ri})=0 for every singleton, the factor g_i^A = |f(A) - f({ri})| is 1 exactly for adjacent pairs and 0 otherwise. The objective in Eq. (5) therefore collapses to Risk = sum_i max_{j adjacent to i} d_{I(ri), I(rj)}, which is a sum of per-role maxima of incident leakage probabilities, not the TSP cycle cost sum_i d_{I(ri), I(r_{i+1})}. The construction also does not specify n=m or require I to be a bijection, so the claimed equivalence to a Hamiltonian cycle ordering does not hold. For a triangle with edge costs 1, 2, 3, both role-to-vertex bijections give the same RSPAP value (8) while all TSP tours have cost 6, so the reduction cannot select a TSP-optimal tour. Theorem 3.1 is therefore unproven, and the NP-completeness claim, a key contribution, is unsupported.","section":"Section 3, Theorem 3.1"},{"comment":"The primary performance metric Risk is exactly the objective function that TDH and NBH are designed to minimize, and the risk-reduction metric Delta is defined as (PA - Risk)/PA with PA = sum_i f(ri). Consequently, the reported improvements in Risk and Delta are partly built into the optimization target rather than measuring an independent security property. The head-to-head comparison between TDH and NBH is meaningful as an empirical algorithmic comparison, but the absolute statements about risk reduction in Sections 5.4.1 and 5.5 should be framed as properties of the chosen cost function, not as validated security guarantees.","section":"Section 5.2, Eq. (5)-(7)"},{"comment":"The experimental study provides no baseline scheduler (e.g., random assignment, load-balanced assignment, or the earlier risk-aware methods cited as [9], [10]), and Figures 7-17 show no error bars despite the stochastic generation of the vulnerability matrix and the random check-in subsampling described in Section 5.1.2. The vulnerability matrix generation is specified only as 'randomly generated' in Section 5.3, without a distribution, range, or seed, so the experiments are not reproducible and the claim that TDH outperforms NBH is not statistically supported.","section":"Section 5.3 and Section 5.4"},{"comment":"The pseudocode contains defects that prevent reproduction. In Algorithm 2, Line 10 writes 'C2 = C2 ∩ ri' (set intersection with a role) where the text describes moving ri from C1 to C2, so it should be a union; Line 8 evaluates f(C1 - ri) + f(C2 ∪ ri) < dis, but after several moves the local variable dis may not reflect the total disclosure of the resulting clusters. In Algorithm 3, Line 13 reads 'Find (vq, vl) with minimum di,j where vl ∈ F', but F is the set of free roles, not free VMs (which is G); and the inner loop in Lines 19-22 uses Ci,j with j not bound in that scope, making the computation of Bi,q undefined. These issues need to be corrected before the heuristics can be implemented from the paper.","section":"Section 4, Algorithms 2 and 3"}],"minor_comments":[{"comment":"The introduction says 'Section 10 outlines the conclusion' but the conclusion is actually Section 7.","section":"Section 1"},{"comment":"The subscript on d is malformed: 'd_{kℓdI(ri),I(rj)}' should be d_{I(ri),I(rj)}.","section":"Equation (5)"},{"comment":"The monotonicity of divergence and mutual information is demonstrated for a single dataset and the authors acknowledge this caveat. However, the explanation of HSD versus LSD behavior in Section 5.4.1 relies on this monotonicity, so the generalization should be stated as an assumption rather than an observed property.","section":"Section 5.1.2"},{"comment":"The x-axis label says 'Number of roles (n)' but the experiment described in the text varies the number of virtual resources m; the caption should be updated for consistency with Figure 8.","section":"Figure 14"},{"comment":"The acronym is written as 'SPRAP' in two places in the proof; it should be RSPAP.","section":"Theorem 3.1 proof"},{"comment":"Figure 17 is referenced as 'Figure 6.17' in the text; the figure numbering should be fixed.","section":"Section 5.5"}],"recommendation":"reject","confidential_remarks":"The manuscript's central hardness proof is not a minor gap but a fundamental mismatch between the RSPAP objective and the TSP cost function; I do not see how the current reduction can be repaired with a small patch. The self-citation to the authors' prior work [9], [10], [16] is heavy, and the incremental advance over [10] is not clearly delineated. If the authors can supply a valid NP-hardness proof and a more rigorous evaluation with baselines and error bars, the work may be worth resubmission."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the problem is real and the KLD/MI sensitive property profile is a sensible extension of the authors' earlier work, but the NP-completeness proof in Theorem 3.1 is invalid, and the evaluation is too thin to support the performance claims.\n\nWhat's new: they augment the spectral model of RBAC with a sensitive property profile grounded in KL-divergence and mutual information, and use it to define a risk-aware role-to-VM assignment problem. That's incremental over [9],[10],[16], but it's a reasonable next step. The paper uses a real dataset (Gowalla check-ins), and the monotonicity experiment is repeated and honestly caveated: the authors explicitly say the behavior might not hold for other datasets. Credit where due.\n\nThe soft spots are serious. The TSP reduction in Theorem 3.1 does not encode the TSP tour cost. With f(A)=1 only for adjacent role pairs, the RSPAP objective collapses to a sum over roles of the maximum incident leakage probability, not the sum of edge costs along a cycle. The proof also quietly assumes a bijection between roles and VMs. So the NP-completeness claim is unsupported. That's a load-bearing contribution, not a side remark. The pseudocode has bugs (Algorithm 2 line 10 uses intersection instead of union, and refers to TBH), and the text is littered with typos and bad cross-references. Individually minor, but they add up. The evaluation compares TDH and NBH against each other only: no baseline, no error bars, and the vulnerability matrix is 'randomly generated' without specifying the distribution. The risk metric is the same as the objective, so some risk reduction is baked in, though the TDH-versus-NBH comparison is still empirical.\n\nBottom line: this is an incremental idea with a real dataset and an honest caveat, but the main theoretical contribution doesn't hold up and the empirical evidence is suggestive at best. A reader interested in risk-aware cloud scheduling might take the KLD/MI formulation as a starting point, but should not cite the NP-completeness result. I'd send it to peer review only with the expectation of major revision: either prove the complexity properly or drop the claim, and rebuild the evaluation with baselines and error bars. If the authors can do that, there's a usable paper here.","headline":"Real problem and a reasonable KLD/MI-based extension, but the NP-completeness proof is invalid and the evaluation is too thin to carry the paper as it stands.","tokens_in":20027,"tokens_out":3722,"would_cite":false,"duration_ms":32921,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that assigning cloud access-control roles to virtual machines can be optimized to minimize the risk that tenants infer sensitive statistical properties of shared data, and supports that claim with an NP-completeness…","keywords":["cloud computing","risk-aware scheduling","role-based access control","sensitive property","KL divergence","mutual information","NP-completeness","heuristic assignment"],"falsifier":"Take a small TSP instance with $m$ cities and distances $h(\\cdot,\\cdot)$, set the vulnerability matrix $d_{ij}=h(i,j)$, define $f(A)=1$ when $A=\\{r_i,r_j\\}$ with $|i-j|\\bmod n = 1$ and $0$ otherwise, and compare the optimal RSPAP risk to the optimal TSP tour cost. If the two values do not coincide across all small instances, the reduction's claimed equivalence fails.","tokens_in":19013,"feed_emoji":"🛡️","tokens_out":4500,"duration_ms":40683,"temperature":0.7,"pith_summary":"Cloud tenants sharing physical machines can infer statistical properties of each other's data even when access control is enforced. This paper claims that the resulting risk can be formulated as an assignment problem, RSPAP, in which roles from a role-based access control policy are placed onto virtual machines to minimize the maximum information gain about a global sensitive property. The authors model sensitive properties with KL divergence and mutual information, prove RSPAP is NP-complete, and propose two heuristics, TDH and NBH. Simulations on a real check-in dataset indicate that the top-down heuristic TDH consistently achieves lower disclosure risk than the neighbor-based NBH. If correct, the work gives cloud providers a practical scheduling method that treats statistical data confidentiality as a first-class resource management objective.","feed_headline":"Role placement cut cloud data-leak risk in simulations","feed_subtitle":"Two heuristics place access-control roles onto VMs to minimize what tenants can infer about shared data statistics.","key_machinery":"The central object is the Sensitive Property Profile (SPP), a vector $W$ indexed by non-empty subsets of roles, where each entry $w_p$ stores the cardinality $C(w_p)$, the number of data objects shared by exactly those roles, and a set of characteristics supplied by a property function $f$ that quantifies how much a subset's local probability distribution differs from the global one. The risk objective in Eq. (5) is the sum over roles of the maximum, over role-sets $A$ containing the role, of the disclosure gap times the product of inter-VM leakage probabilities. This objective drives the aggregated-risk clustering logic of TDH and the pairwise best-fit logic of NBH.","core_discovery":"The paper's central claim is that minimizing risk of sensitive-property disclosure in a multitenant cloud reduces to a cost-driven assignment problem, RSPAP, and that this problem is NP-complete (Theorem 3.1). The risk of a role is the maximum, over all subsets of roles that include it, of the product of the property-disclosure gap $g_i^A = |f(A)-f(r_i)|$ and the vulnerabilities $d_{I(r_i),I(r_j)}$ between the virtual machines hosting the roles in the subset. Sensitive properties are encoded by two information-theoretic quantities: Kullback-Leibler divergence $f(A)=D(P_A||P_G)$ and mutual information $f(A)=|MI_A(X;Y)-MI_G(X;Y)|$. Two heuristics, the top-down heuristic (TDH) and the neighbor-based heuristic (NBH), are proposed and evaluated under high- and low-sensitivity datacenter workloads; in the reported simulations TDH outperforms NBH on total risk and risk-reduction quality.","pith_inferences":["The same SPP objective could be adapted to protect other statistical aggregates, such as correlations or distribution moments, as long as the property function $f$ is computable over role subsets.","The reported monotonic decrease of divergence with dataset size is observed in one dataset; a natural check is whether the heuristics' advantage persists when monotonicity fails.","The discriminator index, used here as a fairness diagnostic, may double as a per-role risk-equity constraint in SLA-aware scheduling."],"forward_implications":["If RSPAP is as hard as claimed, no exact polynomial algorithm exists, so heuristics are the practical route for real datacenter scales.","TDH's aggregated-risk clustering means that providers can keep the strongest-disclosure role groups on the least vulnerable VMs.","The information-theoretic framing extends the notion of leakage beyond raw data access to statistical inferential disclosure.","The datacenter sensitivity classification (HSD, MSD, LSD) gives operators a workload-level parameter for choosing between scheduling strategies."],"supporting_citations":[{"why":"Supplies the vulnerability matrix and risk model for multitenant cloud virtual resource management that RSPAP builds on.","marker":"[9]"},{"why":"Introduces the Spectral Model and the risk-aware assignment lineage that the Sensitive Property Profile extends.","marker":"[10]"},{"why":"Provides the distributed access control architecture, including the Virtual Resource Manager, adopted for the proposed framework.","marker":"[16]"},{"why":"Motivates the Zipfian workload generation used to synthesize heterogeneous RBAC policies for the simulations.","marker":"[28]"},{"why":"Defines the Kullback-Leibler divergence and mutual information used to represent sensitive properties.","marker":"[29]"},{"why":"Originates the quantitative fairness and discrimination measure that the paper adapts as the discriminator index DI.","marker":"[30]"}],"fun_headline_variants":["NP-complete cloud data-leak risk cut by role heuristics","Simulations show role placement trims cloud data-leak risk","Sensitive-property risk minimized via VM role assignment","Risk-aware VM placement cuts data-leak in cloud simulations","Two heuristics beat data-leak risk in cloud datacenters"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The NP-completeness proof assumes that the sensitive property function $f$ can be defined so that the RSPAP objective exactly mirrors the total cost of a TSP tour; if that correspondence does not hold, the hardness claim is unsupported.","fun_headline_variants_meta":{"raw":{"variants":["NP-complete cloud data-leak risk cut by role heuristics","Simulations show role placement trims cloud data-leak risk","Sensitive-property risk minimized via VM role assignment","Risk-aware VM placement cuts data-leak in cloud simulations","Two heuristics beat data-leak risk in cloud datacenters"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000161,"raw_usage":{"total_tokens":1226,"prompt_tokens":923,"completion_tokens":303,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":539,"completion_tokens_details":{"reasoning_tokens":218}},"tokens_in":539,"tokens_out":303,"duration_ms":2970,"temperature":1.0,"reasoning_tokens":218,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-09T11:21:38.469316+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a small TSP instance with $m$ cities and distances $h(\\cdot,\\cdot)$, set the vulnerability matrix $d_{ij}=h(i,j)$, define $f(A)=1$ when $A=\\{r_i,r_j\\}$ with $|i-j|\\bmod n = 1$ and $0$ otherwise, and compare the optimal RSPAP risk to the optimal TSP tour cost. If the two values do not coincide across all small instances, the reduction's claimed equivalence fails.","supporting_citations":[{"cited_title":"Risk-aware virtual resource management for multitenant cloud datacenters,","cited_arxiv_id":null,"evidence_quote":"Supplies the vulnerability matrix and risk model for multitenant cloud virtual resource management that RSPAP builds on."},{"cited_title":"Risk-aware manage- ment of virtual resources in access controlled service-oriented cloud datacenters,","cited_arxiv_id":null,"evidence_quote":"Introduces the Spectral Model and the risk-aware assignment lineage that the Sensitive Property Profile extends."},{"cited_title":"A distributed access control architecture for cloud computing,","cited_arxiv_id":null,"evidence_quote":"Provides the distributed access control architecture, including the Virtual Resource Manager, adopted for the proposed framework."},{"cited_title":"Benchmarking cloud serving systems with ycsb,","cited_arxiv_id":null,"evidence_quote":"Motivates the Zipfian workload generation used to synthesize heterogeneous RBAC policies for the simulations."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the Kullback-Leibler divergence and mutual information used to represent sensitive properties."},{"cited_title":"Jain, D.-M","cited_arxiv_id":null,"evidence_quote":"Originates the quantitative fairness and discrimination measure that the paper adapts as the discriminator index DI."}],"review_version":1}