{"id":"3fc71d33-1487-4b8a-b15b-cc1775a8164b","arxiv_id":"2502.02913","paper_version":4,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"The paper introduces privacy tokens, learned gradient embeddings, to estimate mutual information between training data and gradients for real-time privacy risk monitoring during model training.","lead":"This paper proposes measuring privacy leakage in deep learning by estimating mutual information between training data and gradients using learned privacy token embeddings and a neural MI estimator. It claims this offers real-time, attack-free privacy monitoring and shows the measured MI difference roughly tracks image reconstruction attack success over training.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Table 1 contradicts the claimed MI–attack correlation at early checkpoints, so the central claim that ΔI reliably measures attack potential is empirically unsupported.","rationale":"The reader's weakest assumption concerned whether learned embeddings preserve all privacy-relevant information; that is a real theoretical gap. I see the empirical contradiction in Table 1 as the more load-bearing issue, because the paper's own attack experiments are the only evidence that ΔI tracks privacy risk, and those experiments show the opposite in the most important phase. If the authors could restore the correlation (e.g., by conditioning on training stage), the embedding concern would still need addressing, but as written the central claim is unsupported by the paper's own data. I therefore agree with the REJECT verdict; no verdict change.","tokens_in":15946,"tokens_out":4968,"duration_ms":42529,"concrete_test":"Using the existing Table 1 rows, compute Spearman's rank correlation between ΔI (both autoencoder and transformer variants) and each attack metric (SSIM, PSNR, LPIPS) across all checkpoints, including sub-epoch 0, for all four models; then compute the partial correlation controlling for sub-epoch index. If the rank correlation is not positive and significant, or if the partial correlation is near zero, the claim that ΔI reliably measures attack potential independent of training time is falsified. A corroborating check: run the same measurement at finer early sub-epochs (0–10) to confirm whether the lowest ΔI coincides with the highest reconstruction quality.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 4.2.2's summary states that the mutual information difference ΔI between matched and mismatched data-gradient pairs is 'strongly correlated' with attack performance and 'provides a reliable measure of attack potential without the need for actual privacy attacks.' Table 1 does not support this. In every model, the sub-epoch 0 row has the lowest (or near-lowest) ΔI yet near-perfect reconstruction quality: LeNet ΔI=0.03288 with SSIM=0.9990, PSNR=15.11; CNN ΔI=0.00033 with SSIM=0.99999; MLP ΔI=5.83e-4 with SSIM=0.999996. Conversely, the highest ΔI checkpoints (LeNet sub-epoch 60, ΔI≈4.15; CNN sub-epoch 20, ΔI≈1.66) show worse attack metrics. The authors' explanation in the third bullet of Section 4.2.2—that random initialization makes early gradients easier to exploit—concedes that ΔI misses a major determinant of attack success. Since the estimated quantity is I(intermediate_layer_output; gradient_embedding), not I(X;G), the only external validation is this attack correlation; the contradiction at the beginning of training, the regime the paper itself flags as most privacy-sensitive, removes that validation. The rise-then-fall of ΔI may track training dynamics, but it does not track attack potential.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a proactive privacy risk measurement framework for gradient leakage. It introduces 'privacy tokens,' which are embedding vectors obtained by passing gradients through a trainable feature extractor (an autoencoder or a transformer). The framework then uses the Mutual Information Neural Estimator (MINE) to estimate the mutual information between intermediate-layer outputs of the monitored model (as data features) and these privacy tokens. The central claim is that the difference in estimated MI between matched and mismatched data-gradient pairs, denoted ΔI, is strongly correlated with the success of gradient-based reconstruction attacks, and therefore provides a real-time measure of attack potential without actually running attacks. Experiments on CIFAR-10 (LeNet, AlexNet) and CelebA-HQ (CNN, MLP) compare ΔI across training sub-epochs with DLG and DSG reconstruction attacks.","tokens_in":16241,"tokens_out":3924,"duration_ms":128631,"significance":"If the central claim were valid, the framework would fill a genuine gap: model trainers could continuously monitor gradient leakage during training, adjust DP noise adaptively, and avoid the cost and incompleteness of post-hoc attack simulations. The paper's use of a theoretically grounded MI estimator (MINE with the Donsker-Varadhan lower bound) and its evaluation on multiple architectures and two datasets are strengths. However, the significance is undermined by a fundamental mismatch between the quantity estimated and the quantity claimed, by a direct empirical contradiction in Table 1, and by a potential circularity in the training of the feature extractor and the MI estimator. These issues are load-bearing for the paper's main contribution.","major_comments":[{"comment":"The Donsker-Varadhan lower bound is applied to the mutual information between intermediate-layer outputs f(X) and learned gradient embeddings Emb(G), not to I(X;G) as claimed in Section 3.1. The paper explicitly states in Section 3.2 that it cannot directly use the original training data and gradients. Unless f and Emb are shown to be sufficient statistics for the privacy-relevant information, the estimated ΔI is not a lower bound on the true leakage I(X;G) and cannot support the claim of measuring 'the extent of private information leakage from training data.' Provide theoretical or empirical evidence that the chosen intermediate features and gradient embeddings preserve privacy-relevant information, or reframe the claim as applying to the embedding-level MI only.","section":"Section 3.2, Eq. (4)"},{"comment":"In every model, the sub-epoch 0 row has the lowest (or near-lowest) ΔI yet near-perfect reconstruction quality: LeNet ΔI=0.03288 with SSIM=0.9990, CNN ΔI=0.00033 with SSIM=0.99999, and MLP ΔI=5.83e-4 with SSIM=0.999996. This is the opposite of the claimed 'strong correlation' between ΔI and attack performance. The third bullet of Section 4.2.2 concedes that early-stage gradients are easier to exploit despite the increasing ΔI, attributing this to random initialization. Since the paper itself identifies early stages as the most privacy-sensitive, the metric fails in precisely the regime where it matters most. Report a correlation coefficient (e.g., Spearman rank correlation) over all checkpoints and explicitly discuss this non-monotonicity.","section":"Table 1, sub-epoch 0 rows"},{"comment":"The MINE network and the gradient feature extractor are trained on data-gradient pairs collected during the same training run that is later used to compute the reported ΔI values. If the evaluation batches overlap with the training batches for the MINE network, the reported mutual information differences may reflect overfitting of the estimator to specific batches rather than intrinsic properties of the gradients. Moreover, the gradient extractor is optimized jointly with the MINE loss (Section 3.3 and Appendix A), so the estimated MI is maximized over the choice of embedding. The paper should specify the exact train/evaluation split and, if the same batches are used, provide validation on held-out batches or otherwise rule out this circularity.","section":"Algorithm 1, Section 4.2.1"},{"comment":"The paper claims that ΔI is 'strongly correlated' with attack performance, but no quantitative measure of correlation is given. Visual inspection of Table 1 reveals non-monotonic relationships: for LeNet, the highest ΔI (sub-epoch 60) does not correspond to the best attack quality, and for CNN, sub-epoch 20 has a high ΔI (1.66) but worse PSNR than sub-epoch 0 despite the much larger ΔI. The assertion that 'as the mutual information difference decreases, the quality of the reconstructed data deteriorates' is contradicted by the sub-epoch 0 rows. Provide a quantified analysis (e.g., rank correlation across all rows) and address the exceptions; otherwise the central claim of Section 4.2.2 is not supported by the presented evidence.","section":"Section 4.2.2, Table 1"},{"comment":"The MINE estimates are reported without error bars, confidence intervals, or significance tests. Values such as 0.00033 (CNN sub-epoch 0) and -0.00633 (the corresponding Transformer-based estimate) are within the typical noise of MINE estimates, making it unclear whether ΔI is distinguishable from zero in early training. Since the paper's conclusions about the early-training regime depend on the relative magnitudes of these small numbers, report standard deviations over batches or bootstrap confidence intervals. Without this, the claim that ΔI is consistently positive except at initialization is not established.","section":"Section 3.3, Appendix A, Table 1"}],"minor_comments":[{"comment":"The term 'dismatched pairs' should be 'mismatched pairs'; multiple typographical errors appear throughout the text (e.g., 'F or' in Lemma 3.2).","section":"Abstract and throughout"},{"comment":"The table formatting is inconsistent and at times unreadable, with LPIPS and PSNR values run together (e.g., '15.1052361 dB2.7979574e-06'). Use proper column separation and consistent units.","section":"Table 1"},{"comment":"CIFAR-10 is commonly 32×32; the paper states 64×64 pixels. If images were resized, please state the resizing procedure; if 64×64 is a typo, correct it.","section":"Section 4.1"},{"comment":"Several references have incomplete or inconsistent formatting (e.g., missing page ranges, inconsistent 'pp.' usage). Please unify the bibliography style.","section":"References"}],"recommendation":"reject","confidential_remarks":"The paper addresses a timely and practically relevant problem, but the central claim is not supported by the evidence as presented. The Table 1 contradiction at sub-epoch 0 directly undermines the claimed reliability of ΔI as a measure of attack potential, and the methodological gap between the estimated embedding-level MI and the claimed data-level I(X;G) would require a substantial reconceptualization. The absence of statistical significance measures and the potential circularity in jointly training the extractor and MINE add further concerns. In its current form, the manuscript does not meet the bar for publication, and I do not see a minor revision path that would fix the load-bearing issues."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the paper has a real idea—use mutual information between data and gradient embeddings for continuous privacy monitoring during training—and it does the engineering work to make that operational. But the central validation fails on the paper's own Table 1, and the MI being estimated is not the quantity the theory is written for.\n\nWhat's new and good: the privacy token is essentially a learned gradient embedding, which is not novel by itself, but tying it to MINE and monitoring at sub-epoch granularity is a reasonable combination. The observation that the MI difference rises then falls across training is consistent across models and batch-size ablations, and the paper is honest enough to report the early-epoch contradiction even though it then explains it away. Using DLG as an external validation on CIFAR-10 is a plus.\n\nThe soft spots are serious. First, Section 3.2 explicitly says they cannot use raw data and gradients, so they substitute intermediate-layer outputs for data features and learned embeddings for gradients. The Donsker–Varadhan bound then applies to I(features; embedding), not I(X;G). The link to actual privacy leakage is assumed, not shown. Second, Table 1 contradicts the claim that the MI difference correlates with attack potential. At sub-epoch 0, the MI difference is near zero or negative (LeNet 0.0329, CNN 0.0003, MLP 5.8e-4) yet SSIM is 0.998–0.99999, near-perfect reconstruction. The paper's third bullet in Section 4.2.2 concedes that random initialization helps attacks—which is exactly a case where the MI difference misses a major determinant of attack success. The paper calls this 'unexpected,' but it is fatal for a 'reliable measure' claim. Third, there are no error bars, the MINE network appears to be trained on very small batches (10% of Dpos, which itself is limited), and the CelebA-HQ validation relies on the authors' own DSG attack.\n\nWhere does this leave the paper? The empirical rise-then-fall pattern may be a real phenomenon, and the framework could be useful if re-scoped to monitor training dynamics rather than attack potential. But as written, the load-bearing claim is empirically unsupported by the paper's own data. I would desk-reject this version. If the authors revise to drop the attack-potential claim and add proper I(X;G) grounding or independent attack validation across the whole training curve, it would be worth another look.","headline":"The monitoring idea is worth a look, but the paper's own Table 1 contradicts the claimed MI–attack correlation, so the central claim doesn't hold.","tokens_in":16819,"tokens_out":3310,"would_cite":false,"duration_ms":55080,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that privacy tokens—gradient embeddings scored by mutual information—measure gradient leakage in real time without running privacy attacks.","keywords":["privacy tokens","gradient leakage","mutual information","MINE","real-time privacy monitoring","gradient inversion attack","differential privacy","privacy risk measurement"],"falsifier":"At a late sub-epoch where the paper's mutual-information difference is near its minimum (for example LeNet sub-epoch 200), run the same DLG reconstruction on those gradients and measure SSIM/PSNR; if reconstruction quality remains high while the mutual-information difference is low, the difference does not actually track attack potential.","tokens_in":15656,"feed_emoji":"🔐","tokens_out":5456,"duration_ms":47771,"temperature":0.7,"pith_summary":"The paper proposes that privacy risk from gradient leakage can be monitored continuously during training, without launching attacks, by measuring mutual information between training data and gradients. Its method embeds gradients into compact privacy tokens and combines them with the model's own intermediate-layer features inside a Mutual Information Neural Estimator (MINE). The paper reports that the resulting mutual-information difference between matched and mismatched data-gradient pairs is positive during training, rises and then falls, and tracks the quality of gradient-inversion image reconstruction. If correct, trainers get a real-time signal of when gradients are most exposed and can adjust protection, such as differential privacy noise, accordingly.","feed_headline":"Privacy tokens gauge gradient leaks without running attacks","feed_subtitle":"A mutual-information score tracks how much training data gradients reveal, letting trainers react mid-training.","key_machinery":"Privacy tokens are learned embeddings of gradients produced by an autoencoder or transformer-based feature extractor. The MINE network, parameterized by $T_\\theta$, estimates a Donsker–Varadhan lower bound on $I(X;G)$ using positive samples (a batch of data with its own gradient) and negative samples (data paired with another batch's gradient); the estimated score is the difference $I(X;G)-I(X;G')$. This difference quantifies how distinguishable matched from mismatched pairs are—the operational proxy for attacker information gain.","core_discovery":"The central discovery claimed is that the mutual-information difference between correctly matched data-gradient pairs and shuffled pairs is a dependable privacy measure: it exceeds zero once training begins, follows a rise-then-fall trajectory, and correlates with the success of gradient-based reconstruction attacks. On this basis the paper concludes that gradients in early and intermediate training stages are the most sensitive, that later-stage gradients leak less and tolerate more DP noise, and that mutual information computed from privacy tokens can substitute for actual attack simulations in assessing leakage.","pith_inferences":["Beyond the paper, the mutual-information score measures how distinguishable matched and mismatched pairs are, not the absolute amount of recoverable private content; two models with the same score could differ in how much of the reconstructed image is semantically sensitive.","Beyond the paper, the same privacy-token machinery could be tested against membership inference: if the mutual-information difference predicts membership-inference accuracy as well as it predicts reconstruction quality, the measure would generalize to a broader class of attacks.","Beyond the paper, privacy tokens could be applied in federated learning rounds, where per-client gradient exposure varies with data heterogeneity; the mutual-information difference could flag which client's update is most leaky and trigger client-side noise."],"forward_implications":["A trainer can watch the mutual-information difference over sub-epochs and know when gradient leakage risk is highest, without running any attack.","The rise-then-fall trend implies that the most sensitive gradients appear in the early and intermediate training stages, so protection effort should concentrate there.","Because the mutual-information difference tracks reconstruction quality, it can serve as a fast proxy for attack-based privacy evaluation in settings where attacks are costly or unrealistic.","In a differential-privacy workflow, the measured sensitivity schedule tells the trainer when noise can be reduced to preserve utility (later stages) and when it must be higher (earlier stages).","Batch size shifts the timing of the peak sensitivity, so the monitoring signal should be interpreted relative to the training schedule."],"supporting_citations":[{"why":"Supplies the Mutual Information Neural Estimator (MINE) used to approximate a lower bound on the mutual information between data and gradients.","marker":"Belghazi et al. 2018"},{"why":"Provides the DLG gradient-inversion attack used as the reconstruction baseline on CIFAR-10.","marker":"Zhu et al. 2019"},{"why":"Provides the DSG-based conditional diffusion reconstruction attack used on CelebA-HQ.","marker":"Huang et al. 2024b"},{"why":"Introduces the class token in Vision Transformers, the conceptual inspiration for the privacy token.","marker":"Dosovitskiy 2020"},{"why":"Establishes the differential privacy training framework that motivates adaptive noise allocation based on measured sensitivity.","marker":"Abadi et al. 2016"}],"fun_headline_variants":["Token-based mutual info measures gradient leakage in real time","Privacy tokens + MI: live gradient leak risk without attacks","Real-time privacy risk via token-derived mutual information","Gradient leaks measured live with privacy tokens, no attacks","Mutual information on privacy tokens detects leak risk early"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The estimate assumes the chosen embeddings—the model's intermediate-layer outputs and the gradient privacy token—preserve all privacy-relevant information about the raw data; if either embedding discards or distorts such information, the measured mutual-information difference will not track the true risk.","fun_headline_variants_meta":{"raw":{"variants":["Token-based mutual info measures gradient leakage in real time","Privacy tokens + MI: live gradient leak risk without attacks","Real-time privacy risk via token-derived mutual information","Gradient leaks measured live with privacy tokens, no attacks","Mutual information on privacy tokens detects leak risk early"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000211,"raw_usage":{"total_tokens":1357,"prompt_tokens":831,"completion_tokens":526,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":447,"completion_tokens_details":{"reasoning_tokens":449}},"tokens_in":447,"tokens_out":526,"duration_ms":5929,"temperature":1.0,"reasoning_tokens":449,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-09T10:39:21.509748+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"At a late sub-epoch where the paper's mutual-information difference is near its minimum (for example LeNet sub-epoch 200), run the same DLG reconstruction on those gradients and measure SSIM/PSNR; if reconstruction quality remains high while the mutual-information difference is low, the difference does not actually track attack potential.","supporting_citations":[{"cited_title":"B., Mironov, I., Talwar, K., and Zhang, L","cited_arxiv_id":null,"evidence_quote":"Establishes the differential privacy training framework that motivates adaptive noise allocation based on measured sensitivity."}],"review_version":1}