{"id":"43ddfeb3-0f1b-4085-b589-3de47cd2544a","arxiv_id":"2502.04771","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":1,"one_line_summary":"DMPA is a collusive model poisoning attack for decentralized federated learning that negates and selectively replaces malicious model updates along the principal component of their correlation matrix.","lead":"This paper proposes DMPA, a model poisoning attack for decentralized federated learning that uses the principal eigenvector of malicious clients' model updates to craft poisoned updates. The authors report lower F1 scores than three prior attacks across multiple datasets and topologies, but the claim of consistent superiority is contradicted by the paper's own tables.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"DMPA's own Table 1 contradicts the claim that its F1 scores are all the lowest; for example, CIFAR-10 Ring/Median shows LIE (0.2806) beating DMPA (0.3145), and Fashion-MNIST Ring/Krum shows Min-Max (0.4537) beating DMPA (0.7675).","rationale":"The reader's verdict is REJECT, and I agree. My concern differs in emphasis: the reader's weakest_assumption focuses on the theoretical justification of the principal-eigenvector attack direction, whereas I see the more load-bearing issue as the direct contradiction between the paper's headline claim and the data in its own Table 1. The central claim is empirical, so the first check is whether the reported experiments support it. They do not: in at least four cells, a baseline attack achieves a lower (better) F1 than DMPA, contrary to the statement that DMPA's F1 scores are all the lowest. This is not a disagreement about consensus or a subtle statistical issue; it is an internal inconsistency in the paper's evidence. Even if the eigenvector mechanism were theoretically sound, the paper fails to establish that DMPA consistently outperforms prior attacks, and the absence of error bars, code, or seed details makes the single unreplicated table all the more fragile. The reader's eigenvector concern is secondary because a heuristic with poor empirical support could still be interesting if the experiments were correct, but the experiments as reported do not support the claim. I therefore recommend keeping the REJECT verdict. My agreement is 'partial' because the reader's formal weakest_assumption differs from mine, even though the reader's rationale also cites some of the same Table 1 counterexamples.","tokens_in":10734,"tokens_out":3888,"duration_ms":40472,"concrete_test":"Reproduce the DFL experiments for the contested cells (CIFAR-10 Ring/Median and Fashion-MNIST Ring/Krum) with the stated configuration: 10 clients, 40% malicious, 10 communication rounds, 3 local epochs, IID with alpha=100, and the same model architectures. Run at least 5 random seeds and record the final-round F1 for all benign clients. If any baseline (LIE, Min-Max, or Min-Sum) achieves a lower mean F1 than DMPA, the claim of consistent superiority fails. Alternatively, audit Table 1's arithmetic; if the reported numbers are correct, the claim is already false.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is empirical: DMPA 'consistently surpasses' existing attacks and 'its F1 scores are all the lowest' (Section 5). This claim is directly falsified by the paper's own Table 1 in multiple cells. Since lower F1 indicates a more effective attack, the following baseline values beat DMPA: CIFAR-10 Ring/Median, LIE 0.2806 vs DMPA 0.3145; Fashion-MNIST Ring/Krum, Min-Max 0.4537 vs DMPA 0.7675; MNIST Fully/Median, Min-Max 0.8281 vs DMPA 0.8479; CIFAR-10 Fully/Krum, LIE 0.2305 vs DMPA 0.5696. If these numbers are accurate, the headline claim is false. If they are inaccurate, the experimental report cannot be trusted. Either way, the central contribution—an attack that is uniformly better than the state of the art—is unsupported. A secondary concern is that the method's 'optimal poisoning direction' from the principal eigenvector of the malicious updates' correlation matrix (Equations 5–7) is asserted without proof or sensitivity analysis, but the empirical self-contradiction is sufficient to reject the paper as written.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes DMPA, a collusive model poisoning attack for decentralized federated learning (DFL). The attack computes the correlation matrix of malicious client model updates, extracts the principal eigenvector, projects the updates onto that direction, negates the updates, and retains the top 10% of parameters by magnitude. The authors evaluate DMPA against LIE, Min-Max, and Min-Sum across MNIST, Fashion-MNIST, and CIFAR-10 under three topologies (fully connected, ring, star) and four aggregation rules (FedAvg, Krum, Trimmed Mean, Median), reporting F1 scores of benign clients. The abstract and Section 5 claim that DMPA consistently surpasses existing state-of-the-art attacks and that its F1 scores are the lowest in all settings.","tokens_in":11037,"tokens_out":2762,"duration_ms":31820,"significance":"If the claimed universal superiority held, DMPA would be a valuable new attack for DFL, a setting with comparatively little attack research, and the paper would provide useful evidence about the vulnerability of robust aggregation rules in decentralized topologies. The paper is also careful to state a strict threat model in which attackers know only their own compromised models, which is a reasonable and practically relevant assumption. However, the central contribution is purely empirical, and the paper's own results contradict the headline claim in several settings. The reported evaluation also lacks error bars, multiple runs, or an analysis of the attack's key hyperparameters, so the paper's main assertion is not supported as written.","major_comments":[{"comment":"The central claim that DMPA's F1 scores are 'all the lowest' is directly contradicted by the paper's own Table 1. Since a lower F1 score indicates a more effective attack, several baseline results are better than DMPA: CIFAR-10 Ring/Median gives LIE 0.2806 versus DMPA 0.3145; Fashion-MNIST Ring/Krum gives Min-Max 0.4537 versus DMPA 0.7675; MNIST Fully/Median gives Min-Max 0.8281 versus DMPA 0.8479; and CIFAR-10 Fully/Krum gives LIE 0.2305 versus DMPA 0.5696. These cells falsify the abstract's 'consistently surpasses' claim and the Section 5 statement that 'its F1 scores are all the lowest.' If the numbers are accurate, the main claim is false; if they are inaccurate, the experimental report cannot be trusted. Either way, the paper's central empirical contribution is unsupported.","section":"Section 5, Table 1"},{"comment":"The attack's central design choice is asserted rather than derived. The paper claims that the principal eigenvector of the correlation matrix of malicious updates identifies the 'optimal poisoning direction' and that negating the updates, adding the projection onto that eigenvector, and keeping the top 10% of parameters maximizes the benign loss after aggregation. No optimization problem, formal justification, or proof is given for this choice, and no sensitivity analysis is provided for the top_k_percent hyperparameter. Because the method's effectiveness depends entirely on this heuristic, the paper needs either a derivation of why this direction is optimal for decreasing benign F1 under the tested aggregation rules or an ablation study showing that this specific construction is necessary. As written, the attack could reduce to an arbitrary perturbation, which is especially important given the contradictory results in Table 1.","section":"Section 4, Equations (5)-(7) and Algorithm 1"},{"comment":"The evaluation reports only a single average F1 value per setting, with no standard deviations, confidence intervals, number of independent runs, or seed variations. This is a serious problem because many of the comparisons in Table 1 are close; for example, in Fashion-MNIST Star/Median, DMPA achieves 0.878103 versus Min-Max 0.878469, a difference of 0.0004 that is meaningless without an estimate of variance. The lack of any uncertainty quantification means that even when DMPA appears best, the result cannot be distinguished from noise. The paper should include multiple trials with different random seeds and report variances, or at least justify why a single run is sufficient.","section":"Section 5, Experimental Setup and Table 1"}],"minor_comments":[{"comment":"There is a typo in 'This workd proposes' that should be corrected.","section":"Section 4.1"},{"comment":"The text says 'aggeration' instead of 'aggregation' in the sentence introducing Equation (2).","section":"Equation (2)"},{"comment":"The attack name is inconsistently written as both DMPA and DPMA; the authors should use one spelling consistently.","section":"Throughout"},{"comment":"The notation is inconsistent: Algorithm 1 defines C = (1/(n-1)) V V^T, while Equation (4) writes C = (1/(n-1)) V^T V; the dimensions of V, T, and the element-wise division in Equation (5) are also not defined clearly. This makes the method hard to reproduce.","section":"Section 4, Equations (4)-(5) and Algorithm 1"},{"comment":"The paper does not mention whether code, hyperparameter configurations, or pre-trained models are publicly available, which limits reproducibility.","section":"Section 5, Experimental Setup"},{"comment":"The figure caption and the text do not explain the exact aggregation rule used for each panel beyond the labels, and the legend is unclear; the reader cannot tell which curve corresponds to which method in the densely overlapping plots.","section":"Section 5, Figure 3"},{"comment":"The related-work section would benefit from a more explicit discussion of how the described CFL attacks are adapted to DFL, since the paper assumes the malicious clients collude and share models but does not describe how the DFL topology affects the adaptation.","section":"Section 2"}],"recommendation":"reject","confidential_remarks":"The paper addresses an interesting and under-studied problem, and the threat model is realistic, but the empirical core of the manuscript is self-contradictory. The authors' own Table 1 contains multiple settings in which existing baselines outperform DMPA, directly refuting the abstract's consistency claim. The theoretical justification for the attack direction is a heuristic without proof or sensitivity analysis, and the evaluation lacks any variance estimates. These issues are load-bearing for the paper's contribution, so I cannot recommend revision within the current scope. If the authors re-scope the claims to a competitive-but-not-universally-superior attack, provide a longer experimental study with error bars, and add an ablation for the top-k parameter, a future submission could be viable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The headline claim doesn't survive contact with its own Table 1. The paper proposes a spectral method for collusive model poisoning in decentralized federated learning, but the central empirical claim that DMPA 'consistently surpasses' existing attacks is contradicted by the paper's own results.\n\nWhat's new: using the principal eigenvector of the correlation matrix of malicious updates to pick a poisoning direction, then flipping the update and projecting onto that eigenvector, is a fresh mechanism compared to LIE, Min-Max, and Min-Sum. The experimental coverage is also broad—three datasets, four aggregation rules, three topologies—which is more than many attack papers bother with.\n\nThe soft spots, in order of severity. First, Table 1 itself undermines the 'all the lowest' claim. LIE beats DMPA on CIFAR-10 Ring/Median (0.2806 vs 0.3145); Min-Max beats DMPA on Fashion-MNIST Ring/Krum (0.4537 vs 0.7675); several other cells go the same way. When the paper's own data refutes its headline, the rest of the evaluation can't be trusted, especially with no error bars, no multiple seeds, and no code. Second, the 'optimal poisoning direction' from the maximum eigenvector is asserted, not derived. There's no optimization problem, no proof, and no sensitivity analysis for the top-10% sparsification. Third, the paper never compares against Tan et al.'s collusive DFL attack, which is the closest prior work; that omission weakens the novelty claim.\n\nTo be fair, DMPA does work well in a number of settings—fully connected topologies with Krum, for example, where it drops F1 below 0.1. So the mechanism has some power. But the paper overgeneralizes it.\n\nThis is for researchers who want to see one way to construct a DFL poisoning attack, not as a benchmark. I'd bring it up in a reading group as a case study in self-contradictory evaluation, but I wouldn't cite it.\n\nRecommendation: desk reject as is. The central claim is falsified by the paper's own table. If the authors redo the evaluation, add error bars, compare against the collusive baseline, and drop the universal superiority claim, it could become a decent workshop paper—but not as submitted.","headline":"The paper's own Table 1 contradicts its claim that DMPA consistently beats existing attacks; the spectral idea is worth a look but the evaluation doesn't hold up.","tokens_in":11609,"tokens_out":3847,"would_cite":false,"duration_ms":37668,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A colluding group of malicious clients can break decentralized federated learning using only its own models, by computing the principal eigenvector of their correlations and using it to craft poisoned updates.","keywords":["decentralized federated learning","model poisoning attack","collusive attack","correlation matrix eigenvector","robust aggregation","Byzantine robustness","adversarial machine learning"],"falsifier":"Take one of the reported configurations, such as CIFAR-10 with FedAvg in a fully connected topology and 40 percent malicious clients, and rerun DMPA with the projection onto the maximum-eigenvalue eigenvector replaced by a projection onto a random unit vector or onto the minimum-eigenvalue eigenvector; if the benign F1 drop is essentially unchanged, the principal-direction claim is not what carries the attack.","tokens_in":10498,"feed_emoji":"🎯","tokens_out":6161,"duration_ms":66455,"temperature":0.7,"pith_summary":"This paper tries to establish that decentralized federated learning (DFL), where clients exchange and aggregate models directly with peers instead of through a central server, is vulnerable to a powerful new model poisoning attack called DMPA. DMPA has malicious clients collude using only their own model updates, with no knowledge of benign clients' models, aggregation rules, or global state. The attack computes the correlation matrix of the malicious updates, takes the eigenvector of the maximum eigenvalue as an optimal poisoning direction, negates the original updates, and adds a projection onto that direction, keeping only the top 10 percent of parameters. The authors report that this consistently produces the lowest benign-client F1 scores compared with state-of-the-art attacks (LIE, Min-Max, Min-Sum) across three datasets, three overlay topologies, and four aggregation rules including robust ones like Krum and Median. If true, this matters because DFL is often promoted as more robust than centralized FL, and this attack shows a practical, knowledge-light way to undermine that robustness.","feed_headline":"One eigenvector lets colluding clients wreck federated learning","feed_subtitle":"Attack using only the attackers' own models beats LIE, Min-Max, and Min-Sum across topologies and defenses.","key_machinery":"The central object is the principal eigenvector of the correlation matrix of the malicious clients' model updates, which the paper treats as the 'optimal poisoning direction' (also called the angle bias vector). The machinery centers the updates, computes the covariance matrix, normalizes by standard deviations to obtain a correlation matrix, extracts the eigenvector for the largest eigenvalue, and uses it to compute a projection $P = (y_{\\max}^\\top U) y_{\\max}$. The crafted update is $U_{\\text{new}} = -U + P$, and a mask keeps the top 10 percent of squared parameters to preserve the attack after averaging; the eigenvector is asserted, without proof, to be the direction that maximally increases benign loss after aggregation.","core_discovery":"On its own terms, the paper claims that a decentralized model poisoning attack called DMPA outperforms existing federated-learning poisoning attacks by exploiting the correlation structure among colluding malicious models. The procedure takes the malicious updates as a matrix, centers them, forms a covariance matrix, normalizes to a correlation matrix, and extracts the eigenvector associated with the largest eigenvalue; this eigenvector is asserted to be the optimal poisoning direction. Each malicious update is then set to the negation of the original update plus the projection of that update onto this eigenvector, and finally only the top 10 percent of parameters by squared magnitude are retained, with the rest replaced by the mean vector. The authors report that in their experiments DMPA achieves the lowest average F1 scores for benign clients in almost every tested configuration, including under FedAvg, Krum, Trimmed Mean, and Median aggregation, across fully connected, ring, and star topologies, and for malicious-client ratios from 10 to 60 percent.","pith_inferences":["The paper does not test whether the maximum-eigenvalue eigenvector is truly the optimal poisoning direction; a natural ablation would compare it against random or minimum-eigenvalue directions while holding all other steps fixed.","Because DMPA's correlation matrix is built only from malicious updates, a defense that monitors the principal component or covariance structure of incoming updates could in principle detect this attack pattern, though the paper does not propose or evaluate such a defense.","The top-10 percent sparsification step appears to be what lets the attack survive coordinate-wise robust aggregators like Median and Trimmed Mean; removing that mask in an experiment would isolate its contribution.","The paper explicitly leaves non-IID data to future work; if the attack's power depends on malicious updates sharing a coherent direction, non-IID local data could weaken the correlation and reduce DMPA's effectiveness."],"forward_implications":["If DMPA works as reported, a DFL network with a modest fraction of colluding clients can be severely degraded, with benign F1 scores dropping below 0.1 in several fully connected configurations.","Robust aggregation rules such as Krum, Median, and Trimmed Mean do not by themselves neutralize the attack, since DMPA reports the lowest F1 scores even under these defenses.","The attack requires no knowledge of benign models, so DFL defenses cannot rely on hiding benign updates or on assuming attackers only know global aggregates.","Ring topologies appear to dilute but not stop the attack, suggesting that sparser peer-to-peer overlays are a partial mitigation rather than a defense.","The same attack pipeline transfers across datasets, model architectures, and overlay topologies without per-environment adaptation, which makes it a practical threat across DFL deployments."],"supporting_citations":[{"why":"Establishes FedAvg, the baseline aggregation algorithm that DMPA must compromise.","marker":"(McMahan et al. 2017)"},{"why":"Introduces Krum, one of the robust aggregation rules tested as a defense against the attack.","marker":"(Blanchard et al. 2017)"},{"why":"Provides the Median and Trimmed Mean robust aggregation algorithms used in the evaluation.","marker":"(Yin et al. 2018)"},{"why":"Defines the Min-Max and Min-Sum attack baselines that DMPA claims to outperform.","marker":"(Shejwalkar and Houmansadr 2021)"},{"why":"Defines the LIE attack baseline that DMPA is compared against.","marker":"(Baruch, Baruch, and Goldberg 2019)"},{"why":"Describes a collusive model poisoning attack in DFL, framing the attack setting DMPA targets.","marker":"(Tan et al. 2023)"},{"why":"Supplies the MNIST dataset used in the experiments.","marker":"(Deng 2012)"},{"why":"Supplies the Fashion-MNIST dataset used in the experiments.","marker":"(Xiao, Rasul, and V ollgraf 2017)"},{"why":"Supplies the CIFAR-10 dataset used in the experiments.","marker":"(Krizhevsky, Hinton et al. 2009)"}],"fun_headline_variants":["Eigenvector attack tops SOTA in decentralized FL poisoning","Collusion via covariance: best poisoning strategy yet","DMPA: single eigenvector beats all FL poisoning baselines","Decentralized FL's weakness: correlated malicious updates"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack's whole force rests on an unproven bet: that the direction in which the attackers' own model updates differ most is also the direction that most damages the honest models after averaging, and if that bet fails the attack reduces to a random or arbitrary perturbation.","fun_headline_variants_meta":{"raw":{"variants":["Eigenvector attack tops SOTA in decentralized FL poisoning","Collusion via covariance: best poisoning strategy yet","DMPA: single eigenvector beats all FL poisoning baselines","Decentralized FL's weakness: correlated malicious updates"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000561,"raw_usage":{"total_tokens":2661,"prompt_tokens":935,"completion_tokens":1726,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":551,"completion_tokens_details":{"reasoning_tokens":1660}},"tokens_in":551,"tokens_out":1726,"duration_ms":13786,"temperature":1.0,"reasoning_tokens":1660,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-08T21:32:00.563213+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take one of the reported configurations, such as CIFAR-10 with FedAvg in a fully connected topology and 40 percent malicious clients, and rerun DMPA with the projection onto the maximum-eigenvalue eigenvector replaced by a projection onto a random unit vector or onto the minimum-eigenvalue eigenvector; if the benign F1 drop is essentially unchanged, the principal-direction claim is not what carries the attack.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Describes a collusive model poisoning attack in DFL, framing the attack setting DMPA targets."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the MNIST dataset used in the experiments."}],"review_version":1}