{"id":"e829cac3-7aac-44bf-8293-28772b241b70","arxiv_id":"2502.05547","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"DDFed combines fully homomorphic encryption with cosine-similarity filtering so a federated learning server can aggregate encrypted updates and reject poisoned ones.","lead":"This paper introduces DDFed, a federated learning framework that uses fully homomorphic encryption to keep client model updates hidden while still filtering out poisoned updates. It aims to give a single-server federated learning system both privacy protection and resistance to model poisoning attacks.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Shared perturbation in Eq. (4) destroys the Byzantine-client privacy guarantee: a malicious client can cancel the common noise using its own score and recover exact similarity scores of all other clients.","rationale":"The paper's headline contribution is simultaneously privacy and robustness in the standard single-server topology. The FHE integration and poisoning experiments are plausible, and the cosine-filtering defense likely works as a plaintext-free anomaly detector. However, the privacy component specifically against Byzantine clients is the differentiator from prior work, and it rests entirely on the perturbation in Eq. (4). The construction uses one common Δ(t) for all clients; since each client decrypts the full vector of scores and knows its own true score, the common noise term is perfectly cancelable. This is not a subtle statistical attack; it is an exact inversion of the masking. Appendix A.3.2 asserts DP but never computes sensitivity Δ_f or addresses the shared-noise structure. Therefore the strongest claim—'without introducing new participant roles... ensures strong privacy protection'—is not established. A corrected version with per-client independent noise and a proper DP proof could be a useful contribution, but as written the central dual-defense claim fails. The reader identified precisely this weakness, and I agree; the REJECT verdict should stand unchanged.","tokens_in":16082,"tokens_out":4787,"duration_ms":47040,"concrete_test":"Implement the DDFed similarity phase with the documented common Δ(t) (e.g., 100 clients, one malicious); let the malicious client compute n = s'_j - <u_j,v> from its decrypted score and public normalized update, then subtract n from each s'_i. If the recovered values match the true cosine similarities to CKKS precision, the Appendix A.3.2 DP guarantee is refuted for Byzantine clients. A correct design would need per-client independent Δ_i(t) plus a sensitivity bound for the inner product; verify that with per-client noise this recovery fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that DDFed provides both FHE-based privacy and poisoning defense in a single-server topology. The load-bearing assumption is that the server-side perturbation in Eq. (4) gives each client (ε,δ)-DP for the decrypted similarity scores. This fails. In Eq. (4), the server adds a single common vector Δ(t) to every normalized encrypted update, so every score s'_i = <u_i,v> + <Δ(t),v> contains the same additive noise n = <Δ(t),v>. A malicious client C_j knows its own normalized update u_j and the public previous global model v (it decrypts the global model each round), so it computes its true score s_j = <u_j,v>, observes s'_j among the scores it decrypts, recovers n = s'_j - s_j, and subtracts n from every other s'_i to recover each benign client's exact cosine similarity. The claimed protection against Byzantine-client inference in §3.3 and Appendix A.3.2 is therefore vacuous. Appendix A.3.2 never defines the function whose sensitivity Δ_f must be bounded; Eq. (7) uses Δ_f but no bound is provided. Even if the noise were per-client, the analysis would require a sensitivity calculation for the normalized last-layer inner product. As written, the privacy half of the dual-defense claim is unsupported; what remains is robust aggregation with FHE against a semi-honest server, not the advertised simultaneous dual defense.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes DDFed, a federated learning framework that combines fully homomorphic encryption (FHE)-based secure aggregation with a two-phase anomaly detection mechanism for encrypted model updates. The server computes encrypted cosine-similarity scores between normalized local updates and the previous global model, adds Gaussian perturbation intended to provide differential privacy for the decrypted scores, and asks clients to decrypt and vote on the set of trustworthy clients. The final aggregation uses FedAvg-style weights over the voted set, plus a clipping step by benign clients. Experiments on MNIST, Fashion-MNIST, and CIFAR-10 compare DDFed with several robust aggregation baselines under IPM, scaling, and ALIE poisoning attacks, reporting strong defense accuracy and modest overhead.","tokens_in":16340,"tokens_out":4514,"duration_ms":43333,"significance":"If the claimed guarantees held, DDFed would be a meaningful advance: it promises simultaneous privacy and Byzantine robustness in a single-server FL topology without non-colluding servers or three-party computation. The experimental evaluation is thorough on the poisoning side, with public datasets, multiple attacks, ablations on attacker ratio, client count, and epsilon, and the code is made available. However, the privacy half of the contribution is not established: the perturbation in Eq. (4) is common to all clients and can be canceled by any malicious client, and the appendix's DP analysis omits the required sensitivity calculation. Since the paper's headline claim is the simultaneous dual defense, the unsupported privacy guarantee is load-bearing.","major_comments":[{"comment":"The server adds a single perturbation vector Δ(t) to every client's encrypted normalized update before computing the inner product with the previous global model. Because the decrypted score list is returned to all clients, any malicious client C_j can compute its own true score s_j = <u_j, v> from its plaintext normalized update u_j and the publicly available (decrypted) global model v, observe its noisy score s'_j, and recover n = s'_j - s_j. Subtracting n from every other s'_i recovers each benign client's exact cosine similarity, contradicting the privacy claim in §3.3 and Appendix A.3.2. The perturbation must be client-specific, or the protocol must prevent clients from seeing the full score list, for the Byzantine-client privacy argument to have any force.","section":"§3.2, Eq. (4)"},{"comment":"The differential privacy analysis never specifies the function f whose sensitivity Δ_f must be bounded. Equation (7) defines σ in terms of Δ_f, but no bound is derived for the normalized last-layer inner product, and no adjacent-dataset relation is stated. As a result, the paper provides no concrete (ε, δ) guarantee for any participant. The sentence 'By adding Gaussian noise, each client's similarity score computation adheres to (ε, δ)-differential privacy' is asserted, not derived.","section":"Appendix A.3.2"}],"minor_comments":[{"comment":"The text contains typographical errors ('offen', 'we proposes', 'DDF ed', 'SCALINE' in Tables 4 and 5, 'ALE' in Table 3 caption) that should be corrected.","section":"Abstract and Section 2"},{"comment":"Equation (3) is expressed as if the norm operations are applied to ciphertexts; since normalization is done by clients in plaintext, the notation should be clarified to avoid suggesting FHE supports division.","section":"Eq. (3)"},{"comment":"The non-IID parameter q is mentioned but never defined; please define it or cite its source.","section":"Section 4.1"},{"comment":"Line 8 returns a model M(m)_G that is never defined; presumably this is W(T)_G.","section":"Algorithm 1"},{"comment":"The paper does not report any privacy evaluation (e.g., measured epsilon, attack experiments on score inference); the privacy claim is supported only by the flawed analysis in Appendix A.3.2.","section":"Section 4"}],"recommendation":"reject","confidential_remarks":"The manuscript's central claim is the simultaneous dual defense. The poisoning experiments are credible and the overhead is modest, but the Byzantine-client privacy protection is invalidated by the common perturbation in Eq. (4). The missing sensitivity analysis is not a minor omission; it is the core of the claimed DP guarantee. A revision would require redesigning the perturbation mechanism and re-proving privacy, which goes beyond typical minor revisions. The paper may be better suited to a security venue rather than a general ML conference as submitted."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: DDFed is a real new combination—FHE-based secure aggregation plus cosine-similarity client filtering in a single-server FL topology—and the poisoning experiments are honestly run against standard attacks. But the privacy half of the advertised dual defense does not hold as written. The shared perturbation in Eq. (4) is cancelable by any malicious client, so the claimed (ε,δ)-DP for similarity scores is vacuous. Worth a serious referee, but I would reject in current form.\n\nThe novel part is real: prior private-robust FL work mostly uses DP, two-server non-colluding setups, or 3PC. DDFed keeps a single server, uses CKKS to compute encrypted inner products, and shifts comparison/selection to clients. The two-phase detection with majority voting is a sensible way to avoid server-side plaintext access. Experiments cover IPM, SCALING, and ALIE across MNIST and FMNIST, varying attacker ratios and client counts, and the 20% time overhead is reported. That is solid empirical work for the robustness half.\n\nThe soft spots are disproportionately in the privacy analysis. Eq. (4) adds the same Delta(t) to every client's normalized encrypted update. A malicious client knows its own update and the previous global model (it decrypts it), so it can compute its true cosine score, observe the perturbed score, recover the inner product <Delta(t), v>, and subtract it from all other decrypted scores, recovering exact similarity scores of benign clients. The Byzantine-client inference protection described in Section 3.3 and Appendix A.3.2 is therefore not established. A.3.2 never defines the function whose sensitivity is bounded, and it contradicts Eq. (4) by saying clients add Gaussian noise when in fact the server does. Even per-client noise would need a real sensitivity bound for the normalized last-layer inner product; none is provided.\n\nAlso minor: the GitHub link is missing—the paper refers to 'the GitHub repository' without a URL—so reproducibility claims are incomplete. The self-cited cosine defense [38] is properly acknowledged as the basis of the detection step.\n\nWho is this for: researchers working on private and robust FL. The robustness results are usable, and the framework idea is worth pursuing. But as submitted, the headline claim—simultaneous privacy and poisoning defense under a single-server topology—is unsupported. I would send it to review because the combination and experiments justify referee time, and the review should demand a corrected DP analysis with per-client noise or an explicit sensitivity bound, plus the code. Without a fixed privacy argument, acceptance is not defensible.","headline":"A genuinely new single-server combination of FHE secure aggregation and cosine-based poisoning defense, but the privacy half is broken as written: the shared perturbation in Eq. (4) is cancelable by any malicious client, so the DP claim is vacuous.","tokens_in":16903,"tokens_out":2508,"would_cite":false,"duration_ms":23622,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"DDFed claims that federated learning can be made both private and poisoning-resistant inside the existing single-server topology, by pairing fully homomorphic encryption with encrypted cosine-similarity scoring and majority-vote client…","keywords":["federated learning","model poisoning attacks","fully homomorphic encryption","secure aggregation","Byzantine-robust aggregation","anomaly detection","differential privacy","encrypted similarity"],"falsifier":"Run the protocol with a corrupted client that decrypts its own similarity score, uses its own normalized update and the public global model to reconstruct the server's common perturbation, subtracts it from the other clients' scores, and measures whether the residuals reveal information about benign updates; if they do, the differential-privacy claim is false. A direct sensitivity calculation for the normalized-update inner product, which the paper's appendix never supplies, would also settle whether the stated Gaussian parameters establish any concrete $(\\varepsilon,\\delta)$ guarantee.","tokens_in":15833,"feed_emoji":"🛡️","tokens_out":13952,"duration_ms":118448,"temperature":0.7,"pith_summary":"The paper is trying to establish that a federated learning system can be simultaneously privacy-preserving and robust to model poisoning without changing the standard single-server, many-client topology. The proposed DDFed framework encrypts local updates with fully homomorphic encryption, performs cosine-similarity anomaly detection on the ciphertexts, and lets clients decrypt and vote on which updates to trust, after which the server does weighted secure aggregation. The authors also add a clipping step to counter attacks that similarity filtering alone misses. If the claim holds, privacy and robustness to malicious clients would no longer be a forced trade-off or require a second non-colluding server, which is the practical bottleneck in prior dual-defense schemes.","feed_headline":"Block poisoned FL updates while keeping models encrypted","feed_subtitle":"Encrypted similarity filtering and secure aggregation run inside the standard single-server federated learning setup.","key_machinery":"The load-bearing mechanism is the encrypted cosine-similarity filter with client-side selection. Clients pre-normalize their local updates so that cosine similarity reduces to an inner product, which fully homomorphic encryption can evaluate; the server computes, per client, $\\langle \\llbracket \\mathbf{W}_i^{(t)} / \\lVert \\mathbf{W}_i^{(t)} \\rVert_2 \\rrbracket + \\Delta^{(t)}, \\llbracket \\mathbf{W}_G^{(t-1)} / \\lVert \\mathbf{W}_G^{(t-1)} \\rVert_2 \\rrbracket \\rangle$ over ciphertexts of the extracted last layer. The encrypted score vector is sent to every client, each client decrypts and thresholds it, and the server takes a majority vote over the submitted selection lists to decide which updates enter the weighted secure aggregation. The perturbation $\\Delta^{(t)}$ is the designated differential-privacy device for hiding similarity scores from malicious (Byzantine) clients, and a clipping step after aggregation is the device that makes the defense hold against scaling-type attacks.","core_discovery":"The central claim, as the authors present it, is that the conflict between secure aggregation and anomaly detection can be dissolved by moving the two operations FHE cannot do—division and comparison—away from the aggregation server. Clients normalize updates before encryption, so the server only needs encrypted inner products; clients decrypt the resulting encrypted similarity scores and perform the threshold comparison locally. A majority vote over the clients' selection lists then gives the server a trusted aggregation group without revealing any update in plaintext. Experiments on MNIST, Fashion-MNIST, and CIFAR-10 under IPM, scaling, and ALIE attacks, in both cross-device and cross-silo settings, are used to support the claim that DDFed keeps accuracy close to the no-attack baseline and that the privacy noise does not degrade the aggregated model.","pith_inferences":["The same encrypted inner-product filter could express other inner-product-based robust aggregation rules, such as Krum-style geometric selection, without revealing plaintext updates, as long as the scoring step stays linear.","A natural hardening step is per-client Gaussian noise with a proven sensitivity bound, since a single shared perturbation is removable by any client that knows its own plaintext score.","The design uses one shared FHE key that lets every client decrypt the global model, so a threshold-decryption or key-sharing variant would be needed before the scheme fits settings where clients do not trust each other symmetrically.","An unstated stress test is an adaptive poisoning attack in which malicious clients know the majority-vote threshold and tune their updates to stay just above it; the paper's evaluation uses fixed attack recipes rather than such tailored ones."],"forward_implications":["A single aggregation server can hide all model updates from itself and still filter poisoned updates, so deployments no longer need a non-colluding two-server assumption.","The protocol preserves the standard federated learning topology and adds no new participant roles, so the framework can be adopted by changing the protocol rather than the deployment architecture.","Similarity-based defenses can be made privacy-preserving by moving normalization to the client and the selection threshold to a majority vote among clients, which is DDFed's main design pattern.","At attacker ratios below 0.5, the reported defense keeps model accuracy near the unattacked baseline across the tested attacks and datasets, with roughly a 20 percent increase in per-round time cost.","Because the differential-privacy noise touches only the similarity scores and not the aggregated weights, model utility is not reduced by the privacy mechanism in the reported settings."],"supporting_citations":[{"why":"Supplies the CKKS fully homomorphic encryption scheme that DDFed uses for encrypted arithmetic and secure aggregation.","marker":"[8]"},{"why":"The cosine-similarity client filtering method that DDFed re-implements over ciphertexts and extends with privacy protections.","marker":"[38]"},{"why":"Defines the Byzantine-robust median and trimmed-mean baselines that DDFed's encrypted defense is compared against.","marker":"[40]"},{"why":"Defines the IPM poisoning attack used to test whether the encrypted detection mechanism filters malicious updates.","marker":"[34]"},{"why":"Defines the ALIE poisoning attack used to test the defense's resilience to small coordinated perturbations.","marker":"[3]"},{"why":"Defines the scaling attack used in evaluation and motivates the post-aggregation clipping step.","marker":"[1]"},{"why":"The Krum robust aggregation baseline compared in the experiments.","marker":"[5]"},{"why":"A prior private-and-robust federated learning scheme with secure aggregation and backdoor detectability that DDFed contrasts with by avoiding an extra trusting server.","marker":"[43]"}],"fun_headline_variants":["Dual defense: encrypted updates and poisoned client filtering","Federated learning that guards both privacy and integrity","Encrypted aggregation with built-in poisoning detection","Single-server FL that resists attacks and leaks nothing","Combining homomorphic encryption and secure similarity for FL"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole privacy guarantee rests on the assumption that one shared noise value added by the server to every encrypted update can hide each client's similarity score from a malicious fellow client; if a malicious client can compute its own score in plaintext and subtract that shared noise, the claimed protection collapses.","fun_headline_variants_meta":{"raw":{"variants":["Dual defense: encrypted updates and poisoned client filtering","Federated learning that guards both privacy and integrity","Encrypted aggregation with built-in poisoning detection","Single-server FL that resists attacks and leaks nothing","Combining homomorphic encryption and secure similarity for FL"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000617,"raw_usage":{"total_tokens":2874,"prompt_tokens":966,"completion_tokens":1908,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":582,"completion_tokens_details":{"reasoning_tokens":1834}},"tokens_in":582,"tokens_out":1908,"duration_ms":15639,"temperature":1.0,"reasoning_tokens":1834,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-08T18:53:25.055552+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the protocol with a corrupted client that decrypts its own similarity score, uses its own normalized update and the public global model to reconstruct the server's common perturbation, subtracts it from the other clients' scores, and measures whether the residuals reveal information about benign updates; if they do, the differential-privacy claim is false. A direct sensitivity calculation for the normalized-update inner product, which the paper's appendix never supplies, would also settle whether the stated Gaussian parameters establish any concrete $(\\varepsilon,\\delta)$ guarantee.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the CKKS fully homomorphic encryption scheme that DDFed uses for encrypted arithmetic and secure aggregation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The cosine-similarity client filtering method that DDFed re-implements over ciphertexts and extends with privacy protections."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the Byzantine-robust median and trimmed-mean baselines that DDFed's encrypted defense is compared against."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the IPM poisoning attack used to test whether the encrypted detection mechanism filters malicious updates."},{"cited_title":"Baruch, M","cited_arxiv_id":null,"evidence_quote":"Defines the ALIE poisoning attack used to test the defense's resilience to small coordinated perturbations."},{"cited_title":"Bagdasaryan, A","cited_arxiv_id":null,"evidence_quote":"Defines the scaling attack used in evaluation and motivates the post-aggregation clipping step."},{"cited_title":"Blanchard, E","cited_arxiv_id":null,"evidence_quote":"The Krum robust aggregation baseline compared in the experiments."},{"cited_title":"Zhang, J","cited_arxiv_id":null,"evidence_quote":"A prior private-and-robust federated learning scheme with secure aggregation and backdoor detectability that DDFed contrasts with by avoiding an extra trusting server."}],"review_version":1}