{"id":"6196f0a0-894c-4080-83ee-08163d392367","arxiv_id":"2502.06889","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":3.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A federated learning system using YOLOv8 object detection and Gaussian blur anonymization is evaluated on Open Images, showing accuracy losses versus centralized training.","lead":"Researchers combined federated learning, object detection, and anonymization into a single visual data processing pipeline. They report a small accuracy drop compared to centralized training, but the claimed privacy benefits are not measured in the paper.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Privacy benefit is asserted, not shown: Gaussian blur of detected faces/plates is never evaluated against re-identification or model-inversion, and Section 4.4 defers that evaluation to future work.","rationale":"The reader's weakest_assumption correctly identifies the untested privacy value of blurring. My stress-test agrees that this is the load-bearing gap: the paper's novelty and headline claim rest on a privacy benefit that is never measured. I add that the placement of anonymization at the end of the pipeline means it cannot mitigate FL-specific leakages (gradient inversion, membership inference), so the 'robust, multi-layered defence' is structurally incomplete even if blurring worked. I do not see reproducible code or machine-checked support to offset this; the accuracy experiments are single-run tables without variance, and the participant setup is described too vaguely to assess data partitioning. Thus the central claim is not established, and the REJECT verdict remains appropriate.","tokens_in":13587,"tokens_out":5204,"duration_ms":52836,"concrete_test":"Run a face re-identification attack on the anonymized output. Detect faces in the test set with the trained FL model, apply the same Gaussian blur kernel as Section 4.3, and match the blurred faces against the original identity gallery using a pre-trained face recognition network (e.g., ArcFace). Report True Accept Rate at False Accept Rate = 1e-4, and compare with unblurred and pixelated baselines. If blurred TAR remains close to the unblurred baseline, the anonymization fails to provide meaningful protection. Additionally, attempt a model-inversion attack on the federated gradients (as in Geiping et al., 2020) to check whether the FL phase itself leaks identifiable images. If either attack succeeds, the claimed 'substantial privacy benefits' are not supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that combining object detection, FL, and anonymization yields a 'robust privacy protection strategy' with 'substantial privacy benefits' (Abstract). The only evidence for this is Figure 3, a single illustrative image showing blurred faces and plates. No privacy metric, threat model, or attack evaluation appears anywhere in Section 4. Section 4.4 concedes that 'it is crucial to evaluate the possible threats in anonymized images. This challenge will be addressed in future work' and acknowledges that unique visual characteristics may still permit re-identification after blurring. Thus the load-bearing premise—that Gaussian blur provides meaningful privacy against re-identification or model inversion—is untested. Moreover, the system's own pipeline (Section 3.1, Figure 1) places anonymization after model deployment, so the layer does not protect the federated training phase from the gradient-inversion and membership-inference risks the introduction itself cites for FL. Even if the accuracy tables are reproducible, the 'robust privacy' conclusion collapses without a demonstrated privacy guarantee.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a framework that combines federated learning (FL) with YOLOv8-based object detection and a Gaussian-blur anonymization layer for visual data containing faces and license plates. The authors train a centralized YOLOv8 baseline and federated models on a subset of Open Images V6, compare detection accuracy across epochs, communication rounds, and aggregation methods (FedAvg vs. FedOpt), and illustrate the anonymization layer on a single image. The paper claims to be the first to integrate object detection, FL, and anonymization, and it asserts that this combination provides a robust privacy protection strategy with substantial privacy benefits.","tokens_in":13675,"tokens_out":4195,"duration_ms":43011,"significance":"If the privacy claim were actually demonstrated, the work would be a useful systems contribution for privacy-sensitive visual-data applications, and the accuracy/communication trade-off measurements provide some practical data points. However, the central claimed contribution—robust privacy protection—is never evaluated. There is no privacy metric, no threat model, and no attack experiment anywhere in Section 4; the only evidence offered is one illustrative image. The FL accuracy results are also presented as single runs without variance or statistical analysis, which weakens the empirical conclusions. The manuscript therefore does not, in its current form, support the significance claimed in the abstract and conclusions.","major_comments":[{"comment":"The central privacy claim is unsupported. The abstract states that the proposed combination offers a robust privacy protection strategy with substantial privacy benefits, but Section 4.3 evaluates the anonymization layer only by showing a single illustrative image (Figure 3). No re-identification, model-inversion, membership-inference, or any other privacy metric is reported. Section 4.4 explicitly concedes that 'It is crucial to evaluate the possible threats in anonymized images. This challenge will be addressed in future work.' Thus the paper's headline claim is not substantiated by experimental evidence.","section":"Abstract and Section 4.3"},{"comment":"The architecture as described does not protect the FL training phase, which is the phase where the paper's own introduction says FL privacy risks (gradient inversion, membership inference) arise. Anonymization is applied only after deployment to detected sensitive regions; during training, participants share model updates with no differential privacy, secure aggregation, or other privacy-enhancing mechanism. The claim of a 'multi-layered defense' therefore does not follow from the described pipeline, and the private-training benefit of the proposed combination is not demonstrated.","section":"Section 3.1 and Figure 1"},{"comment":"All accuracy results are reported as single runs without error bars, seeds, or statistical significance tests. Several entries are non-monotonic with respect to the stated trends (e.g., Table 3: mAP50 is 62.55% at 25 epochs but 56.23% at 50 epochs; Table 5: FedAvg mAP50 rises to 75.62% at 100 epochs, then 76.51% at 150 epochs, then 76.69% at 200 epochs). Given differences of only 1–2% between several configurations, the conclusion of a 'slight trade-off' between federated and centralized training is fragile without repeated runs or confidence intervals.","section":"Section 4.2 and Tables 2–5"},{"comment":"The experimental setup is underspecified for reproducibility. The paper does not state whether the data partition among the three FL participants is IID or non-IID, how many images each client holds, whether clients participate equally each round, or the local training settings (local epochs, batch size, learning rate) per round. Additionally, the claim that the 48.8/13.0/38.2 train/validation/test split 'ensures a balanced evaluation' is questionable, since the test set is far larger than the validation set. These omissions make the FL results difficult to interpret or reproduce.","section":"Section 3.3"}],"minor_comments":[{"comment":"The claim of being 'the first' to combine these three components is asserted without a systematic comparison to prior integrated systems; it should be softened to 'to our knowledge' and supported by a broader search of FL-plus-anonymization work.","section":"Section 2.4 and Section 5"},{"comment":"Duplicate references appear for Hukkelås and Lindseth (2023) and for McMahan et al. (2017/2023); these should be unified.","section":"References"},{"comment":"The phrase 'these losses are minimal' is not supported by the tables: comparing Table 2 (200 epochs) with Table 3 (200 epochs, 5 rounds) shows mAP50 dropping from 80.05% to 74.67% and recall from 77.34% to 68.52%, which is a nontrivial utility loss that should be acknowledged and analyzed.","section":"Section 4.3"},{"comment":"The image count '29.690' appears to use a European thousands separator; in English it should be written as '29,690'.","section":"Section 3.3"},{"comment":"The final sentence has a grammatical error: 'combining object detection, FL and anonymization techniques, provides a robust approach' should be rephrased so that the subject and verb agree.","section":"Section 5"}],"recommendation":"reject","confidential_remarks":"The manuscript is more of a technical demo than a completed research contribution. The central privacy claim is not evaluated at all, and the architecture as described does not protect the FL training phase from the privacy risks the paper itself cites. Adding a proper privacy evaluation would require substantial new experiments and possibly architectural changes (e.g., differential privacy or secure aggregation), not just a small revision. The accuracy study also lacks the statistical rigor expected in a journal publication. If the authors can address these issues, a future resubmission might be considered, but the current submission does not meet the bar."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a competent systems paper with a load-bearing unsupported claim. The authors wire together Flower, YOLOv8, and Gaussian blur, run a reasonable set of FL experiments on Open Images, and then assert that the combination gives 'substantial privacy benefits.' They never measure privacy. One illustrative image is the entire evaluation of the anonymization layer.\n\nWhat's genuinely here: the empirical sweep over epochs, rounds, and FedAvg vs FedOpt is fine for what it is, and the paper is honest in Section 4.4 about the limitations, including re-identification risk and the need for future threat evaluation. The writing is clear and the related work is cited appropriately. As an integration demo, it works.\n\nSoft spots, in order of severity. First, the central claim: blurring faces and plates with a Gaussian filter is presented as a privacy defense, but there is no threat model, no re-identification attempt, no model-inversion test, and the paper explicitly defers that to future work. The stress-test is right: the anonymization happens after deployment, so it also doesn't mitigate the gradient-inversion or membership-inference risks that FL itself faces. The privacy benefit is assumed, not shown. Second, novelty is thin: the paper cites prior FL-for-detection (Memia, Yu & Liu) and detection-with-anonymization (Andrade) and does not compare against any of them, so the 'first to combine all three' claim is a matter of direct combination rather than a new mechanism. Third, all results are single runs with no error bars or significance tests, which makes the small differences between aggregation methods unreliable. The dataset and participant split are described vaguely enough that reproduction would be hard.\n\nNone of this is fatal to the engineering value. But as a research paper it is a REJECT: the main conclusion rests on an unmeasured quantity. If the authors added a real privacy evaluation, compared against the closest prior systems, ran multiple seeds, and released code, it could become a solid applied paper.\n\nFor us: not worth bringing to reading group, not something I'd cite. But it's not incoherent—it's just unfinished. I'd desk reject rather than spend referee time on it.","headline":"Competent plumbing, unmeasured privacy: the FL+YOLOv8 integration is fine, but the anonymization layer is never evaluated and the novelty is thin.","tokens_in":14292,"tokens_out":2609,"would_cite":false,"duration_ms":25440,"reading_group":"no","serious_thinker":"yes","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims to be the first to combine federated learning, object detection, and anonymization into a single pipeline that trains a detector without sharing raw visual data and then blurs detected faces and license plates.","keywords":["federated learning","object detection","image labelling","anonymization","data privacy","YOLOv8","Gaussian blur"],"falsifier":"Run a face-recognition or model-inversion attack against images anonymized by this Gaussian blur; if identities or reconstructed content are recovered at a nontrivial rate, the claim of robust privacy protection fails, regardless of the federated accuracy measurements.","tokens_in":13318,"feed_emoji":"🛡️","tokens_out":9914,"duration_ms":81548,"temperature":0.7,"pith_summary":"The paper argues that a pipeline combining federated learning, object detection, and anonymization is the first integrated framework that addresses visual-data privacy in a way no pair of these techniques can. Its experiments train a YOLOv8 detector across three participants on roughly 29,690 images from Open Images, keeping raw data local, and then blur the detected faces and license plates with a Gaussian filter. The federated model reaches about 76% mAP50 after eight rounds, about three to four points below the centralized baseline, which the authors call a slight accuracy trade-off for substantial privacy benefit. The central claim to establish is that this three-part combination works as a robust, multi-layer privacy defense.","feed_headline":"Federated detector plus blurring guards faces at slight accuracy cost","feed_subtitle":"Faces and plates are blurred after federated detection, with about a 4-point mAP drop.","key_machinery":"The load-bearing mechanism is the ordered pipeline itself: local YOLOv8 training on private data, transmission of only model updates to a central server that aggregates them with federated averaging (FedAvg) or the adaptive FedOpt variant, followed by deployment of the global model to detect sensitive regions, and finally a Gaussian-blur anonymization step that masks those regions. The argument's weight rests on the combination addressing complementary weaknesses—federated learning stops raw-data exposure, while blurring masks the regions that would otherwise identify people.","core_discovery":"The paper's central claim is that a three-component pipeline—federated learning, object detection, and anonymization—can deliver visual-data privacy that no pair of these components achieves alone. Concretely, a YOLOv8 object detector is trained across three participants on a 29,690-image subset of Open Images without any raw image leaving its host; after training, the model localizes faces and license plates, which are then obfuscated with Gaussian blur. The strongest experimental result is that the federated model's mean average precision (mAP50) reaches about 76% after eight rounds, about three to four percentage points below the centralized baseline, which the authors describe as a slight accuracy trade-off for substantial privacy benefit. The paper frames the unblurred regions as still usable for downstream analysis because scene context is preserved.","pith_inferences":["Editorial inference: The privacy benefit is asserted rather than demonstrated; a fair test would pit the blurred outputs against off-the-shelf re-identification or model-inversion tools.","Editorial inference: The accuracy gap was measured on one Open Images partition with only three participants and balanced data; real non-IID distributions with more participants could widen the gap, so the 'slight trade-off' is not yet a general law.","Editorial inference: The paper's own discussion acknowledges that unique visual traits (tattoos, distinctive clothing) can survive face/plate blurring; extending the anonymization layer to such traits is a natural next step that the framework could support.","Editorial inference: Because the framework keeps raw data local and only shares model updates, it is compatible with future additions such as differential privacy or secure aggregation, which could strengthen the privacy guarantee without changing the detection step."],"forward_implications":["Organizations holding sensitive image repositories can train a detector without transferring raw images to a central server, reducing the surface for data breaches.","The federated model's mAP50 of roughly 76% after eight rounds versus 80% centralized indicates that decentralized training is viable for face and license-plate localization with a modest accuracy cost.","Increasing communication rounds from three to eight produces large early gains (mAP50 rising from 28.8% to 76.2%) but diminishing returns after round five, informing where to stop for efficiency.","FedOpt and FedAvg perform similarly on these data, with FedOpt's better loss and precision suggesting a slight edge for heterogeneous participant data.","The combination of detection and blurring preserves scene context, so the anonymized images remain usable for downstream analysis, a stated design goal."],"supporting_citations":[{"why":"Establishes federated object detection without anonymization, defining the gap this paper fills.","marker":"Yu and Liu (2019)"},{"why":"Prior work applying FL to YOLOv8 real-time detection without anonymization, which the paper builds on by adding an anonymization layer.","marker":"Memia (2023)"},{"why":"Supplies the face-anonymization analysis (blurring and pixelation) that motivates the blurring choice.","marker":"Andrade (2024)"},{"why":"Shows model inversion can expose private data despite anonymization or encryption, motivating the multi-layer defense.","marker":"Fredrikson et al. (2015)"},{"why":"Compares anonymization techniques and shows traditional methods may not fully prevent re-identification, cited as a limitation.","marker":"Hukkelås and Lindseth (2023)"},{"why":"Introduces FedAvg, the primary aggregation method used in the federated experiments.","marker":"McMahan et al. (2017)"},{"why":"Introduces FedOpt, the adaptive aggregation method compared against FedAvg.","marker":"Reddi et al. (2020)"},{"why":"Provides YOLOv8, the object detection model used throughout the pipeline.","marker":"Jocher et al. (2023)"},{"why":"Supplies the Open Images dataset with the face and license plate annotations used for training and testing.","marker":"Krasin et al. (2017)"}],"fun_headline_variants":["Federated vision blurs faces, plates; near-parity accuracy","Federated detector blurs faces, plates: only 3-4 mAP less","Privacy via federated detection: blur faces, plates, near-parity","Federated learning + blurring: faces hidden, accuracy dips slightly","Blur faces, plates after federated detection: 4 mAP cost for privacy"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The untested premise is that blurring detected faces and license plates with a Gaussian filter actually stops re-identification and model-inversion attacks; the paper asserts this but provides no attack evaluation, only a single example image.","fun_headline_variants_meta":{"raw":{"variants":["Federated vision blurs faces, plates; near-parity accuracy","Federated detector blurs faces, plates: only 3-4 mAP less","Privacy via federated detection: blur faces, plates, near-parity","Federated learning + blurring: faces hidden, accuracy dips slightly","Blur faces, plates after federated detection: 4 mAP cost for privacy"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000509,"raw_usage":{"total_tokens":2440,"prompt_tokens":866,"completion_tokens":1574,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":482,"completion_tokens_details":{"reasoning_tokens":1471}},"tokens_in":482,"tokens_out":1574,"duration_ms":11573,"temperature":1.0,"reasoning_tokens":1471,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-08T17:46:21.012369+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a face-recognition or model-inversion attack against images anonymized by this Gaussian blur; if identities or reconstructed content are recovered at a nontrivial rate, the claim of robust privacy protection fails, regardless of the federated accuracy measurements.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Prior work applying FL to YOLOv8 real-time detection without anonymization, which the paper builds on by adding an anonymization layer."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the face-anonymization analysis (blurring and pixelation) that motivates the blurring choice."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Shows model inversion can expose private data despite anonymization or encryption, motivating the multi-layer defense."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Introduces FedAvg, the primary aggregation method used in the federated experiments."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides YOLOv8, the object detection model used throughout the pipeline."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the Open Images dataset with the face and license plate annotations used for training and testing."}],"review_version":1}