{"id":"6f8dec39-aa55-4d07-a283-50e80c4a3a6f","arxiv_id":"2504.19955","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":2,"one_line_summary":"For Gaussian-mixture clients with a Byzantine fraction, the proposed algorithm achieves personalized mean error roughly proportional to the corruption ratio, but the paper's matching lower bound fails in the small-corruption regime.","lead":"Federated learning must deliver customized models while some clients send corrupted data, and this paper studies the cost of that corruption in a simplified statistical setting. It contributes a filter-then-cluster algorithm whose error grows roughly linearly with the corruption ratio, plus a claimed lower bound that is not valid for small corruption levels.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 1's lower bound is invalid in the small-corruption regime: Appendix A replaces an integer maximization by a real one in the wrong direction, so the linear c/k bound does not follow; for c<√(2π) the valid integer optimum gives only a quadratic bound.","rationale":"The reader's rationale already identifies the same core flaw in Appendix A: the proof relaxes an integer optimization over the number of attacked components to a real optimization in the wrong direction. The real maximizer k'=c/√(2π) is infeasible when c<√(2π) because fewer than one component cannot be attacked, so the claimed linear lower bound is not established in the small-corruption regime. This is load-bearing because the paper's headline contribution is a matching linear rate between the lower and upper bounds; without a valid Theorem 1, the abstract's 'lower bound with the same behavior' is unsupported exactly when collaboration would be most helpful. I set agreement_with_reader to 'partial' because the reader's weakest_assumption field names the D≥9∆ separation condition, which I view as a stated modeling restriction rather than a correctness flaw, whereas the deciding issue is the invalid integer-to-real relaxation in the lower-bound proof. The upper-bound Theorem 2 is a sketch and may have its own gaps, but the lower-bound error alone justifies the reject verdict. The paper appears repairable by restricting Theorem 1 to c ≥ √(2π) or by replacing the claimed linear bound with the minimum of the quadratic integer-optimum bound and the linear asymptotic bound, so the rejection is for the stated theorem rather than for the entire approach.","tokens_in":15120,"tokens_out":5904,"duration_ms":58963,"concrete_test":"Check the inequality in Appendix A by evaluating both sides for k=1, c=0.01. Let h(ε)=ε²/(ε²+2π). The proof's integer maximization is max_{k'∈Z_+, k'≤k} (k'/k)h(c/k') = h(c) ≈ 1.59e-5, whereas the claimed real maximum is c/(k√(8π)) ≈ 1.995e-3. If these numbers are confirmed, the step 'max over integer ≥ max over real' is invalid. To close the matter, instantiate the one-component attack and estimation problem with c=0.01 and compute or simulate the MSE of the algorithm from Section V; achieving MSE below 1.995e-3 would make Theorem 1 false as stated.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Appendix A derives K(m) ≥ (1/k) max_{k'∈Z_+} c^2 k'/(c^2 + 2π k'^2) and then replaces this by (1/k) max_{k'∈R_+} c^2 k'/(c^2 + 2π k'^2), claiming the real maximum is a lower bound. This is the wrong direction: since Z_+ ⊂ R_+, the real maximum is generally larger than the integer maximum, so the displayed inequality cannot hold. The real maximizer is k' = c/√(2π). For c < √(2π) this is less than 1 and is not an admissible number of attacked components. The actual integer optimum in this regime is k' = 1, which gives only K(m) ≥ c^2/(k(c^2+2π)) — a quadratic dependence on c/k, not the claimed linear one. For k=1, c=0.01, the claimed lower bound is c/(k√(8π)) ≈ 1.995e-3, while the valid integer bound is about 1.59e-5, and a one-component estimator combining a median-based server estimate with the client's verified sample has achievable MSE below the claimed bound. Thus Theorem 1, and with it the abstract's claim of a lower bound 'with the same behavior', is unsupported precisely in the small-corruption regime where collaboration has the most value.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies robust personalized mean estimation in a federated setting where each client draws one sample from one component of a k-component univariate Gaussian mixture and a constant fraction of clients are Byzantine. The authors propose a filter-then-cluster algorithm (ROBUST CLUSTERING plus COMBINE ESTIMATES) and prove an asymptotic upper bound on the average uncorrupted client's MSE that is approximately linear in the corruption ratio c/k for c/k above a tiny threshold epsilon_cr, with a much smaller exponent for c/k <= epsilon_cr. They also claim a lower bound, Theorem 1, stating K(m) >= (1/sqrt(8*pi))*(c/k) whenever c/k < sqrt(2*pi), which would show that the linear dependence is optimal up to a constant factor. The lower bound is derived in Section IV and Appendix A by reducing to a single-component problem and then maximizing a budget-splitting objective over the number of attacked components.","tokens_in":15302,"tokens_out":10961,"duration_ms":114688,"significance":"If both theorems were correct, the paper would give a clean and interesting characterization of when collaboration helps in a simple model combining personalization, heterogeneity, and Byzantine robustness, and the proposed algorithm would be a useful concrete contribution. The algorithmic idea of filtering points, clustering into components, and estimating both the component mean and the quality of that estimate is sensible and nontrivial. However, the lower bound is central to the paper's stated contribution, and it is invalid as written. The upper-bound analysis also relies on a convexity claim that is not rigorously proved and contains at least one undefined expression in the main theorem. The paper's headline result, that the MSE depends almost linearly on the corruption ratio and that this is essentially optimal, is therefore not established. The significance of the work would depend on a substantial revision that corrects the lower-bound argument and makes the upper-bound analysis fully verifiable.","major_comments":[{"comment":"The step in Appendix A after 'This brings the final error bound to' is invalid: the inequality max_{k' in Z_+} c^2 k'/(c^2 + 2*pi*k'^2) >= max_{k' in R_+} c^2 k'/(c^2 + 2*pi*k'^2) has the wrong direction, because the real maximum over a superset is an upper bound, not a lower bound, on the integer maximum. The real maximizer k' = c/sqrt(2*pi) is not an admissible integer when c < sqrt(2*pi); in that regime the valid integer optimum is k' = 1, which gives K(m) >= c^2/(k(c^2+2*pi)), a quadratic rather than linear dependence on c/k. This is not a mere technicality: for k=1 and c=0.01 the claimed bound is approximately 1.995e-3, while a simple one-component strategy based on a median server estimate combined with the client's own sample can asymptotically achieve an MSE below 0.0002, so Theorem 1 is not merely unproved but false as stated. This undermines the abstract's claim of a lower bound with the same linear behavior.","section":"Appendix A / Theorem 1"},{"comment":"The two-regime structure of Theorem 2 depends on the assertion that the one-component MSE bound g(epsilon_hat)^2/(1+g(epsilon_hat)^2) is convex for epsilon > epsilon_cr. The proof of Lemma 5 in Appendix B shows only that the sign of the second derivative is equivalent to the sign of a complicated expression, and then asserts that the existence of 0 < epsilon_cr < rho follows because certain terms are increasing or tend to 0. Monotonicity of individual terms does not imply that the entire sum is positive for all epsilon > epsilon_cr, and the numerical values quoted for epsilon_cr are not backed by a reproducible computation. Since this convexity is the basis for the adversary's optimal budget split (spread evenly when c/k <= epsilon_cr, concentrate otherwise), the upper bound's two regimes are not rigorously supported.","section":"Section V / Lemma 5"},{"comment":"The small-corruption regime in Theorem 2 contains a term 2*Phi(-3*Delta/2)*C3*Delta^2, but the constant C3 is never defined anywhere in the paper and the asymptotic analysis in Appendix B does not derive it. As written, the main theorem statement is incomplete and cannot be checked. This is a load-bearing part of the claimed upper bound, since this term accounts for the event that a client's verified sample falls far from its component mean.","section":"Theorem 2 / Appendix B"},{"comment":"The derivation of the linear large-epsilon regime obtains the coefficient C0(Delta) as 1/f^{-1}(rho - 3*Delta), but for Delta >= 2 the argument rho - 3*Delta is negative (e.g., rho = Phi(2)-Phi(-2) ~ 0.9545 for Delta=2), while f(x) = Phi(x+Delta)-Phi(x-Delta) takes values only in (0,1). Hence f^{-1}(rho-3*Delta) is undefined for these values of Delta, so the displayed expression for the linear bound is either misprinted or relies on an unstated additional condition. The claimed asymptotic bound for c/k > epsilon_cr therefore cannot be verified from the text as written.","section":"Appendix B, last paragraph before 'In the event...'"}],"minor_comments":[{"comment":"There are several typographical and grammatical errors, e.g., 'the fundamental questions is' in the introduction, and the phrase 'we give analytical guarantees ... for a chosen Byzantine model' is vague.","section":"Abstract and Section I"},{"comment":"The sentence 'A detailed analysis via the Lagrange multiplier method shows that the above expression is maximised when the adversary splits its budget evenly across c/sqrt(2*pi) components' is misleading because the number of attacked components must be an integer; Appendix A acknowledges this but then relaxes it incorrectly.","section":"Section IV"},{"comment":"The proof of Lemma 6 contains typos such as 'Talylor expansion' and uses unclear notation like '9*sqrt' for a ninth root; the chains of inequalities in the derivation of C2(Delta) are difficult to follow because of these notational problems and should be rewritten with standard root notation.","section":"Appendix B, Lemma 6 and surrounding text"},{"comment":"The algorithm description states that 'in the second phase, the algorithm draws fresh samples', but the formal protocol gives each client only one sample and Algorithm 1 randomly splits the single collection of samples into H, T1, and T2; this discrepancy should be clarified.","section":"Section V"}],"recommendation":"reject","confidential_remarks":"The lower bound error is fundamental: Theorem 1 is false in the small-c regime, not merely unproved, and the claimed near-optimality of the algorithm's linear dependence cannot be repaired by a short correction. The upper-bound analysis also has important gaps (Lemma 5 convexity, undefined C3, undefined f^{-1}(rho-3Delta)). Given that the paper's central contribution is the matching lower and upper bounds, the manuscript would require a major new argument and reframing before it could be considered for publication."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague, here's my take on arXiv:2504.19955. The interesting half is the upper bound. The problem is well-posed: k Gaussian components, each client gets one verified sample, a fraction of clients are Byzantine, and the server broadcasts a robust mean estimate plus a quality estimate. The filter-then-cluster algorithm is natural, and the analysis that each corrupted point can affect at most one component under D≥9Δ is genuinely nice. The asymptotic bound—MSE ≈ (c/k) for c/k above a tiny threshold—is plausible and would be a real contribution to robust personalized FL.\n\nThe soft spot is Theorem 1. The lower bound is false as stated. The proof in Appendix A derives K(m) ≥ (1/k) max_{k'∈Z₊} c²k'/(c²+2πk'²) and then writes ≥ (1/k) max_{k'∈R₊} ... . That inequality goes the wrong way: the real maximum is larger than the integer maximum. For c<√(2π), the real maximizer k'=c/√(2π) is less than 1, so it's not an admissible number of attacked components; the integer optimum is k'=1, giving a bound of c²/(k(c²+2π)), quadratic in c/k. A concrete check: k=1, c=0.01, the claimed bound is about 2e-3, but a median-based server estimate combined with the client's sample achieves roughly 1.6e-4. So the abstract's claim of a lower bound 'with the same behavior' as the upper bound is unsupported. The upper bound may be fine, but without a valid lower bound the paper no longer shows that linear dependence is optimal.\n\nOn the reader's report and the stress-test note: they're right on the main point. The stress-test's counterexample checks out. I don't think of this as a performance or an incoherent paper—the authors made a specific technical error in an otherwise clear derivation. The paper is repairable: restrict the lower bound to the regime where the adversary can break at least one full component, or replace the linear claim with the correct quadratic-until-saturation curve. But as written, Theorem 1 is not correct.\n\nWho is this for? Theory researchers in robust federated learning or minimax estimation. The upper-bound algorithm and its analysis could be worth a read. But the central optimality claim is broken, so I wouldn't cite it in its current form. Would I accept it for peer review? Yes—the problem is interesting, the upper bound is non-trivial, and a good referee could help fix the lower bound. It deserves a serious referee, not a desk rejection. If I were the action editor, I'd send it out and hope the referee catches the same integer/real issue.","headline":"A solid upper-bound analysis for a new robust personalized FL problem, but Theorem 1's lower bound is wrong: the integer/real maximization swap in Appendix A invalidates the claimed linear dependence.","tokens_in":15972,"tokens_out":5498,"would_cite":false,"duration_ms":50453,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["62F35","62H30"],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper proves a near-tight min-max law for personalized mean estimation under corruption: the average uncorrupted client's squared error grows linearly with the ratio of corrupted to genuine clients, and gives an algorithm matching…","keywords":["federated learning","personalized mean estimation","Gaussian mixture model","Byzantine robustness","minimax lower bound","robust clustering","corruption ratio","median estimation"],"falsifier":"Simulate the paper's algorithm and the Section IV adversary with $k=100$ components, $\\Delta=3$, $\\frac{c}{k}=0.1$, and $m$ large, with means exactly $9\\Delta$ apart: the lower bound says no estimator can have average uncorrupted-client MSE below about $0.0199$, and Theorem 2 says the algorithm should stay near $0.1$; observed average MSE below the lower bound would refute Theorem 1, and observed errors far above the linear prediction for many adversary placements would refute Theorem 2.","tokens_in":14701,"feed_emoji":"🛡️","tokens_out":8398,"duration_ms":90065,"temperature":0.7,"pith_summary":"The paper studies a deliberately simple instance of robust personalized federated learning: each client sees one sample from one component of a univariate Gaussian mixture and wants its own component's mean, while an adversary corrupts a constant fraction of clients. The central question is whether collaboration with other clients still helps when their data are heterogeneous and partially poisoned. The paper answers yes in a strong worst-case sense: every estimator must incur an average uncorrupted-client mean squared error of at least $rac{c}{k}$ times a constant, and a filter-then-cluster algorithm achieves roughly $rac{c}{k}$, compared with error 1 for using only one's verified local sample. This makes the dependence on the corruption ratio linear and essentially unavoidable, up to a constant gap.","feed_headline":"Mean-estimation error scales with the corruption ratio","feed_subtitle":"Filter-then-cluster estimation keeps average uncorrupted-client error near c/k, beating local-only MSE of 1.","key_machinery":"The carrying object is the average uncorrupted-client min-max criterion $K(m)$, evaluated over the Gaussian mixture model with means separated by at least $D$. On the algorithmic side, the workhorse is a two-phase filter-then-cluster procedure: random splitting of samples into filter and estimation halves; a density filter that keeps only points with enough near neighbours; clique construction with threshold $3\\Delta$ so that corrupted points, under the separation guarantee, can poison at most one component; a median estimate of each cluster mean; and a count-based estimate of the adversarial mass near each component. The client then takes a convex combination of its verified local sample and the closest cluster mean, with weight controlled by the estimated quality; clients whose cluster is absent or of poor quality fall back entirely on their own sample. On the lower-bound side, the key is a shifted normal density that replaces a small adversarial mass in each component, reducing the server's knowledge of the true mean to an interval of length $\\sqrt{2\\pi\\varepsilon}$, followed by a Bayesian minimax risk bound with the squared-cosine prior.","core_discovery":"Formally, the paper establishes two matching bounds. Theorem 1 gives $K(m) \\geq \\frac{1}{\\sqrt{8\\pi}}\\cdot\\frac{c}{k}$ for every $m$ whenever $\\frac{c}{k}<\\sqrt{2\\pi}$, by relaxing the problem to one where the estimator sees component labels and then attacking each component with a constructed density that hides the mean in an interval of length $\\sqrt{2\\pi\\varepsilon_i}$. Theorem 2 bounds the asymptotic error of the proposed algorithm by $C_0(\\Delta)\\frac{c}{k}+C_1(\\Delta)$ when $\\frac{c}{k}$ exceeds a very small threshold $\\varepsilon_{\\mathrm{cr}}$, with $C_0(\\Delta)$ approaching 1 as $\\Delta$ grows, and by a small $\\left(\\frac{c}{k}\\right)^{2/9}$ term in the tiny-ratio regime. Thus the average uncorrupted client's error is almost exactly linear in the corruption ratio, matching the lower bound up to the constant factor $\\sqrt{8\\pi}$. Without collaboration the same client would suffer MSE 1, so the result says collaboration survives Byzantine corruption as long as the corrupted-to-genuine client ratio is below about 1.","pith_inferences":["The same filter-then-cluster skeleton could be lifted to higher dimensions by replacing the median with any robust mean estimator, but the counting-based quality estimate and the one-point-one-component budget argument would need a geometric replacement, so the linear-in-$\\frac{c}{k}$ rate is not automatic.","The separation threshold $D\\geq 9\\Delta$ points to a concrete tradeoff: clustering closer components would require either a smaller filter radius, which weakens the adversary's forced concentration, or a more granular accounting of adversarial mass that can sit between two components.","A testable extension suggested by the lower-bound construction is that in a personalized mixture, robustness on average is limited by the indistinguishability of small adversarial shifts within each component; algorithms that actively estimate and remove such local shifts may close the $\\sqrt{8\\pi}$ constant gap.","The small-ratio regime $\\frac{c}{k}\\leq\\varepsilon_{\\mathrm{cr}}$ is the only place where the paper's upper bound is not linear; for real deployments with very few corruptions per component, the error may be dominated by a $\\left(\\frac{c}{k}\\right)^{2/9}$ term, which could be an artefact of the simple filtration and might be improvable."],"forward_implications":["If these bounds are correct, then in any sufficiently separated Gaussian mixture, average-client personalized estimation is robust up to corruption ratios just below about 1, and the per-client cost of adversarial clients is essentially the fraction of corrupted clients rather than a collapse of the whole collaboration.","The lower bound rules out sublinear dependence on the corruption ratio: no estimator in this model can make the average uncorrupted client's error grow more slowly than $\\frac{c}{k}$ against a worst-case adversary.","Clients in components the adversary attacks heavily are detected by the quality estimate and fall back to their local verified sample, so the harm is isolated to roughly $\\frac{c}{k}$ fraction of components while the remaining clients enjoy near-zero error.","When no clients are corrupted, the asymptotic bound tends to the negligible tail term, consistent with a server estimate that becomes exact as the number of clients grows.","The finite-client regime and tight constants are left open; the asymptotic statement is the established part."],"supporting_citations":[{"why":"Supplies the minimum-Fisher-information squared-cosine prior used to derive the one-component minimax risk in the lower-bound proof.","marker":"[16]"},{"why":"Defines the additive contamination model that the paper adopts for the adversary, allowing each corrupted client's observation to be replaced arbitrarily.","marker":"[4]"},{"why":"Provides the classical robust-statistics setting of sampling from contaminated distributions that motivates the algorithm's filtering step.","marker":"[3]"}],"fun_headline_variants":["Federated learning survives Byzantine clients with near-optimal error","Personalized federated mean estimation: robustness without the cost","Corruption ratio drives error in personalized federated learning","Filter-then-cluster: robust personalized means beat local baselines"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The upper-bound analysis assumes the mixture's component means are separated by at least $9\\Delta$ with $\\Delta>1.5$, so any single corrupted point can lie near at most one component; if clusters are closer, one poisoned point can contaminate several clusters and the per-component budget accounting that yields the linear bound breaks down.","fun_headline_variants_meta":{"raw":{"variants":["Federated learning survives Byzantine clients with near-optimal error","Personalized federated mean estimation: robustness without the cost","Corruption ratio drives error in personalized federated learning","Filter-then-cluster: robust personalized means beat local baselines"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000472,"raw_usage":{"total_tokens":2327,"prompt_tokens":905,"completion_tokens":1422,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":521,"completion_tokens_details":{"reasoning_tokens":1353}},"tokens_in":521,"tokens_out":1422,"duration_ms":10999,"temperature":1.0,"reasoning_tokens":1353,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T05:44:14.177162+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Simulate the paper's algorithm and the Section IV adversary with $k=100$ components, $\\Delta=3$, $\\frac{c}{k}=0.1$, and $m$ large, with means exactly $9\\Delta$ apart: the lower bound says no estimator can have average uncorrupted-client MSE below about $0.0199$, and Theorem 2 says the algorithm should stay near $0.1$; observed average MSE below the lower bound would refute Theorem 1, and observed errors far above the linear prediction for many adversary placements would refute Theorem 2.","supporting_citations":[{"cited_title":"On minimum Fisher information distributions with restricted support and fixed variance,","cited_arxiv_id":null,"evidence_quote":"Supplies the minimum-Fisher-information squared-cosine prior used to derive the one-component minimax risk in the lower-bound proof."},{"cited_title":"Robust estimation of a location parameter,","cited_arxiv_id":null,"evidence_quote":"Defines the additive contamination model that the paper adopts for the adversary, allowing each corrupted client's observation to be replaced arbitrarily."},{"cited_title":"A survey of sampling from contaminated distributions,","cited_arxiv_id":null,"evidence_quote":"Provides the classical robust-statistics setting of sampling from contaminated distributions that motivates the algorithm's filtering step."}],"review_version":1}