{"id":"9d06cfa8-7df6-4cfb-a978-92a269589763","arxiv_id":"2504.21182","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A three-stage protocol combining secret sharing and graph-based PIR hides both the federator's target objective and clients' labels in one-shot federated learning.","lead":"This paper designs a three-stage protocol for one-shot federated learning that lets a server retrieve aggregated client predictions for one target task without revealing which task it wants, while clients' labels stay information-theoretically private. It combines secret sharing, knowledge distillation, and graph-based private information retrieval, and claims better communication costs than prior PIR-based schemes.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Symmetric-privacy extension breaks the Section V reconstruction: the added one-time pad R_p(x) is not cancelled by the recovery sums, so the federator cannot decode the aggregate labels it is promised.","rationale":"The reader's weakest assumption was the mere existence of shared randomness in the symmetric-privacy extension. My stress-test found a more fundamental and specific flaw: even granting that shared randomness, the protocol as written cannot recover the desired aggregate because the added one-time pad contaminates the reconstruction. Section V's recovery uses weighted sums Σ_i α_i^{-ϑ} A_i^p(α_i) that cancel interference only through the dual-code identity Σ_{i∈I(e_t)} ν_{t,i} α_i^ζ = 0. The pad R_p(x) is added without such ν factors, and its weighted sums Σ_i α_i^{-ϑ} R_p(α_i) are generically nonzero over the chosen evaluation points. Therefore the federator's system of equations for the aggregate labels includes unknown random offsets, making the claimed retrieval impossible. This directly invalidates Theorem 4 and the paper's headline claim of information-theoretic privacy of clients' data from the federator while still recovering the objective's aggregate. The issue is internal inconsistency, not a disagreement with consensus. It is fixable in principle (e.g., by constraining R_p to the kernel of the reconstruction map, or by redesigning the recovery), but the current paper does not provide such a fix and asserts 'the recovery process as in Section V remains unchanged,' which is false. Because the error affects a central claimed contribution and no correct recovery is described, the appropriate verdict is REJECT rather than CONDITIONAL. The reader's conditional acceptance was based on the assumption that the core theorems are internally consistent; this specific counterexample shows they are not as stated.","tokens_in":1018,"tokens_out":1093,"duration_ms":219845,"concrete_test":"Implement the protocol in a small finite field with concrete parameters, e.g., n=5, q=7, z_s=z_q=1, ρ=5, k_C=3, α=3, α_i=3^i, and any nonzero label aggregates. Compute the Section V recovery sums with and without R_p(x)=s_1 x^2+s_2 x^3+s_3 x^4 for random s_j and nonzero s_1. If A^{(1)} and A^{(2)} differ by terms depending on s_j (as predicted by the geometric sums), the reconstruction is corrupted. Then check that no linear combination of the n answers can recover the aggregates without knowledge of s_j.","verdict_should_be":"REJECT","load_bearing_attack":"Section VI (Theorem 4) states that the recovery process of Section V remains unchanged after each client adds the shared one-time pad R_p(x) to its answer: A'_p(alpha_i)=A_i^p(alpha_i)+R_p(alpha_i). But Section V's recovery computes A^{(ϑ)}=Σ_i α_i^{-ϑ} A'_p(α_i) for ϑ=1..k_C-z_s and relies on the cancellation of all high-degree interference via Σ_{i∈I(e_t)} ν_{t,i} α_i^ζ=0 for 0≤ζ≤ρ-2. The R_p contribution is Σ_{τ=1}^{k_C+z_q-1} s_{p,τ} Σ_{i=1}^n α_i^{k_C-z_s+τ-1-ϑ}. These inner sums are over all n clients and contain no ν factors; for the evaluation points α_i=α^i (α primitive), they are geometric sums that are not zero in general (e.g., n=5, q=7, ϑ=1, τ=1 gives exponent 1 and sum ≡6 mod 7). Hence A^{(ϑ)} is contaminated by unknown random terms, so the federator cannot solve for the aggregates {Σ_{i∈I(e_j)} y^{(j)}_{i,p,u}}. The one-time pad hides the interference but also destroys correctness. A fix would require constraining R_p to lie in the kernel of the reconstruction map, which changes the pad's entropy and invalidates the current one-time-pad proof; alternatively a different recovery method would need to be specified. As written, Theorem 4's claim that the federator learns exactly the aggregate labels while recovering them is unsupported.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes a three-stage protocol for one-shot federated learning with a public unlabeled dataset. In Stage 0 each objective is assigned to rho of n clients; in Stage 1 clients use McEliece-Sarwate secret sharing so that each client stores a share of the sum of the labels for each objective; in Stage 2 the federator queries all clients with graph-based PIR-style query polynomials and combines the answers with dual-GRS weights nu_{t,i} so that all undesired terms cancel. The claimed rates are Rshare = (rho - zs - zq + 1)/(2 T rho (rho - 1)) and RPIR = (rho - zq - zs + 1)/(2n), with information-theoretic privacy of the clients' labels from up to zs colluding clients and objective-hiding from up to zq colluding clients. An extension in Section VI adds a client-side one-time pad R_p(x) and claims symmetric privacy from the federator (Theorem 4).","tokens_in":25722,"tokens_out":13145,"duration_ms":141737,"significance":"The core Section V construction is a genuine attempt to co-design secure aggregation and graph-based PIR, and the algebraic cancellation argument is explicit and internally coherent for the non-symmetric setting; the rate formulas follow directly from the parameters, and the comparison with GXSTPIR and star-product PIR is informative. However, the symmetric-privacy extension is not correct as written: the one-time pad that masks interference also prevents the federator's reconstruction, so Theorem 4 does not establish the paper's headline privacy-plus-utility claim. The non-symmetric scheme and the rate analysis may still be salvageable after substantial revision.","major_comments":[{"comment":"The extension to symmetric privacy breaks the reconstruction of Section V. The claim that 'the recovery process as in Section V remains unchanged' is incorrect: with A'_p(alpha_i) = sum_t nu_{t,i} F_t(alpha_i) q_t(alpha_i) + R_p(alpha_i), the recovery sum becomes A^(vartheta) = sum_i alpha_i^{-vartheta} A'_p(alpha_i) = (desired triangular terms) + sum_{tau=1}^{kC+zq-1} s_{p,tau} sum_{i=1}^n alpha_i^{kC-zs+tau-1-vartheta}. The inner sums are over all n clients and contain no nu_{t,i} factors, so the dual-GRS cancellation does not apply; for example, with n=5, q=7, vartheta=1 and tau=1, sum_{i=1}^5 alpha^i = 6 mod 7 for a primitive alpha. Since the federator does not know the shared randomness s_{p,tau}, it cannot subtract these terms and hence cannot decode the aggregate labels {sum_{i in I(e_j)} y^{(j)}_{i,p,u}}. Thus Theorem 4's correctness claim is unsupported. A fix would require either constraining R_p to the kernel of the reconstruction map, which would reduce its entropy and invalidate the one-time-pad argument as written, or specifying a different recovery procedure that cancels the pad.","section":"Section VI, Theorem 4"}],"minor_comments":[{"comment":"The theorem conditions on answers from clients i in I(e_j) only, but the proof and the reconstruction in Section V use the answers from all n clients; conditioning on the subset I(e_j) is insufficient to cancel the interference terms, so the statement should read i in [n].","section":"Section V, Theorem 3"},{"comment":"The notation Q^{(t)}_{T_s} in Definition 2 should be Q^{(t)}_{T_q}, since the colluding set in the objective-hiding definition is T_q and the parameter z_s is not involved.","section":"Section III, Definition 2"},{"comment":"The answer A'_p(alpha_i) is written as a sum over t=1..T, but F_t and nu_{t,i} are only defined for t in I(i); the sum should be over I(i), or one should define nu_{t,i}=0 for t not in I(i).","section":"Section VI"},{"comment":"The shared randomness R_p is introduced only in the extension section and is absent from the system model and Definitions 1-3; the out-of-band mechanism by which all clients share R_p while hiding it from the federator is unspecified, and this assumption is load-bearing for Theorem 4.","section":"Section VI"},{"comment":"The field-size condition q >= max{rho + kC - zs, (gamma-1)n} should also include q-1 >= n, since the evaluation points alpha_i = alpha^i for a generator alpha are distinct only if n <= q-1.","section":"Section V, b)"}],"recommendation":"major_revision","confidential_remarks":"The Section VI error is real and central: the advertised symmetric-privacy guarantee cannot be achieved by the proposed one-time pad while preserving correctness. The Section V scheme and its rate analysis appear coherent, so the paper could be revised by fixing or removing Theorem 4. The comparison section is fair, and I see no citation or novelty concerns; the single self-citation [57] is not load-bearing."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. First, the core scheme in Sections III–V is a real extension of [19]: it replaces Shamir secret sharing with McEliece-Sarwate ramp sharing and designs a matching graph-based PIR scheme from duals of Reed-Solomon codes, handling arbitrary task-assignment hypergraphs. The rate expressions follow from the construction, and I checked the interference-cancellation algebra in the proof of Theorem 3; it holds. Theorems 2 and 3 are plausible. Second, the symmetric-privacy extension in Section VI has a correctness bug. The paper adds a shared-random polynomial R_p(x) to every client's answer and then says \"the recovery process as in Section V remains unchanged.\" It doesn't. The reconstruction sums A^{(\\vartheta)} = \\sum_i \\alpha_i^{-\\vartheta} A'_p(\\alpha_i) pick up the term \\sum_{\\tau} s_{p,\\tau} \\sum_i \\alpha_i^{k_C-z_s+\\tau-1-\\vartheta}, which is not zero in general (n=5, q=7, \\vartheta=1, \\tau=1 gives a nonzero sum). The federator doesn't know the s_{p,\\tau}, so the aggregates it is promised are corrupted. The one-time pad hides the interference but destroys correctness. Fixing it by constraining R_p to the kernel of the reconstruction map would shrink the pad's entropy and break the privacy proof. So Theorem 4 is unsupported as written.\n\nThe rest of the soft spots are minor by comparison. The paper is purely theoretical; there is no simulation showing the aggregated labels produce a usable model, which is acceptable for an ISIT-style theory paper but means the utility claim is unvalidated. The communication-cost comparison omits the upload cost of the queries, and the parameter integrality/divisibility conditions are unpolished. None of that affects the core rates.\n\nWhat is genuinely good: the problem formulation (objective-hiding in one-shot FL) is timely, the co-design of storage and query codes is new, and the comparison to star-product PIR at \\rho=n and to GXSTPIR is honest. The self-citation [57] is not load-bearing. No circularity.\n\nVerdict: the paper deserves a serious referee. The core result is likely correct and valuable; Section VI needs a fix or should be withdrawn. If the authors can repair Theorem 4, this is a solid journal paper. I'd send it out and expect heavy revision.","headline":"Core ramp-secret-sharing plus graph-PIR construction is a genuine extension of [19] with sound rates, but the symmetric-privacy extension in Section VI breaks correctness because the added one-time pad R_p is not canceled during reconstruction, leaving Theorem 4 unsupported.","tokens_in":26367,"tokens_out":4825,"would_cite":true,"duration_ms":46721,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["94A62","68P27","94B05"],"pacs":[],"model":"deepseek-v4-flash","headline":"A three-stage protocol lets a federator train one hidden objective on private client data while clients see neither each other's labels nor the chosen task.","keywords":["federated learning","objective-hiding","private information retrieval","secret sharing","information-theoretic privacy","secure aggregation","knowledge distillation","Reed-Solomon codes"],"falsifier":"Run the Section VI protocol twice with the same shared-randomness polynomial $R_p(x)$ for two different target objectives; if the federator can subtract one answer set from the other and recover non-target aggregate labels, then the one-time-pad assumption is violated and Theorem 4's symmetric-privacy guarantee collapses for reused randomness. More directly, a federator that obtains any client's stored shares together with the shared randomness can reconstruct $R_p$ and decode the interference terms.","tokens_in":1881,"feed_emoji":"🔒","tokens_out":2280,"duration_ms":59448,"temperature":0.7,"pith_summary":"The paper claims that a federator can train one target model from many private client datasets without either exposing the clients' data or revealing which target model is being trained. The key move is to turn arbitrary non-linear training into label generation on a shared public dataset, so that each client's contribution becomes an additively separable function of its data. Those labels are secret-shared among clients using McEliece-Sarwate (ramp) secret sharing, and the federator then retrieves only the aggregated labels for its chosen objective through a graph-based private information retrieval scheme. The claimed result is information-theoretic privacy: up to $z_s$ colluding clients learn nothing about other clients' labels, up to $z_q$ colluding clients learn nothing about which objective was requested, and (with shared randomness) the federator learns nothing beyond the aggregate labels for the requested objective. The rates are $R_{\\text{share}} = (\\rho - z_s - z_q + 1)/(2T\\rho(\\rho-1))$ and $R_{\\text{PIR}} = (\\rho - z_s - z_q + 1)/(2n)$.","feed_headline":"One-shot federated learning hides the target task too","feed_subtitle":"Clients never see which of many objectives the server wants, and the server sees only aggregated labels.","key_machinery":"The engine is a pair of polynomials over $\\mathbb{F}_q$: a McEliece-Sarwate (ramp) secret sharing polynomial $f^{(t)}_{i,p}(x)$ whose low-degree coefficients hold a block of a client's labels and whose high-degree coefficients are randomness, and a query polynomial $q^{(t,j)}_p(x)$ that is a secret sharing of a Kronecker delta indicating the target objective $j$. Clients sum incoming shares to obtain codewords of a generalized Reed-Solomon (GRS) code, and answer by evaluating the product polynomial scaled by dual-code coefficients $\\nu_{t,i}$; summing weighted answers over clients cancels every term except the target aggregate because the $\\nu$ factors annihilate low-degree monomials. This cancellation property is what allows arbitrary task-assignment graphs and is the mechanism that makes the rate formulas hold.","core_discovery":"The paper's central claim is that objective-hiding and data privacy can be achieved simultaneously, in the information-theoretic sense, for arbitrary non-linear federated learning tasks, provided the clients first convert their trained models into labels on a public unlabeled dataset. The federator asks for one of $T$ candidate objectives; by combining secret-sharing-based secure aggregation with a graph-based private information retrieval scheme built from the duals of Reed-Solomon codes, the protocol lets the federator compute exactly the sum of labels for that objective while learning nothing else, and prevents colluding clients from learning either individual labels or the requested objective. Theorems 1 through 4 state the rates and privacy guarantees; Theorem 4 adds symmetric privacy on the assumption of shared randomness among clients unknown to the federator.","pith_inferences":["The shared-randomness assumption in Section VI is the hidden cost of symmetric privacy: without a specified out-of-band mechanism for distributing and protecting the random polynomial $R_p(x)$, Theorem 4's guarantee rests on a setup assumption rather than on the communication protocol alone.","The same machinery could be adapted to any additively separable finite-field-valued statistic, not just classification labels, by replacing the label vectors with other function outputs and keeping the rate formulas unchanged.","Because labels are quantized predictions on a public dataset, the data-privacy guarantee protects training data only to the extent that those predictions do not themselves encode identifiable information; differential-privacy-style protection of the labels is not claimed.","A natural stress test is to reuse the same shared randomness across two runs of the protocol: if the federator can then subtract the answers and recover the interference coefficients, the one-time pad has failed and aggregated labels for non-target objectives become visible."],"forward_implications":["If the protocol is correct, a server can fine-tune a model on decentralized private data for one target among many without the participating clients learning which task is being trained, and the guarantee does not rely on computational hardness assumptions.","The explicit rates give a computable operating point: for fixed numbers of clients $n$ and objectives $T$, increasing $\\rho$ (the number of clients computing each objective) improves the PIR rate but degrades the sharing rate, so one can optimize total communication cost over $\\rho$.","The scheme's total communication cost is claimed to be lower than applying existing graph-based PIR schemes in the query stage, while the star-product approach is competitive only in the non-graph-based case $\\rho = n$.","Because the protocol is one-shot, it avoids iterative model-inversion attacks and the repeated communication overhead that privacy mechanisms would add to standard federated learning.","The privacy guarantees protect both directions at once: clients hide individual labels from other clients and from the federator, and the federator hides its objective from colluding clients."],"supporting_citations":[{"why":"Supplies the graph-based PIR method with cross-subspace alignment for Shamir secret sharing that this paper generalizes to McEliece-Sarwate sharing and arbitrary task assignments.","marker":"[19]"},{"why":"Provides the star-product PIR scheme for coded databases used as the baseline and as the optimized scheme in the non-graph-based case $\\rho = n$.","marker":"[17]"},{"why":"Introduces McEliece-Sarwate secret sharing, the ramp secret-sharing scheme used as the storage code in the sharing stage.","marker":"[38]"},{"why":"Establishes secure aggregation for federated learning, the baseline approach the paper extends toward non-linear functions and objective hiding.","marker":"[2]"},{"why":"Gives the capacity and framework for private computation that motivates the function-privacy setting addressed here.","marker":"[12]"},{"why":"Introduces graph-based PIR on replicated storage, the model underlying the task-assignment hypergraph.","marker":"[18]"},{"why":"Provides cross-subspace alignment for X-secure T-private PIR with Shamir secret sharing, the rate baseline for comparison.","marker":"[44]"},{"why":"Defines Shamir secret sharing, used in the illustrative first approach and in the compared schemes.","marker":"[76]"},{"why":"Provides the knowledge-distillation idea that averaged predictions over a public dataset transfer ensemble knowledge, supporting the label-aggregation formulation.","marker":"[74]"},{"why":"Develops symmetric PIR from MDS coded data, the basis for extending the protocol to data privacy against the federator.","marker":"[21]"}],"fun_headline_variants":["One-shot FL hides both data and the target task","Dual privacy: clients' data and server's objective stay secret","Secret-sharing plus PIR: one-shot FL with objective-hiding","Federated one-shot: neither data nor target task leaks","Information-theoretic dual privacy for federated learning"],"cache_read_input_tokens":28288,"weakest_assumption_plain":"The symmetric-privacy result assumes all clients share a random one-time pad that the federator cannot learn; if that shared randomness is leaked, reused, or impossible to set up out-of-band, the federator can unmask the interference terms and read aggregated labels for objectives it did not request.","fun_headline_variants_meta":{"raw":{"variants":["One-shot FL hides both data and the target task","Dual privacy: clients' data and server's objective stay secret","Secret-sharing plus PIR: one-shot FL with objective-hiding","Federated one-shot: neither data nor target task leaks","Information-theoretic dual privacy for federated learning"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000415,"raw_usage":{"total_tokens":2111,"prompt_tokens":883,"completion_tokens":1228,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":499,"completion_tokens_details":{"reasoning_tokens":1145}},"tokens_in":499,"tokens_out":1228,"duration_ms":11153,"temperature":1.0,"reasoning_tokens":1145,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T05:13:28.838795+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the Section VI protocol twice with the same shared-randomness polynomial $R_p(x)$ for two different target objectives; if the federator can subtract one answer set from the other and recover non-target aggregate labels, then the one-time-pad assumption is violated and Theorem 4's symmetric-privacy guarantee collapses for reused randomness. More directly, a federator that obtains any client's stored shares together with the shared randomness can reconstruct $R_p$ and decode the interference terms.","supporting_citations":[{"cited_title":"On the asymptotic capacity of x-secure t- private information retrieval with graph-based replicated storage,","cited_arxiv_id":null,"evidence_quote":"Supplies the graph-based PIR method with cross-subspace alignment for Shamir secret sharing that this paper generalizes to McEliece-Sarwate sharing and arbitrary task assignments."},{"cited_title":"Private information retrieval from coded databases with colluding servers,","cited_arxiv_id":null,"evidence_quote":"Provides the star-product PIR scheme for coded databases used as the baseline and as the optimized scheme in the non-graph-based case $\\rho = n$."},{"cited_title":"On sharing secrets and reed-solomon codes,","cited_arxiv_id":null,"evidence_quote":"Introduces McEliece-Sarwate secret sharing, the ramp secret-sharing scheme used as the storage code in the sharing stage."},{"cited_title":"Practical secure aggrega- tion for privacy-preserving machine learning,","cited_arxiv_id":null,"evidence_quote":"Establishes secure aggregation for federated learning, the baseline approach the paper extends toward non-linear functions and objective hiding."},{"cited_title":"The capacity of private computation,","cited_arxiv_id":null,"evidence_quote":"Gives the capacity and framework for private computation that motivates the function-privacy setting addressed here."},{"cited_title":"Private information retrieval in graph-based replication systems,","cited_arxiv_id":null,"evidence_quote":"Introduces graph-based PIR on replicated storage, the model underlying the task-assignment hypergraph."},{"cited_title":"Cross subspace alignment and the asymptotic capacity of x-secure t-private information retrieval,","cited_arxiv_id":null,"evidence_quote":"Provides cross-subspace alignment for X-secure T-private PIR with Shamir secret sharing, the rate baseline for comparison."},{"cited_title":"Symmetric private information retrieval from mds coded distributed storage with non-colluding and colluding servers,","cited_arxiv_id":null,"evidence_quote":"Develops symmetric PIR from MDS coded data, the basis for extending the protocol to data privacy against the federator."}],"review_version":1}