{"id":"89a0f9f6-0ad8-41c7-af5e-bdb353b171c2","arxiv_id":"2505.01874","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"CAFCOR combines pairwise shared-randomness correlated noise with a covariance-agnostic robust filter to achieve central-DP-like utility under the SecLDP trust model with Byzantine workers and an untrusted server.","lead":"A federated learning system can get the privacy of central differential privacy without trusting the server, if every pair of participants privately shares a random seed. The new algorithm CAFCOR adds correlated noise using these seeds and a robust aggregation filter to withstand malicious participants, achieving near-central-DP utility.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"No significant objection identified; the central claim holds under the explicitly stated honest-but-curious server model.","rationale":"The reader's weakest assumption—seed secrecy and honest-but-curious server—is indeed the key load-bearing assumption, but the paper explicitly adopts it as the SecLDP threat model. I examined the proofs of the privacy and utility guarantees and found no internal inconsistency: the RDP composition argument is standard, the covariance inversion in Lemma A.4 is correct, the CAF aggregation bound follows the filtering literature, and the convergence analysis accounts for the correlated noise in the drift terms. The empirical weaknesses noted by the reader (privacy budgets outside the theorem's range, missing code, homogeneous data experiments) are legitimate but do not affect the central theoretical result. Therefore, the conditional verdict is appropriate, and no change is needed.","tokens_in":49837,"tokens_out":26326,"duration_ms":265535,"concrete_test":"Independently re-derive Lemma A.4 for the d-dimensional case, verifying that the Rényi divergence bound with sensitivity 2C is valid for the momentum messages under adaptive composition over T steps. Specifically, check that conditioning on the previous transcript fixes the momentum from earlier rounds, so the per-step sensitivity is at most 2C (in fact (1-β_t)2C), and that the covariance matrix Σ⊗I_d is correctly inverted. If the divergence bound changes by more than a constant factor, the privacy guarantee in Theorem 4.1 would need revision.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is scoped to a specific SecLDP threat model: an honest-but-curious server that does not know the pairwise randomness seeds, colluding with up to f malicious workers. This assumption, introduced in Section 2.2, is genuinely load-bearing: if the server obtained the seeds or behaved actively maliciously, it could cancel the correlated noise, reducing the guarantee to LDP. However, the paper is explicit about this scope, and the proofs of Theorem 4.1 and Corollary 4.1 are internally consistent for that model. I reviewed the RDP analysis in Lemma A.4, including the Sherman-Morrison inversion of the covariance matrix and the d-dimensional extension, and found no technical gap. The CAF aggregation analysis in Proposition 4.1 and the convergence analysis in Theorem 4.2 also appear coherent, with rates matching the stated trade-off. The main remaining concerns are empirical: the privacy budgets in Section 5 lie outside the theorem's range \\(\\varepsilon \\in (0, \\log(1/\\delta))\\), and no code is released. These do not invalidate the theoretical claim.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper studies federated learning with an untrusted, honest-but-curious server and up to f Byzantine workers. It proposes CAFCOR, which combines correlated Gaussian noise (generated from pairwise shared randomness seeds) with a new robust aggregation rule called CAF. The main theoretical results are: (Theorem 4.1) a per-iteration Rényi privacy analysis yielding (ε,δ)-SecLDP against a server colluding with q ≤ f malicious workers, under an explicit noise condition; (Proposition 4.1) a high-dimensional robustness guarantee for CAF that does not require a bound on the honest covariance; and (Theorem 4.2 and Corollary 4.1) convergence rates for strongly convex and non-convex losses, giving an excess-error trade-off of O((f+1)d/(n^2 ε^2) + f/(n ε^2) + (f/n)G_cov^2) asymptotically in T. This rate matches central DP when f=O(1) and beats LDP when f is sublinear in n. The paper also reports experiments on MNIST and Fashion-MNIST comparing CAFCOR against LDP, CDP, and several robust aggregators.","tokens_in":50060,"tokens_out":17936,"duration_ms":179671,"significance":"If the central claim holds, the paper makes a significant contribution: it shows that pairwise shared randomness suffices to approach central-DP utility without a trusted server, while retaining Byzantine robustness. The privacy proof in Theorem 4.1 is a substantive new derivation: it computes the exact Rényi divergence for the correlated-noise covariance via Sherman-Morrison and handles partial collusion (q ≤ f) in a way not done in prior SecLDP analyses. The CAF filter is a novel, covariance-agnostic variant of the Filter algorithm, and the empirical section compares against multiple attacks and baselines. The main caveats are that the termination/complexity argument for CAF has a genuine gap (Major Comment 1) and that the experiments are run outside the theorem's privacy regime (Major Comment 2).","major_comments":[{"comment":"Section 5 and Figure 1: the reported privacy budgets (ε=26.4, 27.8, 39.6 with δ=10^-4) are all larger than log(1/δ)≈9.21, while Theorem 4.1 only applies for ε∈(0, log(1/δ)). The paper does not acknowledge this mismatch or provide experiments in the theorem's valid regime. As a result, the abstract's claim that empirical results validate CAFCOR's practicality is not backed by tests within the proven privacy range. Please add experiments with ε in (0, log(1/δ)) or explain why the privacy estimate outside that range should be trusted (e.g., via the exact Rényi accountant of Lemma A.4).","section":"§4.2 (Algorithm 2, Proposition 4.1)"}],"minor_comments":[{"comment":"The heterogeneity term in the stated bound for ϱ is written as (f/n)G_cov^2, but Theorem 4.2 gives κ G_cov^2/μ; the factor 1/μ is omitted. Please state the dependence on problem constants (including μ) explicitly.","section":"Corollary 4.1"},{"comment":"The d-dimensional extension of the Rényi divergence computation is described as straightforward, but no formal statement is given. Please provide the reduction (e.g., showing that the covariance becomes A ⊗ I_d and the sensitivity vector is 2C e_i ⊗ u) to make the proof self-contained.","section":"Appendix A (Lemma A.4)"},{"comment":"The claim that the O(f nd log d) power-method variant satisfies Proposition 4.1 up to constants is made without proof; please add a brief justification or a precise reference.","section":"§4.2"},{"comment":"The paper states that the authors 'intend to publicly release' the code; for a journal version, please release the code or provide a link, or describe the experimental setup in sufficient detail to allow replication.","section":"§5 (Reproducibility)"}],"recommendation":"major_revision","confidential_remarks":"This is a solid theoretical paper from a group with a strong prior record in this area. The privacy analysis (Theorem 4.1) is the main novel contribution and appears correct. However, the CAF termination/complexity issue in Proposition 4.1 is a real gap that must be fixed; it is not merely a presentation problem, since the utility theorem depends on it. I also recommend asking the authors to add experiments in the theorem's privacy regime and to make code available. After a careful revision, the paper could be suitable for a top journal."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is worth reading for the theory. It gives the first Byzantine-robust analysis of SecLDP with an untrusted server, and the main result holds up: CAFCOR, with per-pair shared randomness and the CAF filter, achieves a privacy-utility trade-off that interpolates between LDP and CDP, matching central DP when f is O(1). The novelty is real—the adversarial SecLDP analysis with 0≤q≤f colluding malicious workers, and the covariance-agnostic CAF filter, are both new relative to the authors' own prior work. The privacy proof is detailed: the Rényi divergence computation for the correlated Gaussian noise is internally consistent, and the Sherman-Morrison step in Lemma A.4 is correct. The CAF guarantee is proven by a termination contradiction and the convergence analysis adapts the SMEA blueprint with the right noise terms. I checked the d-dimensional extension and found no technical gap.\n\nThe soft spots are mostly empirical. The headline experiments use privacy budgets ε = 26.4 to 39.6, but Theorem 4.1 requires ε < log(1/δ) = 9.21 for δ = 1e-4. So the empirical regime is outside the range where the privacy guarantee is proven. That is not a fatal flaw—the bound is conservative—but the paper should either re-run within the theorem's range or explain why the extrapolation is safe. Second, there is no code released; the text says the authors 'intend' to release it, which is not the same as shipping it. Third, DP-BREM (Gu et al., 2023) targets the same problem with a different approach and is cited but never compared. Fourth, Figure 1's headline comparison uses homogeneous data, sidestepping the heterogeneity term that matters in the theory. None of these undermine the central theoretical claim; they are execution gaps.\n\nThe threat model—honest-but-curious server that does not know the pairwise seeds—is explicitly stated and load-bearing. If the server obtained the seeds, the guarantee degrades to LDP. That is a model choice, not a hidden flaw; the paper is honest about it.\n\nThis paper deserves a serious referee. The theory is coherent, the proofs are checkable, and the intermediate trust model is practically relevant for cross-silo FL. I would send it to peer review with requests for code, a fix or justification of the epsilon regime mismatch, and a DP-BREM comparison. The central argument should survive those changes.","headline":"Solid theory paper: first Byzantine-robust analysis of SecLDP with an untrusted server, with a rate that genuinely interpolates between LDP and CDP for small f; the experiments are weaker than the theory and use privacy budgets outside the theorem's range.","tokens_in":50604,"tokens_out":1666,"would_cite":true,"duration_ms":19000,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper argues that pairwise shared randomness among workers is enough to get central-DP-level utility with an untrusted server and Byzantine workers, and proves it for the CAFCOR algorithm.","keywords":["federated learning","differential privacy","Byzantine robustness","SecLDP","correlated noise","shared randomness","robust aggregation"],"falsifier":"Give the server all pairwise seeds ($S_{\\mathrm{known}} = S$) and rerun CAFCOR: if the per-iteration Rényi divergence between adjacent datasets then exceeds the expression in Theorem 4.1, or if a membership-inference attack succeeds at the local-DP rate rather than the SecLDP rate, the central claim is falsified.","tokens_in":49638,"feed_emoji":"🔐","tokens_out":8785,"duration_ms":80957,"temperature":0.7,"pith_summary":"The paper sets out to show that robust and private federated learning does not require a trusted central server: it suffices that each pair of participants share a random seed the server does not know. Under this relaxed privacy model (secret-based local differential privacy, SecLDP), the proposed CAFCOR algorithm adds pairwise-canceling Gaussian noise to clipped gradients and aggregates the noisy momenta with a new filter, CAF, that needs only an upper bound on the number of malicious workers. The paper proves an (epsilon, delta)-SecLDP guarantee against an honest-but-curious server colluding with up to f malicious workers, and a convergence error that matches central differential privacy up to constants when the number of malicious workers is constant, and beats local differential privacy whenever f is sublinear in n. If correct, this closes most of the utility gap between the no-trust and full-trust regimes while keeping Byzantine robustness.","feed_headline":"Shared seeds make federated learning match trusted-server privacy","feed_subtitle":"CAFCOR withstands malicious workers and beats local differential privacy, no trusted server needed.","key_machinery":"The load-bearing object is the pair (SecLDP, CAF). SecLDP is the privacy relaxation that conditions the differential-privacy guarantee on the subset of pairwise secrets revealed to the server; its power is that a single withheld seed acts as an independent noise source for the honest workers. CAF is the Covariance bound-Agnostic Filter: an iterative weighting algorithm that down-weights the input vector contributing most to variance along the worst-case direction, tracks the weighted mean with the smallest top eigenvalue of the empirical covariance, and stops once the total weight drops below $n-2f$. It requires only the bound $f$ on corrupt inputs, runs in $O(f(nd^2+d^3))$ time, and its robustness error depends on the maximum eigenvalue of the honest covariance rather than its trace, which removes a factor of $d$ compared with trimmed mean or median aggregations.","core_discovery":"The paper's central claim is that the trust assumption can be moved from the server to the participants' pairwise shared randomness. Under secret-based local differential privacy (SecLDP), in which each pair of workers shares a random seed that the honest-but-curious server does not see, the CAFCOR algorithm makes the server observe gradients masked by correlated Gaussian noise that cancels only among honest workers. The paper proves that with noise scale $\\sigma_{\\mathrm{cor}}^2 = \\sigma_{\\mathrm{ind}}^2 = \\Theta(1/(n\\varepsilon^2))$, Algorithm 1 is $(\\varepsilon,\\delta)$-SecLDP against a server colluding with any $q \\le f$ malicious workers (Theorem 4.1), and that its excess loss on the honest loss is $O((f+1)C^2 d \\log(1/\\delta)/(n^2\\varepsilon^2) + f C^2\\log(1/\\delta)/(n\\varepsilon^2) + (f/n) G_{\\mathrm{cov}}^2)$ asymptotically in the number of iterations (Corollary 4.1). This rate matches central DP when $f=O(1)$ and beats local DP whenever $f$ is sublinear in $n$.","pith_inferences":["Editorial inference: SecLDP interpolates between LDP and CDP through the fraction of secrets withheld from the server, so tuning which pairwise seeds are exposed could yield a smooth privacy-utility trade-off curve for systems that trust some workers more than others.","Editorial inference: because CAF assumes only the bound $f$ and not a bound on the honest covariance, the correlated-noise-plus-filter recipe may transfer to other robust estimators (e.g., geometric median variants) as long as the Gaussian concentration argument that controls the momentum drift is preserved.","Editorial inference: an actively malicious server is the natural stress test for the seed-secrecy assumption; making the one-time seed exchange verifiable with lightweight cryptographic commitments would defend the SecLDP model without changing the proven rates."],"forward_implications":["With a constant number of malicious workers ($f=O(1)$), CAFCOR's excess loss matches central differential privacy up to constants, as the leading term becomes $O(C^2 d\\log(1/\\delta)/(n^2\\varepsilon^2))$.","Whenever $f$ grows sublinearly in $n$, the SecLDP rate remains strictly better than the local-DP minimax rate $\\Theta(d/(n\\varepsilon^2))$.","If pairwise shared randomness is unavailable, setting $\\sigma_{\\mathrm{cor}} = 0$ recovers a state-of-the-art LDP algorithm with the same $\\tilde{\\Theta}(d/(n\\varepsilon^2))$ rate.","The CAF filter is essential to the trade-off: with coordinate-wise trimmed mean in its place, the convergence rate degrades to $\\tilde{O}(fd/(n\\varepsilon^2))$, which is $n$ times worse."],"supporting_citations":[{"why":"Introduces SecLDP with pairwise correlated noise in decentralized learning and supplies the Rényi-divergence machinery the paper adapts to the server-based setting.","marker":"Allouah et al., 2024"},{"why":"Studies secret-based local DP averaging with malicious workers but without utility guarantees, the gap CAFCOR fills.","marker":"Sabater et al., 2022"},{"why":"Establishes the privacy-robustness-utility trilemma under LDP and the eigenvalue-based robustness criterion that CAF must satisfy, plus the SMEA baseline.","marker":"Allouah et al., 2023c"},{"why":"Provides Rényi DP composition and conversion used to turn the per-iteration Rényi bound into the final (epsilon,delta)-SecLDP guarantee.","marker":"Mironov, 2017"},{"why":"Supplies the filter algorithm and the mass-removal invariant underlying the proof of CAF's robustness.","marker":"Diakonikolas et al., 2017"},{"why":"Demonstrates how pairwise shared-randomness seeds can be established in one encrypted communication round, grounding the SecLDP assumption.","marker":"Bonawitz et al., 2017"},{"why":"Gives the minimax LDP rate $\\Theta(d/(n\\varepsilon^2))$ that CAFCOR must beat in the trade-off comparison.","marker":"Duchi et al., 2018"},{"why":"Gives the central DP rate $\\Theta(d/(n^2\\varepsilon^2))$ that CAFCOR approaches when $f = O(1)$.","marker":"Bassily et al., 2014"}],"fun_headline_variants":["Pairwise seeds oust trusted server in federated learning","CAFCOR: privacy without trusted server, beats local DP","Shared randomness enables robust federated learning without server trust","From server trust to pairwise seeds: CAFCOR's privacy leap","Untrusted server? Pairwise seeds still secure federated learning"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The entire privacy guarantee rests on the server being honest-but-curious and on it not learning the pairwise random seeds shared by honest (and by non-colluding malicious) workers; if the server obtains those seeds, the correlated noise cancels and the guarantee degrades to local differential privacy.","fun_headline_variants_meta":{"raw":{"variants":["Pairwise seeds oust trusted server in federated learning","CAFCOR: privacy without trusted server, beats local DP","Shared randomness enables robust federated learning without server trust","From server trust to pairwise seeds: CAFCOR's privacy leap","Untrusted server? Pairwise seeds still secure federated learning"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000494,"raw_usage":{"total_tokens":2418,"prompt_tokens":931,"completion_tokens":1487,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":547,"completion_tokens_details":{"reasoning_tokens":1403}},"tokens_in":547,"tokens_out":1487,"duration_ms":9959,"temperature":1.0,"reasoning_tokens":1403,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T04:10:35.144698+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Give the server all pairwise seeds ($S_{\\mathrm{known}} = S$) and rerun CAFCOR: if the per-iteration Rényi divergence between adjacent datasets then exceeds the expression in Theorem 4.1, or if a membership-inference attack succeeds at the local-DP rate rather than the SecLDP rate, the central claim is falsified.","supporting_citations":[{"cited_title":"The privacy power of correlated noise in decentralized learning","cited_arxiv_id":null,"evidence_quote":"Introduces SecLDP with pairwise correlated noise in decentralized learning and supplies the Rényi-divergence machinery the paper adapts to the server-based setting."},{"cited_title":"An accurate, scalable and verifiable protocol for federated differentially private averaging","cited_arxiv_id":null,"evidence_quote":"Studies secret-based local DP averaging with malicious workers but without utility guarantees, the gap CAFCOR fills."},{"cited_title":"M., Li, J., Moitra, A., and Stewart, A","cited_arxiv_id":null,"evidence_quote":"Supplies the filter algorithm and the mass-removal invariant underlying the proof of CAF's robustness."}],"review_version":1}