{"id":"7094b3f2-ffa5-4247-a48e-a62ddfcfe84b","arxiv_id":"2505.04889","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":1,"one_line_summary":"FedRE allocates layer-wise local differential privacy noise based on gradients' sensitivity to client-specified privacy-sensitive regions, plus a perturbation-aware aggregation, for federated text tamper detection.","lead":"FedRE is a federated learning method that lets each client mark privacy-sensitive image regions, then adds differential privacy noise per neural-network layer guided by how much each layer exposes those regions. A server-side aggregation step tries to down-weight noisy updates using a public dataset.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"FedRE's Corollary 1 LDP claim is unproven: Eq. 7 clips the summed layer gradient, not per-sample contributions, so the Gaussian mechanism's sensitivity bound does not follow.","rationale":"The reader's weakest assumption is exactly the load-bearing issue: Eq. (7) clips the whole layer gradient rather than per-sample gradients, so the sensitivity bound needed for the Gaussian mechanism is missing, and Corollary 1's (epsilon, delta)-LDP claim is unsupported. The threat model explicitly claims that an eavesdropper or malicious server can attempt gradient inversion; without a valid sensitivity bound the central privacy protection claim collapses, which justifies a REJECT verdict rather than a CONDITIONAL one, because the core formal guarantee is absent. The reader's other points (aggregation equation sign, missing baselines) are secondary; the privacy proof failure is the decisive concern. The paper's empirical comparison is not enough to rescue the central claim because the headline contribution is described as 'provable privacy protection' and 'rigorous analytical results'. A REJECT with the privacy proof as the stated reason is consistent with the reader's verdict and severity. I agree with the reader on the main concern and do not see a need to adjust the verdict.","tokens_in":15326,"tokens_out":1499,"duration_ms":13690,"concrete_test":"Take a two-layer linear model and a single client with a batch of two samples. Compute the released per-layer values under Eq. (7)-(9) with fixed epsilon_l, delta_l, C_l. Construct an adjacent dataset by replacing one sample. Numerically estimate the L2 sensitivity of the released layer-1 value (maximum over adjacent pairs of ||M(g)-M(g')||_2 / sigma_l). If the empirical sensitivity bound exceeds C_l for any layer, the stated (epsilon_l, delta_l)-LDP guarantee for that layer—and hence Corollary 1—fails. A cheaper analytic check: re-derive the sensitivity of the post-clip sum and show it is not bounded by C_l unless per-sample clipping is inserted after the gradient computation.","verdict_should_be":"REJECT","load_bearing_attack":"The central privacy claim (Corollary 1) needs each layer's perturbation mechanism M_l to be (eps_l, delta_l)-LDP. Definition 3.1 and the Gaussian mechanism require a bound on the L2 sensitivity of the released quantity with respect to adjacent local datasets, which demands per-sample clipping before summation. The paper instead clips the whole layer gradient in Eq. (7) and adds noise calibrated to that clipped norm in Eqs. (8)-(9). Clipping a sum does not control the sensitivity of the sum: with a batch of n samples, replacing one sample can change the sum by up to twice the per-sample gradient norm, while clipping the sum to C_l bounds the output but not the sensitivity of the released value. Therefore the DP guarantee in Corollary 1 is not established. Additionally, even if per-sample clipping were inserted, Eq. (9) gives sigma_l = sqrt(2T ln(1/delta_l))/eps_l, which is the standard per-round Gaussian noise composition but does not account for the layer-wise correlation of noise across layers; Corollary 1's composition argument is only stated as an invocation of Theorem 1, and the total privacy claim relies on an unstated composition argument across layers and rounds. The formal claim is not just missing a proof: the stated mechanism as written cannot satisfy the claimed LDP guarantee because the sensitivity analysis is absent.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes FedRE, a federated learning method that allocates layer-wise local differential privacy budgets according to a per-client privacy-sensitive information (PSI) score, and a server-side parameter aggregation mechanism (PDA-PAM) intended to favor less perturbed gradients. The method is evaluated on text tamper detection with the T-SROIE and DocTamper datasets, reporting competitive utility and improved defense against gradient inversion relative to LDP-Fed and BLUR+LUS. The central advertised contribution is that FedRE provides a provable (epsilon,delta)-LDP guarantee while achieving better or comparable model accuracy.","tokens_in":15554,"tokens_out":2541,"duration_ms":29141,"significance":"If the formal privacy claim were valid, the idea of allocating privacy budgets layer-wise according to client-defined sensitive regions would be useful and timely: it addresses a real limitation of uniform LDP mechanisms in federated learning and introduces a plausible way to match privacy protection to user preferences. The empirical study is also nontrivial: the authors annotate PSI regions on two real-world document datasets and compare against two LDP baselines, and the defense-evaluation protocol (recovered-image similarity in the PSI regions) is appropriate for the stated threat. However, the main theoretical result is not established as written, and the aggregation mechanism contains an internal inconsistency, so the paper's load-bearing claims do not currently hold.","major_comments":[{"comment":"The empirical evaluation does not isolate the contribution of the PSI-based budget allocation. There is no ablation that compares FedRE with a uniform layer-wise Gaussian mechanism using the same total privacy budget and the same clipping and aggregation scheme; without such a comparison, the reported gains in utility or defense could come from the clipping operation, the particular aggregation rule, or the noise scale, rather than from the PSI-aware allocation. In addition, the defense metrics (MSE, SSIM, PSNR, LPIPS) are evaluated on the PSI regions, which are exactly the regions where FedRE injects more noise; this makes the defense comparison favorable by construction. A matched-noise or matched-budget ablation, and ideally an evaluation on both PSI and non-PSI regions, is needed to support the claim that FedRE provides better protection at equal utility cost.","section":"§3.3, Tables 1-2 and Fig. 5"}],"minor_comments":[{"comment":"The text says \"IoU values surpass those of centralized training without applying differential privacy\" when the privacy budget is large and there is a single client, but this is an unusual and potentially important observation; it should be explained more carefully, particularly whether the clipping regularizes the update or whether the comparison is confounded by the number of clients.","section":"Fig. 6"}],"recommendation":"reject","confidential_remarks":"The manuscript's main theoretical contribution is a layer-wise LDP guarantee, but the guarantee is invalid as stated because the sensitivity argument is missing: Eq. (7) clips the summed gradient, not per-sample gradients. This is not a minor proof gap but a fundamental flaw in the core privacy claim. The aggregation mechanism also has an internal inconsistency that undermines the interpretation of the empirical results. The empirical study is useful and the problem is well motivated, but the paper would require substantial rewriting and new experiments to establish its claims, which is beyond a minor revision. I recommend rejection, though I would view a revised version with per-sample clipping and a corrected aggregation derivation as potentially publishable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: FedRE has a genuine, practical idea—allocating the LDP budget layer-by-layer according to where each client thinks its sensitive information lives—but the central privacy guarantee is not established as written, and one of the aggregation equations points in the opposite direction from what the text says.\n\nWhat's new: the PSI score, computed from the Jacobian of each layer's gradient with respect to the annotated region, is a sensible quantity to drive budget allocation. Tying per-layer epsilon to that score, instead of applying the same noise to all layers, is a novel combination. The server-side aggregation that reweights clients using a public dataset is also interesting in principle. The experiments are not careless: multiple metrics, standard deviations, a clipping-threshold sensitivity analysis, and a comparison against pixel-level perturbation. The gains are most visible when the privacy budget is tight (eps=10), which is the regime that matters.\n\nThe problems. First, Corollary 1 is unsupported. Eq (7) clips the whole layer gradient before noise addition. The Gaussian mechanism needs an upper bound on the L2 sensitivity of the released quantity with respect to adjacent local datasets. Clipping a sum does not give that bound—one sample can change the batch gradient by more than C_l. So M_l in Eq (8) is not (eps_l, delta_l)-LDP as written, and the composition claim drops with it. This is not a cosmetic gap; it is the load-bearing wall of the paper. It could be fixed by clipping per-sample gradients and redoing the sensitivity analysis, but that is real work, not a typo.\n\nSecond, Eq (10) computes softmax of the PSI score S_l, so higher S_l gets a larger aggregation weight. The text explicitly says the server prefers to aggregate less sensitive gradients. But in this scheme, higher S_l is also the layer that receives a smaller epsilon budget, hence more noise. So the server is upweighting the noisiest gradients. That looks like a sign error or a softmax direction mistake.\n\nThird, the experiments lack a uniform-noise ablation. The claimed benefit is from reallocating budget across layers, but they never compare against the same total privacy budget spread evenly. Without that, part of the measured gain could come from clipping or from the aggregation rule rather than from PSI-based allocation. Also, they don't compare with the adaptive-DP FL methods they cite (e.g., FedDPA).\n\nWho it's for: people working on practical DP-FL, especially user-defined privacy preferences. If you're in that niche, the budget-allocation idea is worth a look, but don't rely on the proof as it stands. Others can skip it.\n\nMy recommendation: this deserves a serious referee. The idea is novel enough, and the flaws are concrete and fixable. I'd invite a revision with a correct per-sample sensitivity analysis, a fixed aggregation weight, and an ablation that isolates the PSI allocation. I would not cite it in its current form.","headline":"Interesting layer-wise budget allocation idea, but the LDP proof doesn't hold and the aggregation weight contradicts the stated goal.","tokens_in":16099,"tokens_out":4697,"would_cite":false,"duration_ms":45185,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A federated learning method claims to protect privacy-sensitive image regions with layer-wise noise, without losing model accuracy.","keywords":["Federated Learning","Local Differential Privacy","Privacy Preference","Privacy-Sensitive Information","Layer-wise Privacy Budget","Gradient Inversion Defense","Parameter Aggregation","Text Tamper Detection"],"falsifier":"Check whether Algorithm 1 contains a per-sample clipping step: it clips the aggregated gradient, not each sample's gradient. Measure the L2 sensitivity of the released layer update by comparing the outputs for two adjacent datasets that differ in one sample; if the maximum difference exceeds $C_l$, the Gaussian noise calibrated with sensitivity $C_l$ cannot provide the claimed $(\\epsilon_l,\\delta_l)$-LDP for that layer. A concrete empirical test is a canary-insertion membership probe: add a unique sample to a client's batch and test whether the released gradient reveals its presence beyond the $e^\\epsilon$ bound implied by the claimed budget.","tokens_in":1427,"feed_emoji":"🔒","tokens_out":1679,"duration_ms":68701,"temperature":0.7,"pith_summary":"The paper argues that standard federated learning with local differential privacy wastes privacy budget on non-sensitive areas, which degrades the model. It introduces FedRE, which measures how strongly each network layer's gradients respond to the privacy-sensitive regions a client has marked, then distributes a fixed total privacy budget across layers so that sensitive layers receive more noise. A server-side aggregation mechanism weights client updates by their sensitivity scores on a public dataset, favoring less perturbed gradients. The claim is that this achieves strong protection of user-chosen regions and better global model accuracy than uniform LDP baselines under the same total privacy budget.","feed_headline":"Federated learning targets noise to private regions","feed_subtitle":"FedRE splits the privacy budget by layer so protected areas get stronger noise without wrecking accuracy.","key_machinery":"The load-bearing objects are the PSI score and the derived layer-wise budget allocation. The PSI score $S_l$ is the average, over the annotated privacy-sensitive region, of the Frobenius-normalized Jacobian of the layer gradient with respect to the input; it measures how much each layer's gradient reveals about that region. The budget allocation sets $\\epsilon_l$ in inverse proportion to $S_l$, so sensitive layers get smaller budgets and hence more noise. The Gaussian mechanism clips the layer gradient to norm $C_l$ and adds zero-mean noise with variance $C_l^2 \\sigma_l^2$. The server-side PDA-PAM aggregation computes softmax weights from PSI scores of each client model on a public dataset and combines the updates. The paper's Corollary 1 asserts that composing these per-layer mechanisms yields $(\\epsilon,\\delta)$-LDP for the full gradient.","core_discovery":"The paper's central claim is that privacy preference can be encoded as a per-layer sensitivity score, and that reallocating the privacy budget according to that score yields a strict $(\\epsilon,\\delta)$-LDP guarantee for the uploaded gradient while simultaneously improving defense against gradient inversion and preserving accuracy. The PSI score for a layer is defined as the average aligned Frobenius norm of the Jacobian of the layer gradient with respect to the input, computed over the client's annotated sensitive region. Layers with higher PSI scores receive smaller privacy budgets and therefore stronger Gaussian noise. The server then aggregates using softmax weights derived from PSI scores evaluated on a public dataset. Experiments on text tamper detection datasets T-SROIE and DocTamper report that FedRE outperforms LDP-Fed and BLUR+LUS on both utility and defense metrics.","pith_inferences":["One unstated risk is that the server's PSI-score weighting on a public dataset could leak information about where a client's sensitive regions lie; an adversary with access to the aggregation weights might infer the location of the PSI regions.","The sensitivity computation adds $O(F D)$ time and $O(D N)$ space per sample; the paper's suggestion to sample ten same-format images may be insufficient under high data heterogeneity, which is testable.","A natural extension would be to combine FedRE with per-sample clipping (as in DP-SGD) to actually certify the LDP guarantee; this would likely change the reported utility because per-sample clipping is more aggressive.","The PSI concept could transfer to non-image domains where 'regions' become tokens or features, but the Jacobian alignment step would need a new definition and validation."],"forward_implications":["If FedRE's claim holds, a fixed total privacy budget can be reallocated across layers to give stronger protection to user-specified sensitive regions at no extra utility cost.","The layer-wise PSI score provides a gradient-level map of where private information resides, which could guide defenses beyond LDP, such as gradient compression or selective dropout.","The server-side aggregation implies that a public dataset can down-weight noisy updates, so the method's tolerance to LDP noise may improve as the number of clients grows.","The same sensitivity-based budget allocation could be applied to other architectures by computing Jacobians per layer, making the method architecture-agnostic rather than specific to text tamper detection.","The paper reports the largest accuracy gains under tight privacy budgets, suggesting the benefit grows with the noise level."],"supporting_citations":[{"why":"Supplies the FedAvg base paradigm that FedRE builds on.","marker":"[23]"},{"why":"The main LDP baseline (LDP-Fed) that FedRE compares against for both utility and defense.","marker":"[30]"},{"why":"Provides the layer-wise gradient sensitivity idea that FedRE adapts into PSI scores.","marker":"[32]"},{"why":"Supplies the noise multiplier and composition formula used to set $\\sigma_l$ per layer.","marker":"[33]"},{"why":"The composition theorem used to claim $(\\epsilon,\\delta)$-LDP for the full gradient from layer-wise mechanisms.","marker":"[13]"},{"why":"Defines the gradient inversion attack that motivates the threat model and defense evaluation.","marker":"[8]"},{"why":"Provides the framework for evaluating gradient inversion defenses.","marker":"[10]"}],"fun_headline_variants":["Per-layer privacy budgets boost federated learning","FedRE: noise where it matters, accuracy preserved","Layer-wise LDP: stronger where data is sensitive","Federated learning that spends noise wisely","Sensitive layers get stricter privacy, better utility"],"cache_read_input_tokens":18304,"weakest_assumption_plain":"The privacy proof assumes that clipping the whole layer gradient bounds the sensitivity of the released output to any single sample, but the algorithm clips only after summing many samples, so the per-sample sensitivity can exceed the clipping bound and the stated guarantee does not follow.","fun_headline_variants_meta":{"raw":{"variants":["Per-layer privacy budgets boost federated learning","FedRE: noise where it matters, accuracy preserved","Layer-wise LDP: stronger where data is sensitive","Federated learning that spends noise wisely","Sensitive layers get stricter privacy, better utility"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00014,"raw_usage":{"total_tokens":1166,"prompt_tokens":957,"completion_tokens":209,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":573,"completion_tokens_details":{"reasoning_tokens":138}},"tokens_in":573,"tokens_out":209,"duration_ms":2837,"temperature":1.0,"reasoning_tokens":138,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T23:19:07.625994+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Check whether Algorithm 1 contains a per-sample clipping step: it clips the aggregated gradient, not each sample's gradient. Measure the L2 sensitivity of the released layer update by comparing the outputs for two adjacent datasets that differ in one sample; if the maximum difference exceeds $C_l$, the Gaussian noise calibrated with sensitivity $C_l$ cannot provide the claimed $(\\epsilon_l,\\delta_l)$-LDP for that layer. A concrete empirical test is a canary-insertion membership probe: add a unique sample to a client's batch and test whether the released gradient reveals its presence beyond the $e^\\epsilon$ bound implied by the claimed budget.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the layer-wise gradient sensitivity idea that FedRE adapts into PSI scores."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the noise multiplier and composition formula used to set $\\sigma_l$ per layer."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The composition theorem used to claim $(\\epsilon,\\delta)$-LDP for the full gradient from layer-wise mechanisms."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the framework for evaluating gradient inversion defenses."}],"review_version":1}