{"id":"7c930bb4-4f24-441f-8dc0-9e3402be2a84","arxiv_id":"2505.05018","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Adding calibrated artificial noise at the transmitter and a diffusion-model denoiser at the receiver can block semantic eavesdropping while keeping the legitimate link's reconstruction quality near baseline.","lead":"This paper builds pluggable encryption and decryption modules for image semantic communication, using artificial noise to block eavesdroppers and a diffusion model to clean the signal for the legitimate receiver. It could make secure 6G semantic communication practical without retraining the deployed transmitter and receiver.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The receiver-side DDPM decryption is presented as pluggable without retraining, but the NENN must be trained on the semantic transmitter's channel-input distribution; the paper never verifies this trained-in-advance component against the specific deployed transmitter, so the pluggability claim is…","rationale":"The reader's weakest_assumption focused on the SNR-matched one-step denoise accuracy in Eq. (34)-(35). That is a related but secondary concern: if the NENN is well-trained on the deployed transmitter's output distribution, the SNR-matching (35) is a heuristic that could still fail at extreme SNRs. My concern is more fundamental and prior: the paper's headline contribution is pluggability without retraining, and the DDPM decryption module is the component that makes this possible. The DDPM NENN is a trained neural network, and the training distribution in Eq. (28) is the semantic transmitter's output distribution. The paper never states whether the NENN was trained on the same transmitter used in the experiments, nor demonstrates transfer to a different transmitter. Without that, the central claim that the modules can be plugged into an online system without retraining is not supported. This is a load-bearing gap in the argument, not merely a missing ablation. The simulations have no code or error bars, so the claim rests entirely on the reported curves. The verdict should remain CONDITIONAL, with the condition being the demonstration of NENN transfer across transmitters and the SNR-matched denoising accuracy. I partially agree with the reader because the reader identified a real risk in Eq. (34)-(35), but the deeper issue is the training distribution of the NENN and the lack of a pluggability test.","tokens_in":20167,"tokens_out":1620,"duration_ms":13753,"concrete_test":"Retrain or reuse the NENN with a semantic transmitter different from the one used in the reported experiments (e.g., a different random seed or a different semantic encoder architecture), and evaluate the 'Tx: plug, Rx: plug' communication MSE and privacy metrics under the same SNR settings as Figs. 5 and 7. If the MSE degrades significantly relative to the reported values, the pluggable-without-retraining claim fails; if the MSE remains near baseline, the claim survives this test. Also check whether the NENN was trained on the same transmitter output distribution as the evaluation setup and report this in the paper.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim is that the paired pluggable modules can be inserted into an already-deployed semantic communication system without retraining the semantic encoder or decoder, and that the DDPM decryption module removes both AN and channel noise to keep Bob's reconstruction quality near baseline. This requires the noise estimation neural network (NENN) to have been trained on the exact channel-input distribution produced by the deployed semantic transmitter, since the DDPM forward model in Eq. (28) is defined on x_Alice(0) ~ q(x_Alice(0)), which is the distribution of the semantic transmitter's output. The paper states the NENN is trained with loss (32) over x_Alice(t) generated via (28), but never specifies which transmitter output distribution was used to train it, whether that distribution matches the transmitter used in the evaluation, or whether the NENN generalizes to a different transmitter. The only experimental evidence is simulation curves with no code, no error bars, and no baseline comparisons across different semantic transmitter instances. If the NENN is trained on the same transmitter used in the experiments, the 'pluggable' claim is circular for that specific transmitter and the module is not demonstrated as pluggable across deployments. The claimed pluggability without retraining is thus not established by the presented evidence.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a diffusion-enabled security framework for semantic communication, in which a pluggable encryption module adds artificial noise (AGN in Scenario I, adversarial residual-network perturbation in Scenario II) to the semantic transmitter's output, and a pluggable DDPM-based decryption module at the legitimate receiver removes both the artificial noise and channel noise without retraining the semantic encoder/decoder. In Scenario I, an optimization problem over the AGN power allocation is solved by a DDPG agent; in Scenario II, an adversarial residual network is trained end-to-end. Experiments on MNIST, CIFAR-10, and Fashion MNIST report communication MSE, privacy-leakage mutual information or accuracy, and covertness MSE. The central claim is that the paired pluggable modules prevent semantic eavesdropping while keeping the legitimate link's reconstruction quality near baseline.","tokens_in":20530,"tokens_out":9253,"duration_ms":95463,"significance":"The pluggable architecture is a potentially useful practical idea: if the NENN-based decryption module could be inserted into an already-deployed semantic communication system without retraining the core modules, it would reduce deployment friction compared to existing adversarial-training schemes that retrain the whole encoder-decoder pair. The paper is clearly written and covers two distinct threat-knowledge scenarios, and the multi-dataset experiments show the proposed modules work on simple image datasets. However, the security gain in Scenario I is essentially a consequence of the noise-injection construction, the pluggability claim is not yet established because the NENN is trained on a transmitter output distribution that is never specified, and the one-step DDPM denoising is assumed to be accurate without proof or ablation. The empirical comparison also lacks baselines and error bars, so the claimed advantages over prior secure semantic communication schemes are not yet demonstrated.","major_comments":[{"comment":"The privacy-leakage result in Scenario I is an algebraic consequence of the signal model rather than a newly established security property. Since y_Eve = sqrt(u)x_Alice + sqrt(1-u)w + n_Eve, Eq. (24) shows I(x_Alice; y_Eve) tends to 0 as u tends to 0 by construction, and the DDPG in Eq. (40) minimizes an upper bound of exactly this mutual information. The paper should state clearly what security insight beyond 'inject more noise to Eve' is being contributed, and should report the true mutual information, not only the upper bound IUP from Eq. (37), in the evaluation. In particular, §V-B says the privacy-leakage MI 'remains at a low level (around 2)' while Observation 1 says 'near-zero'; this inconsistency must be resolved and the units specified.","section":"§IV-B, Eqs. (24) and (40)"},{"comment":"The central 'pluggable without retraining' claim is not established. The NENN is trained with loss (32) over x_Alice(t) generated via Eq. (28), where x_Alice(0) follows q(x_Alice(0)), the distribution of the semantic transmitter's output. The manuscript never specifies how q(x_Alice(0)) is obtained, whether it matches the specific transmitter used in the experiments, or whether the NENN generalizes across different semantic encoder/decoder instances. If q is the empirical distribution of the evaluated transmitter, then the pluggability claim is only demonstrated for that transmitter, and no evidence is given for deployment with a different semantic communication system. Please add experiments with multiple transmitter instances, or explicitly state that a one-time offline training of the NENN on the deployed transmitter's output distribution is required.","section":"§IV-B, Eq. (32) and §V-A"},{"comment":"The one-step DDPM decryption formula (34), with the time step selected by SNR matching in (35), is assumed to approximate the full reverse diffusion process accurately for all operating SNRs, but no derivation, theoretical bound, or ablation is provided. Equation (34) estimates x_Alice(0) directly rather than performing iterative reverse sampling; at large time steps this estimate can be poor unless the noise predictor is well calibrated. If the SNR-matched time step is inaccurate at some operating points or datasets, Bob's reconstruction quality could degrade and the claimed security-communication tradeoff would collapse. Please provide an ablation comparing Eq. (34) with iterative DDPM sampling and report reconstruction error over a fine SNR grid.","section":"§IV-B, Eqs. (34)-(35)"},{"comment":"The empirical evaluation does not include comparisons with existing secure semantic communication baselines such as adversarial training [18]-[21] or random permutation [22], and it reports no error bars, standard deviations, or multiple random seeds. Consequently, the claim that the proposed paired pluggable modules achieve 'high-quality semantic communication' while preventing eavesdropping is not shown to be competitive with prior art. Please add baseline comparisons and statistical significance information, and provide code or sufficient detail for reproducibility.","section":"§V"}],"minor_comments":[{"comment":"The hyper-parameter list says λcom, λpri, and λper are set to 10, 0.25, and 1, but the objective in Eq. (63) uses λcov for the covertness term; please standardize the notation.","section":"§V-A"},{"comment":"The sign convention changes between Eq. (51), which contains -λpri Pr{g_Eve ≠ m}, and Eq. (53), which contains +λpri E[e^{φ_m}/Σ e^{φ_j}]; the equivalence requires the reader to recognize the replacement of 'probability of wrong classification' with 'confidence of the true label.' Please state this explicitly to avoid confusion.","section":"§IV-C, Eqs. (51)-(53)"},{"comment":"The noise variances are denoted σ_b^2 and σ_e^2 in some places and σ_Bob^2 and σ_Eve^2 in others; please use a single consistent notation throughout.","section":"Notation"},{"comment":"The figure caption contains the typo 'datastes' for 'datasets', and the paper does not mention the computational cost or latency of the DDPM-based decryption module, which would be relevant to the claimed practical deployability.","section":"§V-D and Fig. 10"}],"recommendation":"major_revision","confidential_remarks":"The paper is a competent system-design study, but the theoretical novelty is thin: the Scenario I security result is a direct consequence of noise injection, and the central pluggability claim depends on the unstated training distribution of the NENN. The most valuable piece is the DDPM-based decryption module at Bob, which is worth further investigation. I believe the issues are fixable with additional experiments, explicit statements about what is trained offline, and comparisons with baselines, so I recommend major revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the DDPM-as-decryptor idea is genuinely nice and the paper is competent, but the central \"pluggable without retraining\" claim is not actually established beyond a single fixed transmitter, and the evaluation is too thin to call it a clear win over existing secure semantic communication schemes.\n\nWhat's new: pairing an AN generation module (Gaussian or adversarial) with a diffusion-based denoiser that removes both the artificial noise and the channel noise in one step is a new combination. The SNR-matched time-step selection in (35) is a clever practical trick, and the ARN design with the covertness constraint is a reasonable way to generate low-power adversarial perturbations. I believe the math is mostly correct—Theorem 1 is a standard upper bound, and the DDPG formulation is standard. The paper does a decent job of laying out the two scenarios (Eve known/unknown) and the experimental results on MNIST/CIFAR-10/Fashion-MNIST show the scheme works in the specific setup tested.\n\nWhere it gets soft:\n1. The privacy-leakage numbers in Scenario I are not a finding; I(x_Alice; y_Eve)→0 as u→0 is built into (21)-(24). The DDPG is just minimizing an upper bound on that forced quantity. The real question is whether Bob's reconstruction stays competitive, and that part is interesting and works in the simulations, but it needs error bars and an ablation of the one-step denoising approximation. I would like to see what happens when the SNR-matched time step in (35) is off—there is no study of robustness to mismatch.\n2. The \"pluggable\" claim is undersupported. The NENN has to be trained on the exact channel-input distribution of the semantic transmitter. The paper never specifies which transmitter was used to generate x_Alice(0) for NENN training, and all experiments appear to use the same transmitter. That is circular in the sense that you've shown it works for the transmitter you trained on. What if you plug the modules in front of a different semantic encoder? The whole selling point is no retraining, so you need a cross-transmitter experiment or at least a statement that the NENN is trained per-transmitter (in which case 'pluggable' is closer to 'pre-installed').\n3. No comparisons to existing secure semantic communication baselines (e.g., adversarial training methods [18]-[21]). Without those, I can say this works but not that it improves on the state of the art. For a systems paper that's a big gap.\n4. Minor: the \"first time AN is introduced into semantic communication\" claim in the abstract is over-strong—there are related physical-layer AN works, and the novelty is really in the specific pairing with DDPM.\n\nWho it's for: people in secure semantic communication who want a plug-in defense design. It deserves a serious referee, but the revision needs to add baselines, error bars, and a cross-transmitter test. If those hold up, it's a solid IEEE-level paper; right now it's a promising idea with insufficient evidence.","headline":"DDPM-based plug-in decryptor is a genuinely nice idea, but the pluggability claim is only shown for one fixed transmitter and the evaluation lacks the baselines needed to back it up.","tokens_in":20984,"tokens_out":4176,"would_cite":true,"duration_ms":40012,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Adding artificial noise plus a diffusion clean-up step blocks semantic eavesdroppers without retraining the semantic encoder or decoder.","keywords":["semantic communication","eavesdropping","artificial noise","diffusion model","DDPM","adversarial residual network","wireless security","deep reinforcement learning"],"falsifier":"Fix a grid of Alice-Bob SNRs, take the AGN power $u$ selected by the DDPG actor, and run Bob's decryption with the single-step formula (34). If, at any operating SNR, the reconstruction MSE is substantially worse than running a full multi-step reverse diffusion chain, or worse than the unplugged semantic system, the claim that the SNR-matched time step suffices is refuted.","tokens_in":20013,"feed_emoji":"🔒","tokens_out":10605,"duration_ms":97127,"temperature":0.7,"pith_summary":"Semantic communication transmits meaning rather than exact bits, and this paper tries to prove that such a link can be made secure against eavesdropping by inserting paired pluggable modules rather than by retraining the deployed neural networks. The transmitter-side module adds artificial noise, Gaussian when the eavesdropper is unknown and adversarial when it is known; the receiver-side module uses a denoising diffusion model to remove both the artificial noise and the channel noise before the semantic decoder. The paper's central claim is that this pluggable arrangement prevents semantic eavesdropping while keeping the legitimate reconstruction quality close to, or sometimes better than, the unsecured baseline. If true, it matters because existing security schemes either retrain the semantic system or visibly distort the channel input, whereas this design can be switched on only when private information is transmitted.","feed_headline":"Diffusion clean-up lets security noise hide a semantic link","feed_subtitle":"No retraining needed: plug-in modules add noise to block eavesdroppers and remove it at the receiver.","key_machinery":"The central mechanism is the paired pluggable encryption/decryption modules. Encryption adds either artificial Gaussian noise (AGN), $x'_{\\mathrm{Alice}}=\\sqrt{u}\\,x_{\\mathrm{Alice}}+\\sqrt{1-u}\\,w$, or an adversarial residual network (ARN) perturbation, $x'_{\\mathrm{Alice}}=x_{\\mathrm{Alice}}+\\delta$, to the semantic transmitter's output. Decryption is a one-step DDPM denoiser, $x_{\\mathrm{Bob}}=\\frac{1}{\\sqrt{\\bar\\alpha(\\hat t)}}\\big(\\bar y_{\\mathrm{Bob}}-\\sqrt{1-\\bar\\alpha(\\hat t)}\\,f_{\\mathrm{NENN}}(\\bar y_{\\mathrm{Bob}},\\hat t)\\big)$, where $f_{\\mathrm{NENN}}$ is the noise estimation neural network trained with the standard DDPM loss and $\\hat t$ is chosen by matching the effective SNR $u/(1-u+\\sigma_b^2)$ or $1/(\\mathbb{E}[\\|\\delta\\|^2/L_t]+\\sigma_b^2)$ to the diffusion schedule's $\\bar\\alpha(t)/(1-\\bar\\alpha(t))$. This machinery is what turns the added security noise from an irreducible cost into a modeled noise level that the receiver can reverse.","core_discovery":"The proposed defense treats the actively added artificial noise and the passively added channel noise as part of a diffusion forward process, then removes both at the legitimate receiver with a single denoising step. In the unknown-eavesdropper scenario the transmitted signal is $x'=\\sqrt{u}x+\\sqrt{1-u}\\,w$ with artificial Gaussian noise (AGN) $w$, the power allocation $u$ is chosen by a deep reinforcement learning actor to minimize a weighted sum of legitimate reconstruction MSE, an upper bound on mutual information leakage $I(x;y_{\\mathrm{Eve}})$, and channel-input distortion, and Bob computes a normalized signal $\\bar y$, picks a diffusion time step $\\hat t$ whose SNR matches the link SNR, and applies one reverse step to recover $x$. In the known-eavesdropper scenario the encryption module is an adversarial residual network producing a low-power perturbation $\\delta$, and the same diffusion decryption removes $\\delta$ and channel noise for Bob while Eve's classifier is driven to near-random accuracy. The paper reports that the privacy leakage MI stays near zero or Eve's accuracy falls to roughly 0.2 while the covertness MSE remains small and the legitimate link's MSE is close to the no-security baseline.","pith_inferences":["A natural extension the authors leave implicit is to use more than one reverse diffusion step or a posterior sampler at the receiver; that would likely make legitimate reconstruction robust over a wider range of SNRs than the single-step estimate used here.","The ARN is trained against one known Eve model, so the security level depends on the assumption that Eve cannot train a perturbation-robust classifier or obtain the ARN parameters; evaluating the scheme against a stronger, adaptive Eve would be a direct next test.","The SNR-matching rule in (35) relies on the second-order statistics of the added noise, so in fading or non-Gaussian channels the one-to-one match to the diffusion schedule would break; the paper notes extension through neural-network channel models as future work.","The unknown-eavesdropper analysis measures privacy leakage by mutual information on a Gaussian wiretap model, which may not reflect the success rate of a specific inversion or attribute-inference attack; an attack-oriented privacy metric would complement the MI result."],"forward_implications":["A deployed semantic encoder/decoder could gain eavesdropping protection by plugging modules around it, with no retraining and no modification of the existing semantic networks.","In the unknown-eavesdropper case, the trained actor network chooses the AGN power in about 0.15 s while matching the objective value of an exhaustive search that takes about 18.7 s, enabling fast adaptation to changing link SNRs.","In the known-eavesdropper case, Eve's classification accuracy drops to roughly 0.2 with a perturbation whose power stays below 10 percent of the transmitted signal power, so the security measure is low-power and harder to detect.","Because the diffusion decryption can even outperform the unplugged receiver at some signal-to-noise ratios, the scheme does not always trade away communication quality to buy security."],"supporting_citations":[{"why":"Supplies the DDPM forward/reverse process that the decryption module uses to remove artificial and channel noise in one step.","marker":"[30]"},{"why":"Establishes the paired adversarial residual network approach to secure semantic communication that this paper extends with a diffusion-based decryption module.","marker":"[15]"},{"why":"Provides the rate-distortion-equivocation framework and MI-style privacy metric used to measure eavesdropping leakage.","marker":"[16]"},{"why":"Exemplifies a nearly information-theoretically secure superposition-coding baseline whose channel-input distortion the proposed scheme claims to avoid.","marker":"[17]"},{"why":"Supplies a generative-network wiretap baseline that uses adversarial training, against which the retraining-free pluggable design is contrasted.","marker":"[19]"},{"why":"Uses adversarial training for encrypted semantic communication; its need to retrain the semantic system motivates the pluggable modules.","marker":"[21]"},{"why":"Supports the premise that small adversarial perturbations can degrade deep classifiers, justifying the ARN-based encryption module.","marker":"[31]"},{"why":"Shows low-power universal perturbations exist that fool classifiers, backing the low-power perturbation design in the known-Eve scenario.","marker":"[32]"}],"fun_headline_variants":["Diffusion strips both noise types to foil semantic eavesdroppers","Adding noise, then diffusing it away: secure semantic link","One denoising step hides a semantic channel from eavesdroppers","Diffusion-based noise removal secures semantic communication","Pluggable diffusion modules add noise, then erase it for receivers"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The receiver's one-step denoising formula, whose time step is chosen only by matching the link SNR, is assumed to remove the artificial and channel noise accurately enough at every operating noise power; the paper gives no proof or ablation for that accuracy.","fun_headline_variants_meta":{"raw":{"variants":["Diffusion strips both noise types to foil semantic eavesdroppers","Adding noise, then diffusing it away: secure semantic link","One denoising step hides a semantic channel from eavesdroppers","Diffusion-based noise removal secures semantic communication","Pluggable diffusion modules add noise, then erase it for receivers"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00063,"raw_usage":{"total_tokens":2981,"prompt_tokens":1086,"completion_tokens":1895,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":702,"completion_tokens_details":{"reasoning_tokens":1810}},"tokens_in":702,"tokens_out":1895,"duration_ms":13944,"temperature":1.0,"reasoning_tokens":1810,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T23:15:08.412108+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Fix a grid of Alice-Bob SNRs, take the AGN power $u$ selected by the DDPG actor, and run Bob's decryption with the single-step formula (34). If, at any operating SNR, the reconstruction MSE is substantially worse than running a full multi-step reverse diffusion chain, or worse than the unplugged semantic system, the claim that the SNR-matched time step suffices is refuted.","supporting_citations":[{"cited_title":"Denoising diffusion prob abilistic models,","cited_arxiv_id":null,"evidence_quote":"Supplies the DDPM forward/reverse process that the decryption module uses to remove artificial and channel noise in one step."},{"cited_title":"Secure Semantic Communication over Wiretap Channel","cited_arxiv_id":"2405.03361","evidence_quote":"Provides the rate-distortion-equivocation framework and MI-style privacy metric used to measure eavesdropping leakage."},{"cited_title":"Privacy-a ware communi- cation over a wiretap channel with generative networks,","cited_arxiv_id":null,"evidence_quote":"Supplies a generative-network wiretap baseline that uses adversarial training, against which the retraining-free pluggable design is contrasted."},{"cited_title":"Encrypted semantic communi- cation using adversarial training for privacy preserving,","cited_arxiv_id":null,"evidence_quote":"Uses adversarial training for encrypted semantic communication; its need to retrain the semantic system motivates the pluggable modules."},{"cited_title":"Towards deep learning models resistant to adversarial attacks,","cited_arxiv_id":null,"evidence_quote":"Supports the premise that small adversarial perturbations can degrade deep classifiers, justifying the ARN-based encryption module."},{"cited_title":"Univer- sal adversarial perturbations,","cited_arxiv_id":null,"evidence_quote":"Shows low-power universal perturbations exist that fool classifiers, backing the low-power perturbation design in the known-Eve scenario."}],"review_version":1}