{"id":"efed3f32-5ece-41c1-a91c-5f6db6b466f7","arxiv_id":"2505.05519","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"PCVS uses conformal-calibrated detections and a compressed two-state history to blur objects so a live video satisfies temporal-logic privacy rules with a stated probability bound.","lead":"This paper introduces PCVS, a video-streaming filter that blurs privacy-sensitive objects in real time while maintaining a mathematical estimate of how likely the stream is to obey a user-written privacy rule. It combines conformal prediction, object detection, and a compressed logical history to keep the calculation fast enough for robots.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Equation 3 is not a valid lower bound even under the paper's own assumptions: it omits negated literals and uses unnormalized products, so a detector-confirmed face can leave the guarantee unchanged.","rationale":"The Reader's verdict is REJECT, and this stress-test pass finds an even more direct reason for rejection. The paper's headline guarantee rests on Eq. 3, which multiplies the previous frame guarantee by a per-frame factor. That factor is computed as a sum over satisfying truth assignments of products of lower-bound probabilities for positive literals only. This is not a probability: it omits negated literals, is not normalized, and the empty assignment contributes a factor of 1. The concrete counterexample with AP={face} and Phi = box not face shows the computed bound can remain at 1 while the true safe probability is below 0.1. This is an internal algebraic flaw, not a disagreement with the field's consensus or a mere question of empirical validation. It means the theoretical lower-bound claim in Def. 1 and Problem 1 is not supported by the presented derivation. The Reader's weakest assumption about conditional independence is plausible and relevant, but the failure of Eq. 3 under the paper's own assumptions is more load-bearing because it does not require any external assumptions about temporal correlations. The paper's evaluation datasets randomize frame order, which would mask temporal dependence, but it also would not expose this algebraic defect because the reported metric is a detection/concealment success ratio rather than a comparison between PG_k and the actual specification-satisfaction frequency. Therefore the central formal claim should be rejected as stated, pending a corrected derivation and a metric that directly measures the lower-bound property.","tokens_in":11986,"tokens_out":6640,"duration_ms":73061,"concrete_test":"Run the recurrence analytically on AP={face}, Phi = box not face, with f_C(c)=0.9 whenever the detector reports a face and with PG_0=1. Equation 3 keeps PG_k=1 for all k, whereas the true safe probability for a frame with a face present is at most 0.1, so the claimed lower bound is violated on the first frame. Equivalently, recompute the same quantity using normalized transition probabilities that include factors (1 - f_C) for negated literals and check whether Eq. 3 changes; if it changes, the formula in the paper is not a valid lower bound.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central recurrence, Eq. 3, is not established as a probability lower bound. In Algorithm 1, for each sigma in 2^AP the transition into state sigma is assigned prob = prod_{p in sigma} f_C(Mvl(F_k,p)). These values are not normalized and do not represent the probability that the current frame has exactly the literals in sigma: a frame with p=false would need a factor for the negated proposition, and no such factor appears. Consequently, the sum over sigma |= Phi_tilde in Eq. 3 is not the conditional probability beta demanded by Theorem 2. The defect is independent of the temporal-correlation concerns. Take AP={face} and Phi = box not face. The only satisfying sigma is the empty set; the empty product is 1, so Eq. 3 gives PG_k = PG_{k-1} for every frame, no matter how confident the detector is that a face is present. If f_C(Mvl(F_k,face)) = 0.9, then the true probability that the current frame is safe is at most 0.1, yet the computed guarantee does not decrease from its previous value. Thus PG_k can lie far above the actual probability; it is not a lower bound, and the claimed formal privacy guarantee fails at exactly the point where it should respond to a detected privacy violation. The missing independence assumption identified by the Reader is real, but Eq. 3 is already invalid under independence.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes PCVS, a real-time video privacy system. Given a temporal-logic privacy specification Φ over atomic propositions AP (e.g., □(person → ¬face)), a vision-language model scores each proposition in each incoming frame, a conformal calibration function f_C converts those scores into per-frame probability bounds, and Algorithm 1 builds a two-state Markov-chain abstraction of the frame history. The method then computes a probabilistic guarantee PG_k(A_k |= Φ) via Eq. (3), blurs objects when the guarantee falls below a user threshold λ, and otherwise releases the frame. Experiments on ImageNet-, COCO-, and UFPR-ALPR-based datasets report high privacy preservation success ratios, comparisons against GPT-4V and Video-LLaVA, real-robot demonstrations, and latency measurements intended to show real-time operation.","tokens_in":12217,"tokens_out":5074,"duration_ms":52775,"significance":"If the formal guarantee were valid, this would be a practically valuable contribution: a streaming privacy filter with a per-frame-updated probabilistic certificate, backed by real robot deployments and reproducible-looking empirical methodology. The system components, including the modular abstraction and the calibrated detector, are reasonable engineering choices, and the latency analysis is a useful practical result. However, the paper's central claim is the correctness of Eq. (3) as a lower bound on the probability that the frame sequence satisfies the privacy specification. As detailed below, Eq. (3) is not a valid probability bound even under the paper's own assumptions: it omits negated literals, uses non-normalized products, and makes an unstated and generally false independence assumption. Because the formal guarantee is the stated novelty that distinguishes this work from prior detection-and-blurring approaches, the manuscript's main scientific claim is not established.","major_comments":[{"comment":"The recurrence in Eq. (3) is not a valid lower bound because the per-frame factor omits negated literals and is not normalized over the possible assignments. In Algorithm 1 line 7, each state σ is assigned probability prob = ∏_{p∈σ} f_C(Mvl(F_k,p)), with no factor for propositions not in σ and no normalization over all 2^AP assignments. Consider AP={face} and Φ=□¬face. The only satisfying positive assignment is σ=∅, whose empty product is 1, so Eq. (3) gives PG_k = PG_{k-1} for every frame no matter how confident the detector is that a face is present. If f_C(Mvl(F_k,face))=0.9, the actual probability that the current frame satisfies ¬face is at most 0.1, while the computed guarantee remains unchanged. Thus PG_k can lie far above the true probability; it is not a lower bound, and the guarantee fails exactly when it should respond to a detected privacy violation. A correct factor must include factors for negated propositions and must be a conditional probability of the current frame's assignment, normalized over all assignments.","section":"Section IV-A-c, Eq. (3); Algorithm 1 line 7"},{"comment":"Even if the per-frame terms were correctly normalized, Eq. (3) would require the current frame's proposition assignment to be conditionally independent of the full previous frame history given safety; this assumption is neither stated nor proven. Theorem 2 and Proposition 1 justify multiplying a prefix safety probability by a per-state conditional factor only when the factor is conditional on the prefix, but Eq. (3) uses a factor that depends only on the current frame F_k and not on the previous history. In real video streams, detections are strongly autocorrelated: a person or face persists across many frames, so the conditional probability of the current frame's assignment given the previous frames differs substantially from its marginal probability. The synthetic evaluation datasets ED1 and ED2 are constructed by randomly inserting selected images into videos, which artificially enforces independence and therefore does not test the assumption that the formal guarantee relies on.","section":"Section IV-A-c, Eq. (3); Theorem 2 and Proposition 1"},{"comment":"The abstraction constructed by Algorithm 1 does not satisfy Definition 2 of a labeled Markov chain because the transition function P is not stochastic. For example, with AP={face} and f_C(Mvl(F_k,face))=0.9, the transitions out of State 1 include the state σ=∅ with probability 1 (empty product) and the state σ={face} with probability 0.9, giving a total outgoing probability of 1.9, which violates the requirement ∑_{s'} P(s,s')=1. Consequently the trace-probability computation in Eq. (2), which multiplies transition probabilities along paths, is not well-defined for the abstraction produced by the algorithm.","section":"Section IV-A-b, Definition 2 and Algorithm 1"}],"minor_comments":[{"comment":"The metric 'Number of p_i∈AP detected or concealed' counts detections even if those detections are not actually concealed, while the benchmarks are credited for detections alone; as a result, the empirical satisfaction rate does not directly measure the claimed formal guarantee of concealment.","section":"Section VI-A, Privacy Preservation Success Ratio"},{"comment":"The running example should be reconciled with Eq. (3): with AP={person,face} and the displayed values f_C(Mvl(F_k,face))=0.3 and f_C(Mvl(F_k,person))=1.0, the sum in Eq. (3) over positive satisfying assignments does not obviously equal 0.7, the factor used to obtain PG_k=0.56.","section":"Figure 2"},{"comment":"The definition of the calibration function f_C would benefit from more precise notation: the density f_nc is defined on nonconformity scores 1-Mvl(x_i,y_i), but Eq. (1) integrates it up to c for c>0.5 and up to 1-c for c≤0.5 without a clear derivation of how these integrals become a function of the raw confidence c.","section":"Section IV-A-a, Eq. (1)"}],"recommendation":"reject","confidential_remarks":"The empirical system and robot demonstrations appear substantial, and the latency results are useful. However, the central formal claim is invalid as written; Eq. (3) is demonstrably not a probability lower bound. A substantially revised version that repairs the per-frame probability computation, states and tests the required independence assumptions, and re-evaluates the formal claims might be worth reconsidering, but the current manuscript's main contribution is not established."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"PCVS has a genuinely attractive architecture: it compresses the entire history of frames into two states and updates a privacy guarantee in constant time. That abstraction trick is the best thing in the paper and could be reused. But the central claim, Eq. 3, is not a valid lower bound, and the defect is independent of the temporal-correlation concern the reader flagged.\n\nFor Phi = box not face, the only satisfying assignment is the empty set. Algorithm 1 computes the probability of each sigma as the product of f_C(Mvl(F_k,p)) over p in sigma. The empty product is 1, so Eq. 3 gives PG_k = PG_{k-1} for every frame. A detector that reports face with confidence 0.9 leaves the guarantee unchanged. That is not a lower bound; it is a constant. The recurrence never sees negated literals. A frame with face=false needs a factor for the negated proposition, and no such factor appears. The probabilities are also unnormalized sums of products, which are not probabilities over the frame's state. The theorem proof has conditioning problems, too.\n\nThe paper does earn credit. The constant-size abstraction is a genuine new mechanism relative to the cited neurosymbolic video-search works, and the robot demonstrations show the pipeline can run in real time. The authors are honest about limitations, and the writing is clear.\n\nBut the empirical evaluation cannot rescue the theory. ED1 and ED2 insert images at random positions, which removes temporal correlation and makes independence artificially plausible. The calibration function is a fitted density integral, not a distribution-free conformal guarantee. And the abstract's 'over 95 percent' overstates the body's 80-97 percent.\n\nWho benefits? Researchers in privacy-aware robotics and formal methods will find the abstraction idea worth reading, but not the guarantee. I would not cite the bound; I might cite the abstraction mechanism if it were developed in a corrected paper. This deserves a serious referee because the core idea is promising and the flaw is fixable: include negated literals, normalize the product, and test on truly continuous video. As submitted, the formal privacy guarantee fails.","headline":"A promising constant-time video abstraction for privacy specs, but the central recurrence is not a valid lower bound and the guarantee never responds to a detected face in the simplest case.","tokens_in":12824,"tokens_out":3408,"would_cite":false,"duration_ms":35326,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A per-frame recurrence computes a provable lower bound on the probability that a live video stream keeps satisfying its privacy specification.","keywords":["privacy-constrained video streaming","conformal prediction","temporal logic specifications","video abstraction","probabilistic guarantee","robot visual perception","real-time object concealment","safety properties"],"falsifier":"Run PCVS on a continuous, temporally ordered video in which the same person's face appears in many consecutive frames, and compare the empirical fraction of prefixes that satisfy the specification with the computed bound \\(\\mathrm{PG}_k\\). Any sustained dip below \\(\\mathrm{PG}_k\\) falsifies the lower-bound claim.","tokens_in":11730,"feed_emoji":"🔒","tokens_out":7152,"duration_ms":67354,"temperature":0.7,"pith_summary":"PCVS is a method for live video streams that conceals privacy-sensitive objects such as faces, license plates, and people while carrying a formal, per-frame probabilistic guarantee that the output still satisfies a user-written privacy specification. The paper's central claim is that a simple recurrence, multiplying the previous frame's guarantee by a term built from calibrated detection probabilities in the current frame, gives a valid lower bound on the probability that the whole frame sequence so far satisfies the specification. The abstraction compresses all past frames into two states, so the guarantee updates in constant time regardless of stream length. If the claim holds, privacy filtering for robots and cameras becomes a real-time, verifiable operation rather than an appeal to a detector's black-box accuracy.","feed_headline":"Live video privacy gets a per-frame lower-bound guarantee","feed_subtitle":"PCVS recalibrates detections on the fly and updates a provable chance that the stream still meets its privacy rule.","key_machinery":"The central object is the video abstraction: a labeled Markov chain whose states are conjunctions of atomic propositions, such as person=true and face=false, plus two summary states recording whether the previous frames satisfied the specification. The abstraction's work is to collapse the entire history into one number, \\(\\mathrm{PG}_{k-1}\\), so a new frame only adds transitions from the two summary states to the current frame's proposition states. Conformal calibration \\(f_C\\) supplies the per-detection probabilities, and Theorem 2 with Proposition 1 justifies multiplying the old bound by the sum over current-frame states that keep the trace out of the bad-prefix set. This product form is what makes per-frame, constant-time verification possible.","core_discovery":"On the paper's own terms, the discovery is that a privacy specification of the form \\(\\Phi = \\square \\tilde{\\phi}\\) can be monitored online by building a labeled Markov chain abstraction \\(\\mathcal{A}_k\\) of the frames seen so far and computing \\(\\mathrm{PG}_k(\\mathcal{A}_k \\models \\Phi) = \\mathrm{PG}_{k-1}(\\mathcal{A}_{k-1} \\models \\Phi) \\times \\sum_{\\$\\sigma$ \\models \\tilde{\\phi}} \\prod_{p \\in \\$\\sigma$} f_C(M_{vl}(F_k, p))\\), where \\(f_C\\) is a conformal-calibrated lower bound on the probability that the vision-language model correctly detects proposition \\(p\\) in frame \\(F_k\\). The authors prove, through a safety-property argument, that this product is a lower bound on the probability that the frame sequence satisfies the specification, and they show experimentally that the empirical satisfaction rate stays above the computed bound across several datasets.","pith_inferences":["A direct implication the paper leaves implicit is that the product recurrence is only a valid lower bound if detections in successive frames are conditionally independent given the specification; for real streams where a person or face persists across many frames, the true probability could fall below the computed bound, so the guarantee should be read as conditioned on that independence.","One testable extension is to replace the per-frame product with a small stateful model of persistence, such as a Hidden Markov Model over object presence, which would preserve the recurrence structure while respecting temporal correlation.","The method's guarantee inherits the calibration set: if the robot moves to a new environment with different lighting or camera geometry, the lower bound needs recalibration to remain valid.","The paper's own stated limitation, no action-based specifications like \"person eating,\" suggests a natural next step: use a second multi-frame action detector and add its calibrated output as another atomic proposition in the same abstraction."],"forward_implications":["The per-frame guarantee stays constant-time as video grows, so privacy enforcement can run at frame rate on a robot's onboard CPU or GPU.","Users can specify privacy as temporal logic, such as \"never show a face while a person is present,\" and PCVS chooses which objects to blur so the remaining detections satisfy the formula.","The computed number is a conservative, user-facing privacy score: if \\(\\mathrm{PG}_k\\) stays above a threshold \\(\\lambda\\), the frame is admitted; otherwise objects are blurred and the score recomputed.","Because only violating objects are concealed, non-sensitive features remain visible, and robot control policies such as stopping for pedestrians keep working with faces blurred.","Empirical satisfaction rates in the paper's evaluations consistently exceed the theoretical bounds, which is what the lower-bound claim predicts."],"supporting_citations":[{"why":"It supplies the conformal prediction theorem that yields the calibration function f_C and per-detection lower bounds.","marker":"[22]"},{"why":"It defines safety properties and bad prefixes, the formal foundation for the recurrence in Theorem 2.","marker":"[1]"},{"why":"It is the object detection backbone used in the implemented system and experiments.","marker":"[27]"},{"why":"It is the multi-label image dataset used to build the specification-complexity evaluation set.","marker":"[15]"},{"why":"It is the real-world driving dataset used for the license-plate concealment evaluation.","marker":"[13]"},{"why":"It is the image dataset used to construct the video-length evaluation set.","marker":"[9]"},{"why":"It is one of the two multimodal benchmarks compared against on privacy violation detection.","marker":"[14]"},{"why":"It is the other multimodal benchmark compared against on privacy violation detection.","marker":"[17]"}],"fun_headline_variants":["Provable privacy bounds for real-time robot video","Robot vision privacy with a conformal guarantee","Real-time privacy with a conformal lower bound","Guaranteed privacy satisfaction for live robot streams","A per-frame privacy guarantee for robot cameras"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The recurrence treats each frame's detection outcomes as conditionally independent of all earlier frames and of one another, which real video streams with persistent people or faces typically violate.","fun_headline_variants_meta":{"raw":{"variants":["Provable privacy bounds for real-time robot video","Robot vision privacy with a conformal guarantee","Real-time privacy with a conformal lower bound","Guaranteed privacy satisfaction for live robot streams","A per-frame privacy guarantee for robot cameras"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000631,"raw_usage":{"total_tokens":2945,"prompt_tokens":1010,"completion_tokens":1935,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":626,"completion_tokens_details":{"reasoning_tokens":1866}},"tokens_in":626,"tokens_out":1935,"duration_ms":13873,"temperature":1.0,"reasoning_tokens":1866,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T23:19:00.140866+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run PCVS on a continuous, temporally ordered video in which the same person's face appears in many consecutive frames, and compare the empirical fraction of prefixes that satisfy the specification with the computed bound \\(\\mathrm{PG}_k\\). Any sustained dip below \\(\\mathrm{PG}_k\\) falsifies the lower-bound claim.","supporting_citations":[{"cited_title":"A tutorial on confor- mal prediction","cited_arxiv_id":null,"evidence_quote":"It supplies the conformal prediction theorem that yields the calibration function f_C and per-detection lower bounds."},{"cited_title":"Yolov9: Learning what you want to learn using pro- grammable gradient information","cited_arxiv_id":null,"evidence_quote":"It is the object detection backbone used in the implemented system and experiments."},{"cited_title":"Gpt-4 vision system card","cited_arxiv_id":null,"evidence_quote":"It is the other multimodal benchmark compared against on privacy violation detection."}],"review_version":1}