{"id":"8c3979fd-9d53-4789-8f47-851688b67638","arxiv_id":"2505.06759","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":5,"one_line_summary":"The authors generalize PBACC to tensor data and derive secure aggregation and secure training schemes for centralized and decentralized learning, with experiments on CNN, VAE, and Cox models.","lead":"This paper adapts Private Berrut Approximate Coded Computing (PBACC), a privacy layer for federated learning, to three distributed learning setups: centralized data, decentralized aggregation, and decentralized training. The authors report that model accuracy is mostly preserved while an information-theoretic leakage bound stays near or below one bit per data element.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Secure training over decentralized data assumes, without proof, that a δ-stable Berrut interpolation of outputs of different per-worker training functions yields the global model; the paper's own CNN/VAE results contradict the claimed minimal quality loss.","rationale":"The reader's weakest_assumption identifies the same unprotected step: the inference in Sec. V-B2 from δ-stability to a meaningful aggregate is where the 'general solution' claim is least secure. The paper itself flags the issue by saying 'this would appear to be a problem but actually...', so the missing support is self-declared. I do not treat the privacy-bound section as the main objection because Eq. (12) is presented as a mathematical consequence of a MIMO capacity bound; the leakage values in the tables are design constraints computed from that formula rather than independent measurements. The VAE and CNN results are better read as evidence that the unproved aggregation step is actually failing: the one configuration lacking a derivation is also the one whose quality degrades most, and the abstract promises 'minimally altered' quality. The proposed test targets exactly the missing equivalence: with identical data across workers, all workers evaluate the same training function, so any extra error in the non-IID case must come from the per-worker function heterogeneity that the δ-stability argument does not cover. If the test confirms the discrepancy, REJECT stands; if it does not, the authors would need to supply a proof of the averaging property and to revise the quality claims. I therefore agree with the reader's weakest assumption and maintain the REJECT verdict.","tokens_in":19892,"tokens_out":10342,"duration_ms":113233,"concrete_test":"Use a minimal controlled setup: two workers, K=1, N=2, linear regression (or a one-layer network) with one gradient step per worker, and disjoint non-IID data splits. Compute (i) the FedAvg target theta' = (train(theta;X_0)+train(theta;X_1))/2 and (ii) the PBACC decoded model theta'_PBACC = w_0*train(u_theta(beta_0);X_0)+w_1*train(u_theta(beta_1);X_1) with the Berrut weights from Eq. (17). Repeat the comparison with X_0=X_1 to calibrate the ordinary interpolation error for a fixed function. If theta'_PBACC differs from theta' by more than the calibrated identical-data error, or if the discrepancy grows with data heterogeneity, the δ-stability argument fails; if it matches, the concern is resolved. For linear regression all quantities are computable in closed form, so the test is decisive and cheap.","verdict_should_be":"REJECT","load_bearing_attack":"The generalization to secure training over decentralized data (Sec. V-B2) is the load-bearing part of the central claim. The master sends an encoded model u_theta(beta_j) to worker j; worker j computes full_train(u_theta(beta_j); X_j) on its private data; the master decodes via Eq. (17). BACC decoding is valid when the interpolated values are evaluations of one fixed function at the encoded points; here the function differs across workers (different X_j) and, moreover, each local training starts from a different encoded parameter value u_theta(beta_j), not from theta. The only justification offered is that Berrut interpolation is δ-stable and therefore 'theoretically similar to an average of all the trained models.' Delta-stability bounds the interpolation operator; it does not show that the weighted average of full_train(u_theta(beta_j); X_j) approximates the target global model, e.g., FedAvg of full_train(theta; X_j). The samples needed for the target would be F_j(theta)=F_j(u(alpha)), not F_j(u(beta_j)). No derivation or convergence argument is supplied. The experiments support this gap: this configuration's CNN accuracy drops from 0.98 to 0.86 (Table IV), VAE test loss rises from 289.8 to 461.1 (Table VII), and Tables V and VIII show severe degradation as sigma_n increases, contradicting the 'minimally altered' wording in the abstract. Since this setting is presented as one of three modes of the general solution, the central claim is not established.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript extends Privacy-aware Berrut Approximated Coded Computing (PBACC) to three distributed learning configurations: secure training over centralized data (DLCD), secure aggregation over decentralized data (DLDD), and secure training over decentralized data (DLDD). It proposes tensor-based encoding/decoding, a MIMO-capacity privacy bound (Eq. (12)) with leakage per data element iL, and reports experiments on CNN/MNIST, VAE/Fashion-MNIST, and Cox/METABRIC. The central claim is that PBACC is a general solution providing bounded leakage below one bit with minimal quality loss in all three configurations.","tokens_in":20228,"tokens_out":4660,"duration_ms":46439,"significance":"The paper addresses a real gap: extending approximate coded computing with privacy to non-linear ML training and decentralized data. Its strengths are the breadth of the experimental campaign (three model families, three configurations, convergence and timing measurements) and a clear threat model of colluding honest-but-curious nodes. The efficiency comparison in Table II is useful. However, the theoretical support for the main generalization is not sound: the secure decentralized training mode lacks a valid decoding justification, and the privacy bound in Eq. (12) is dimensionally inconsistent. The reported leakage values are determined by the same equation used to select parameters, so they are not independent verifications. If the DLDD secure-training claim were removed and the privacy analysis corrected, the remaining contributions (secure aggregation and DLCD secure training) would be more modest incremental extensions of [25].","major_comments":[{"comment":"The decoding operation in secure training over decentralized data is not justified. PBACC decoding via Eq. (17) is valid when the interpolated points are evaluations of one fixed function at the encoded points; here each worker j evaluates a different function full_train(·; X_j) on its private data and from a different encoded starting point u_theta(beta_j). The δ-stability of Berrut interpolation bounds the interpolation operator and does not imply that the decoded value approximates the desired global model (e.g., the FedAvg aggregate of full_train(theta; X_j)). No proof or convergence argument is supplied. The experiments in Tables IV and VII show a substantial quality loss for this configuration (CNN accuracy 0.86 vs 0.98; VAE loss 461.1 vs 289.8), and Tables V and VIII show severe degradation as sigma_n increases, contradicting the abstract's claim of minimally altered quality. Since this configuration is presented as one of the three modes of the general solution, the central claim is not established.","section":"Section V-B2"},{"comment":"The privacy bound is formally invalid as written. The matrix \\tildeΣ_c defined in Eq. (13) is c×T and Σ_c is c×K, yet Eq. (12) uses \\tildeΣ_c^{-1}, which only exists if c=T and the matrix is square. Furthermore, the matrices in Eq. (13) contain interpolation basis evaluations q_i(beta_j), not covariance matrices of encoded input and noise; the MIMO channel capacity formula in Eq. (9) applies to covariance matrices of the transmitted signal and additive noise, and the paper does not derive how these basis-evaluation matrices arise as covariances. Because the parameters T and sigma_n in Tables III, VI, and IX are chosen using Eq. (12), the reported leakage bounds are design constraints imposed by the equation rather than independent measurements of the protocol's privacy. The privacy guarantee stated in the abstract is therefore unsupported.","section":"Section III-C, Eqs. (12)-(13)"},{"comment":"The paper's own numerical results contradict the 'minimally altered' claim for the DLDD secure-training configuration even at the parameter settings chosen by the authors. In Table IV, the DLDD secure-training accuracy is 0.86 versus 0.98 for the uncoded baseline, and in Table V the accuracy degrades to 0.45 at σ_n=100 and 0.10 at σ_n=400. The text acknowledges this outlier but frames it as a privacy benefit; however, without a proof that the decoded model is a meaningful aggregate, the degradation is evidence that the interpolation-of-different-functions argument does not hold. This is a load-bearing issue for the claimed generality of PBACC.","section":"Section VII-A, Tables IV-V"}],"minor_comments":[{"comment":"In the second sum of Eq. (16), the denominator has (−1)^j/(z−α_k) but the summation index is k; this appears to be a typo for (−1)^k. Please fix the index and ensure the denominator is consistent with Eq. (5).","section":"Equation (16)"},{"comment":"The abstract states leakage is bounded 'strictly to less than a fraction of one bit per participant,' but Table VI reports a leakage bound of ≤ 1.0 bit for the VAE experiments. The wording should be aligned with the actual numeric values.","section":"Abstract and Tables III, VI, IX"},{"comment":"All experiments appear to be single runs with no indication of seeds, variance across runs, or statistical significance. Given the large timing differences and the noise-based privacy mechanism, reporting means and standard deviations over multiple runs would strengthen the empirical claims.","section":"Section VII"},{"comment":"There is a typo in the category name 'Dentralized Data' in the paragraph introducing DLCD and DLDD; it should read 'Decentralized Data.'","section":"Section V"}],"recommendation":"reject","confidential_remarks":"The manuscript relies heavily on the authors' own prior PBACC paper [25] for the core privacy guarantee, and the new contributions are extensions of that framework. The formal error in Eq. (12) and the unsupported DLDD secure-training claim are load-bearing; in my view they cannot be fixed by local edits without substantially reworking the paper's central claims. If the authors can provide a valid privacy analysis and a rigorous convergence or approximation argument for the decentralized secure-training mode, a resubmission could be considered."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. First, the paper is a real extension of the authors' PBACC scheme: the tensor encoding in Eq. (16) and the three operation modes (DLCD, DLDD secure aggregation, DLDD secure training) go beyond the earlier K=1 construction. The secure aggregation over decentralized data is a legitimate linear trick: each node encodes its local model, workers aggregate the encoded shares, and the master decodes the aggregate. The secure training over centralized data is also a proper BACC application: workers evaluate the same model function on encoded data points, and the master interpolates those evaluations. Second, the third mode — secure training over decentralized data — is the load-bearing piece of the 'general solution' claim, and it is not established. The only justification given is that Berrut interpolation is δ-stable, so the decoded output is 'theoretically similar to an average of all the trained models.' That confuses the stability of an interpolation operator with the validity of interpolating evaluations of different functions. Each worker computes full_train(u_theta(β_j); X_j) with a different local dataset, so the quantities being interpolated are outputs of different functions, not samples of one fixed function at different points. No convergence argument is provided. The experiments compound the problem: in this mode the CNN accuracy drops from 0.98 to 0.86 and the VAE test loss rises from 290 to 461, which contradicts the abstract's 'minimally altered' claim. The privacy analysis has its own issues. Eq. (12) is dimensionally shaky — the matrices called covariances are actually interpolation basis matrices, and the inverse is not well-defined for the stated dimensions. More importantly, the reported leakage is computed with the same formula used to choose T and σ_n, so 'leakage below one bit' is a design constraint, not an independent measurement. There are also smaller editing slips (e.g., Table XI is titled VAE but reports Cox results). On the positive side, the experiments are extensive across CNN, VAE, and Cox, and the running-time measurements are consistent with the communication-cost analysis. The paper does not provide code or data, so only the tables can be checked. In sum: the secure aggregation and centralized training extensions are plausible and worth preserving, but the decentralized training mode needs either a proof or a much narrower claim, and the privacy metric needs repair before this can be accepted. I'd send it to a serious referee — the topic is timely and the valid parts are useful — but the current version should be rejected and heavily revised.","headline":"A broader PBACC with two working modes and one unproved mode: secure training over decentralized data relies on an invalid interpolation assumption, and the privacy bound is circular.","tokens_in":20790,"tokens_out":3927,"would_cite":false,"duration_ms":38370,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["68P27","65D05","94A17","68T05"],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper generalizes Private Berrut Approximate Coded Computing to three distributed-learning configurations—centralized training, secure aggregation, and fully decentralized training—and reports that all three keep per-participant…","keywords":["private coded computing","Berrut rational interpolation","federated learning privacy","secure aggregation","secure distributed training","decentralized learning","mutual information leakage","approximate coded computing"],"falsifier":"Run the secure-training-over-decentralized-data protocol with two or more workers whose local datasets are strongly non-IID, for example disjoint MNIST digit classes, then compare the decoded global model against the plain average of the same workers' local models. If the decoded model's accuracy is much worse than the average, or if permuting which worker's share sits at which interpolation point changes the decoded model materially, the delta-stability-as-average justification fails.","tokens_in":19684,"feed_emoji":"🔒","tokens_out":9702,"duration_ms":91510,"temperature":0.7,"pith_summary":"The paper claims that Private Berrut Approximate Coded Computing, a scheme that encodes data as Gaussian-noised rational interpolation shares before sending it to workers, can be exported from federated aggregation to the full range of distributed learning layouts. Three adapted protocols are given: secure training when one owner distributes a dataset, secure aggregation when many owners train locally and a master combines their models, and secure training when both the model and the data stay encoded end to end. The engineering value is that the scheme works for arbitrary nonlinear learning functions on real-valued tensors, needs no input quantization, tolerates stragglers, and carries a per-data-element privacy guarantee. In experiments with convolutional networks, variational autoencoders, and Cox regression, the encoded protocols keep mutual-information leakage at or below one bit per participant while model quality is largely unchanged, except for the fully decentralized training variant.","feed_headline":"One coded scheme guards three model types under one bit of leakage","feed_subtitle":"PBACC now guards centralized, secure-aggregation, and decentralized training with under one bit leakage per participant.","key_machinery":"The load-bearing object is the PBACC interpolating rational function $$u_X(z)=\\frac{\\sum_{j=0}^{K-1}\\frac{(-1)^j}{z-\\alpha_j}X_j+\\sum_{j=0}^{T-1}\\frac{(-1)^{j+K}}{z-\\alpha_{K+j}}R_j}{\\sum_{k=0}^{K+T-1}\\frac{(-1)^k}{z-\\alpha_k}},$$ with $X_j$ the data slices, $R_j$ Gaussian noise tensors, $\\alpha$ the Chebyshev interpolation nodes of the first kind, and evaluations at Chebyshev nodes of the second kind $\\beta_j$ forming the shares sent to workers. The decoder is the Berrut rational interpolant built from the fastest workers' outputs, which recovers $f(X_j)$ approximately at the $\\alpha_j$ nodes. The privacy metric $i_L$ is the normalized worst-case mutual information between the private inputs and the shares observed by up to $c$ colluding nodes, bounded through a MIMO channel-capacity formula; the randomness $T,\\sigma_n$ sets the leakage level. This same mechanism carries all three distributed-learning protocols, with the only differences being which object (dataset, local model, or global model) is encoded and which entity decodes.","core_discovery":"On the paper's own terms, the discovery is that the PBACC encoding, built from a barycentric rational function whose numerator places data points and Gaussian random tensors at distinct interpolation nodes, is not tied to a single master-owner setup. The scheme is generalized to tensor-valued inputs and to multiple data owners, yielding three workable modes: distributed training over centralized data, secure aggregation over decentralized data, and secure training over decentralized data. In the third mode, each worker trains on an encoded copy of the global model with its own private data, and the master decodes a new model by Berrut interpolation; the paper argues this is meaningful because Berrut rational interpolation is delta-stable, so the decoded result approximates an average of the trained models. The measured consequence is that the three protocols attain less than one bit of leakage per data element for groups of honest-but-curious colluding workers, with model accuracy essentially preserved for CNN and Cox experiments and a clear accuracy cost only in secure training over decentralized data.","pith_inferences":["A testable extension is to treat PBACC secure training as a privacy-preserving approximation of FedAvg and measure the gap between its decoded model and the explicit average of local models as a function of data heterogeneity; the paper's delta-stability argument predicts the gap stays small, but does not test it.","Because the leakage bound is derived from a MIMO channel model under Gaussian noise, the same machinery could yield explicit privacy-versus-utility curves for other interpolation point sets beyond Chebyshev nodes, which might improve the accuracy of the fully decentralized mode without lowering privacy.","The numerical overflow that forced the VAE experiments to use a Gumbel-Softmax reparameterization suggests the encoded-training mode will need numerical safeguards when applied to models with exponentials; this is a practical boundary of the method rather than a tested claim.","A system designer could exploit the $K$ trade-off differently from the paper, for instance by encoding only selected layers of a model or by using larger $K$ in secure aggregation to improve precision at a predictable communication cost."],"forward_implications":["The three PBACC protocols give a single privacy mechanism for distributed learning that does not require exact computations, finite fields, or quantized inputs.","At the tested security levels (leakage at most one bit per element under twenty percent colluding nodes for the CNN and Cox cases), CNN and Cox model quality is essentially the same as uncoded training, so privacy can be added without hurting those models.","The fully decentralized training variant is the most private but costs accuracy and convergence speed; for the Cox model this cost nearly vanishes, so simpler models tolerate the strongest setting.","Because the approximation error does not accumulate with the number of workers, the scheme behaves differently from differential privacy as the network grows.","Encoding and decoding cost scales with the split parameter $K$ and with the degree of decentralization, giving a tunable communication-versus-computation trade-off, such as $N(N-1)$ share exchanges for secure aggregation versus unchanged per-round communication for secure training."],"supporting_citations":[{"why":"Defines Lagrange coded computing, the exact-recovery scheme whose finite-field and polynomial-only restrictions motivate approximate coded computing.","marker":"[7]"},{"why":"Introduces Berrut approximated coded computing, supplying the barycentric encoding, Chebyshev nodes, and bounded-error decoding that PBACC privatizes.","marker":"[4]"},{"why":"Presents the initial PBACC extension to federated learning that this paper generalizes to three distributed-learning configurations.","marker":"[21]"},{"why":"Defines PBACC's Gaussian-random-coefficient encoding and the mutual-information leakage metric used for the privacy bounds.","marker":"[25]"},{"why":"Supplies the MIMO channel-capacity bound used to turn the leakage metric into the computable $i_L$ formula.","marker":"[31]"},{"why":"Provides FedAvg, the reference aggregation strategy used in the secure-aggregation protocol and in the uncoded baselines.","marker":"[32]"},{"why":"Supplies the Cox-Time neural regression model and the dataset used for the survival-analysis experiments.","marker":"[37]"}],"fun_headline_variants":["PBACC: one bit privacy for three federated learning modes","Under one bit leakage: PBACC secures three distributed setups","Three training modes, one coded scheme, <1 bit privacy loss","Berrut coded computing: three FL modes, under one bit leak","PBACC extends to decentralized FL with sub-bit leakage"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing assumption is that decoding the complete training outputs produced by different workers on their own private data yields a meaningful global model: the paper invokes delta-stability of Berrut interpolation to say the decoded result behaves like an average, but it does not prove that interpolating different data-dependent training functions produces a valid aggregate.","fun_headline_variants_meta":{"raw":{"variants":["PBACC: one bit privacy for three federated learning modes","Under one bit leakage: PBACC secures three distributed setups","Three training modes, one coded scheme, <1 bit privacy loss","Berrut coded computing: three FL modes, under one bit leak","PBACC extends to decentralized FL with sub-bit leakage"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000166,"raw_usage":{"total_tokens":1260,"prompt_tokens":958,"completion_tokens":302,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":574,"completion_tokens_details":{"reasoning_tokens":215}},"tokens_in":574,"tokens_out":302,"duration_ms":3137,"temperature":1.0,"reasoning_tokens":215,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T22:33:59.867961+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the secure-training-over-decentralized-data protocol with two or more workers whose local datasets are strongly non-IID, for example disjoint MNIST digit classes, then compare the decoded global model against the plain average of the same workers' local models. If the decoded model's accuracy is much worse than the average, or if permuting which worker's share sits at which interpolation point changes the decoded model materially, the delta-stability-as-average justification fails.","supporting_citations":[{"cited_title":"Lagrange coded computing: Optimal design for resiliency, security, and privacy,","cited_arxiv_id":null,"evidence_quote":"Defines Lagrange coded computing, the exact-recovery scheme whose finite-field and polynomial-only restrictions motivate approximate coded computing."},{"cited_title":"Berrut approximated coded computing: Straggler resistance beyond polynomial computing,","cited_arxiv_id":null,"evidence_quote":"Introduces Berrut approximated coded computing, supplying the barycentric encoding, Chebyshev nodes, and bounded-error decoding that PBACC privatizes."},{"cited_title":"Privacy-aware Berrut approximated coded computing applied to federated learning,","cited_arxiv_id":null,"evidence_quote":"Presents the initial PBACC extension to federated learning that this paper generalizes to three distributed-learning configurations."},{"cited_title":"From antenna spacings to theoretical capacities - guidelines for simulating MIMO systems,","cited_arxiv_id":null,"evidence_quote":"Supplies the MIMO channel-capacity bound used to turn the leakage metric into the computable $i_L$ formula."},{"cited_title":"Communication-efficient learning of deep networks from decentralized data,","cited_arxiv_id":null,"evidence_quote":"Provides FedAvg, the reference aggregation strategy used in the secure-aggregation protocol and in the uncoded baselines."},{"cited_title":"Time-to-event prediction with neural networks and Cox regression,","cited_arxiv_id":null,"evidence_quote":"Supplies the Cox-Time neural regression model and the dataset used for the survival-analysis experiments."}],"review_version":1}