{"id":"1848d31c-e57c-46b5-88fc-c724d5ac8d29","arxiv_id":"2505.13292","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":2.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"The paper asserts that combining federated learning, large language model features, and homomorphic encryption delivers the best cross-cloud privacy and training performance, but reports no quantitative evidence.","lead":"This paper proposes a cross-cloud training scheme that combines federated learning, LLM feature extraction, and homomorphic encryption to keep data private. It claims large gains in privacy, accuracy, and convergence, but provides no experimental evidence to support the claim.","discovery_kind":"incremental","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Section IV compares 'Ours' under an epsilon privacy budget, but the method has no stated DP mechanism or privacy accounting; the claimed privacy advantage is untestable and the supporting figures are absent.","rationale":"The reader's REJECT verdict is well supported. The paper's strongest claim depends entirely on experimental evidence in Section IV, but that evidence is not present in the manuscript: the figures are missing, no numbers are reported, and the privacy comparison under epsilon is ill-posed because 'Ours' has no stated differential privacy mechanism. This is not a disagreement with a consensus; it is a missing load-bearing verification of the central empirical claim. My concrete concern focuses on the privacy-utility comparison being untestable, which is the most direct blow to the conclusion. The reader's weakest_assumption about the LLM feature substitution and encrypted aggregation is related, but the privacy metric problem is even more fundamental: even if those steps were valid, the paper still would not support its headline result without measurable privacy and performance data. Therefore I agree with the reader's verdict and recommend no change.","tokens_in":6899,"tokens_out":2355,"duration_ms":25059,"concrete_test":"Obtain or reconstruct the missing experimental artifacts: the exact numerical results behind Figure 1, the epsilon values used, the noise mechanism and privacy accounting for 'Ours', the dataset version, and the model/hyperparameter configuration. Then rerun the comparison of 'Ours' versus FedAvg, DP-FL, SMC-FL, and HE-FL under identical settings, reporting privacy loss with a defined metric such as epsilon or a formal DP guarantee. If no DP mechanism or privacy budget accounting exists for 'Ours', the claimed privacy advantage cannot be measured, and the central claim fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim in Section V is that 'Ours' achieves the highest privacy protection effect, fewest iteration rounds, fastest convergence, and shortest and most stable training time. The most load-bearing premise is that the Section IV experiments are real measurements: Figure 1 plots a 'privacy protection effect' against epsilon for 'Ours' and four baselines. However, nowhere in Sections III or IV is 'Ours' defined as a differentially private mechanism. There is no statement of what noise is added, no privacy accounting, no formal guarantee, and no definition of the 'privacy protection effect' being plotted. Epsilon is the budget of a differential privacy mechanism, so plotting 'Ours' on the same axis presupposes that 'Ours' has a DP guarantee; the homomorphic encryption layer in Eqs. (5)-(6) provides confidentiality of model updates, not differential privacy. Compounding this, Figures 1-3 referenced in Section IV.B do not appear in the manuscript, and no numerical tables, dataset version, model architecture, hyperparameters, or error bars are reported. The claimed superiority is therefore an assertion, not a demonstrated result. A separate but related omission is the LLM feature map z_i,n = LLM(x_i,n) in Eqs. (3)-(4): no ablation or error analysis shows that this substitution preserves task-relevant information, and no privacy analysis of the LLM features themselves is given. Either issue would undercut the conclusion; the missing privacy accounting alone makes Section V unsupported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a cross-cloud privacy-preserving training framework that combines federated learning, LLM-based feature augmentation, homomorphic encryption, and cross-cloud fine-tuning. Section III presents standard FedAvg update equations, replaces local features with LLM embeddings, and adds an encrypted aggregation step via homomorphic encryption. Section IV claims experiments on Google Cloud BigQuery comparing FedAvg, DP-FL, SMC-FL, HE-FL, and “Ours”, and Section V concludes that the proposed method has the highest privacy protection effect, the fewest iterations, the fastest convergence, and the shortest and most stable training time. The manuscript contains no numerical results, no reproducible experimental protocol, and none of the three cited figures are present. The central claims are therefore assertions rather than demonstrated findings.","tokens_in":1203,"tokens_out":1312,"duration_ms":48251,"significance":"If the claimed results were supported by a reproducible protocol, a formal privacy analysis, and ablations, the paper would offer a practically relevant recipe for privacy-preserving distributed LLM training across clouds. As submitted, however, the paper provides no evidence for these claims: it contains no machine-checked proofs, no code, no dataset version or partitioning, no model architecture or hyperparameters, and no numerical tables. Its privacy comparison rests on an unstated assumption that the proposed method is differentially private, although the only described mechanism is homomorphic encryption, which does not imply differential privacy. The potential significance of the topic is real, but the contribution is currently not substantiated.","major_comments":[{"comment":"The claim that “Ours” achieves the highest privacy protection effect on an epsilon (differential privacy budget) axis is unsupported, because the proposed method is never defined as a differentially private mechanism. Section III.B adds only homomorphic encryption, which protects the confidentiality of model updates and does not by itself provide differential privacy. No noise mechanism, privacy accounting, or formal guarantee is stated, and the plotted quantity “privacy protection effect” is not defined. The comparison in Fig. 1 and the corresponding conclusion in Section V therefore rely on an unjustified assumption.","section":"Section IV.B, Fig. 1"},{"comment":"The experimental evaluation is not reproducible and cannot support the paper’s conclusions. No dataset version, data partitioning, model architecture, LLM choice, hyperparameters, evaluation metrics, or numerical results are reported, and Figures 1–3 are referenced in the text but do not appear in the manuscript. The claims of fewer iterations, faster convergence, and shorter and more stable training time cannot be checked against any measurements, which is load-bearing because Section V states these as empirical findings.","section":"Sections IV.A-IV.B"},{"comment":"The substitution z_i,n = LLM(x_i,n) is asserted to improve training efficiency and decision-making, but no analysis or ablation shows that the LLM embedding preserves task-relevant information. If the embedding discards information, the reported gains in accuracy and convergence could be an artifact of the specific baselines or of the feature transformation. The privacy properties of the LLM features themselves are also not analyzed, so the security claim of the framework does not cover this component.","section":"Section III.A, Eqs. (3)-(4)"},{"comment":"The secure communication layer is underspecified. The paper does not state which homomorphic encryption scheme is used, how encrypted weighted sums over rational model parameters are computed, how noise growth is managed, or what security assumptions hold. Equation (6) implicitly assumes that Dec(sum (N_i/N) Enc(w_i)) equals the weighted average of the plaintext parameters, which requires a concrete scheme and parameterization; without these details, the claim that the layer “ensures privacy and integrity” is not checkable.","section":"Section III.B, Eqs. (5)-(6)"}],"minor_comments":[{"comment":"The equation numbering is inconsistent: the LLM output is labeled as Equation (1) immediately after Equation (2), and the subsequent local objective is labeled Equation (4). The equations should be renumbered sequentially.","section":"Section III.A, Eqs. (3)-(4)"},{"comment":"The manuscript states that Figures 1–3 illustrate the privacy, convergence, and training-time results, but the actual figures are missing. The paper should either include the figures or remove the references to them.","section":"Section IV.B, Figs. 1-3"},{"comment":"The prose contains multiple grammatically incomplete or awkward sentences, for example the passage ending “the system using cross-cloud architecture can not only improve the collaboration ability of large-scale language models (LLMs) between different cloud platforms.” The text needs careful editing.","section":"Throughout"},{"comment":"Reference [27] includes the authors of this manuscript; self-citations are not inherently problematic, but the citation should be flagged and its relevance to the present work should be explained in the related-work discussion.","section":"References"}],"recommendation":"reject","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe paper is a short cross-cloud FL+LLM recipe that recombines textbook pieces: FedAvg (Eqs. 1-2), an LLM feature map (Eqs. 3-4), homomorphic encryption (Eqs. 5-6), and standard fine-tuning (Eq. 7). There is no new method here, and the one place it tries to establish an advantage—Section IV—does not survive contact with the paper itself.\n\nWhat it does reasonably: the writing is clear about the building blocks, and the related work correctly points to [33] and [34], which already combine cross-cloud FL with HE and LLM training. The authors do not hide those references, and the notation is mostly clean. The idea of using LLM embeddings as local features is a reasonable thing to try.\n\nThe soft spots are large. First, the experimental section describes Figures 1-3, but the figures are absent, and there are no numerical results, no dataset version, no model architecture, no hyperparameters, no error bars, and no code or data. The claimed superiority in Section V is an assertion. Second, the privacy comparison is undefined: 'Ours' has no DP mechanism, no noise, no privacy accounting, yet it is plotted on an epsilon axis. The text even says privacy improves as epsilon increases, which is backwards under standard DP semantics—smaller epsilon is stronger privacy. That is a conceptual error, not a minor typo. Third, the LLM feature substitution is introduced without any ablation or error analysis showing it preserves task-relevant information; it could just as easily discard signal. The self-citation in [27] is minor and not a problem by itself.\n\nNet: this reads like an architecture sketch with an unsubstantiated empirical claim. The math is standard, the evidence is missing, and the privacy reasoning is wrong. I would not send it to peer review in its current form—the reviewer would have nothing to evaluate. If the authors provide actual experiments, code, and a coherent privacy analysis, a revised version might be worth another look, but this draft is not.","headline":"A clear but thin architecture paper whose claimed privacy and convergence advantages are unsupported by missing experiments and a misapplied epsilon differential-privacy axis.","tokens_in":7677,"tokens_out":3087,"would_cite":false,"duration_ms":26509,"reading_group":"no","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A cross-cloud training recipe that runs federated learning on LLM-extracted features and encrypted model updates claims to beat four baselines in privacy, convergence speed, and training time.","keywords":["cross-cloud data privacy","federated learning","large language models","homomorphic encryption","secure communication layer","differential privacy","model fine-tuning","convergence speed"],"falsifier":"Run the proposed pipeline on a fixed task twice: once with raw features and once with the LLM feature map, both without encryption, and compare convergence curves; if the LLM version is not faster and more accurate, the reported gains are not caused by the LLM. Separately, compare the server's decrypted aggregate with the result of averaging the same updates in plaintext, since homomorphic aggregation should reproduce plaintext FedAvg exactly and any discrepancy would falsify the correctness of Eq. (6).","tokens_in":6589,"feed_emoji":"🔐","tokens_out":6450,"duration_ms":55564,"temperature":0.7,"pith_summary":"This paper tries to establish that cross-cloud AI training can be both private and efficient by combining federated learning with large language models. The authors propose a framework in which each cloud node replaces raw inputs with LLM-generated semantic features $z_{i,n}=\\mathrm{LLM}(x_{i,n})$ for local training, encrypts its model update $\\widehat{w}_i=\\mathrm{Enc}(w_i)$, and lets a server aggregate encrypted updates before decryption. They report experiments on a real-world multi-domain dataset showing that this recipe reaches 85% accuracy in fewer iterations, converges faster, and shows the smallest and most stable training time while scoring highest on a differential-privacy test, ahead of FedAvg, DP-FL, SMC-FL, and HE-FL. If the claim holds, it gives cloud operators a concrete way to fine-tune large models across data centers without centralizing sensitive data.","feed_headline":"Cross-cloud recipe claims fastest private LLM training","feed_subtitle":"Paper reports a cross-cloud federated recipe that beats four baselines on privacy, convergence, and training time.","key_machinery":"The load-bearing mechanism is a two-stage pipeline. First, LLM feature augmentation maps each raw sample $x_{i,n}$ through a pre-trained large language model to a context feature $z_{i,n}$; that feature feeds local training, allowing the local model to exploit semantic and contextual information while the raw data never leaves the node. Second, a secure communication layer applies homomorphic encryption, meaning encryption that supports arithmetic on ciphertexts, to each local update, $\\widehat{w}_i = \\mathrm{Enc}(w_i)$, and the server computes the global model by decrypting the weighted sum of encrypted updates, matching the form of the standard federated averaging rule. The third piece, cross-cloud fine-tuning, adjusts the model with $\\Delta w$ after migration so performance does not degrade in a new cloud environment. Together these equations are what the experimental comparison is testing; the argument that privacy and efficiency can coexist rests on them.","core_discovery":"The paper's central claim is that the combination of LLM-based feature augmentation with homomorphic encryption preserves the benefits of federated averaging while improving both privacy and convergence. On each node, the local loss is computed on LLM-extracted features rather than raw features, so the global model learns from semantic representations without transmitting them. Model updates are encrypted before aggregation, and the server's update step is the decrypted weighted sum of those ciphertexts, $w^{(t+1)} = \\mathrm{Dec}\\left(\\sum_i \\frac{N_i}{N}\\widehat{w}_i\\right)$, which the authors treat as preserving the FedAvg objective. Cross-cloud fine-tuning, $w' = w + \\Delta w$, is added to keep a migrated model adapted to a new cloud's data distribution. The reported experiments state that this design achieves the highest privacy protection effect in the differential privacy test, with the least iteration rounds, the fastest convergence, and the shortest and most stable training time compared with the four baselines.","pith_inferences":["It remains an open question whether the speed-up comes from the LLM features or from the encrypted aggregation; a version that replaces the LLM with raw inputs while keeping encryption would isolate the source.","The privacy argument presumes the aggregator cannot see updates or hold the decryption key; in a fully honest-but-curious cloud, homomorphic encryption alone does not prevent inference from the final model.","A natural stress test is data heterogeneity: the reported convergence result used one dataset, and the LLM feature map may transfer less well when nodes have very different modalities or label distributions.","The same recipe could apply at the edge: if the LLM is small enough to run on a phone or local gateway, this augments federated learning beyond clouds."],"forward_implications":["If the claim holds, the standard FedAvg update rule can be run on encrypted gradients with no change to the aggregation arithmetic, so privacy protection and convergence are not in tension.","After the LLM feature map $z_{i,n}=\\mathrm{LLM}(x_{i,n})$ is precomputed on each node, participating clouds only exchange ciphertexts, which makes raw data sharing unnecessary for collaborative fine-tuning.","Cross-cloud model migration with $w' = w + \\Delta w$ would let an organization move a trained model between providers and quickly re-adapt it without retraining from scratch.","The paper's differential-privacy result implies that the combined method can operate at smaller privacy budgets, meaning less noise is required for the same protection, than DP-FL alone."],"supporting_citations":[{"why":"Supplies the closest predecessor: federated learning with homomorphic encryption and cross-cloud orchestration for LLM privacy, which this paper extends with LLM feature augmentation.","marker":"[34]"},{"why":"Provides the AI-generated privacy protocol combining FL, differential privacy, and dynamic encryption, a baseline for cross-cloud data sharing.","marker":"[33]"},{"why":"Identifies convergence and communication challenges in federated fine-tuning of LLMs, motivating the paper's design choices.","marker":"[30]"},{"why":"Introduces FLFT, a federated fine-tuning method for large pre-trained language models, the basis for the cross-cloud fine-tuning step.","marker":"[31]"},{"why":"Argues for federated learning as a governance framework for collaborative LLM development, supporting the paper's collaboration claim.","marker":"[28]"},{"why":"Supplies cross-cloud federated training of LLMs as the problem background, justifying the need for a cross-cloud architecture.","marker":"[2]"}],"fun_headline_variants":["Cross-cloud FL+LLM speeds up private model training","Federated LLM recipe boosts privacy and convergence","Private cross-cloud training: LLM features, encrypted updates","LLM-augmented federated learning beats baselines on privacy","Fast private cross-cloud learning via LLM and encryption"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the encrypted aggregation in Eq. (6) computes exactly the same global update as standard FedAvg, and that the LLM feature map $z_{i,n} = \\mathrm{LLM}(x_{i,n})$ does not discard information the downstream task needs; if either fails, the claimed accuracy, privacy, and speed advantages collapse.","fun_headline_variants_meta":{"raw":{"variants":["Cross-cloud FL+LLM speeds up private model training","Federated LLM recipe boosts privacy and convergence","Private cross-cloud training: LLM features, encrypted updates","LLM-augmented federated learning beats baselines on privacy","Fast private cross-cloud learning via LLM and encryption"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000297,"raw_usage":{"total_tokens":1709,"prompt_tokens":922,"completion_tokens":787,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":538,"completion_tokens_details":{"reasoning_tokens":706}},"tokens_in":538,"tokens_out":787,"duration_ms":7705,"temperature":1.0,"reasoning_tokens":706,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T20:15:29.041808+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the proposed pipeline on a fixed task twice: once with raw features and once with the LLM feature map, both without encryption, and compare convergence curves; if the LLM version is not faster and more accurate, the reported gains are not caused by the LLM. Separately, compare the server's decrypted aggregate with the result of averaging the same updates in plaintext, since homomorphic aggregation should reproduce plaintext FedAvg exactly and any discrepancy would falsify the correctness of Eq. (6).","supporting_citations":[{"cited_title":"AI-generated privacy-preserving protocols for cross-cloud data sharing and collaboration,","cited_arxiv_id":null,"evidence_quote":"Provides the AI-generated privacy protocol combining FL, differential privacy, and dynamic encryption, a baseline for cross-cloud data sharing."},{"cited_title":"Flft: A large-scale pre-training model dis- tributed fine-tuning method that integrates federated learning strategies,","cited_arxiv_id":null,"evidence_quote":"Introduces FLFT, a federated fine-tuning method for large pre-trained language models, the basis for the cross-cloud fine-tuning step."},{"cited_title":"Open-source AI-based se tools: Opportunities and challenges of collaborative software learning,","cited_arxiv_id":null,"evidence_quote":"Argues for federated learning as a governance framework for collaborative LLM development, supporting the paper's collaboration claim."},{"cited_title":"Research on key technologies for cross-cloud federated training of large language models,","cited_arxiv_id":null,"evidence_quote":"Supplies cross-cloud federated training of LLMs as the problem background, justifying the need for a cross-cloud architecture."}],"review_version":1}