{"id":"239e1b90-574e-40af-af45-217828e0213c","arxiv_id":"2505.13319","paper_version":2,"verdict":"REJECT","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":8,"one_line_summary":"SVAFD signs per-slice sums of logits, not the logits themselves, so a malicious server can change the teacher knowledge without breaking the proof.","lead":"This paper proposes SVAFD, a secure aggregation protocol for federated distillation that lets clients co-aggregate logits while a server decodes and issues a verification proof. A generalist might read it to see whether private, verifiable training can work when clients use different model architectures.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Eq. (20) verifies only the total sum of teacher-knowledge entries, so a colluding leader/server can tamper with any entries and still pass the proof; the claimed matrix-level verifiability is unsupported.","rationale":"The reader's rejection is justified, but the sharpest version of the attack is slightly different from the reader's server-only framing. A non-colluding server does not know R_c, so it cannot freely choose the deblinded teacher-knowledge matrix; the sum-only verification is not immediately exploitable by the server alone. The real problem is that the protocol's own collusion model and key distribution supply the missing pieces: the leader knows R_c, followers send their private keys to the leader, and the server holds all signatures. Under server-leader collusion, Eq. (20) can be satisfied for an arbitrary matrix with the correct total sum, so the proof does not provide the claimed matrix-level knowledge integrity or verifiability. The reader identified the scalar-sum gap and the key handoff as separate weaknesses; my stress-test merges them into one load-bearing concern: the verification predicate is too weak, and the protocol gives colluding parties the information needed to exploit that weakness. No adjustment to the reader's REJECT verdict is needed. The experimental results, which measure accuracy under poisoning attacks, do not test this forgery path, and the code is not released, so nothing in the evaluation mitigates the concern.","tokens_in":23791,"tokens_out":28016,"duration_ms":299425,"concrete_test":"Build a single-group simulation using the paper's Charm SS512 setting with D=10, K=1, and three followers. First run the honest protocol to obtain Yhat, R_c, pi_c, and the leader's accept/reject result. Then test the mathematical invariance: replace Yhat by Yhat + Delta for any zero-sum Delta (e.g., add +1 to entry (1,1) and -1 to entry (2,1)) and leave pi_c unchanged; if Eq. (20) still accepts, the predicate is only a total-sum check. Next demonstrate the collusion attack: have the leader, knowing R_c and the followers' private keys, re-sign the modified slice sums corresponding to Yhat+Delta, recompute pi_c, and confirm that the leader accepts the tampered matrix. Both checks together show that Eq. (20) does not authenticate the teacher-knowledge matrix and that the protocol's stated collusion resistance is false.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central verifiability claim rests on Eq. (20), but the proof built in Eqs. (14)-(17) is constructed from scalar slice sums V_z^(k), and the expansion in Eq. (23) shows the verification predicate depends on the decoded teacher knowledge only through the single scalar sum of all entries. Thus Eq. (20) authenticates, at most, one number per group, not the full teacher-knowledge matrix. The only mechanism preventing a lone malicious server from exploiting this is the secret deblinding matrix R_c held by the group leader. However, the paper's threat model (Section II-C) explicitly allows the server to collude with clients, and Section IV-A requires every follower to send its private signature key to that same leader. A colluding leader/server therefore knows R_c, knows all follower keys, and holds all signatures. It can select any tampered matrix with the same total sum, set the blinded value to R_c times that matrix, re-sign the modified slice sums using the known keys, and produce a proof satisfying Eq. (20). The statement in Section V.A.2 that colluding parties 'cannot deceive the leader' is therefore unsupported: the proof is only a scalar-sum check, and the colluding parties have all the information needed to make that scalar match. The same key handoff also lets the colluding pair strip the blinding from the signatures and recover the slice sums, contradicting the claimed privacy guarantee.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SVAFD, a secure aggregation protocol specifically for Federated Distillation. The design splits responsibilities: clients encode local logits with Lagrange Coding Computation, exchange and locally aggregate shares, while the server decodes the aggregated results and generates a pairing-based verification proof. A quality-aware filtration scheme (CAL) is used to exclude biased logits from poisoning attacks. The authors claim privacy protection, knowledge integrity, and verifiability against a malicious server, and present experiments over four FD architectures under multiple poisoning attacks and an inference attack.","tokens_in":24047,"tokens_out":11103,"duration_ms":124682,"significance":"If the security claims were sound, this would be a meaningful step: SVAFD targets a realistic setting (heterogeneous FD, malicious server, colluding clients), avoids a trusted third party, and reports broad experiments and overhead measurements. The LCC-based co-aggregation idea is interesting and the system-level evaluation is extensive. However, the central verifiability claim is not supported by the protocol as written: the verification equation authenticates only a scalar sum of the decoded teacher knowledge, not the individual entries, and the protocol requires followers to hand their private signature keys to the group leader. These issues are load-bearing for the paper's main advertised properties, so the contribution cannot be accepted in its current form.","major_comments":[{"comment":"The verification predicate does not bind the entries of the teacher-knowledge matrix; it only checks the total sum of all entries. Since π^{(k)'}_z = g^{V_z^{(k)}+Υ_z} and π^c_z = g^{w_z}, the product in Eq. (17) collapses in Eq. (23) to e(g,g)^{Σ_{g,l} y_{g,l} + K Σ_i w_i Υ_i}. Thus any matrix Y' with the same total sum as the genuine teacher knowledge satisfies Eq. (20) with the same proof. A server that can produce such a Y' therefore passes verification while changing every entry of the matrix. This directly contradicts the claimed 'knowledge integrity' and 'verifiability' properties. The security of the protocol now depends entirely on the secrecy of the deblinding matrix R_c and on the server being unable to learn or reproduce the scalar sum, which is a much weaker guarantee than the advertised matrix-level integrity.","section":"Section IV-D, Eq. (20) and Eq. (23)"},{"comment":"The protocol requires every follower to send its private signature key Υ_z to the group leader. Since the threat model in Section II-C explicitly allows the server to collude with any clients, a colluding leader/server pair knows R_c, all follower keys Υ_z, all weights w_z, and all signatures. This pair can select any tampered matrix Y' with the same total sum as the true result, re-sign the modified slice digests using the known keys, and produce a proof satisfying Eq. (20). The statement in Section V.A.2 that colluding parties 'cannot deceive the leader' is therefore unsupported. Handing private signature keys to another party also undermines the unforgeability assumption on which the whole verification argument rests.","section":"Section IV-A and Section V.A.2"},{"comment":"The claimed information-theoretic privacy guarantee is asserted rather than proven. The text states that truncated circularly-symmetric complex Gaussian noise 'ensure[s] information-theoretic privacy', but no theorem or analysis connects the noise distribution, the parameters K and T, and the number of clients N to a privacy bound. The LCC privacy theorem (Theorem 1) is stated for the algebraic LCC setting; the protocol here uses real-valued/truncated Gaussian blinding and real-valued aggregated shares, so the T-privacy guarantee cannot simply be inherited. This is a load-bearing gap for the privacy requirement, which is one of the three central advertised properties.","section":"Section IV.C.1, Eq. (10)"}],"minor_comments":[{"comment":"There are numerous typos and inconsistencies, including 'inple ment' (Note 4), 'attatins' (Section IV.C.4), 'simplied' (Section V.A.1), 'eights attacks' (Fig. 6 caption), 'poision' (Section VI.B), 'Dilliclet' (Section III.C), and inconsistent use of 'MAUA' vs 'MUAU'.","section":"Throughout"},{"comment":"The precision conversion function has a typo: '⌊V^{(k)}_z * 10^q.⌋' contains an extra period inside the floor notation.","section":"Appendix C"},{"comment":"The correctness proof writes exact equality for the decode/deblind operation, but the protocol uses analog LCC with truncation and real-part extraction, and Table III reports nonzero relative error. The proof should state that the equality holds only up to the approximation error, and the verification step should specify how that error is tolerated.","section":"Section V.A.1, Eq. (21)"},{"comment":"The CAL filtration rule is motivated by measurements on the same datasets used in the evaluation (Fig. 4b), and the parameters of the LSH projection P and the group size R are chosen without a formal analysis. The robustness results should be interpreted as empirical evidence for a heuristic, not as a security guarantee.","section":"Section III.C"}],"recommendation":"reject","confidential_remarks":"The verification flaw is fundamental: Eq. (20) checks only a scalar sum, and the protocol's own key-handoff procedure gives a colluding leader/server the material needed to forge proofs. This cannot be repaired by local edits; the proof system would need to be redesigned to bind individual logits entries and the private-key distribution would need to be reconsidered. I recommend rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"I agree with the rejection, and the stress-test note lands. The central verifiability claim fails: Eq. (20) only checks the total sum of all teacher-knowledge entries. The signatures in Eqs. (14)-(17) are built from per-slice scalar digests V_z^(k), and the expansion in Eq. (23) confirms that the pairing product collapses to a single scalar. So a malicious server can keep the sum fixed, alter every entry of the decoded matrix, and the leader's check still passes. Given the threat model explicitly allows server-client collusion, and Section IV-A requires every follower to send its private signing key to the leader, the colluding pair has the keys, knows the blinding matrix, and can re-sign the tampered slice sums. The claim in Section V.A.2 that colluding parties cannot deceive the leader is simply unsupported. The same key handoff strips the blinding and lets the leader recover per-slice sums, which contradicts the privacy guarantee.\n\nCredit where due: the integration is new. Secure aggregation for FD genuinely is underexplored, and the co-aggregation idea—clients aggregate LCC-encoded logit shares locally, with the server handling only decoding and proof generation—is sensible. The CAL/LSH filtration is a reasonable way to address poisoning in a setting where parameter-update heuristics do not transfer. The authors implemented the protocol on four FD architectures and ran a broad poisoning-attack evaluation; that is real work, and the overhead numbers are useful. The paper is clearly written, and the literature is adequately covered. Self-citations are heavy but not inappropriate given the authors' prior FD work.\n\nSoft spots beyond the core flaw: the robustness evaluation compares against the no-defense baseline rather than against existing secure aggregation or Byzantine-robust methods, so the accuracy gains may be mostly from filtering, not from security. The code is not released, only promised after review. The CAL threshold is motivated by their own experiments on the same datasets, which is acceptable but not a formal guarantee.\n\nThe paper is for readers working on FD security and secure aggregation. It is worth reading to see a concrete attempt at the FD-specific design space and to appreciate why per-slice scalar signatures do not give matrix-level integrity. I would not cite it as a construction to build on, and I would not rely on its claims.\n\nRecommendation: it deserves a serious referee, not a desk reject, because the question is important and the failure mode is instructive. But the verdict should be reject in current form. The verification primitive needs to be rebuilt, ideally to authenticate the full decoded matrix, and the key-handoff issue needs to be addressed before resubmission.","headline":"A genuinely motivated FD-specific secure aggregation design, undermined by a scalar-sum verification that lets a colluding server/leader tamper with any entries of the teacher-knowledge matrix.","tokens_in":24623,"tokens_out":3556,"would_cite":false,"duration_ms":38454,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"SVAFD claims to be the first secure aggregation protocol built specifically for federated distillation, giving clients a cryptographic proof that the aggregated teacher knowledge has not been tampered with by a malicious server.","keywords":["federated distillation","secure aggregation","verifiable aggregation","malicious server","Lagrange coded computation","bilinear pairings","poisoning attacks","knowledge filtration"],"falsifier":"Run SVAFD with two different logits matrices for the same group that have identical per-slice totals $V^{(k)}_z$ but different entries, using the same weights and keys, and see whether Eq. (20) accepts both; if the proof passes, the verification cannot detect tampering that preserves slice sums. A complementary check is to have a group leader use the follower keys it receives to compute $\\pi^c$ itself and to strip the blinding from $\\tilde{Y}_c$, and observe whether clients accept the leader's transcript.","tokens_in":23534,"feed_emoji":"🔐","tokens_out":10414,"duration_ms":96214,"temperature":0.7,"pith_summary":"This paper sets out to show that secure aggregation for federated distillation can be made verifiable even when the server is malicious. Federated distillation trains heterogeneous models by exchanging soft predictions (logits) rather than model parameters, but most existing secure-aggregation protocols assume a server that is at worst honest-but-curious and are designed for homogeneous model updates. The paper proposes SVAFD as the first secure-aggregation protocol built for this setting, arguing that client-side local aggregation, server-side decoding and proof generation, and a quality-aware logits filter together protect privacy, preserve knowledge integrity, and let each client verify that the aggregated teacher knowledge was not altered. If the protocol works as argued, heterogeneous federated learning could operate without a trusted central aggregator while resisting both poisoning and inference attacks.","feed_headline":"New protocol verifies federated distillation against malicious servers","feed_subtitle":"Clients can verify aggregation proofs without trusting the server, cutting poisoning in heterogeneous training.","key_machinery":"MM-LCC (Multi-to-Multi Lagrange Coding Computation), an extension of Lagrange Coded Computation in which each client acts as both a data provider and a computation provider, encodes its split and blinded logits as evaluations of a polynomial, and exchanges shares so that weighted sums can be computed before any single party sees the plaintext knowledge. The redundancy built into the Lagrange encoding is what gives $D$-resilience against stragglers and $T$-privacy against colluding clients, while the homomorphic-share property lets clients aggregate shares locally and the server decode the global teacher knowledge. The verification machinery is a bilinear-pairing signature scheme: followers sign scalar sums of their logits slices, the leader signs the aggregation weights, and the server combines these into a single proof that the decoded knowledge matches the signed inputs.","core_discovery":"The central claim is that SVAFD gives each group leader a way to verify the teacher knowledge it receives: the server decodes the aggregated logits and computes a proof $\\pi^c$ from signatures over each follower's per-slice logits sums and the leader's aggregation weights, and the leader accepts only if the bilinear-pairing equality $\\pi^c \\overset{?}{=} e(g,g)^{\\sum_{g=1}^{M}\\sum_{l=1}^{D} y_{g,l} + K\\sum_{i\\in G_c} w_i \\Upsilon_i}$ holds. The paper argues that this equality, together with the Lagrange-coded encoding and the class-average-logits filter, ensures that no malicious server or colluding follower can forge an aggregation result or inject poisoned knowledge without detection. On the paper's own terms, this establishes privacy protection, knowledge integrity, and verifiability for both class-grained and sample-grained federated distillation.","pith_inferences":["The verification in Section IV-C authenticates only the per-slice totals $V^{(k)}_z$ (Eq. (14) and Eq. (17)), not the individual logit entries; a party that redistributes values within a slice while preserving each slice's total would still satisfy Eq. (20), so the integrity guarantee is weaker than full-matrix integrity.","Because each follower sends its private signing key $\\Upsilon_z$ to its group leader during the aggregation stage, a malicious leader can compute the proof $\\pi^c$ itself and can strip the blinding from the decoded knowledge; the protocol's security against a malicious server therefore depends on leaders being semi-honest toward their own followers.","The proof-of-sum construction is not specific to logits: it could be tested on other linear aggregates such as model updates or gradient sums, since it only requires a bilinear pairing group and signed per-slice sums."],"forward_implications":["Federated distillation systems can run with a malicious server: clients no longer need to trust the server to aggregate honestly, because each group leader can check the proof in Eq. (20) before using the teacher knowledge.","Quality-aware filtration based on class-average logits and locality-sensitive hashing keeps poisoned clients from steering the aggregate, improving model accuracy under eight poisoning attacks with 40% to 60% malicious clients.","The co-aggregation design applies to both class-grained and sample-grained logit formats, and the prototype runs on four federated distillation architectures.","The protocol keeps client-side latency in the millisecond range while the server performs the heavy decoding, so the scheme is intended for resource-constrained edge networks with up to 1,300 clients."],"supporting_citations":[{"why":"Supplies the Lagrange Coded Computation theorem giving D-resilience and T-privacy that MM-LCC builds on.","marker":"[30]"},{"why":"Provides the analog LCC encoding scheme used for the logits shares.","marker":"[32]"},{"why":"Basis of the bilinear-pairing signature aggregation and verification used for the aggregation proof.","marker":"[38]"},{"why":"Introduces the class-grained federated distillation architecture that the protocol targets.","marker":"[27]"},{"why":"One of the distillation architectures on which the prototype is evaluated.","marker":"[24]"},{"why":"Existing robust verifiable secure aggregation baseline with a semi-honest server that the paper contrasts with its malicious-server setting.","marker":"[10]"},{"why":"Existing secure aggregation protocol for malicious actors whose server-dominant design motivates the co-aggregation approach.","marker":"[9]"},{"why":"Shows an inference attack on federated distillation that motivates the privacy requirement.","marker":"[8]"}],"fun_headline_variants":["Clients verify server's aggregation proofs in federated distillation","Server-proof verification for heterogeneous federated distillation","Untrusted-server-safe aggregation for federated distillation","Verify-and-filter protocol thwarts poisoning in federated distillation","Co-aggregation with client-side proof checks for federated distillation"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The protocol's proof checks only the per-slice sums of each client's logits, so the integrity claim rests on the assumption that guarding these sums guards the full teacher-knowledge matrix, and it also assumes a group leader can be trusted with followers' private signing keys even though the server is malicious.","fun_headline_variants_meta":{"raw":{"variants":["Clients verify server's aggregation proofs in federated distillation","Server-proof verification for heterogeneous federated distillation","Untrusted-server-safe aggregation for federated distillation","Verify-and-filter protocol thwarts poisoning in federated distillation","Co-aggregation with client-side proof checks for federated distillation"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000192,"raw_usage":{"total_tokens":1396,"prompt_tokens":1047,"completion_tokens":349,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":663,"completion_tokens_details":{"reasoning_tokens":271}},"tokens_in":663,"tokens_out":349,"duration_ms":3577,"temperature":1.0,"reasoning_tokens":271,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T20:16:03.799676+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run SVAFD with two different logits matrices for the same group that have identical per-slice totals $V^{(k)}_z$ but different entries, using the same weights and keys, and see whether Eq. (20) accepts both; if the proof passes, the verification cannot detect tampering that preserves slice sums. A complementary check is to have a group leader use the follower keys it receives to compute $\\pi^c$ itself and to strip the blinding from $\\tilde{Y}_c$, and observe whether clients accept the leader's transcript.","supporting_citations":[{"cited_title":"Lagrange Coded Computing: Optimal Design for Resiliency, Security and Privacy,","cited_arxiv_id":null,"evidence_quote":"Supplies the Lagrange Coded Computation theorem giving D-resilience and T-privacy that MM-LCC builds on."},{"cited_title":"Analog Lagrange Coded Computing,","cited_arxiv_id":null,"evidence_quote":"Provides the analog LCC encoding scheme used for the logits shares."},{"cited_title":"Privacy- Preserving and Verifiable Outsourcing Linear Inference Computing Framework,","cited_arxiv_id":null,"evidence_quote":"Basis of the bilinear-pairing signature aggregation and verification used for the aggregation proof."},{"cited_title":"Communication-Efficient On-Device Machine Learning: Federated Dis- tillation and Augmentation under Non-IID Private Data,","cited_arxiv_id":null,"evidence_quote":"Introduces the class-grained federated distillation architecture that the protocol targets."},{"cited_title":"Fedcache: A knowledge cache-driven federated learning architecture for personalized edge intelligence,","cited_arxiv_id":null,"evidence_quote":"One of the distillation architectures on which the prototype is evaluated."},{"cited_title":"RoFL: Robustness of Secure Federated Learning,","cited_arxiv_id":null,"evidence_quote":"Existing robust verifiable secure aggregation baseline with a semi-honest server that the paper contrasts with its malicious-server setting."},{"cited_title":"ELSA: Secure Aggregation for Federated Learning with Malicious Actors,","cited_arxiv_id":null,"evidence_quote":"Existing secure aggregation protocol for malicious actors whose server-dominant design motivates the co-aggregation approach."},{"cited_title":"Breaching FedMD: Image Recovery via Paired-Logits Inversion Attack,","cited_arxiv_id":null,"evidence_quote":"Shows an inference attack on federated distillation that motivates the privacy requirement."}],"review_version":1}