{"id":"86c37dd6-eed2-4f9e-be67-52444f98bb42","arxiv_id":"2505.19823","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"A new adaptive privacy allocation and transmission power control scheme for wireless FL is proposed, with a convergence bound and MNIST/Fashion-MNIST experiments, but the DP sensitivity calibration and noise-switch condition are flawed.","lead":"This paper proposes a personalized differential privacy budget allocation method for wireless federated learning under non-IID data, plus a reinforcement-learning power control that switches from artificial to channel noise. The value for a generalist is in whether such adaptive privacy schemes can preserve model accuracy while claiming formal privacy, which the paper's own derivations call into question.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Eq. (18) understates DP sensitivity by a factor of the learning rate, and Eq. (23) enforces only a sum condition, so the claimed per-device privacy guarantee after switching to channel noise alone is not established.","rationale":"The weakest load-bearing point is the privacy calibration, because the dynamic noise-control mechanism and the convergence bound both depend on it. The reader identified the aggregate-switching condition in Eq. (23); I agree, and the sensitivity error in Eq. (18) makes that condition even more directly unsafe. The paper has useful algorithmic ideas and experiments, but simulations cannot repair a proof whose noise magnitudes are wrong. No machine-checked proof or released code is provided. Therefore the reader's REJECT verdict is unchanged.","tokens_in":19704,"tokens_out":5638,"duration_ms":63517,"concrete_test":"Recompute the switching time Tth from the per-device inequalities sigma_n0/(p_k ||h_k||) >= c Delta s_k / epsilon_k^(Tth) for all k, with Delta s_k = 2C/|D_k| (not 2 lambda C/|D_k|), using the parameters of Fig. 7. If no integer Tth <= T satisfies all K inequalities, or if Tth shifts beyond the training horizon, then stopping artificial noise at Tth does not preserve per-device DP, and the central privacy claim fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that the scheme \"provides both privacy guarantees and convergence guarantees\" rests on the noise calibration, and that calibration is not valid for the transmitted quantity. In the paper's own setup, what is transmitted and perturbed in Eq. (19) is the local gradient g_k^t, not lambda times it; Eq. (18) nonetheless reports Delta s_k = 2 lambda C / |D_k|. Even under standard per-example clipping, the sensitivity of the clipped averaged gradient is 2C/|D_k|, so the required Gaussian noise scale is too small by a factor lambda (100x for lambda=0.01). If the authors intended to transmit lambda*g instead, then Eq. (19) and Theorem 1 are written for the wrong signal. Independently, Eq. (23) decides that artificial noise can stop when the sum of channel-noise standard deviations equals the sum of required DP scales. Differential privacy is per device: each device k needs its own channel noise standard deviation sigma_n0/(p_k ||h_k||) to be at least c Delta s_k / epsilon_k^(Tth). A sum equality can hold while some devices have zero environmental noise and others have excess, leaving the zero-noise devices unprotected after round Tth. Since Eq. (24) uses the same too-small scales, the convergence bound does not describe the actual system. This invalidates the paper's headline privacy and convergence claims.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript considers a wireless federated learning (FL) system with non-IID data, a semi-honest parameter server, and per-device differential privacy. It proposes a Lightweight Adaptive Privacy Allocation (LAPA) strategy that assigns per-round, per-device privacy budgets from a PID-like gradient-progress measure and a device-contribution angle, then clips local gradients and adds Gaussian noise. A DDPG controller optimizes transmit powers and a switching round Tth after which artificial noise is stopped and only channel noise is claimed to satisfy DP. The paper also introduces Wasserstein-distance/SINR-based aggregation weights and states a convergence upper bound (Theorem 1, Eq. (24)) that is said to simultaneously provide privacy and convergence guarantees. Experiments on MNIST and Fashion-MNIST compare the proposed mechanism with several baselines.","tokens_in":19944,"tokens_out":14690,"duration_ms":167760,"significance":"If the theoretical claims were sound, the paper would make a useful contribution to wireless FL by showing that adaptive privacy budgets and channel noise can be jointly exploited without sacrificing accuracy. The aggregation-weight design and the DDPG-based power control are plausible, and the experimental comparison covers informative baselines. However, the core privacy accounting, the artificial-noise switching condition, and the convergence proof contain load-bearing errors. As written, the claimed privacy and convergence guarantees are not established, and the reported numerical results follow from the incorrect noise calibration. I do not see machine-checked proofs or released code that would independently support the derivations.","major_comments":[{"comment":"The stated sensitivity Δs_k = 2λC/|D_k| is not the sensitivity of the quantity released in Eq. (19). Eq. (19) transmits the clipped local gradient g_k^t; under per-example clipping to l2-norm C, the sensitivity of the averaged clipped gradient is 2C/|D_k|. The learning rate λ should not appear in this sensitivity unless the transmitted quantity is the learning-rate-scaled update λg_k^t, in which case Eq. (19) and Theorem 1 are written for a different signal. With λ=0.01 in Section V-A, the Gaussian noise scale calibrated after Eq. (19) is too small by a factor of λ, and this error propagates into Theorem 1 and Constraint (28b). The argmin-distance expression in Eq. (18) also does not define the l2 sensitivity of the released gradient.","section":"Section III-B, Eq. (18)"},{"comment":"The stopping rule equates sums of standard deviations over devices, but differential privacy is a per-device property. After round Tth, each device k needs its own channel-noise scale σ_n0/(p_k||h_k||) to be at least c Δs_k / ϵ_k^{Tth}. Equality of the sums can hold while some devices have channel noise far below their required scale, so those devices receive no privacy guarantee once artificial noise stops. The same sum condition is used as Constraint (28b); consequently the DDPG optimizer can satisfy the constraint while leaving individual devices unprotected. Eq. (23) and (28b) should be replaced by per-device inequalities, with Tth determined by the binding device(s).","section":"Section IV-A, Eq. (23)"},{"comment":"The convergence proof uses Δs_k^2 and the channel-noise variance terms as if these were the total per-device noise power. For a q-dimensional gradient, Gaussian mechanism noise has per-coordinate variance σ^2, so E||η_k^t||^2 = q σ^2. Thus the artificial-noise and channel-noise contributions in Eqs. (47), (48), (50), and (24) are missing the gradient-dimension factor q. The convergence upper bound and the DDPG objective in (28) therefore understate the actual noise by the model size. Unless q=1, Theorem 1 does not describe the simulated system.","section":"Appendix I and Eq. (24)"},{"comment":"The inequality E||Σ_k G_k ∇F_k(w)||^2 ≤ Σ_k G_k^2 E||∇F_k(w)||^2 is not valid. If all local gradients are equal to a common vector v and Σ_k G_k = 1, the left-hand side is ||v||^2 while the right-hand side is (Σ_k G_k^2)||v||^2, which is strictly smaller for non-degenerate weights. The valid Cauchy-Schwarz/Jensen bound gives Σ_k G_k E||∇F_k||^2, not the squared-weight version. Because this step defines A = 1 + μLλ^2δ^2Σ_k G_k^2 − 2λμ and the learning-rate condition in Eq. (27), Theorem 1's rate and the subsequent optimization are built on an invalid inequality.","section":"Appendix I, Eqs. (43)-(45)"},{"comment":"The budget schedule assumes that the Risk of Privacy Leakage decays approximately exponentially with training progress. This is a load-bearing premise imported from [33], a paper sharing the first author, and it is neither derived nor independently verified in this manuscript. Because the LAPA schedule, the switching round Tth, and the reported experiments all depend on this premise, the paper should provide direct evidence or an ablation that isolates and validates the exponential-decay assumption.","section":"Section III-B, Eq. (12)"}],"minor_comments":[{"comment":"The phrase \"with a batch size of 0.1\" is unclear; a batch size is normally an integer, and this value appears to be a typo or a shorthand for a fraction of the dataset.","section":"Section V-A"},{"comment":"The constraint is written with T before T is defined, and the text following Eq. (11) uses \"RoLP\" where \"RoPL\" is meant. Also, if e[t] is negative, exp(−e[t]) can exceed 1 and the stated sum constraint ϵ[t] ≤ ϵT is asserted but not enforced; the budget allocation should explicitly enforce nonnegative remaining budget.","section":"Section III-B, Eq. (12)"},{"comment":"Assumption A1 is written as ∥F_k(w) − F_k(w′)∥ ≤ L∥w − w′∥, which is not the standard L-smoothness condition; the inequality should involve gradients, i.e., ∥∇F_k(w) − ∇F_k(w′)∥ ≤ L∥w − w′∥.","section":"Section IV-B, Assumption A1"},{"comment":"In the strong-convexity inequality, the linear term should be (w[t+1] − w[t])^T ∇F_k(w[t]) for each local function; as written it uses ∇F(w[t]) for the global function, which is inconsistent notation.","section":"Section IV-B, Assumption A2"},{"comment":"The claim that the method works \"without transmitting any additional information beyond gradients\" is overstated: the base station must still communicate per-device privacy budgets and the switching round Tth to the devices, which is control information beyond the gradients themselves.","section":"Abstract and Section III-B"}],"recommendation":"reject","confidential_remarks":"The paper's headline privacy and convergence guarantees are not supported by the derivations, and the reported simulation numbers are affected by the incorrect sensitivity calibration. I would not preclude a future version: a corrected manuscript would need to redo the sensitivity analysis, replace the sum switching condition with per-device conditions, add the dimension factor to the convergence analysis, and re-run the experiments under the corrected accounting. The load-bearing reliance on the self-cited [33] for the exponential RoPL model should also be addressed in any revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First, the substance: the paper's contribution is a single system that combines adaptive per-device privacy budgets, channel-noise-aware power control, and data/communication-aware aggregation weights. Each piece is known, but the combination is new and the experimental comparisons against ARB and uniform DP show consistent gains on MNIST and Fashion-MNIST in non-IID settings. The writing is clear and the literature coverage is honest, including the closest work [30]. That earns real credit.\n\nThe problem is the privacy analysis. Eq. (18) reports the sensitivity of the local gradient as 2λC/|D_k|. The transmitted quantity in Eq. (19) is the clipped gradient g_k, not λ times it, and the sensitivity of the clipped-averaged gradient is 2C/|D_k|. Including the learning rate under-scales the Gaussian noise by a factor of λ — roughly 100x at λ=0.01 — so the scheme does not provide the stated DP guarantee. This is not a cosmetic slip; Theorem 1 uses the same too-small scale, so the convergence bound describes a different system. Eq. (23) is a second load-bearing issue: it decides when to stop artificial noise by equating the sum of channel-noise standard deviations to the sum of required DP scales. Differential privacy is per device; each device needs its own channel noise to meet its own budget. A sum equality can hold while some devices have no effective channel noise, leaving them unprotected. The convergence proof in the appendix also has an algebraic error: Eq. (50) starts the recursion from w[0] instead of w[Tth]. That is likely fixable, but as written it's wrong.\n\nTwo smaller gaps: the 'no additional communication overhead' claim conflicts with the need for the devices' label distributions to compute the Wasserstein aggregation weights, and the simulations omit comparison with [30], the paper they are most directly extending. I'd also like error bars on at least the main comparisons.\n\nNet: reject in its current form. The core privacy guarantee is not established, and the error is in the main mechanism, not a boundary case. But the problem is real, the integration is sensible, and with a corrected sensitivity and a per-device switching condition the paper could become a solid systems contribution. Worth a serious referee, but the referee should be told to check the DP calibration first.","headline":"A well-written integration of known DP and power-control methods for wireless FL, but the privacy analysis has a load-bearing error that under-scales the noise, so the central guarantee does not hold.","tokens_in":20536,"tokens_out":3983,"would_cite":false,"duration_ms":40171,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Under the LAPA rule, per-device privacy budgets plus ambient channel noise let wireless federated learning hit its differential privacy targets with accuracy close to the no-privacy baseline.","keywords":["federated learning","wireless communication","differential privacy","non-IID data","privacy budget allocation","transmit power optimization","deep deterministic policy gradient","convergence analysis"],"falsifier":"Compute, at the DDPG-selected transmit powers, each device's effective channel-noise standard deviation \\(\\sigma_{n_0}/(p_k\\|\\mathbf{h}_k\\|)\\) at the switching round and compare it with that device's required DP scale \\(c\\$\\Delta$ s_k/\\$epsilon_k^{{[T_{\\mathrm{th}}$}]}\\); if any device falls short, the post-switch privacy guarantee fails. A related empirical check is a per-device DP audit on a non-IID deployment in which one device has a weak channel, asking whether its gradients satisfy \\((\\epsilon,\\delta)\\)-DP after \\(T_{\\mathrm{th}}\\) without artificial noise.","tokens_in":19449,"feed_emoji":"🔒","tokens_out":10355,"duration_ms":88733,"temperature":0.7,"pith_summary":"This paper tries to strip away the usual accuracy penalty that differential privacy imposes on federated learning when the devices hold non-IID data and communicate over wireless channels. It proposes LAPA, a rule that gives each device its own privacy budget each round, sized by how close that device's gradient direction lies to the global gradient, and that requires no information beyond the gradients FL already exchanges. It then argues that because the privacy-leakage risk falls roughly exponentially as training progresses, the system can stop injecting artificial noise after a switching round and let the inherent channel noise satisfy the differential privacy requirement, with a DDPG-trained controller choosing device transmit powers to position the switch. The central support is Theorem 1, a convergence upper bound for the whole scheme, and experiments that show final accuracy close to the no-privacy baseline while the stated DP constraints are met.","feed_headline":"Differential privacy costs nearly nothing in wireless FL","feed_subtitle":"Per-device privacy budgets plus channel noise keep non-IID federated learning close to its no-privacy baseline.","key_machinery":"The central object is the LAPA allocation rule\n\\[\n\\epsilon_{k}^{[t+1]} = \\frac{f(\\tilde{\\vartheta}$_k^{{[t]}}$)}{\\sum_{k'} f(\\tilde{\\vartheta}_{k'}^{[t]})} \\$epsilon^{{[t]}}$,\n\\]\nwhere \\(\\tilde{\\vartheta}$_k^{{[t]}}$\\) is a smoothed angular deviation between device \\(k\\)'s local gradient and the global gradient and \\(f\\) is a monotone exponential mapping. That rule converts data-distribution contribution into a personalized privacy budget with no extra uplink transmission. The switching condition in Eq. (23) is the identity that does the main work: it equates the summed channel-noise standard deviations with the summed required artificial-noise scales, defining the round \\(T_{\\mathrm{th}}\\) after which environmental noise alone is declared sufficient for DP. The convergence bound in Eq. (24) is the analysis workhorse; it turns the switching decision into a transmission-power optimization problem that the DDPG controller solves.","core_discovery":"On the paper's own terms, the discovery is that the wireless channel's ambient noise can be budgeted as a privacy resource rather than treated as an impairment. Under the LAPA allocation, each device's added noise scale is set to \\(\\$sigma_k^{{(t)}}$ \\ge c \\$\\Delta$ s_k / \\$epsilon_k^{{(t)}}$\\), with \\(\\epsilon_k\\) allocated round by round from a total budget according to a smoothed angular contribution; aggregation weights are separately set by Wasserstein distance between label distributions and an SINR selection threshold. Theorem 1 then bounds the expected training loss by \\(A^T\\) times the initial suboptimality plus two additive noise terms, one from channel noise that persists all rounds and one from artificial DP noise that is active only up to switching round \\(T_{\\mathrm{th}}\\). The paper reads this bound as a simultaneous privacy and convergence guarantee, and it uses the bound as the objective for optimizing transmit power, with DDPG finding the power allocation that positions the privacy switch. The experimental section reports that LAPA reaches accuracy near the no-DP baseline on MNIST and Fashion-MNIST, and that the dynamic noise control adds further gains over fixed power settings.","pith_inferences":["A consequence the paper leaves implicit is that the privacy accounting after switching must be per device, not aggregate: Eq. (23) sums noise scales, whereas \\((\\epsilon,\\delta)\\)-DP is a per-device property, so a direct audit would check each device's effective channel noise at round \\(T_{\\mathrm{th}}\\) against its calibrated DP scale.","The observed case where LAPA's artificial noise slightly improves on the no-DP baseline under a small learning rate suggests a broader principle—calibrated noise can act as a regularizer against underfitting—but the paper only reports it as an experimental phenomenon, not a theorem.","The same switching logic could be re-evaluated online when channel statistics change mid-training, turning the one-time switch \\(T_{\\mathrm{th}}\\) into a trigger that monitors per-round channel noise; that extension is not in the paper.","The convergence bound could also be used to co-select participating devices and clipping thresholds, since both enter through \\(G_k\\) and \\(\\Delta s_k\\), as a way to further reduce the privacy noise burden."],"forward_implications":["Under assumptions A1–A4, the convergence bound in Theorem 1 holds with rate \\(A = 1 + \\mu L \\lambda^2 \\delta^2 \\sum_k G_k^2 - 2\\lambda\\mu\\), and the condition \\(A<1\\) gives the explicit learning-rate rule \\(\\lambda < 2/(L\\delta^2\\sum_k G_k^2)\\), which makes the learning rate shrink as data heterogeneity grows.","Because the LAPA budget allocation reads only gradients already exchanged, the privacy mechanism adds zero communication overhead to the FL protocol.","After the switching round \\(T_{\\mathrm{th}}\\), artificial noise is removed, so the remaining perturbation is only channel noise; this is the mechanism by which the scheme claims to keep convergence close to the no-privacy baseline.","The DDPG-based power control produces a feasible, online way to choose \\(T_{\\mathrm{th}}\\), since the switching time has no closed-form expression in terms of power.","The Wasserstein-distance aggregation weights and SINR-based device selection are claimed as independent improvements for non-IID FL, with reported accuracy gains over FedAvg and the angle-based BEDA baseline."],"supporting_citations":[{"why":"Supplies the foundational definition of differential privacy and the Gaussian mechanism that the paper's noise calibration builds on.","marker":"[20]"},{"why":"Supplies the DP-FL convergence analysis and upload-phase privacy accounting that Theorem 1 extends to heterogeneous wireless settings.","marker":"[23]"},{"why":"Provides the ARB benchmark, an adaptive but device-agnostic privacy budget allocation that LAPA personalizes.","marker":"[27]"},{"why":"Provides the prior joint DP-noise and power-control balance that this paper extends to non-IID data and dynamic switching.","marker":"[30]"},{"why":"Supplies the relaxed (epsilon,delta)-DP notion used in the paper's privacy definition and composition.","marker":"[31]"},{"why":"Is the citation for the formal (epsilon,delta)-DP definition in Definition 1.","marker":"[32]"},{"why":"Is the predecessor adaptive privacy allocation with the nearly exponential risk-of-privacy-leakage trend; LAPA removes its extra test-information overhead.","marker":"[33]"},{"why":"Is the BEDA baseline for angle-based dynamic aggregation weights that the proposed Wasserstein and SINR weighting is compared against.","marker":"[36]"},{"why":"Supplies the uniform-noise DP baseline and the Gaussian noise mechanism used in the experiments.","marker":"[37]"}],"fun_headline_variants":["Wireless FL gets near-free privacy via adaptive noise","LAPA turns channel noise into privacy budget for FL","Adaptive privacy allocation keeps FL accurate in non-IID","DDPG aligns noise to make DP nearly costless in FL"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that after the switching round, the channel noise alone—not just its sum across devices—meets each device's differential privacy requirement; if Eq. (23) holds only in aggregate, stopping artificial noise can leave individual devices with weaker protection than their allocated budget.","fun_headline_variants_meta":{"raw":{"variants":["Wireless FL gets near-free privacy via adaptive noise","LAPA turns channel noise into privacy budget for FL","Adaptive privacy allocation keeps FL accurate in non-IID","DDPG aligns noise to make DP nearly costless in FL"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000215,"raw_usage":{"total_tokens":1458,"prompt_tokens":1002,"completion_tokens":456,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":618,"completion_tokens_details":{"reasoning_tokens":389}},"tokens_in":618,"tokens_out":456,"duration_ms":4508,"temperature":1.0,"reasoning_tokens":389,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T14:05:09.856390+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute, at the DDPG-selected transmit powers, each device's effective channel-noise standard deviation \\(\\sigma_{n_0}/(p_k\\|\\mathbf{h}_k\\|)\\) at the switching round and compare it with that device's required DP scale \\(c\\$\\Delta$ s_k/\\$epsilon_k^{{[T_{\\mathrm{th}}$}]}\\); if any device falls short, the post-switch privacy guarantee fails. A related empirical check is a per-device DP audit on a non-IID deployment in which one device has a weak channel, asking whether its gradients satisfy \\((\\epsilon,\\delta)\\)-DP after \\(T_{\\mathrm{th}}\\) without artificial noise.","supporting_citations":[{"cited_title":"Federated learning with differential privacy: Algorithms and performance analysis,","cited_arxiv_id":null,"evidence_quote":"Supplies the DP-FL convergence analysis and upload-phase privacy accounting that Theorem 1 extends to heterogeneous wireless settings."},{"cited_title":"Privacy-preserving asynchronous grouped federated learning for iot,","cited_arxiv_id":null,"evidence_quote":"Provides the ARB benchmark, an adaptive but device-agnostic privacy budget allocation that LAPA personalizes."},{"cited_title":"Time-varying noise perturbation and power control for differential-privacy-preserving wireless federated learning,","cited_arxiv_id":null,"evidence_quote":"Provides the prior joint DP-noise and power-control balance that this paper extends to non-IID data and dynamic switching."},{"cited_title":"Our data, ourselves: Privacy via distributed noise generation,","cited_arxiv_id":null,"evidence_quote":"Supplies the relaxed (epsilon,delta)-DP notion used in the paper's privacy definition and composition."},{"cited_title":"Local differential private data aggregation for discrete distribution estimation,","cited_arxiv_id":null,"evidence_quote":"Is the citation for the formal (epsilon,delta)-DP definition in Definition 1."},{"cited_title":"Shield against gradient leakage attacks: Adaptive privacy-preserving federated learning,","cited_arxiv_id":null,"evidence_quote":"Is the predecessor adaptive privacy allocation with the nearly exponential risk-of-privacy-leakage trend; LAPA removes its extra test-information overhead."},{"cited_title":"Fast-convergent federated learning with adaptive weighting,","cited_arxiv_id":null,"evidence_quote":"Is the BEDA baseline for angle-based dynamic aggregation weights that the proposed Wasserstein and SINR weighting is compared against."},{"cited_title":"Deep learning with differential privacy,","cited_arxiv_id":null,"evidence_quote":"Supplies the uniform-noise DP baseline and the Gaussian noise mechanism used in the experiments."}],"review_version":1}