{"id":"2a0016e6-713f-4381-91ed-873a31fc60ec","arxiv_id":"2506.12749","paper_version":2,"verdict":"REJECT","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"A bit-flipping mechanism for wireless federated learning claims Rényi differential privacy from channel noise, but the proof uses an expected bit-level distance rather than a worst-case sensitivity, leaving the guarantee unproven.","lead":"Federated learning over wireless links could get privacy protection from random channel errors if model numbers are sent in a bit format where bit flips do not wreck the model. The authors propose such a mechanism, but their differential privacy proof relies on an average-case distance instead of the worst-case distance that the definition requires.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 1's privacy bound uses an expected, data-dependent bit-level distance rather than a worst-case sensitivity, so the claimed (λ,ε)-Rényi DP guarantee is not established for all adjacent datasets.","rationale":"The reader's weakest_assumption identifies the same load-bearing flaw: the privacy analysis substitutes an expected bit-level distance for the worst-case sensitivity required by Definition 1. I agree with that assessment. The proof of Theorem 1 in Appendix B models each bit as differing with probability q_k and then uses κ̄ = Σ 2^{(k mod 23)-23} q_k as the sensitivity; this is an average over encoding randomness and over sampled parameter differences, not a bound that holds for every adjacent pair. The empirical estimation in Sec. VII-A reinforces the concern: κ̄ is fitted from finite samples, so a new adjacent pair can have a larger weighted Hamming distance. No formal verification or code is provided, and the convergence analysis in Theorem 2 does not repair the privacy guarantee. The positive elements—the fixed-point conversion idea, Lemma 1's mean/variance statistics, and the convergence bound—are plausible but do not establish the paper's advertised contribution of free worst-case privacy. Since my concern coincides with the reader's, the verdict remains REJECT with no adjustment.","tokens_in":27099,"tokens_out":8768,"duration_ms":112625,"concrete_test":"Recompute Theorem 1 using κ_max = max_{ω∈W, x∈X, ||x||_2=Δω_max} κ(ω, ω+x) over the same 10,000-sample grid used for Eq. (26) instead of the empirical average κ̄. If the corresponding required end-to-end BER exceeds the value used in Sec. VII-B, or if an explicit adjacent pair—e.g., two fixed-point fraction parts u_m = 0.0111...1 and u'_m = 0.1000...0 with the same sign/exponent after the shift, differing by less than Δω_max in that coordinate—yields an exact Rényi divergence D_λ under the reported p_t,n that is larger than ε/K, then Theorem 1's guarantee fails for a valid adjacent dataset pair.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is Theorem 1: the bit-flipping mechanism satisfies (λ,ε)-Rényi DP whenever p_t,n is at least the threshold in Eq. (38). The proof in Appendix B upper-bounds the per-bit Rényi divergence by a quantity linear in q_k, then sums to the expected bit-level distance κ̄_{Δω_max,n} defined in Eq. (15) and (16). But κ̄ is an expectation over a continuum of parameter differences and is then estimated empirically in Sec. VII-A by averaging over 10,000 samples from the sphere ||x||_2 = Δω_max. Definition 1 requires the divergence bound to hold for every adjacent pair D_n and D'_n, not on average over sampled parameter differences. A pair whose encoded fraction bits differ in the most significant position (weight 2^{-1}) contributes κ = 0.5 for that coordinate, which can exceed the reported κ̄ = 0.02 by more than an order of magnitude while still respecting Δω_max; for that pair the selected p_t,n does not enforce D_λ ≤ ε. The paper's Remark 1 states that using the maximum bit-level distance 'may overestimate the privacy risk' and impair utility, but for a formal DP guarantee this reasoning is inverted: an average under-estimates sensitivity. The mechanism therefore has no proven worst-case privacy budget, and the 'free privacy' guarantee is the unproven part of the central claim.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a channel-native bit-flipping differential privacy (DP) mechanism for wireless federated learning (WFL). The authors design a floating-point-to-fixed-point conversion that transmits only the fraction bits of model parameters, thereby avoiding catastrophic sign/exponent bit errors. Privacy is provided by a combination of deliberate bit flips at the transmitter and inherent communication-noise bit errors. The central claim is Theorem 1: the mechanism satisfies (λ, ε)-Rényi DP when the end-to-end bit error rate p_{t,n} is at least a threshold that depends on a newly introduced 'expected bit-level distance' κ̄_{Δω_max,n}. The paper also provides a convergence analysis (Theorem 2) and experiments on F-MNIST and Fed-CIFAR100 showing that the proposed mechanism outperforms channel-agnostic Gaussian mechanisms.","tokens_in":27436,"tokens_out":5139,"duration_ms":62269,"significance":"If valid, the paper would make a notable contribution by showing that inherent wireless channel noise can be harnessed for DP in digital WFL, and the fixed-point conversion avoiding sign/exponent corruption is a useful engineering idea. The convergence analysis is a value-added component, and the experimental comparison is reasonably thorough. However, the central privacy claim is not established: the proof of Theorem 1 replaces the worst-case sensitivity required by Definition 1 with an expectation over sampled parameter differences, which is a load-bearing error that invalidates the main technical contribution.","major_comments":[{"comment":"Theorem 1 uses the expected bit-level distance κ̄_{Δω_max,n} (Eq. (15)) as the sensitivity in the Rényi divergence bound, but Definition 1 requires the divergence bound to hold for every pair of adjacent datasets D_n and D'_n. The proof in Appendix B upper-bounds the per-bit divergence by a term linear in q_k and then sums to κ̄; this is an average over model-parameter differences sampled from the sphere ‖x‖_2 = Δω_max (Eq. (16), Sec. VII-A). For a pair of adjacent datasets whose encoded bitstreams differ in the most significant fraction bit, the per-bit contribution is 2^{-1}, which can exceed the reported κ̄ = 0.02 by an order of magnitude. For such a pair, the chosen p_{t,n} from Eq. (38) does not enforce D_λ ≤ ε, so the claimed (λ, ε)-Rényi DP guarantee does not hold for all adjacent datasets.","section":"Section V-B, Theorem 1 and Appendix B"},{"comment":"The privacy parameter p_{t,n} in Eq. (38) is a function of κ̄_{Δω_max,n}, which is itself estimated from 10,000 samples of the device's own model parameters (Sec. VII-A, Eq. (26)). This makes the privacy budget data-dependent: the mechanism's claimed ε depends on an empirical estimate of a quantity derived from the very data the mechanism is supposed to protect. A standard (λ, ε)-Rényi DP guarantee under Definition 1 requires the mechanism's parameters to be fixed independent of the dataset, or at least to be a certified upper bound; an empirical average does not satisfy this requirement.","section":"Section V-A and Section VII-A"},{"comment":"The key inequality (36), which the proof uses to upper-bound the Rényi divergence, is stated to hold under conditions 0 < q_k < 1, 0 < p < 0.5, λ > 1 and is described as 'verified numerically' rather than proved. A numerically verified inequality is not a rigorous proof step, and the theorem's privacy claim depends directly on this inequality. Without a proof (or a counterexample analysis), the derivation of (37) and hence (38) is incomplete.","section":"Appendix B, Inequality (36)"},{"comment":"The definition of κ̄_{Δω_max,n} relies on a probability q_k that a bit's difference attains its maximum value due to 'inherent randomness' such as dropout and random seeds. However, differential privacy requires a worst-case guarantee over adjacent datasets, not an average over model-training randomness. The 'expected bit-level distance' is therefore not a valid sensitivity: a specific adjacent pair may have a bit-level distance much larger than the expectation, and the Rényi divergence between the mechanism's outputs for that pair can exceed the bound computed from κ̄. Remark 1 even states that using the maximum bit-level distance 'may overestimate the privacy risk,' which inverts the requirement for a DP upper bound: an upper bound must be a worst case, not an average.","section":"Section V-A, Eq. (15)-(16)"}],"minor_comments":[{"comment":"The mechanism M_BF in Definition 2 is written as a function of κ̄_{Δω_max,n}, λ, and ε, but the actual operation of the mechanism only depends on u(D) and the bit-flipping probability p. Including κ̄, λ, and ε as arguments is confusing, since they only serve to select p.","section":"Definition 2"},{"comment":"The sentence 'The nominator on the right-hand side (RHS) of (16) gives the volume of R' should say the denominator gives the volume and the numerator gives the integral of κ over R; the reciprocal of the denominator is the probability density.","section":"Section V-A, text after Eq. (16)"},{"comment":"Remark 1's statement that using the maximum bit-level distance 'may overestimate the privacy risk' is at odds with the standard definition of sensitivity, where an upper bound must hold for all adjacent pairs. The manuscript should clarify that for a formal DP guarantee, taking the maximum is the correct conservative choice.","section":"Remark 1"},{"comment":"The experiments set the communication BER p_{t,n,C} to be uniformly random in [0, 0.02], but the theoretical analysis assumes a fixed p_{t,n,C} per round. The paper should specify whether the end-to-end BER p_{t,n} is computed from the realized BER or from an average, as this affects the validity of the comparisons.","section":"Section VII-B, default settings"}],"recommendation":"reject","confidential_remarks":"The paper has a central technical flaw: the claimed Rényi DP guarantee replaces the required worst-case sensitivity with an empirically estimated expectation. This is not a minor issue but a fundamental invalidation of the main theorem, and the additional reliance on a numerically verified inequality further reduces confidence. Even if the engineering idea of transmitting only fraction bits is interesting, the privacy contribution is not sound enough for publication in a serious journal."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's the short version. The fixed-point encoding idea is genuinely useful, but the paper's central claim—that wireless channel noise plus deliberate bit flips gives formal (λ,ε)-Rényi DP for free—doesn't hold up against Definition 1. The proof of Theorem 1 uses the expected bit-level distance κ̄ as if it were a worst-case sensitivity, and the mixture argument in Appendix B isn't a valid DP step.\n\nWhat's new and good: the floating-point-to-fixed-point conversion that transmits only the fraction bits is clean and practical. It avoids the sign/exponent catastrophe and reduces traffic by 28%. The convergence analysis is standard FedAvg machinery under full-batch assumptions and looks plausible. The experiments show the mechanism trains successfully on two datasets, though they don't validate the privacy claim.\n\nThe soft spot is central. Definition 1 requires a bound for every adjacent pair. κ̄ is defined in (16) as an average over parameter differences, then estimated in Sec. VII-A from 10,000 samples. A pair whose encoded fraction bits differ in the most significant position contributes about 0.5 to the bit-level distance for that coordinate, which is 25 times the reported κ̄=0.02; for that pair the chosen p from (38) does not enforce ε. Remark 1 gets the logic backwards: for a formal DP guarantee, the maximum is the safe choice; an expectation underestimates sensitivity. There's also a deeper issue in Appendix B: the proof couples u(D) and u(D') so each bit either matches or is a fixed 'maximally different' bit with probabilities 1-q_k and q_k. That coupling is never established, and the Rényi divergence between the marginal output distributions is not bounded by the expected bit-level distance under some arbitrary coupling. So the privacy theorem is unproven. Minor: no code/data, no error bars, and the convergence proof assumes full-batch while experiments use SGD.\n\nWho this is for: wireless FL researchers interested in bit-level exploitation of channel noise. The engineering idea is reusable and could be part of a publishable system paper if the privacy analysis is replaced with a worst-case bit-level sensitivity or framed as per-instance DP. I would send it to a referee who knows Rényi DP—the failure is subtle enough to deserve expert review, and the fixed-point conversion deserves another chance. But as is, I wouldn't cite the privacy claim.\n\nRecommendation: send to peer review with the expectation of major revision; likely outcome is rejection unless the central DP analysis is reworked.","headline":"The fixed-point encoding is a real idea, but Theorem 1's DP proof uses an expected bit-level distance instead of a worst-case sensitivity, so the 'free privacy' claim is not established.","tokens_in":27975,"tokens_out":7717,"would_cite":false,"duration_ms":93229,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Random bit flips, deliberate and channel-induced, can certify Rényi differential privacy for wireless federated learning when only fraction bits are transmitted.","keywords":["wireless federated learning","Rényi differential privacy","bit-flipping mechanism","channel noise as privacy","IEEE 754 floating-point conversion","bit-level distance","convergence analysis","digital communication"],"falsifier":"Enumerate or randomly search pairs of adjacent datasets whose local-model difference lies on the sphere $\\|x\\|_2=\\Delta\\omega_{\\max,n}$, compute the exact bit-level distance of their fraction-bit encodings, and record the maximum rather than the average. Feed the worst-case pair through the bit-flipping mechanism at the BER set by Theorem 1 and numerically evaluate the order-$\\lambda$ Rényi divergence; a divergence above $\\epsilon/K$ would refute the privacy claim.","tokens_in":26817,"feed_emoji":"🔒","tokens_out":12967,"duration_ms":130814,"temperature":0.7,"pith_summary":"Wireless federated learning usually treats channel errors as a nuisance: bit flips in IEEE 754 floating-point numbers can corrupt sign or exponent bits catastrophically, so systems retransmit or discard packets. This paper argues the opposite: the same noise, if shaped correctly, can be the privacy mechanism itself. The paper proposes a channel-native bit-flipping DP mechanism that converts each model parameter from floating-point to a fixed-point form, transmits only the fraction bits, and lets random flips—both deliberate and channel-induced—obfuscate the model. It proves that, with an end-to-end bit-error rate above a threshold tied to an expected bit-level distance, the mechanism satisfies $(\\lambda,\\epsilon)$-Rényi differential privacy, and it bounds the resulting convergence penalty. If correct, WFL gains formal privacy protection without paying the utility cost of additive Gaussian noise, and noisy channels become a resource rather than a failure.","feed_headline":"Bit errors can become a formal privacy guarantee in wireless learning","feed_subtitle":"A fixed-point encoding sends only fraction bits, letting channel flips certify Rényi DP without Gaussian noise.","key_machinery":"The load-bearing object is the pair consisting of the fixed-point conversion (7) and the expected bit-level distance (15)-(16). The conversion encodes each model parameter $\\omega_{t,n}$ as a fixed-point number by adding the constant $3\\times 2^{(c_{30}\\cdots c_{23})_2-126}$ derived from the public norm bound $\\nu_\\infty$; this makes all elements share the same positive sign and exponent, so only the 23 fraction bits of each parameter enter the transmitted bitstream. The expected bit-level distance $\\bar{\\kappa}_{\\Delta\\omega_{\\max,n}}$ is the sum over all transmitted bits of their binary weights $2^{(k\\bmod 23)-23}$ times the probability $q_k$ that the bit differs between two adjacent-dataset encodings, averaged over the sphere $\\|x\\|_2=\\Delta\\omega_{\\max,n}$. This quantity plays the role of sensitivity in the Rényi-divergence bound: Theorem 1 converts it into a required end-to-end BER, and the same expected distance, together with the variance of Lemma 1, feeds the convergence-bias bound in Theorem 2.","core_discovery":"The paper's central claim is that bit-level perturbation can be a rigorous privacy mechanism for digital WFL. Theorem 1 states that applying the bit-flipping mechanism $M_{\\mathrm{BF}}(u(D_n), p_{t,n})$ for $K$ communication rounds satisfies $(\\lambda,\\epsilon)$-Rényi DP whenever the end-to-end bit-error rate satisfies $p_{t,n} \\geq \\left[1+\\left(\\frac{(\\lambda-1)\\epsilon}{K \\bar{\\kappa}_{\\Delta\\omega_{\\max,n}}}\\right)^{1/(\\lambda-1)}\\right]^{-1}$. The argument rests on a new floating-point-to-fixed-point conversion: every parameter is shifted by a public constant derived from the $\\ell_\\infty$-norm bound $\\nu_\\infty$, so all parameters share one sign and exponent, and only the 23 fraction bits per dimension need be transmitted. Because sign and exponent bits are never sent, the catastrophic failure mode of IEEE 754 transmission disappears, and random flips in the fraction bits become the noise source of a DP mechanism. Bit-level sensitivity is measured by the expected bit-level distance $\\bar{\\kappa}_{\\Delta\\omega_{\\max,n}}$, the average Hamming weight of the difference between the encoded bitstreams of two models separated by the classical sensitivity $\\Delta\\omega_{\\max,n}$. The paper also proves (Theorem 2) that the induced bias has bounded variance and that the FedAvg-style convergence bound reduces to the standard no-privacy bound as the bit-error rate goes to zero.","pith_inferences":["(Editorial inference) Because the mechanism is a weighted randomized response on bits, the per-bit weights $2^{(k\\bmod 23)-23}$ are what let it outperform uniform bit-flipping; a uniform randomized-response version would need a much higher BER to hit the same $\\epsilon$, which is a testable prediction.","(Editorial inference) An adaptive transmitter could treat the Theorem 1 BER threshold as a control target: choosing modulation order, coding rate, or transmit power to sit exactly at the threshold turns the channel's instantaneous state into a privacy-budget actuator.","(Editorial inference) The guarantee is composition-based, so running fewer than $K$ rounds, early stopping, or dropping clients yields a realized privacy level stronger than the target rather than a violation of the promised $\\epsilon$."],"forward_implications":["Digital WFL with a known channel BER can meet a target $(\\lambda,\\epsilon)$-Rényi DP budget without injecting Gaussian noise into the model; the channel flips supply the obfuscation.","The same privacy budget is spread over $K$ rounds, so longer training lowers the per-round BER required by Theorem 1, inversely through $K$.","The conversion cuts per-parameter transmissions from 32 to 23 bits and removes the risk of sign/exponent corruption, so retransmission or dropping of erroneous models is no longer the only safe option.","When the channel alone is too clean, the client adds artificial flips at probability $p_{t,n,A}$ chosen from the end-to-end BER relation, so privacy holds for any channel condition, including error-free ones.","The convergence bound in Theorem 2 shows the utility penalty is governed by the maximum end-to-end BER $p_{\\max}$ and the bit-level bias term; as $p_{\\max}\\to 0$ and $X_{\\mathrm{BF}}\\to 0$, the bound collapses to the standard FedAvg bound with no privacy noise."],"supporting_citations":[{"why":"defines $(\\lambda,\\epsilon)$-Rényi DP and supplies the composition rule used to extend the per-round guarantee over $K$ rounds.","marker":"[8]"},{"why":"establishes the analog over-the-air baseline that already exploits channel noise for privacy; the present mechanism is its digital-system counterpart.","marker":"[13]"},{"why":"provides the channel-agnostic Gaussian DP FL baseline against which the proposed mechanism is benchmarked.","marker":"[14]"},{"why":"specifies the IEEE 754 binary32 format, whose sign, exponent, and fraction bits the conversion re-encodes.","marker":"[21]"},{"why":"supplies the BPSK/QPSK bit-error probability model used to set the communication error rate.","marker":"[35]"},{"why":"gives the Gaussian mechanism's noise-scale formula used to compare against the proposed scheme.","marker":"[36]"},{"why":"supplies the FedAvg convergence bound under non-IID data that Theorem 2 extends to bit-flipping noise.","marker":"[41]"},{"why":"gives the Rényi-to-$(\\epsilon,\\delta)$ conversion used to equalize privacy budgets with the Gaussian baselines.","marker":"[43]"}],"fun_headline_variants":["Bit flips give wireless federated learning free privacy","Channel errors become a certified privacy mechanism for WFL","Fixed-point encoding lets bit errors guarantee Rényi DP","No Gaussian noise: bit-level perturbation certifies DP in WFL","Inherent noise now a formal privacy tool for wireless learning"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The privacy proof leans on one load-bearing premise: the expected bit-level distance $\\bar{\\kappa}_{\\Delta\\omega_{\\max,n}}$, estimated by averaging over randomly sampled parameter differences on the sphere of radius the classical sensitivity, is treated as an upper bound on the bit-level sensitivity for every adjacent dataset pair; if any pair's encoded bitstreams differ more than that average, the claimed $\\epsilon$ is exceeded.","fun_headline_variants_meta":{"raw":{"variants":["Bit flips give wireless federated learning free privacy","Channel errors become a certified privacy mechanism for WFL","Fixed-point encoding lets bit errors guarantee Rényi DP","No Gaussian noise: bit-level perturbation certifies DP in WFL","Inherent noise now a formal privacy tool for wireless learning"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000217,"raw_usage":{"total_tokens":1511,"prompt_tokens":1098,"completion_tokens":413,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":714,"completion_tokens_details":{"reasoning_tokens":332}},"tokens_in":714,"tokens_out":413,"duration_ms":5321,"temperature":1.0,"reasoning_tokens":332,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T00:44:27.795810+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Enumerate or randomly search pairs of adjacent datasets whose local-model difference lies on the sphere $\\|x\\|_2=\\Delta\\omega_{\\max,n}$, compute the exact bit-level distance of their fraction-bit encodings, and record the maximum rather than the average. Feed the worst-case pair through the bit-flipping mechanism at the BER set by Theorem 1 and numerically evaluate the order-$\\lambda$ Rényi divergence; a divergence above $\\epsilon/K$ would refute the privacy claim.","supporting_citations":[{"cited_title":"Rényi differential privacy,","cited_arxiv_id":null,"evidence_quote":"defines $(\\lambda,\\epsilon)$-Rényi DP and supplies the composition rule used to extend the per-round guarantee over $K$ rounds."},{"cited_title":"Privacy for free: Wireless federated learning via uncoded transmission with adaptive power control,","cited_arxiv_id":null,"evidence_quote":"establishes the analog over-the-air baseline that already exploits channel noise for privacy; the present mechanism is its digital-system counterpart."},{"cited_title":"Federated learning with differential privacy: Algorithms and performance analysis,","cited_arxiv_id":null,"evidence_quote":"provides the channel-agnostic Gaussian DP FL baseline against which the proposed mechanism is benchmarked."},{"cited_title":"On the convergence of fedavg on Non-IID data,","cited_arxiv_id":null,"evidence_quote":"supplies the FedAvg convergence bound under non-IID data that Theorem 2 extends to bit-flipping noise."}],"review_version":1}