{"id":"3361918e-3c9b-45d1-8e9a-78fabe7eba85","arxiv_id":"2506.13561","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":2,"one_line_summary":"ByITFL and LoByITFL are Byzantine-resilient federated learning schemes that claim perfect information-theoretic privacy using a polynomial discriminator and secret sharing, but the privacy proof has a gap around per-user norm validation.","lead":"This paper proposes two federated learning protocols, ByITFL and LoByITFL, that aim to keep user data perfectly private from eavesdroppers while still defending the model against malicious users who send corrupted updates. The methods use a small public dataset at the server and a polynomial trust score to filter bad updates, at the cost of heavy communication or a one-time trusted setup.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Normalization validation leaks each user's exact quantized squared norm, a direction-dependent statistic; the proof's boundedness assertion does not establish independence, so Eq. (2) is unsupported.","rationale":"The reader's weakest_assumption is exactly the load-bearing concern, and I agree with it. The central novelty of the paper is perfect information-theoretic privacy as formalized in Eq. (2). The proof of privacy must show that every message in M_0 is independent of u_H given the listed conditioning. For the normalization-validation messages, the proof only asserts that the decoded squared norm lies in a range, which is insufficient. The explicit example with d=2, q=2 shows the decoded value is not constant and varies with the direction of the honest update. Since the federator is honest-but-curious and receives this exact per-user value, this is a genuine information leak unless nu or another conditioned variable determines the direction, which it does not in general. The same issue affects both ByITFL and LoByITFL. Secondary concerns, such as the unproven transfer of FLTrust convergence to the hand-tuned degree-3 polynomial and the post-hoc algorithm change for Fang's attack on Krum, reinforce the overall verdict but are not needed to reject. The reader's REJECT verdict remains appropriate, so no adjustment is required.","tokens_in":22456,"tokens_out":20750,"duration_ms":231087,"concrete_test":"Enumerate the stochastic quantizer for a minimal privacy instance. Fix d=2, q=2, and compare the two honest normalized updates \\tilde u_a=(1,0) and \\tilde u_b=(1/sqrt(2),1/sqrt(2)). Compute the distribution of the decoded ||\\bar u||^2: for \\tilde u_a it is the point mass at 4; for \\tilde u_b it is {2,5,8} with probabilities {p^2, 2p(1-p), (1-p)^2}, p=sqrt(2)-1. Because Step C sends this exact decoded value to the federator, the transcripts are distinguishable. Then check the conditional version needed for Eq. (2): choose an auxiliary user or an additional coordinate so that the two directions yield the same value of nu and all other conditioned quantities; if the conditional distributions of ||\\bar u||^2 still differ, Eq. (2) is contradicted. This finite computation settles that the proof's assertion cannot be repaired by boundedness.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing defect is in Step C (Sections IV-C and V-C) and its treatment in Appendix A. The federator reconstructs the exact value ||\\bar u_j||_2^2 for every user j, not a pass/fail bit. The privacy proof dismisses this value because it lies within a certain range for all possible model updates, ideally equivalent to one. Boundedness does not imply zero mutual information. Under the entrywise stochastic quantizer Q_q, ||\\bar u_j||_2^2 is direction-dependent: for d=2, q=2, the normalized update (1,0) gives ||\\bar u||^2=4 with probability 1, while (1/sqrt(2),1/sqrt(2)) gives 2, 5, or 8 with probabilities p^2, 2p(1-p), (1-p)^2, where p=sqrt(2)-1. For m>1 the federator can additionally recover per-subvector squared norms. These exact per-user statistics are part of M_0 and are not functions of the conditioning tuple (u_T,u_0,D_T,D_0,w,nu). The same leak appears in LoByITFL, whose Step C also sends {||\\bar u_j||_2^2[i]} to the federator. Thus the zero-mutual-information claim of Theorems 1(1) and 2(1) is not established and fails for natural update distributions.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes two federated learning protocols, ByITFL and LoByITFL, that combine FLTrust-style Byzantine resilience with information-theoretic (IT) privacy via threshold secret sharing, Lagrange coded computing, Beaver triples, and a polynomial discriminator that replaces the ReLU used in FLTrust. The main theorems state that both schemes guarantee IT privacy against any t colluding users and an honest-but-curious federator, Byzantine resilience against b users, dropout tolerance, and convergence, with complexity analyses and experiments on MNIST, Fashion-MNIST, and CIFAR-10 under several attacks.","tokens_in":22741,"tokens_out":5595,"duration_ms":53581,"significance":"If the claimed guarantees held, the schemes would represent a notable advance as the first Byzantine-resilient federated learning protocols with perfect IT privacy under bounded collusion and dropout. The paper provides explicit protocol descriptions, complexity analyses, and an experimental comparison against FLTrust across multiple attacks. However, the central privacy proof has a load-bearing gap: the normalization-validation step reveals each user's exact quantized squared norm to the federator, and the proof does not establish that this statistic is independent of the honest users' updates. In addition, the Byzantine-resilience and convergence guarantees are transferred from FLTrust without a derivation for the degree-3 polynomial discriminator and the quantization/normalization steps. These gaps undermine the main theorems, so the contribution as stated is not established.","major_comments":[{"comment":"The federator reconstructs each user's quantized squared norm ||\\bar u_j||_2^2 during the normalization validation. The proof in Appendix A dismisses this value because it 'lies within a certain range for all possible model updates (ideally equivalent to one)', but boundedness does not imply zero mutual information with u_H. Under the element-wise stochastic quantizer Q_q, ||\\bar u_j||_2^2 depends on the direction of \\bar u_j: for d=2, q=2, the normalized update (1,0) yields ||\\bar u||^2=4 with probability 1, while (1/√2,1/√2) yields 2, 5, or 8 with nonzero probabilities. This exact per-user statistic is part of M_0 and is not a function of the conditioning tuple (u_T,u_0,D_T,D_0,w,ν). The same leak occurs in LoByITFL at Step C (Section V-C). Consequently, the zero-mutual-information claim in Eq. (2) and Theorems 1(1) and 2(1) are not established.","section":"Section IV-C and Appendix A, item (a) on M_0"},{"comment":"The Byzantine resilience guarantee is asserted by referring to FLTrust [13], but FLTrust's analysis applies to the ReLU discriminator. The paper replaces ReLU with the degree-3 polynomial h(x)=0.46897526x^3+0.56578977x^2+0.1860353x+0.01363545, which takes negative values for negative x (e.g., h(-1)≈-0.0756), unlike ReLU. No proof is given that the trust-score properties needed for FLTrust's convergence and robustness analysis hold for this polynomial or under the added quantization and normalization steps. Theorem 3 states that the proof 'follows the same steps as the proofs in Appendix A of [13]' without verifying that the assumptions in [13, Assumptions 1, 2 and 3] are satisfied by the modified aggregation rule. This is a load-bearing gap in Theorems 1(2), 2(2), and 3.","section":"Appendix A.2 and Section VI-A"}],"minor_comments":[{"comment":"The text writes '{||\\bar u_j||_2^2[i]} ∈ F^d_p', but the squared norm is a scalar; it should be an element of F_p, not F^d_p.","section":"Section V-C"},{"comment":"The validation threshold ε is set to 0.02 without a sensitivity analysis; since the privacy proof treats the normalized norm as 'ideally one', the role of this threshold in the privacy argument should be made explicit.","section":"Section VI-B"},{"comment":"The paper claims to be the 'first Byzantine-resilient FL scheme with perfect IT privacy', but the relationship to the authors' prior works [1] and [2] should be clarified, as those papers appear to present earlier versions of the same schemes.","section":"Abstract and Introduction"},{"comment":"The coefficients of the degree-3 polynomial are given with high precision, but no rationale is provided for these specific values beyond a qualitative shape; a justification or a sensitivity study would help.","section":"Section VI-A"},{"comment":"The footnote marker is '⋆' in the table but '*' in the surrounding text; use one symbol consistently.","section":"Table III"}],"recommendation":"reject","confidential_remarks":"The privacy gap is fundamental to the protocol design: the validation step sends a user-specific statistic to the federator, and the proof does not show independence, so the central IT-privacy claim fails as written. The convergence and resilience guarantees are also borrowed from FLTrust without the necessary verification for the polynomial discriminator. This is not a minor-revision issue. The paper also builds heavily on the authors' prior papers [1,2], so the novelty statement should be checked carefully. No code is provided to support the experimental reproducibility claim."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague—\n\nThe headline is that the paper's central claim—perfect information-theoretic privacy for the two schemes—does not survive reading the appendix. The normalization-validation step (Step C) sends each user's exact quantized squared norm ||\\bar u_j||_2^2 to the federator, and the privacy proof dismisses this as lying in a fixed range. Boundedness is not independence. The quantizer Q_q makes the squared norm direction-dependent: for d=2, q=2, an update at (1,0) yields 4 with probability 1, while (1/√2, 1/√2) yields 2, 5, or 8 with different probabilities. So the federator learns a per-user statistic that is not determined by the conditioning tuple in Eq. (2). The mutual information is not zero in general. LoByITFL has the same leak. This is not a minor gap; it invalidates Theorems 1(1) and 2(1) as stated.\n\nWhat the paper does well: it unifies the earlier ITW and FL-AsiaCCS schemes into a single framework, adds a degree-3 polynomial discriminator to avoid ReLU, and runs a broad set of attacks on MNIST/Fashion-MNIST/CIFAR-10 with up to 25% Byzantine users. The communication and computation tables are useful, and the designs are thoughtful—LCC, ITVSS, Beaver triples, one-time MACs are combined in a non-trivial way. The convergence proof, though, leans on FLTrust's ReLU-based analysis and never shows the hand-chosen polynomial has the properties that FLTrust's ReLU guaranteed. Lemma 1 is a very loose bound that ignores the discriminator's shape entirely. The experiments also needed a post-hoc modification to handle Fang's attack on Krum (skip Eq. (6) and use ν directly), which is honestly reported but suggests the robustness story is shakier than the theorems imply.\n\nNovelty is modest beyond the authors' own prior papers, but the unified treatment is a legitimate extension. The citation pattern is not problematic: citing one's own conference versions and FLTrust is reasonable; the problem is relying on FLTrust's proof without the needed derivation.\n\nBottom line: this is a plausible design direction, and the paper should get a serious referee, not a desk reject—the flaw is specific and potentially fixable. But as submitted, the main theorems overclaim. I'd recommend major revision with a demand that the authors either prove independence of the squared-norm statistic (which I doubt) or change the protocol to hide it, e.g., by a secure comparison that reveals only a pass/fail bit.","headline":"The paper's central claim of perfect IT privacy is not proven: the normalization-validation step leaks each user's exact quantized squared norm, a direction-dependent statistic, and the proof's boundedness argument does not establish zero mutual information.","tokens_in":23273,"tokens_out":2800,"would_cite":false,"duration_ms":25704,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"ByITFL and LoByITFL make federated learning Byzantine-resilient and information-theoretically private.","keywords":["federated learning","Byzantine resilience","information-theoretic privacy","secure aggregation","secret sharing","Lagrange coded computing","Beaver triples","trust scores"],"falsifier":"Sample a fixed local update, rotate it in the model space, quantize and secret-share it exactly as the protocol does, and have the federator decode its squared norm; if the decoded norm changes with the rotation while the update still passes the validation threshold, the federator's view carries directional information and the zero-mutual-information guarantee in Eq. (2) is violated.","tokens_in":22237,"feed_emoji":"🛡️","tokens_out":9366,"duration_ms":88207,"temperature":0.7,"pith_summary":"The paper tries to show that federated learning can be robust to Byzantine users and perfectly private at the same time. It introduces ByITFL and LoByITFL, two schemes in which the federator keeps a small root dataset, computes its own reference update, and assigns each user a polynomial trust score based on cosine similarity with that reference. The users' normalized, quantized updates are secret-shared, and the aggregation is reconstructed from shares in such a way that an honest-but-curious federator and any colluding group of up to t users learn nothing beyond the aggregate. ByITFL does this with Lagrange coded computing and re-randomization; LoByITFL lowers communication cost by using Beaver triples and a one-time trusted initialization. The paper claims these are the first Byzantine-resilient federated-learning schemes with perfect information-theoretic privacy, and proves privacy, resilience, dropout tolerance, and convergence.","feed_headline":"Perfect privacy meets Byzantine resilience in federated learning","feed_subtitle":"New schemes hide individual updates from computationally unbounded adversaries while tolerating malicious clients and dropouts.","key_machinery":"The load-bearing object is a polynomial discriminator $h$ evaluated on secret-shared, normalized updates, together with the quotient aggregation $\\nu = \\Sigma_2/\\Sigma_1 = \\left(\\sum_i h(\\langle \\bar{\\mathbf{u}}_0, \\bar{\\mathbf{u}}_i\\rangle) \\bar{\\mathbf{u}}_i\\right) / \\left(\\sum_i h(\\langle \\bar{\\mathbf{u}}_0, \\bar{\\mathbf{u}}_i\\rangle)\\right)$. Each local update is normalized, stochastically quantized, mapped into a finite field, split into sub-vectors, and secret-shared using Lagrange coded computing, a threshold secret-sharing method that lets polynomials be evaluated on shares. Information-theoretic verifiable secret sharing prevents Byzantine users from submitting inconsistent shares, and re-randomization prevents the federator from decoding anything except the quotient. A random scalar $\\lambda$ multiplies both $\\Sigma_1$ and $\\Sigma_2$ before reconstruction, so the federator learns only $\\nu$. LoByITFL replaces the expensive re-randomization with Beaver triples distributed once by a trusted third party, plus additively homomorphic message authentication codes that let the federator verify every linear computation.","core_discovery":"The central claim is that perfect information-theoretic privacy, in the sense of zero mutual information between honest users' local updates and everything the federator and colluding users see, is compatible with Byzantine resilience and dropout tolerance. ByITFL achieves this under the user-count condition $n \\geq 2b + (\\tau+2)(m+t-1) + e + 1$, and LoByITFL under $n \\geq b + m + t + e$; both schemes are proven to converge under the same strong-convexity assumptions used by the reference trust-scoring aggregation. The key move is to replace the reference method's ReLU trust score with a low-degree polynomial $h$ of the cosine similarity $\\langle \\bar{\\mathbf{u}}_0, \\bar{\\mathbf{u}}_i \\rangle$, so that the aggregated update $\\nu = \\Sigma_2 / \\Sigma_1$ can be computed entirely on secret shares. A random field element $\\lambda$ multiplies both sums before reconstruction, so the federator can recover only the quotient $\\nu$. The experiments show test accuracy close to the reference method on three image datasets under several poisoning attacks, including label flipping, min-max, min-sum, ALIE, and scaling attacks.","pith_inferences":["As an editorial inference, the same secret-shared trust-score machinery could be applied to other robust aggregation rules that are low-degree polynomial functions of the updates, not only cosine-similarity scoring.","The perfect-privacy guarantee is for the quantized finite-field embeddings of normalized updates; whether it extends to the original real-valued gradients depends on how much directional information stochastic quantization preserves, which the paper does not quantify.","The schemes concentrate trust in the federator's root dataset; a root dataset that misrepresents the users' data would miscalibrate trust scores and could weaken both robustness and the practical meaning of the privacy guarantee.","A direct test of the privacy claim would be to measure whether the decoded squared norm of a fixed update changes as the update is rotated; if it does while passing the validation threshold, the zero-mutual-information claim needs revision."],"forward_implications":["An honest-but-curious federator that holds a small representative dataset can compute a robust aggregate while learning zero mutual information about any honest user's individual update in each iteration, even against a computationally unbounded adversary.","The two schemes tolerate the simultaneous presence of $b$ Byzantine users, $t$ colluding curious users, and $e$ dropouts: ByITFL requires $n \\geq 2b + (\\tau+2)(m+t-1) + e + 1$ users, while LoByITFL requires only $n \\geq b + m + t + e$.","LoByITFL shows that a one-time trusted initialization with Beaver triples cuts per-user communication from $O((d/m)n^3 + n^4)$ to $O((d/m+\\tau)n)$ without weakening the stated privacy guarantee.","Under strong convexity and Lipschitz-gradient assumptions, both schemes converge linearly to a neighborhood of the optimal model, with the convergence error containing a term proportional to the global learning rate and the reference-update error.","The polynomial discriminator of degree three is sufficient to preserve the practical resilience of the reference trust-scoring method, which suggests that exact ReLU behavior is not needed for Byzantine robustness."],"supporting_citations":[{"why":"Supplies the root-dataset trust-scoring aggregation rule that the schemes make privacy-preserving.","marker":"[13]"},{"why":"Provides Lagrange coded computing, the threshold secret-sharing scheme used to share updates and evaluate polynomials on shares.","marker":"[47]"},{"why":"Provides information-theoretic verifiable secret sharing, used to keep Byzantine users from distributing inconsistent shares.","marker":"[52]"},{"why":"Supplies the re-randomization step that prevents the federator from decoding intermediate sums in ByITFL.","marker":"[49]"},{"why":"Supplies the proof of perfectly secure multiparty computation that the re-randomization argument relies on.","marker":"[50]"},{"why":"Beaver triples enable multiplication of secret shares in LoByITFL without increasing the encoding-polynomial degree.","marker":"[51]"},{"why":"Additively homomorphic MACs give LoByITFL integrity checks against Byzantine computation.","marker":"[48]"},{"why":"Reed-Solomon decoding lets the federator reconstruct correct aggregates despite corrupted shares and dropouts.","marker":"[46]"}],"fun_headline_variants":["Perfect privacy now possible in Byzantine-resilient FL","Zero-leakage federated learning: Byzantine-safe at last","IT-privacy and Byzantine tolerance: a first for FL","ByITFL: perfect privacy, Byzantine-proof, no leaks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The privacy proof assumes that the value each user must reveal for normalization checking, the quantized squared norm of the update, is effectively the same for every possible update and therefore carries no information about the update's direction.","fun_headline_variants_meta":{"raw":{"variants":["Perfect privacy now possible in Byzantine-resilient FL","Zero-leakage federated learning: Byzantine-safe at last","IT-privacy and Byzantine tolerance: a first for FL","ByITFL: perfect privacy, Byzantine-proof, no leaks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000255,"raw_usage":{"total_tokens":1578,"prompt_tokens":959,"completion_tokens":619,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":575,"completion_tokens_details":{"reasoning_tokens":560}},"tokens_in":575,"tokens_out":619,"duration_ms":6052,"temperature":1.0,"reasoning_tokens":560,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T19:59:43.179763+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Sample a fixed local update, rotate it in the model space, quantize and secret-share it exactly as the protocol does, and have the federator decode its squared norm; if the decoded norm changes with the rotation while the update still passes the validation threshold, the federator's view carries directional information and the zero-mutual-information guarantee in Eq. (2) is violated.","supporting_citations":[{"cited_title":"Fltrust: Byzantine-robust federated learning via trust bootstrapping,","cited_arxiv_id":null,"evidence_quote":"Supplies the root-dataset trust-scoring aggregation rule that the schemes make privacy-preserving."},{"cited_title":"Lagrange coded computing: Optimal design for resiliency, security, and privacy,","cited_arxiv_id":null,"evidence_quote":"Provides Lagrange coded computing, the threshold secret-sharing scheme used to share updates and evaluate polynomials on shares."},{"cited_title":"Completeness theorems for non-cryptographic fault-tolerant distributed computation,","cited_arxiv_id":null,"evidence_quote":"Provides information-theoretic verifiable secret sharing, used to keep Byzantine users from distributing inconsistent shares."},{"cited_title":"Simplified vss and fast-track multiparty computations with applications to threshold cryptography,","cited_arxiv_id":null,"evidence_quote":"Supplies the re-randomization step that prevents the federator from decoding intermediate sums in ByITFL."},{"cited_title":"A full proof of the bgw protocol for perfectly secure multiparty computation,","cited_arxiv_id":null,"evidence_quote":"Supplies the proof of perfectly secure multiparty computation that the re-randomization argument relies on."},{"cited_title":"Efficient multiparty protocols using circuit randomization,","cited_arxiv_id":null,"evidence_quote":"Beaver triples enable multiplication of secret shares in LoByITFL without increasing the encoding-polynomial degree."},{"cited_title":"Semi- homomorphic encryption and multiparty computation,","cited_arxiv_id":null,"evidence_quote":"Additively homomorphic MACs give LoByITFL integrity checks against Byzantine computation."},{"cited_title":"On sharing secrets and reed-solomon codes,","cited_arxiv_id":null,"evidence_quote":"Reed-Solomon decoding lets the federator reconstruct correct aggregates despite corrupted shares and dropouts."}],"review_version":2}