{"id":"547062a9-e50f-489d-af47-b0b8f694fb88","arxiv_id":"2506.13612","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"EBS-CFL encodes gradient and cluster identity into orthogonal matrices so a single server can do Byzantine-robust clustered aggregation without seeing individual gradients or cluster membership.","lead":"A new secure aggregation scheme for clustered federated learning claims to hide which cluster each user belongs to, while still filtering out malicious gradients in one server. The scheme combines an existing cosine-similarity robustness idea with orthogonal-matrix encodings, and the paper reports better attack resistance than FLTrust in experiments.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"SRFC Theorem 2 is algebraically inconsistent for negative inputs: Eq. (25) fails when x_i<0 and M_i<0, so the server cannot compute ReLU weights, and the central aggregation claim is unsupported.","rationale":"The reader's stated weakest assumption is the root dataset D0. That limitation is real and is acknowledged in the paper's supplement, but it is a scope condition inherited from FLTrust: with a clean and representative D0, the robustness argument can still hold. The SRFC algebra is more fundamental: if Eq. (25) fails, the protocol does not compute the intended ReLU-weighted aggregation even with a perfect D0, honest clients, and no adversary. The reader did flag the SRFC construction as under-specified and set correctness risk to high, so there is partial agreement, but the precise load-bearing point is the algebraic validity of Eq. (9), not the bootstrap dataset. I recommend REJECT because the manuscript, as written, contains an explicit identity in the core cryptographic primitive that fails in the negative-input regime the primitive is meant to handle. This is not a question of missing experimental details or an over-strong security model; a one-line scalar counterexample exposes the issue. If the authors can repair the definitions of F, F^{-1}, and the supporting random matrices so that Eq. (9) holds, or can show that the intended inputs are always nonnegative in a way that makes the ReLU computation trivial, the paper could return to CONDITIONAL. As it stands, the central claim that a single server can perform Byzantine-robust clustered aggregation while keeping gradients and cluster identities confidential is not supported.","tokens_in":21340,"tokens_out":14203,"duration_ms":136670,"concrete_test":"Run a scalar symbolic check of Eq. (25) and Eq. (9) with n=m=l=1, x=-1, M=-1, R^{(1)}=0.5, R^{(2)}=0, R^{(0)}=-0.5, ζ=0. The true encoded ReLU is 0. Evaluate Eq. (9) as written: Eq. (23) gives 0.5, while the second term gives F^{-1}(1.75)=+√1.75≈1.323, so Eq. (9) returns about 0.91, not 0. More generally, for scalar M=-1, x=-a, and r∈(0,a), the claimed identity reduces to F^{-1}(a^2-r^2+2ar)=r-a, which would require a^2-r^2+2ar=(r-a)^2, i.e. 4ar=2r^2, impossible for r∈(0,a). A CAS or hand derivation of these scalar cases settles whether Eq. (9) is a theorem; if it fails, the aggregation weights are wrong and the central claim is unsupported.","verdict_should_be":"REJECT","load_bearing_attack":"The most load-bearing concern is the correctness of the secure ReLU primitive, not the root dataset. RFCA's Eq. (1) requires the server to compute Σ_i ReLU(c^k_i) and Σ_i E(ReLU(c^k_i)) without seeing c^k_i. SRFC is supposed to supply these via Eq. (9), and its proof rests on Eq. (25): F^{-1}(x_i^2(M_i∘M_i) - R_i^{(1)}∘R_i^{(1)} + R_i^{(2)} + F^{-1}(β α_i^2 τ_3)) = |x_i|M_i + R_i^{(1)}. Instantiate scalar n=1, x_i=-1, M_i=-1, R_i^{(1)}=0.5, R_i^{(2)}=0, which Eq. (7) permits since 0<0.5<max|x|=1. Eq. (24) then gives F^{-1}(β α_i^2 τ_3)=2(-1)(-1)(0.5)-0=1. The argument of the outer F^{-1} is (-1)^2(-1)^2 -0.25 +0 +1 = 1.75. With the paper's sign-preserving square root, F^{-1}(1.75)=+√1.75≈1.323, while the claimed RHS is |x|M+R^{(1)}=-1+0.5=-0.5. Eq. (25) is therefore not an identity for the negative values that ReLU is designed to handle. Since Eq. (9) inherits this step, the encoded sum Σ E(ReLU(w_i)) and the denominator Σ ReLU(w_i) are not computed correctly, so the secure aggregation cannot reproduce the robust weighted average of Eq. (1). This failure does not depend on D_0 quality or adversarial behavior; it is an algebraic inconsistency in the core primitive. A repair would require additional constraints, such as x_i≥0 or special restrictions on M, that are absent and appear incompatible with both orthogonality and the ReLU setting.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes EBS-CFL, a secure aggregation protocol for clustered federated learning that combines a Byzantine-robust clustering algorithm (RFCA), a matrix-based encoding scheme (VOMCA), a secure ReLU computation mechanism (SRFC), a key-transformation mechanism (SKT), and a compression scheme. The central claim is that a single server can compute a weighted robust cluster-wise aggregation from encoded client updates without learning client gradients or cluster identities, with per-client communication O(ml + m^2) and computation O(m^2 l). The manuscript includes convergence analysis, security theorems, and experiments on MNIST, CIFAR-10, and CIFAR-100.","tokens_in":21747,"tokens_out":10815,"duration_ms":95915,"significance":"If the algebraic and security claims were correct, this would be a valuable contribution: single-server secure aggregation for clustered federated learning with cluster-identity privacy and per-client complexity independent of the number of clients is an attractive combination, and the experimental evaluation is reasonably extensive, covering multiple Byzantine attacks and data-heterogeneity settings. The authors also include an honest discussion of the root-dataset dependency in the appendix. However, the central secure-ReLU primitive is algebraically incorrect, and the security proofs are informal; these issues are load-bearing and not fixable by local revision.","major_comments":[{"comment":"Equation (25) is algebraically false under the paper's own definitions of F and F^{-1}. The claimed identity F^{-1}(x_i^2(M_i∘M_i) - R_i^{(1)}∘R_i^{(1)} + 2x_i M_i∘R_i^{(1)}) = |x_i|M_i + R_i^{(1)} does not hold. For a scalar instantiation satisfying Eq. (7), take x_i = -1, M_i = -1, R_i^{(1)} = 0.5, R_i^{(2)} = 0. The argument of the outer F^{-1} is 1 - 0.25 + 1 = 1.75, so F^{-1}(1.75) = sqrt(1.75) ≈ 1.323, while the claimed right-hand side is -1 + 0.5 = -0.5. The two sides are not equal. This is not a degenerate corner case: it is precisely the negative-input regime that the ReLU computation is designed to handle, and Eq. (7) explicitly permits negative M_i with nonzero R_i^{(1)}. Since Eq. (9) and Eq. (10) inherit this step, the server cannot compute Σ_i ReLU(w_i) or Σ_i E(ReLU(w_i)) as claimed, and the secure aggregation formula in Eq. (16) is unsupported. This is a load-bearing error in the central primitive.","section":"Appendix, Proof of Theorem 2, Eq. (25)"},{"comment":"The proof of Theorem 1 equates Pr[V_i R^T = 0] with 1/λ^l, where λ is described as 'the probability of correctly predicting pseudo-random numbers without additional information.' This conflates a probability over the random matrix V_i with a probability over an adversary's guess R; no distribution over R or V_i is specified, and no reduction to a computational assumption is given. The claimed bound ε = 1/λ^l in Eq. (5) is therefore not established. Because Theorem 1 is the basis for the server's verification that clients cannot tamper with ciphertexts, the authentication guarantee is not proven.","section":"Proof of Theorem 1"},{"comment":"The dimensions in the orthogonality condition are inconsistent. Definition 1 requires M_i^T M_j = I for i = j, but in SRFC and the secure aggregation scheme the matrices M_i are stated as elements of R^{lm × 2lmn}; for M_i^T M_i = I_{2lmn} to hold, the rank of M_i would have to be 2lmn, which is impossible when lm < 2lmn. The same issue appears in VOMCA, where M_i ∈ R^{l × lm}. As written, the matrix products in Eqs. (6), (9), (12), and (16) are not all well-defined under the stated dimensions, so the algebraic claims cannot be checked without a corrected dimension specification.","section":"SRFC and VOMCA definitions, Eqs. (2) and (6)"},{"comment":"The Byzantine-robustness claim depends on the server's root dataset D_0 producing trusted updates g_0^j. Eq. (1) weights every client by alignment with these server updates, and Algorithm 2 initializes g_0^j from D_0 before any federated training. If D_0 is unrepresentative, noisy, or poisoned, the filter itself becomes the attack vector. The supplementary discussion explicitly concedes that a poorly chosen initialization makes benign gradients look poisonous and that convergence is tied to the selection of g_0. The security analysis does not formalize this trust assumption in any theorem, so the robustness guarantee is conditional on an assumption that is not modeled.","section":"Algorithm 2 and Eq. (1)"}],"minor_comments":[{"comment":"Several security theorems are informal narrative arguments rather than formal proofs; for example, Theorem 4 argues via 'countless rotations' in the real number field without an indistinguishability-based argument. The paper should either provide formal proofs or explicitly label these as heuristic security analyses.","section":"Security Analysis, Theorems 4-9"},{"comment":"The notation for F and F^{-1} in the text is typeset in a confusing way (e.g., '((A)3ij/(|(A)ij|)'), which obscures the intended elementwise formulas; the definitions should be written cleanly with explicit subscripts.","section":"SRFC definitions, F and F^{-1}"},{"comment":"Algorithm 2 sends the one-hot vector and the plaintext gradient to the server, which conflicts with the privacy claims of the secure aggregation scheme; the relationship between this plaintext baseline and the secure protocol should be clarified so readers can see where privacy enforcement begins.","section":"Algorithm 2, steps 12-13"}],"recommendation":"reject","confidential_remarks":"The algebraic error in Eq. (25) is load-bearing and, as far as I can tell, cannot be fixed by local edits; it invalidates the secure ReLU primitive on which the entire aggregation scheme rests. The informal security proofs and dimension inconsistencies strengthen the case that the paper is not ready for publication in its current form. I recommend rejection, though I encourage the authors to revisit the secure-ReLU construction, as the underlying idea may be salvageable with additional sign/domain constraints."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The combination is genuinely new: no prior scheme hides cluster identities, resists Byzantine attacks, and uses a single server for secure aggregation. The VOMCA encoding idea is clever, the complexity analysis is thoughtful, and the experiments cover a reasonable range of attacks and datasets. The authors also deserve credit for honestly stating the sensitivity to the root dataset g0 in the supplementary text.\n\nThe problem is the SRFC mechanism that computes ReLU weights securely. The stress-test counterexample is correct. With x_i = -1, M_i = -1, R^(1)_i = 0.5, R^(2)_i = 0, Eq. (25) gives F^{-1}(1.75) ≈ 1.323 on the left, while the claimed right-hand side |x_i|M_i + R^(1)_i = -0.5. The identity fails, and since SRFC is the basis for computing both the numerator and denominator in the robust aggregation, the main claim—that a single server can compute the Eq. (1) weighted average without seeing plaintext gradients or cluster identities—is unsupported. This is not a matter of a missing proof; the printed equations are internally inconsistent for negative inputs, which are exactly what ReLU is designed to handle.\n\nOther issues are secondary but real. The proof of Theorem 1 contains a step Pr[Vi R^T = 0] = 1/λ^l that treats a continuous random variable as if it had a discrete guessing probability. The security theorems are informal; the definitions of F and F^{-1} are garbled in the main text, and the security game is never formalized. The convergence proof (Theorem 3) borrows heavily from IFCA and rests on Assumption 5 (weights follow a normal distribution) that is not derived from the cosine-similarity weighting scheme. The root dataset assumption is a practical weakness, but it is secondary to the algebraic failure.\n\nThis paper deserves a serious referee because the problem it targets is real and the combination is novel, but it should not be accepted anywhere near current form. The authors need to either repair the SRFC algebra—perhaps with additional constraints that are absent and likely incompatible with both orthogonality and ReLU—or redesign the mechanism. I would tell them to focus on a correct secure ReLU primitive and a formal security game before resubmission.","headline":"Novel combination of secure aggregation, cluster-identity hiding, and Byzantine robustness, but the secure ReLU primitive has a concrete algebraic flaw that breaks the core aggregation claim.","tokens_in":22334,"tokens_out":2961,"would_cite":false,"duration_ms":29078,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"EBS-CFL lets a single server run Byzantine-robust clustered federated aggregation while clients' gradients and cluster identities stay confidential.","keywords":["federated learning","clustered federated learning","secure aggregation","Byzantine robustness","cluster identity privacy","cosine similarity filtering","mutually orthogonal matrices","secure ReLU computation"],"falsifier":"Run EBS-CFL with a deliberately poisoned or single-class root dataset $D_0$ while honest clients hold diverse data; if benign gradients receive negative cosine similarity to $g_0$ and are filtered out, while an adversary who trains on the poisoned $D_0$ passes the filter and raises attack success rate, then the robustness claim collapses. A second check would test cluster-identity privacy by having the server perform repeated aggregation queries with altered weights and measuring whether any cluster assignment information leaks through the decoded sums.","tokens_in":21081,"feed_emoji":"🔐","tokens_out":7325,"duration_ms":65502,"temperature":0.7,"pith_summary":"Clustered federated learning helps when client data is heterogeneous, but existing schemes either expose which cluster a client belongs to or cannot withstand Byzantine clients. This paper argues that a single server can do both: aggregate cluster-specific updates and filter poisoned gradients, without ever seeing plaintext gradients or cluster assignments. The proposed EBS-CFL encodes each normalized gradient together with a one-hot cluster selector into matrix products and random masks, so the server can compute cluster-wise weighted sums and securely apply ReLU to drop negatively correlated updates. The claimed payoff is client communication $O(ml + m^2)$ and computation $O(m^2l)$, independent of the number of clients, plus a security proof and a convergence guarantee for the underlying RFCA algorithm.","feed_headline":"Cluster identities stay secret while poisoned gradients get filtered","feed_subtitle":"A new encoding lets a single server aggregate by cluster and drop bad updates without seeing raw gradients or cluster membership.","key_machinery":"The load-bearing machinery is VOMCA (Verifiable Orthogonal Matrix Confusion for Aggregation), combined with the Secure ReLU Function Computation Mechanism (SRFC). VOMCA encodes secrets by multiplying them with mutually orthogonal matrices and adding random masks whose sums vanish, so single-client values are hidden while the aggregate decodes correctly; a verification key lets the server confirm that a client did not tamper with its ciphertext. SRFC lets the server compute the sum of ReLU of the cosine-similarity scores, effectively dropping negatively correlated gradients, while the underlying scores remain encrypted. Around these sit the RFCA algorithm and the compression scheme, gradient segmentation and layered aggregation, which keep per-client communication and computation independent of the total number of clients.","core_discovery":"The central claim is that a single honest-but-curious server can run Byzantine-robust clustered federated learning without ever seeing a client's plaintext gradient or its cluster assignment. Each client sends an encoded gradient of the form\n$$\\delta_i = \\frac{g_i}{\\|g_i\\|} A_j M'_i + \\sum_{j=1}^m R''_{ij} A_j M'_{i+n} + \\mu_i M'_{i+2n},$$\nwhere $A_j$ picks the client's cluster, the $M'$ matrices are mutually orthogonal secret masks, and the random terms $R''_{ij},\\mu_i$ sum to zero across clients. The server then uses a decoding key $dk'$ and the secure ReLU mechanism to compute, in Eq. (16), the cluster-wise weighted aggregate\n$$g = \\left(\\sum_i \\delta_i\\right) dk'^T,$$\nwith weights determined by cosine similarity to server-computed reference gradients $g_0$. Negative-correlation updates are discarded, and a norm check $\\|\\delta_i\\|^2 = 3$ plus a verification key authenticates that the client encoded a normalized gradient. The paper claims this keeps gradients and cluster identities confidential, detects poisoned updates, authenticates correct encoding, and does so with client communication $O(ml + m^2)$ and computation $O(m^2l)$, independent of client count $n$.","pith_inferences":["The scheme's usefulness in practice depends on the server holding a trustworthy reference dataset; where no such clean public set exists, one could derive $g_0$ from a small trusted client subset, at the price of weakening the single-server trust model.","Because the filter rewards alignment with $g_0$, a natural next attack is reference-aware poisoning that trains malicious updates to have high cosine similarity with the server's reference gradient; the paper does not evaluate this specific adversary.","The secure ReLU primitive could generalize to other piecewise-linear functions of encrypted similarities, such as clipped ReLU or top-$k$ selection, which would let the same matrix-masking machinery implement other robust aggregation rules."],"forward_implications":["Clients never reveal their cluster identity to the server, because the one-hot selector is buried inside the encoded gradient and only survives aggregation in decoded form.","Updates that are negatively correlated with the server reference gradient are discarded by the secure ReLU computation, and positively correlated updates are weighted by similarity, which weakens label-flipping and scaling attacks.","Per-client communication and computation stay flat as the client population grows, so the scheme scales to settings where earlier secure-aggregation protocols charged each client a cost that grew with $n$.","The same secure-aggregation core is compatible with both FedAvg and IFCA-style clustered training, so adopting it does not force a switch of federated learning algorithm.","Under strong-convexity and bounded-variance assumptions, the RFCA iterate contracts toward the optimum with high probability, matching the style of guarantee IFCA provides."],"supporting_citations":[{"why":"Supplies the FLTrust cosine-similarity weighting rule that RFCA adopts for Byzantine robustness.","marker":"Cao et al. 2021"},{"why":"Supplies IFCA, the clustered federated learning framework and convergence assumptions that RFCA extends.","marker":"Ghosh et al. 2022"},{"why":"Defines the secure aggregation baseline that VOMCA contrasts with as a single-server alternative.","marker":"Bonawitz et al. 2016"},{"why":"Provides FastSecAgg, a key efficiency baseline for communication and computation comparisons.","marker":"Kadhe et al. 2020"},{"why":"Supplies the definition of mutually orthogonal matrices used by VOMCA and SRFC.","marker":"Zheng et al. 2022"},{"why":"Establishes gradient inference attacks, motivating the need to hide plaintext gradients.","marker":"Zhu, Liu, and Han 2019"},{"why":"Defines clustered federated learning and the cluster-identity privacy gap this paper targets.","marker":"Sattler, Müller, and Samek 2021"}],"fun_headline_variants":["Secure clustered FL hides identities, blocks poisoned updates","Byzantine-robust FL with private cluster assignments","Efficient private clustering that filters toxic gradients","Cluster IDs stay secret, bad gradients get dropped"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the server has a small, clean, representative public root dataset $D_0$ from which it can train trustworthy reference gradients $g_0$; if $D_0$ is unrepresentative, noisy, or poisoned, the cosine-similarity filter can misclassify honest gradients as malicious and let aligned attackers through.","fun_headline_variants_meta":{"raw":{"variants":["Secure clustered FL hides identities, blocks poisoned updates","Byzantine-robust FL with private cluster assignments","Efficient private clustering that filters toxic gradients","Cluster IDs stay secret, bad gradients get dropped"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000685,"raw_usage":{"total_tokens":3171,"prompt_tokens":1074,"completion_tokens":2097,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":690,"completion_tokens_details":{"reasoning_tokens":2037}},"tokens_in":690,"tokens_out":2097,"duration_ms":13578,"temperature":1.0,"reasoning_tokens":2037,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T19:57:04.043650+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run EBS-CFL with a deliberately poisoned or single-class root dataset $D_0$ while honest clients hold diverse data; if benign gradients receive negative cosine similarity to $g_0$ and are filtered out, while an adversary who trains on the poisoned $D_0$ passes the filter and raises attack success rate, then the robustness claim collapses. A second check would test cluster-identity privacy by having the server perform repeated aggregation queries with altered weights and measuring whether any cluster assignment information leaks through the decoded sums.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the FLTrust cosine-similarity weighting rule that RFCA adopts for Byzantine robustness."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies IFCA, the clustered federated learning framework and convergence assumptions that RFCA extends."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the definition of mutually orthogonal matrices used by VOMCA and SRFC."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Establishes gradient inference attacks, motivating the need to hide plaintext gradients."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines clustered federated learning and the cluster-identity privacy gap this paper targets."}],"review_version":2}