{"id":"79c53914-2e3f-4bc7-adfd-c32765faa614","arxiv_id":"2506.20290","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":2,"one_line_summary":"Hash selection in LDP creates measurable disparities in inference and poisoning vulnerability, and an entropy-filtered OLH variant reduces those disparities, though with added runtime.","lead":"The paper reports that hash function choices in local differential privacy can make some users much easier to infer and others more dangerous when poisoning, even under the same privacy budget. It proposes Fair-OLH, which rejects low-entropy hash functions, and claims this narrows the gap with acceptable overhead.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"MGA poisoning-unfairness claim is unsupported: Algorithm 2 lets any attacker search the whole hash family, so the reported Low/High-PIS disparity cannot arise unless experiments silently restrict attackers to their assigned hash.","rationale":"The paper's central claim is that hash-function assignment creates unfair vulnerability to both inference and poisoning attacks under the same ε, and that F-OLH mitigates both. For the inference half, the causal story is internally consistent: Algorithm 1 scores domain values in the preimage of the observed hash output, so users with tiny preimages are easier to identify. That part survives scrutiny. The poisoning half, however, is where the argument must hold for the headline to stand. Section 3.3 asserts that High-PIS users produce ULoss 3-4x higher than others and explains this by the user's preimage size Pu. But Algorithm 2, which the paper itself presents as the MGA implementation, lets the attacker choose the hash function by searching over the family H for κ iterations. There is no dependency on the user's assigned hash. Consequently the 'user's preimage size' explanation cannot drive the attack; the only way the reported disparity arises is if the implementation silently binds each attacker to a preassigned hash and suppresses the search, or if 'subpopulation' is reinterpreted as the hash the attack happens to select. Either way, the paper's poisoning-unfairness claim is not supported by the stated model. F-OLH's MGA mitigation inherits this flaw: it changes honest hash selection but leaves attacker hash selection untouched, so under Algorithm 2 the mitigation should not appear. The missing ε-LDP proof for F-OLH is not a fatal concern in my reading -- hash selection in Algorithm 4 is independent of vu, so the standard OLH analysis applies and the gap is easily closed. The MGA issue is not an exposition gap; it requires either a corrected attack model or removal of the poisoning claims. The reader's weakest_assumption identified exactly this, and I agree.","tokens_in":14662,"tokens_out":6418,"duration_ms":70332,"concrete_test":"Locate or reimplement the Figure 2 experiment and run it twice: (a) exactly as Algorithm 2 is written, with each malicious user from the Low-PIS/High-ENT/High-PIS groups independently running κ=1000 hash searches over the same family H with T=D; (b) with the current code if available, verifying which hash the attacker actually uses. If (a) yields statistically indistinguishable ULoss across subpopulations (or (b) reveals the attacker is pinned to a preassigned hash), the poisoning-unfairness claim fails and the ablation in Figure 5 must be re-examined.","verdict_should_be":"REJECT","load_bearing_attack":"The poisoning half of the central claim -- that High-PIS users can mount 3-4x more damaging MGA attacks -- rests on the premise that a malicious user's impact is fixed by the preimage size of the hash they were assigned. Algorithm 2 contradicts this premise: it draws hash functions from the entire family H, scores them on the target set T, and returns the single ⟨Hu, x'u⟩ that maximizes the number of target items in one output bucket. A Low-PIS, High-ENT, or High-PIS attacker therefore has access to the same search space and can return the same optimum. Section 3.3's explanation ('When Pu is large...') invokes the protocol-assigned Pu, but Algorithm 2 explicitly does not use the user's assigned hash. The Figure 2 separation can only be reproduced if the experiments restrict each malicious user to their own assigned hash (or otherwise measure a different attack), a condition not stated anywhere. Because F-OLH only constrains honest users' hash choice and does not change the server-side estimator or the attacker's available hash family, it also cannot reduce MGA damage under Algorithm 2; Figure 5 inherits the same unstated restriction. The BIA/inference finding is less affected, but the poisoning-unfairness and F-OLH-MGA-mitigation contributions are unsupported by the algorithm as written.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies whether the choice of hash function in the OLH local differential privacy protocol creates group-level disparities in vulnerability to inference and poisoning attacks. The authors define three subpopulations (High-ENT, Low-PIS, High-PIS) by entropy and by preimage-set size of the user's assigned hash function, and report that Low-PIS users are 1.5-2x more vulnerable to a Bayesian inference attack (BIA) while High-PIS users achieve 3-4x larger utility loss under a maximal gain attack (MGA). They then propose Fair-OLH (F-OLH), which repeatedly draws hash functions until a user's entropy ratio Eopt/Ecomp is below a threshold rho, and report that F-OLH reduces the BIA disparity and the MGA utility loss at acceptable time overhead.","tokens_in":14909,"tokens_out":7779,"duration_ms":91345,"significance":"If the claimed phenomenon were established, this would be a useful, previously underexplored observation for LDP protocol design: hash function behavior could create de facto unequal privacy and attack resilience under an identical nominal epsilon. The proposed F-OLH mitigation is simple and implementable, and the time-cost analysis is a reasonable practical consideration. However, the current evidence does not support the central poisoning-unfairness claim because the stated attack algorithm contradicts the claimed mechanism, and the BIA finding is substantially definitional because the subpopulations are defined by the exact quantity that determines BIA success. The F-OLH contribution additionally lacks an unbiasedness or privacy analysis for its modified hash distribution. No machine-checked proofs, formal statements, or public code are provided, and all empirical claims rest on point estimates without error bars.","major_comments":[{"comment":"The MGA results are inconsistent with the attack algorithm as written. Algorithm 2 (lines 3-13) draws candidate hash functions from the entire family H and returns the pair <H_u, x'_u> that maximizes the number of target items in one hash bucket. Under this algorithm, a malicious user's protocol-assigned hash function and its preimage size P_u play no role in the chosen tuple. The Section 3.3 explanation ('When P_u is large...') attributes the ULoss differences to the user's own P_u, but a Low-PIS attacker has exactly the same search space as a High-PIS attacker and can return the same optimum. The reported High-PIS vs. Low-PIS separation in Figure 2 can only be reproduced if the experiments silently restrict each malicious user to their assigned hash, a restriction that is not stated anywhere. Since F-OLH changes only how honest users draw hash functions and leaves the attacker's search space and the server estimator unchanged, Figure 5 inherits the same unstated restriction. The poisoning-unfairness exposure and the F-OLH MGA-mitigation claims are therefore unsupported by the algorithm as written.","section":"Algorithm 2 and Section 3.3, Figure 2"},{"comment":"F-OLH changes the distribution of hash functions from uniform over H to a conditioned distribution that depends on the entropy threshold rho, but the server-side estimation formula (3) is the standard OLH estimator. The unbiasedness of (3) relies on the uniform-hash-family property that for any two distinct values v and w, Pr[H(v)=H(w)] = 1/g. Under F-OLH's entropy conditioning this collision probability changes; for example, for perfectly balanced hashes it becomes (|D|/g - 1)/(|D|-1) rather than 1/g. The paper provides no proof that (3) remains unbiased under the F-OLH hash distribution, and the frequency plots in Appendix A show systematic over- and under-estimation (described as a 'scaling up' effect), which is consistent with estimator bias. Consequently, the ULoss reduction attributed to MGA mitigation in Figure 5 may be in part an artifact of a biased estimator rather than a genuine reduction in attack impact.","section":"Section 4.2 and Appendix A, Equations (3), (9), Figure 5"},{"comment":"The BIA subpopulations are constructed by selecting extreme quantiles of exactly the preimage-size quantity |P_u| that determines BIA success under Algorithm 1. Because line 5 of Algorithm 1 increments the scores of values in the preimage set P_u, a user's ASR is a monotone function of |P_u| by construction. The observed ordering Low-PIS > High-ENT > High-PIS in Figure 1 is therefore a direct consequence of the grouping criterion, rather than an independent empirical discovery about hash-induced vulnerability. To support the exposure claim, the paper should report ASR as a function of |P_u| or entropy across the entire population, or define subpopulations in a way that is not the attack-determining quantity, and show that the spread arises from hash assignments in a standard OLH deployment.","section":"Section 3.2 and Algorithm 1, Figure 1"},{"comment":"The paper reports only averages over 10 runs and provides no error bars, confidence intervals, or statistical tests. The headline quantitative claims are ratios such as '1.5-2x' and '3-4x', and the central conclusion is that subpopulations have systematically different mean outcomes. Without variance estimates, the reader cannot assess whether the reported differences are stable or within the noise of the LDP mechanisms. At minimum, the main figures (Figures 1, 2, 4, and 5) should include standard deviations or confidence intervals.","section":"All figures, Sections 3 and 4"}],"minor_comments":[{"comment":"The loop variable v is reused in the nested loops of lines 1 and 4, which is confusing even if functionally correct; using a distinct variable for the inner loop would improve clarity.","section":"Algorithm 1"},{"comment":"The paper does not state explicitly why the rejection sampling in Algorithm 4 preserves epsilon-LDP. Because the acceptance condition (line 5) depends only on H and the domain D, not on the private value v_u, the mechanism is indeed a mixture of epsilon-LDP mechanisms, but this argument should be stated.","section":"Section 4.2"},{"comment":"There is a typo in the appendix header: 'T able 1' should read 'Table 1'.","section":"Appendix B, Table 1"},{"comment":"The notation rho_u for the user's entropy ratio is introduced but never used after the definition; the paper can either drop the subscript or use rho_u consistently in the explanation of the threshold condition.","section":"Equation (9)"}],"recommendation":"reject","confidential_remarks":"The MGA problem is load-bearing: the poisoning-unfairness claim and the corresponding F-OLH mitigation result are not supported by the described attack procedure. Even if the experiments were rerun under a restricted attacker model, the F-OLH estimator-bias issue would need to be resolved before the utility-loss comparisons can be interpreted. The BIA contribution, while suggestive, is largely definitional in its current framing. The paper would need substantial rework—new experiments, an explicit attack model, and an unbiasedness analysis—before it could support its central claims."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Let me give you the short version: the BIA half of this paper is a clean, honest empirical demonstration, and the MGA half is broken as written. The claim that Low-PIS users are 1.5-2x more vulnerable to Bayesian inference is real and follows directly from the BIA scoring rule: smaller preimage sets make the argmax easier. The paper's contribution is framing this as hash-induced unfairness across users with the same epsilon, which I don't think anyone has done explicitly before. The five datasets give the finding some weight, and the entropy-based subpopulation construction is transparent.\n\nThe problem is the poisoning story. Algorithm 2 lets any malicious user sample the entire hash family and return the tuple that maximizes damage. Under that algorithm, a Low-PIS or High-ENT attacker has exactly the same search space and can find the same optimum as a High-PIS attacker. The paper's explanation in Section 3.3 says the opposite — it explicitly invokes the user's assigned preimage size Pu — but Algorithm 2 does not use the assigned hash. So the 3-4x ULoss disparity in Figure 2 cannot be reproduced from the stated algorithm. Either the experiments silently restricted attackers to their assigned hash, which is a different attack, or the explanation is wrong. Either way, the poisoning-unfairness contribution and the F-OLH MGA mitigation inherit this flaw. That is load-bearing.\n\nMinor issues: F-OLH has no formal privacy proof. It is very likely epsilon-LDP because the hash choice is independent of the user's value, so the paper should have stated that in five lines. The Low-PIS/High-PIS grouping is also circular with respect to BIA — you're measuring the same preimage-size quantity that defines the groups — but that's a framing caveat rather than a fatal flaw. No error bars beyond averaging; minor.\n\nWho is this for? Practitioners deploying OLH who want to know whether hash seeds create disparate risk. The BIA result is worth their attention; the poisoning result needs a rewrite. I'd send it to peer review with the expectation of major revision, mainly to fix the MGA model or cut that contribution. As submitted, it is not acceptable.","headline":"BIA half is a clean empirical result; MGA half contradicts its own algorithm and is unsupported as written.","tokens_in":15463,"tokens_out":4182,"would_cite":false,"duration_ms":43121,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Hash functions drawn at random in OLH create real disparities in attack vulnerability, and an entropy-based filter, F-OLH, removes most of the gap.","keywords":["local differential privacy","hash-induced unfairness","OLH protocol","Bayesian inference attack","maximal gain attack","entropy-based fairness","frequency estimation","F-OLH"],"falsifier":"Run the MGA exactly as Algorithm 2 specifies—let every malicious user search all of $\\mathcal{H}$ for the most damaging $\\langle H_u, x'_u\\rangle$—and measure ULoss separately for Low-PIS, High-ENT, and High-PIS users. If the gaps shrink or vanish, the poisoning half of the hash-unfairness claim does not hold as stated. Separately, a direct replication at $\\varepsilon=3$ on any of the five datasets should reproduce the 1.5–2 times ASR gap between Low-PIS and High-PIS if the inference half is right.","tokens_in":14434,"feed_emoji":"⚖️","tokens_out":9148,"duration_ms":82632,"temperature":0.7,"pith_summary":"Local differential privacy protocols such as OLH are supposed to give every user the same $\\varepsilon$-level guarantee, but the paper argues the hash function a user happens to draw changes that guarantee in practice. Users whose hash gives a small preimage set for their value (Low-PIS) are 1.5–2 times more likely to be correctly guessed by a Bayesian inference attack at $\\varepsilon \\ge 2$, while users whose hash gives a large preimage set (High-PIS) can make maximal-gain poisoning attacks 3–4 times more damaging at $\\varepsilon \\le 1$. The paper proposes Fair-OLH (F-OLH), which repeatedly draws hash functions until the hash's entropy is close to the optimal uniform hash, measured by the ratio $E_{\\text{opt}}/E_{\\text{comp}} \\le \\rho$. Experiments on five datasets show F-OLH nearly eliminates the attack-rate gap when $\\rho$ is close to 1 and roughly halves poisoning damage at $\\rho=1.01$, at a time cost that stays in the millisecond range per user. The point is that hash selection, usually treated as an implementation detail, is a first-order parameter for who gets real privacy and who does not.","feed_headline":"Hash choice can double inference risk, quadruple poisoning damage","feed_subtitle":"Users with unlucky hashes face 1.5–2x more inference risk and 3–4x more poisoning impact; F-OLH closes the gap.","key_machinery":"The load-bearing object is the preimage set $P_u$ of a user's hash output under OLH, with its size compared against the output space $g = e^\\varepsilon + 1$. BIA exploits $P_u$ because every value inside it is treated as equally likely, so smaller preimages sharpen the attacker's guess; MGA exploits it because a large bucket collides with many targets $T$. F-OLH's control mechanism is the entropy ratio $\\rho_u = E_{\\text{opt}}/E_{\\text{comp}}$, where $E_{\\text{comp}}$ is the entropy of a hash's distribution over the domain and $E_{\\text{opt}} = \\log g$ is the uniform-hash maximum; Algorithm 4 redraws the hash seed until $\\rho_u \\le \\rho$. The $\\rho$ threshold is the single knob that trades fairness and attack resilience against per-user hashing time.","core_discovery":"On the paper's own terms, the discovery is that hash-function behavior is a source of protocol unfairness in OLH: users are assigned a random hash $H_u$ from a family $\\mathcal{H}$, and the preimage set $P_u = \\{v \\in D : H_u(v) = H_u(v_u)\\}$ of the user's true value is what determines both sides of the ledger. Small preimages make Bayesian inference easier because the attacker's score increments concentrate on fewer candidate values, so Low-PIS users are correctly predicted more often. Large preimages make maximal-gain poisoning stronger because a single reported bucket collides with more target items, so High-PIS users raise ULoss by 3–4 times. The paper claims this is not an artifact of a particular dataset: it appears across Adult, BMS-POS, Kosarak, Gaussian, and Uniform data, and across $\\varepsilon$ regimes. F-OLH then enforces fairness by rejection-sampling hashes until $E_{\\text{opt}}/E_{\\text{comp}} \\le \\rho$, bringing subpopulation attack rates together and shrinking MGA's impact.","pith_inferences":["Our inference: because F-OLH's reported hash distribution is biased toward near-uniform hashes and depends on $\\rho$ and $\\lvert D\\rvert$, a server that knows $\\rho$ gains information about the user's hash-search process; quantifying this extra leakage is a natural follow-up.","Our inference: the same entropy-filter idea transfers to RAPPOR, BLH, and OUE, which also use user-side hashing; if the mechanism generalizes, hash-induced unfairness is a family-wide issue, not an OLH quirk.","Our inference: if the paper's MGA disparity is real under a restricted attacker, then the fairness fix is not just entropy filtering—it is also making the hash family and seed selection secret, or bounding the preimage size directly, because Algorithm 2 as written lets any attacker escape the assigned-hash model.","Our inference: the harmed group here is defined by the realized hash draw, not by any demographic characteristic, so unlike fair-ML notions this unfairness is hard to audit after the fact; a practical deployment would need to enforce fairness at hash-selection time, exactly as F-OLH does."],"forward_implications":["If the claim holds, privacy budgets in OLH are not equal in practice: a fixed $\\varepsilon$ gives Low-PIS users roughly 1.5–2 times the Bayesian-inference success rate of High-PIS users at $\\varepsilon \\ge 2$.","If the claim holds, poisoning risk is concentrated: at $\\varepsilon \\le 1$, a High-PIS attacker can push ULoss 3–4 times higher than a Low-PIS or High-ENT attacker, so aggregate statistics are less trustworthy when unlucky hashes are in circulation.","F-OLH with $\\rho$ near 1 equalizes ASR across subpopulations (at $\\rho=1$ they are equal) and at $\\rho=1.01$ cuts MGA's ULoss roughly in half relative to OLH.","F-OLH's cost is tunable: stricter $\\rho$ raises hashing time, but because users run in parallel the per-user cost stays in milliseconds, so replacing OLH with F-OLH is practically viable.","The choice of $\\rho$ can be guided by simulating $P_{\\min}$, $P_{\\max}$, and $P_{\\text{avg}}$: values close to the theoretical average $\\lvert D\\rvert / g$ with a tight $P_{\\min}$–$P_{\\max}$ spread indicate a fair setting."],"supporting_citations":[{"why":"Defines OLH, the hash-family encoding, and the setting $g = e^\\varepsilon + 1$ that the paper builds on.","marker":"[22]"},{"why":"Introduces the Bayesian Inference Attack whose success rate measures inference vulnerability.","marker":"[14]"},{"why":"Introduces the Maximal Gain Attack whose ULoss measures poisoning impact.","marker":"[6]"},{"why":"Extends BIA and is used by the paper as a BIA variant in its experiments.","marker":"[3]"},{"why":"Studies multidimensional-data inference risks under LDP and supplies another BIA extension used in the paper.","marker":"[4]"}],"fun_headline_variants":["Hash lottery decides who LDP attackers hit hardest","F-OLH: fixing hash-induced unfairness in LDP","Unlucky hash users: 4x more poisoning damage","LDP hash choice: hidden bias in attack exposure","Fair-OLH: leveling LDP's hash-risk playing field"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The poisoning-unfairness result assumes a malicious user's attack power is fixed by the preimage size of the hash they were assigned, even though the paper's own Maximal Gain Attack algorithm lets any attacker search the whole hash family for the hash that does the most damage; if attackers are allowed to do that, the reported 3–4 times gap between subpopulations needs an unstated restriction to survive.","fun_headline_variants_meta":{"raw":{"variants":["Hash lottery decides who LDP attackers hit hardest","F-OLH: fixing hash-induced unfairness in LDP","Unlucky hash users: 4x more poisoning damage","LDP hash choice: hidden bias in attack exposure","Fair-OLH: leveling LDP's hash-risk playing field"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000655,"raw_usage":{"total_tokens":2995,"prompt_tokens":934,"completion_tokens":2061,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":550,"completion_tokens_details":{"reasoning_tokens":1977}},"tokens_in":550,"tokens_out":2061,"duration_ms":19365,"temperature":1.0,"reasoning_tokens":1977,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T22:52:43.246314+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the MGA exactly as Algorithm 2 specifies—let every malicious user search all of $\\mathcal{H}$ for the most damaging $\\langle H_u, x'_u\\rangle$—and measure ULoss separately for Low-PIS, High-ENT, and High-PIS users. If the gaps shrink or vanish, the poisoning half of the hash-unfairness claim does not hold as stated. Separately, a direct replication at $\\varepsilon=3$ on any of the five datasets should reproduce the 1.5–2 times ASR gap between Low-PIS and High-PIS if the inference half is right.","supporting_citations":[{"cited_title":"In: 26th USENIX Security Symposium (USENIX Security 17)","cited_arxiv_id":null,"evidence_quote":"Defines OLH, the hash-family encoding, and the setting $g = e^\\varepsilon + 1$ that the paper builds on."},{"cited_title":"In: 30th USENIX Security Symposium (USENIX Security 21)","cited_arxiv_id":null,"evidence_quote":"Introduces the Maximal Gain Attack whose ULoss measures poisoning impact."},{"cited_title":"arXiv preprint arXiv:2503.01482 (2025)","cited_arxiv_id":null,"evidence_quote":"Extends BIA and is used by the paper as a BIA variant in its experiments."},{"cited_title":"Proceedings of the VLDB Endowment (PVLDB) 16(5), 1126–1139 (2023)","cited_arxiv_id":null,"evidence_quote":"Studies multidimensional-data inference risks under LDP and supplies another BIA extension used in the paper."}],"review_version":1}