{"id":"e9651db6-787b-4e20-b75c-75eff0cff69b","arxiv_id":"2507.14322","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"A LinUCB contextual bandit selects federated aggregation rules online based on update variance, cosine similarity, and mean norm, claiming superior accuracy and tunable risk posture.","lead":"The paper introduces FedStrategist, a contextual-bandit controller that picks among FedAvg, Median, and Krum aggregation rules each round using three update statistics and a user-set risk tolerance. The authors report that this adaptive selector matches or beats static defenses in simulated poisoning scenarios on CIFAR-10.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Reward signal rewards compromised accuracy: under stealth attack the agent selects FedAvg 94% of rounds even at high λ, contradicting the conservative-policy and controllability claims.","rationale":"The reader's weakest assumption identifies the same load-bearing flaw: using immediate accuracy change as reward assumes accuracy is a valid proxy for model integrity, but the paper's own paradox shows it is not. The consequence is visible in Table 4, where the agent overwhelmingly chooses the non-robust FedAvg under the stealth attack, and the policy distribution is invariant to λ in the claimed risk-averse regime. This breaks both the conservative-policy narrative and the monotonic controllability claim, which are central to the abstract and conclusion. The Krum-favorable scenario is also internally inconsistent with its own table, further undermining the claim that the agent adopts optimal static strategies. Because the reported numerical results contradict the text's principal assertions, the reader's REJECT verdict stands. My stress-test therefore does not change the reader's recommendation; the concern is not a matter of external consensus but of internal consistency between the stated claims and the presented evidence.","tokens_in":13919,"tokens_out":2413,"duration_ms":30973,"concrete_test":"Run the archived code (Zenodo DOI 10.5281/zenodo.16068113) on the stealth-attack scenario at λ=0.5 and λ=2.0, recording per-round actions, final validation accuracy, and a backdoor/attack-success metric on the final global model. If the two λ settings yield identical policy distributions and the FedAvg-dominated model exhibits high attack success, reward misalignment is confirmed and controllability fails. Also rerun the β=10 standard-attack scenario to verify Table 3; if Krum's final accuracy is not the best static rule, the 'Krum-favorable' claim is internally contradicted.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim—that FedStrategist learns policies superior to any static defense and is controllable via the risk parameter—rests on the reward in Section 4.5: R_t = (Acc_t − Acc_{t−1}) − λ·C_j. Section 7.2 itself states the 'Paradox of the Losing Winner': under the stealth attack a compromised FedAvg model achieves the highest raw test accuracy. Therefore the accuracy-delta term actively rewards the compromised model. The reported experiments confirm this misalignment: Table 4 shows the agent selecting FedAvg 94.0% of rounds at λ=0.5, and the identical 94/4/2 distribution at λ=1.0 and λ=2.0. This directly contradicts Sections 6.5 and 7.3, which claim that higher λ yields a conservative, integrity-first policy with increased Median/Krum selection. The controllability claim is not supported by the paper's own numbers. Independently, Table 3 undercuts the 'Krum-favorable' narrative: in the environment Section 6.4 calls favorable to Krum, Krum has the lowest final accuracy (39.97%) among FedAvg (43.29%), Median (44.39%), and Adaptive (44.31%). The reported tables thus fail to support the two headline contributions: superior adaptive policy and λ-based risk control.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces FedStrategist, a framework that uses a LinUCB contextual bandit to dynamically select among three aggregation rules (FedAvg, coordinate-wise median, Krum) in each federated learning round, based on a three-dimensional diagnostic state vector. The reward is the change in proxy-validation accuracy minus a cost term scaled by a risk parameter λ. The authors claim that the learned policy outperforms all static baselines across diverse scenarios, remains effective under a stealth poisoning attack, and is controllable via λ. The paper includes reproducibility artifacts (code and data on Zenodo).","tokens_in":14135,"tokens_out":5944,"duration_ms":46837,"significance":"The idea of treating robust aggregation as a contextual bandit problem is timely and extends prior work (e.g., SARA) with a lightweight, cost-aware formulation. If the empirical claims were valid, the framework would offer a practical and tunable defense for federated learning. The paper also provides a clear description of the threat model and the reward design. However, the reported experimental tables contradict the main claims: the 'Krum-favorable' experiment shows Krum as the worst static rule, and the λ-sweep shows no policy change for λ ≥ 0.5. Because these contradictions undermine the central contributions, the current results do not support the conclusions.","major_comments":[{"comment":"The text claims 'In this environment, Krum is the clear champion among static rules,' but Table 3 reports Krum's final accuracy as 39.97%, the lowest among FedAvg (43.29%), Median (44.39%), and Adaptive (44.31%). The adaptive agent's performance is nearest to Median, not to Krum. This discrepancy invalidates the claimed validation of the 'generalist strategy' and suggests the experimental results do not support the narrative.","section":"Section 6.4 / Table 3"},{"comment":"The claim that λ acts as an interpretable 'risk dial' is not supported by the data. The reward in Eq. (4.5) includes λ explicitly, so one would expect the policy to shift with λ, but Table 4 shows identical action distributions (94% FedAvg, 4% Median, 2% Krum) for λ = 0.5, 1.0, and 2.0. Only λ = 0.1 differs (92/4/4). This contradicts the statement in Section 7.3 that 'when λ is high (risk-averse), its policy converges to that of the safer, more stable Median.' The agent continues to select FedAvg almost always, even under high λ.","section":"Section 6.5 / Table 4"},{"comment":"The reward function R_t = (Acc_t − Acc_{t−1}) − λ·C_j is misaligned with the stated goal of prioritizing model integrity. Section 7.2's 'Paradox of the Losing Winner' explicitly states that the compromised FedAvg can achieve the highest raw accuracy. Consequently, the accuracy-delta term rewards a compromised model. The paper claims the agent 'learned a conservative policy that prioritized model integrity' (Section 7.2), but Table 4 shows the agent chooses FedAvg in 94% of rounds, even at λ = 2.0. Thus the reward does not implement the intended risk management.","section":"Section 4.5 and Section 7.2"},{"comment":"The claim that the adaptive agent 'outperformed the best static robust aggregator (Median)' is technically true but incomplete. Under the stealth attack (Table 2), the agent's final accuracy (38.82%) is lower than that of FedAvg (39.43%), and the agent's policy is dominated by FedAvg (94% of rounds per Table 4). Therefore the agent is not learning a robust or conservative strategy; it is approximately following the non-robust baseline. This contradicts the interpretation in Section 7.2 that the agent 'identified a persistent attack and prioritized safety.'","section":"Section 6.3"}],"minor_comments":[{"comment":"Both panels are labeled β = 0.5; the top panel should presumably be β = 0.1 given the text in Section 6.2.","section":"Section 6.2, Fig. 4 caption"},{"comment":"The abstract and Section 6.5 state that controllability is 'proved,' but the paper provides only empirical bar charts and a table; no formal theorem or proof is given.","section":"Abstract and Section 6.5"},{"comment":"The state vector contains both the variance of update norms and the mean update norm, which are likely correlated; the paper does not discuss whether this redundancy affects LinUCB's linear model.","section":"Section 4.4"},{"comment":"All experiments use CIFAR-10 and a single CNN; the generality of the conclusions would be strengthened by additional datasets or models.","section":"Section 5 and Section 6"},{"comment":"Fig. 5 does not state the heterogeneity parameter β; adding it would improve reproducibility of the stealth-attack experiment.","section":"Fig. 5 caption"}],"recommendation":"reject","confidential_remarks":"The paper's central claims are contradicted by its own tables, which suggests the authors may have misinterpreted the results. The repository availability is a plus, but the mismatch between narrative and data is too severe for publication in its current form. The 'proof' of controllability is also overstated."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: FedStrategist is a reasonable technical idea — a LinUCB contextual bandit choosing among FedAvg/Median/Krum with a cost-aware reward. That specific combination is new relative to SARA (context-free MAB) and FedCostAware (cost-aware client selection), and the authors honestly discuss the accuracy-vs-integrity dilemma in Section 7.2. They also ship source code and raw logs on Zenodo/GitHub, which is real evidence and more than many papers do.\n\nThe problem is that the paper's own tables contradict its headline claims. The low-heterogeneity scenario (S1 Table 3) is described as 'Krum-favorable' and Section 6.4 calls Krum the 'clear champion', but Krum has the lowest final accuracy (39.97%) among FedAvg (43.29%), Median (44.39%), and Adaptive (44.31%). That is not a minor discrepancy. Second, Section 6.5 and the abstract claim the risk parameter lambda_cost controls the agent's policy, but S1 Table 4 shows the identical policy distribution (94% FedAvg, 4% Median, 2% Krum) for lambda = 0.5, 1.0, and 2.0, with only a small shift from lambda = 0.1 (92/4/4). The claimed 'risk dial' does not turn. Calling this a 'proof' of controllability is not supported by anything in the paper.\n\nThere is also a more fundamental issue: the reward R_t = (Acc_t - Acc_{t-1}) - lambda*C_j rewards raw accuracy gain. In the stealth-attack experiment, Section 7.2 itself says FedAvg is compromised but achieves the highest accuracy. So the agent's 94% FedAvg selection is exactly what the reward encourages; the paper treats this as a 'conservative policy', but it is the opposite. The reward is misaligned with the stated goal of model integrity, and the lambda-based steering is not evident in the data.\n\nNet: the contribution is a plausible framework, but the evidence presented does not support the two central claims. This is a reject. I would not cite it as evidence. However, because the code and data are archived, a serious referee could ask for a re-analysis and corrected reporting, and the method is novel enough to warrant that effort rather than a desk rejection. My recommendation: engage, but expect heavy revision or a new submission.","headline":"A plausible adaptive-aggregation idea that its own reported tables contradict: the Krum-champion and lambda-controllability claims do not survive contact with the data.","tokens_in":14728,"tokens_out":3650,"would_cite":false,"duration_ms":40248,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"FedStrategist argues that the best defense in federated learning is an adaptive one: a contextual bandit chooses among aggregation rules in real time.","keywords":["federated learning","model poisoning attacks","Byzantine-robust aggregation","contextual bandit","LinUCB","adaptive defense","risk tolerance","aggregation rule selection"],"falsifier":"Run the stealth-attack experiment to completion, then inspect the final adaptive-agent model for the attacker's injected behavior using trigger patterns or a target-class misclassification probe. If the final model is as compromised as the undefended FedAvg model, or if the agent still selects FedAvg in roughly 94% of rounds as reported in Table 4, the claim that the agent learns a conservative integrity-preserving policy is falsified.","tokens_in":13669,"feed_emoji":"🛡️","tokens_out":7192,"duration_ms":78727,"temperature":0.7,"pith_summary":"The paper argues that no static aggregation rule is best in all federated-learning conditions and that defense selection should itself be adaptive. It introduces FedStrategist, a lightweight contextual bandit that reads cheap diagnostics from the client updates each round and chooses among FedAvg, coordinate-wise median, and Krum. The central claim is that this agent learns policies that match or exceed the best static baselines under standard poisoning, tracks Krum when Krum is favored by the environment, and still keeps a stable, integrity-oriented policy under a stealth attack that blinds one of its diagnostics. The authors further claim that a single risk-tolerance parameter in the reward makes the trade-off between raw accuracy and robust behavior controllable in practice.","feed_headline":"No single FL defense wins; a switching agent learns to adapt","feed_subtitle":"FedStrategist's contextual bandit picks among FedAvg, Median, and Krum in real time, tuned by one risk parameter.","key_machinery":"The load-bearing mechanism is a contextual bandit whose reward is $R_t = (\\mathrm{Acc}_t - \\mathrm{Acc}_{t-1}) - \\lambda_{\\mathrm{cost}} C_j$, with accuracy measured on a server-held proxy validation set and $C_j$ a normalized heuristic cost for the chosen aggregation rule. LinUCB models each rule's expected reward as a linear function of a three-dimensional state vector—variance of update norms, average pairwise cosine similarity, and norm of the mean update—and selects the rule maximizing the upper confidence bound. This machinery makes 'which defense to run' a per-round decision, and lets $\\lambda$ act as a risk dial that the practitioner can turn without retraining the bandit.","core_discovery":"The central discovery is that robust aggregation in federated learning is better framed as a real-time control problem than as a choice of a single defense. Using a LinUCB contextual bandit over a three-metric diagnostic state, the paper shows empirically that the adaptive policy outperforms fixed FedAvg, median, and Krum under a standard poisoning attack, tracks Krum when the environment favors Krum, and under a stealth poisoning attack produces a more stable model than the robust baselines while not chasing the highest raw accuracy achieved by a compromised FedAvg. The authors interpret this as evidence that the agent learns a conservative policy that prioritizes model integrity over raw test-set accuracy, and they show that the reward coefficient $\\lambda$ shifts the policy between aggressive FedAvg-heavy and cautious median-heavy behavior.","pith_inferences":["The paper leaves implicit that its reward is only as trustworthy as the proxy validation accuracy: the paper's own Table 4 reports the agent selecting FedAvg in 94% of stealth-attack rounds, which suggests that when a poisoned model scores high on that proxy the agent will favor the non-robust rule despite the claimed conservative policy.","A natural extension is to replace the accuracy-only reward with an integrity-aware signal, such as a small calibration set probed for backdoor triggers or class-specific corruption, which would let the risk parameter genuinely control robustness rather than mainly control convergence speed.","Because the state vector has only three metrics, an adversary who learns to spoof cosine similarity while keeping norm variance low could blind the remaining signals; testing the agent against adversaries that manipulate multiple diagnostics simultaneously would define the real boundary of the framework."],"forward_implications":["Deploying a single static aggregation rule is a losing strategy in heterogeneous or adversarial settings; operators should expect the best rule to change with the data distribution and threat profile.","A single scalar risk tolerance can trade raw accuracy for stability and robustness, so the same framework can serve both aggressive and security-conservative deployments without redesign.","The agent can discover and track the best static defense even when that defense is Krum, which suggests the adaptive policy does not bake in a permanent preference for one aggregation family.","Lightweight diagnostics are sufficient for the agent to retain a useful policy even when an adversary deliberately neutralizes one of its metrics, lowering the computational cost of deploying adaptive defenses."],"supporting_citations":[{"why":"Defines Krum, the geometric Byzantine-robust aggregation rule that serves as one of the agent's arms and whose failure under heterogeneity motivates adaptivity.","marker":"[19]"},{"why":"Supplies the local model poisoning attack constructions, including scaled and stealth update strategies, used as the threat model.","marker":"[5]"},{"why":"First formalized aggregation-rule selection as a multi-armed bandit (SARA), the context-free baseline that FedStrategist extends to a contextual bandit.","marker":"[60]"},{"why":"Introduced a cost-aware reward with a tunable parameter in federated learning, the source of the cost-balancing design with $\\lambda$.","marker":"[63]"},{"why":"Defines FedAvg, the canonical non-robust aggregation baseline that is both a defense-arsenal arm and the main comparison point.","marker":"[1]"},{"why":"Provides the coordinate-wise median and trimmed-mean robust aggregation family that supplies the median arm of the arsenal.","marker":"[57]"}],"fun_headline_variants":["Meta-agent picks best FL defense per scenario","Real-time bandit switches FL aggregation rules","Adaptive FL aggregation beats static defenses","One risk knob tunes FedStrategist's defense choices","Bandit learns to favor robust FL aggregation"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole integrity claim rests on the assumption that an increase in validation accuracy from one round to the next means the chosen defense is keeping the model healthy; if a poisoned model can score high on that same accuracy measure, the reward will reward the attacker.","fun_headline_variants_meta":{"raw":{"variants":["Meta-agent picks best FL defense per scenario","Real-time bandit switches FL aggregation rules","Adaptive FL aggregation beats static defenses","One risk knob tunes FedStrategist's defense choices","Bandit learns to favor robust FL aggregation"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000186,"raw_usage":{"total_tokens":1319,"prompt_tokens":930,"completion_tokens":389,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":546,"completion_tokens_details":{"reasoning_tokens":322}},"tokens_in":546,"tokens_out":389,"duration_ms":5387,"temperature":1.0,"reasoning_tokens":322,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T15:58:40.555985+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the stealth-attack experiment to completion, then inspect the final adaptive-agent model for the attacker's injected behavior using trigger patterns or a target-class misclassification probe. If the final model is as compromised as the undefended FedAvg model, or if the agent still selects FedAvg in roughly 94% of rounds as reported in Table 4, the claim that the agent learns a conservative integrity-preserving policy is falsified.","supporting_citations":[{"cited_title":"Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent","cited_arxiv_id":null,"evidence_quote":"Defines Krum, the geometric Byzantine-robust aggregation rule that serves as one of the agent's arms and whose failure under heterogeneity motivates adaptivity."},{"cited_title":"Local Model Poisoning Attacks to Byzantine-Robust Federated Learning","cited_arxiv_id":null,"evidence_quote":"Supplies the local model poisoning attack constructions, including scaled and stealth update strategies, used as the threat model."},{"cited_title":"Adapting Aggregation Rule for Robust Federated Learning under Dynamic Attacks","cited_arxiv_id":null,"evidence_quote":"First formalized aggregation-rule selection as a multi-armed bandit (SARA), the context-free baseline that FedStrategist extends to a contextual bandit."},{"cited_title":"FedCostAware: Enabling Cost-Aware Federated Learning on the Cloud","cited_arxiv_id":"2505.21727","evidence_quote":"Introduced a cost-aware reward with a tunable parameter in federated learning, the source of the cost-balancing design with $\\lambda$."},{"cited_title":"Communication-Efficient Learning of Deep Networks from Decentralized Data","cited_arxiv_id":null,"evidence_quote":"Defines FedAvg, the canonical non-robust aggregation baseline that is both a defense-arsenal arm and the main comparison point."},{"cited_title":"Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates","cited_arxiv_id":null,"evidence_quote":"Provides the coordinate-wise median and trimmed-mean robust aggregation family that supplies the median arm of the arsenal."}],"review_version":1}