{"id":"e406ee80-81e9-474c-a783-3efca50cdf33","arxiv_id":"2507.19045","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Feature-level rectified flow generation plus dual-layer knowledge distillation yields a one-shot federated learning method that beats several baselines on three non-IID medical imaging datasets.","lead":"A new one-shot federated learning framework for medical images trains a rectified flow model on local image features, then uses dual-layer knowledge distillation to build a global model in a single round. Tests on three medical datasets report accuracy gains over several federated baselines, but the paper's own abstract numbers do not match its result tables.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Privacy guarantee in §3.4 is the load-bearing weak spot: H(x|z)>0 is asserted, not measured; the DPI chain is unproven for label-conditioned sampling; and the Table 5 decoder is a benign actor, so the claimed feature-level privacy advantage is unsupported.","rationale":"I read the paper in good faith: the FG-RF/DLKD combination is a plausible construction, and the reported accuracy gains over FedISCA and multi-round FL are suggestive but not independently verified here. The single most load-bearing concern is the privacy claim, exactly where the reader placed it. My stress test sharpens the reader's objection: it is not only that H(x|z)>0 is unmeasured; the DPI chain itself is not established because sampling is label-conditioned, and the pixel-level baseline's H(x|żx)≈0 is also assumed. The empirical privacy test uses a self-trained decoder rather than a worst-case adversary, so the current evidence does not support the strong statement that feature-level synthesis 'significantly reduces privacy leakage risks.' This concern is load-bearing because the abstract and introduction present privacy preservation as a primary motivation for FG-RF. However, the accuracy results are logically separable: even if the privacy advantage were disproved, the framework could still be a useful one-shot aggregation method. The abstract's numerical inconsistencies (21.73%/21.75% vs. Table 1) and missing error bars are real but secondary; they weaken confidence in reporting without, by themselves, invalidating the central method. A targeted adversarial-reconstruction experiment could settle the privacy question, so the appropriate outcome is to keep the reader's CONDITIONAL verdict rather than escalate to rejection. My read therefore does not change the verdict.","tokens_in":12823,"tokens_out":7967,"duration_ms":88251,"concrete_test":"Run a worst-case reconstruction attack on both variants: hold out 20% of each client's real images, train a high-capacity conditional decoder (e.g., a U-Net or conditional diffusion model) mapping synthetic features żz back to original images x, with access to the same feature extractor and labels as the server, and report LPIPS/PSNR and a membership-inference AUC against both feature-level and pixel-level synthetic outputs. If a strong decoder reconstructs x from żz at near-pixel-level fidelity, or if the membership-inference attack succeeds at comparable rates for feature- and pixel-level generation, the claimed privacy advantage in Eq. (16) fails. Complement this with an empirical MI lower bound I(x;z) estimated on held-out data (e.g., MINE or a kernel estimator) to test whether H(x|z)>0 is actually nonzero and large enough to matter.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The claim of improved privacy rests on the information-theoretic argument in Section 3.4, Eqs. (12)-(16). Three required conditions are asserted but not established. First, Eq. (15) assumes H(x|z)>0 because the feature extractor is 'irreversible and lossy', but the extractor is only a conv layer plus tanh: tanh is bijective and a stride-1 convolution can be near-invertible, so no bound on H(x|z) is given. Second, the Markov chain x→z→żz used for DPI is not guaranteed because the RFM is trained with the class label y as an input (Fig. 4 and Algorithm 1's D_syn construction); y need not be a deterministic function of z, so żz may depend on information in x beyond z, and I(x;żz) can exceed I(x;z). Third, Eq. (14) assumes pixel-level generation satisfies H(x|żx)≈0, which is not generally true for generative models that do not memorize every training example. The empirical check in Table 5 measures ℓ₂ distance after reconstructing with a decoder trained by the authors, i.e., a cooperative adversary, not a worst-case reconstruction attack; larger ℓ₂ values for feature-level outputs do not establish a privacy advantage. Because privacy is one of the two headline contributions, this unproven assumption is load-bearing; the accuracy results are separable and, if reproducible, could stand even if the privacy claim is weakened.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes a one-shot federated learning framework for medical image classification. Each client trains a feature extractor and classifier on its local non-IID data, then trains a rectified flow model on the extracted features, and uploads only the classifier and flow model to the server. The server samples synthetic features from the flow models, aggregates the client classifiers into a teacher ensemble, and trains a global student via Dual-Layer Knowledge Distillation that matches both output logits and intermediate-layer features. Experiments on three medical imaging datasets report accuracies of 60.15%, 86.32%, and 70.01%, which the authors interpret as improvements over multi-round FL, over other one-shot methods, and over a DDPM variant, along with lower training and inference times. The paper also presents an information-theoretic privacy analysis and a generalization bound for the distillation step.","tokens_in":13180,"tokens_out":7912,"duration_ms":80873,"significance":"If the empirical results are reproducible, the framework is a useful contribution: it targets a practical problem, one-shot federated learning under non-IID medical data, with a concrete mechanism combining feature-level rectified flow synthesis and two-level knowledge distillation. The reported accuracy gains over FedISCA and over multi-round FL are large, the efficiency comparison with DDPM is favorable, and the authors release code. However, the privacy guarantee, which is a headline contribution, is not established by the current argument, and the empirical claim is undermined by missing variance/seed reporting and by inconsistencies between the abstract and Table 1. The accuracy result is separable from the privacy claim and could stand after revision, but the paper needs substantial reworking before the central claims are supported.","major_comments":[{"comment":"The data-processing inequality step I(x;zhat) <= I(x;z) is not valid for the proposed pipeline because the rectified flow model is trained and sampled conditionally on the class label y (Figure 4 and Algorithm 1 line 15), and y is not a deterministic function of z; zhat can therefore carry information about x through y that is not mediated by z, so the Markov chain x -> z -> zhat is not guaranteed. In addition, the assumption H(x|z)>0 in Eq. (15) is asserted rather than established: the feature extractor is a stride-1 convolution followed by tanh, and tanh is bijective while a stride-1 convolution can be near-invertible. Please either measure or bound the mutual information for the actual extractor, or replace the formal privacy claim with an empirical reconstruction study under a well-defined threat model.","section":"Section 3.4, Eqs. (12)-(16)"},{"comment":"Equation (14) assumes that pixel-level generation achieves H(x|xhat) ≈ 0, but no memorization test is provided to support this, and generative models trained on finite data do not in general memorize every training example. The empirical check in Table 5 also does not establish a privacy advantage: the authors train a feature decoder themselves, which is a cooperative actor rather than a worst-case adversary, and the threshold delta=0.1 from reference [5] is applied without explaining why it remains meaningful for decoded feature-space outputs. Larger average L2 distances under this protocol do not show that feature-level generation leaks less information than pixel-level generation. Please state a concrete adversary model and report reconstruction success or information leakage under that model.","section":"Section 3.4, Eq. (14), and Section 4.5, Table 5"},{"comment":"The central empirical claim is not consistently reported. The abstract states an improvement of up to 21.73% and an average improvement over FedISCA of 21.75%, but the numbers in Table 1 imply improvements over FedAvg of 23.20, 31.44, and 14.93 percentage points (up to 31.44) and improvements over FedISCA of 23.38, 32.78, and 48.51 percentage points (average 34.89). Table 1 also reports no standard deviations, no number of seeds, and no statistical significance. Please correct the abstract, report mean and standard deviation over multiple seeds, and describe the evaluation protocol precisely.","section":"Abstract and Section 4.2, Table 1"},{"comment":"The generalization analysis is a standard domain-adaptation bound, and the claim that DLKD reduces both terms is not derived. The feature-alignment loss beta L_feat is minimized on synthetic features, but no argument shows that it reduces the H-divergence d_H(D_real, D_syn) or the distillation consistency term |eps_gen(s_psi) - eps_real(cbar_gamma)|. The symbol lambda is also reused for the loss weight in Eq. (1) and for the minimum combined error in Eq. (20), which is confusing. Please either provide a proof of the claimed reduction or state the bound as motivation and remove the claim of proof.","section":"Section 3.4, Eqs. (17)-(21)"},{"comment":"The experimental setup is underspecified to the point of preventing replication. The paper does not state the train/test split, the evaluation protocol, the client/server hyperparameters (learning rates, numbers of epochs, alpha, beta, temperature T, and selected intermediate layer l), or the exact non-IID sharding procedure for the Brain Tumor and HAM10000 datasets. It is also unclear how a client uses the returned student model s_psi on raw images, since s_psi is trained on feature vectors while the feature extractor is not uploaded to the server. The lack of this information, together with the absence of error bars, makes it difficult to rule out data leakage or test-set contamination.","section":"Section 4.1 and Algorithm 1"}],"minor_comments":[{"comment":"The acronym is spelled inconsistently: Section 3 introduces 'Dual-Layer Knowledge Distillation (DLDK)', while the title, abstract, and Algorithm 1 use DLKD; please standardize.","section":"Section 3 heading and Section 3.3"},{"comment":"Equation (1) writes the cross-entropy loss as L_CE(s_psi(x), y) even though D_syn is composed of synthetic features zhat; the student model input should be written consistently as z or zhat.","section":"Eq. (1) and Algorithm 1"},{"comment":"The notation z_i,T and z_i,0 is introduced without defining the noise endpoint, and T is also used for the total number of epochs; please rename one of these quantities to avoid ambiguity.","section":"Algorithm 1, line 7"},{"comment":"The ablation row labeled 'w/o DLKD and feature extractor' is not clearly defined; please state which components are removed in each row, especially whether this row corresponds to pixel-level generation.","section":"Table 4"},{"comment":"The phrases 'Train with pictures' and 'Train with features' are unclear; the caption should describe the two conditions, the decoder training procedure, and why delta=0.1 applies to decoded features.","section":"Section 4.5, Table 5"}],"recommendation":"major_revision","confidential_remarks":"The strongest concern is the privacy proof in Section 3.4: if the authors cannot provide a measured bound or a meaningful adversarial experiment, the formal privacy guarantee should be removed and replaced by a more modest empirical statement. The empirical accuracy claims are interesting but need correction of the abstract numbers and proper seed/variance reporting. The citation list includes several papers from the authors' own group that are closely related to the method; this is not inappropriate, but the related-work positioning should make the novelty relative to those papers explicit."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the paper is worth a serious look for the OSFL crowd. The new combination is feature-level rectified flow for one-shot federated learning plus dual-layer knowledge distillation. That specific packaging isn't in the prior work they cite, and the efficiency numbers are credible: FG-RF trains and samples much faster than the DDPM baseline. The accuracy results on three medical datasets are also suggestive—beating multi-round FL with one round is the kind of thing people in this subfield care about, and the ablations show each added component helps.\n\nThe soft spots are real but not all equal. The abstract numbers don't match Table 1: the abstract claims up to 21.73% improvement over multi-round FL and an average 21.75% over FedISCA, but the text reports 31.44% over FedAvg on Chest X-Ray and 48.51% over FedISCA on HAM10000. That's a glaring internal inconsistency; it should be fixed before anything else. Missing error bars and a single seed per experiment make the accuracy claims weaker than they look. I'd want at least three seeds for the main table.\n\nThe privacy argument is the load-bearing weak spot. Section 3.4 assumes the feature extractor is lossy and concludes H(x|z)>0, but the extractor is a stride-1 conv plus tanh—tanh is bijective and the conv can be near-invertible. They never measure H(x|z) or bound reconstruction error against a real adversary. The DPI chain is also shaky because the RFM is label-conditioned, so the Markov assumption isn't guaranteed. And the Table 5 test uses a decoder they trained, i.e., a cooperative actor, not a worst-case adversary. I don't think the privacy conclusion is salvageable as stated. The accuracy results are separable, so the paper could stand without the privacy proof if they reframe that section as a heuristic argument.\n\nThe generalization bound is more of a repackaging of Ben-David plus a claim that DLKD reduces both terms—no real novelty, but it doesn't hurt. The self-citations are partly from the same group but mostly to prior OSFL work in the area, not a red flag.\n\nWho this is for: people working on one-shot federated learning or medical FL. They'll get a concrete method with code and a dataset setup they can build on. It deserves peer review, but only after the authors fix the number mismatch, add variance stats, and weaken the privacy claims to match the evidence. I'd engage with it.","headline":"Solid engineering result with a plausible accuracy story; the privacy claim is the part that needs real work before I'd trust it.","tokens_in":13644,"tokens_out":952,"would_cite":false,"duration_ms":10988,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that one-shot federated learning can beat multi-round federated learning on medical image classification when clients share a feature-level rectified flow model and the server trains the global model with dual-layer…","keywords":["one-shot federated learning","rectified flow","knowledge distillation","medical image classification","non-IID data","privacy-preserving generation","feature-level synthesis","data-free aggregation"],"falsifier":"Train a powerful, unconstrained reconstruction decoder against the synthetic features produced by FG-RF and measure the minimum $\\ell_2$ distance between reconstructed and original training images; if any original image is recovered at or below the paper's own 0.1 memorization threshold, the claimed strict privacy advantage of feature-level generation over pixel-level generation fails.","tokens_in":12675,"feed_emoji":"🩺","tokens_out":10097,"duration_ms":96392,"temperature":0.7,"pith_summary":"This paper claims that one-shot federated learning can beat multi-round federated learning for medical image classification if clients upload a feature-level generative model and the server trains the global model with dual-layer knowledge distillation. Clients train a convolutional plus tanh feature extractor paired with a classifier, then a rectified flow model on the extracted features; only these trained models are transmitted. The server samples synthetic features from every client, forms an averaged teacher from client classifiers, and trains a student on synthetic features with cross-entropy, logit distillation, and intermediate-feature alignment. On three non-IID medical datasets (brain-tumor MRI, chest X-ray tuberculosis, skin-lesion dermoscopy) the method reaches 60.15%, 86.32%, and 70.01% accuracy, outperforming the tested multi-round federated learning methods and a medical-imaging one-shot baseline. If correct, this would make single-round aggregation a practical and more private option for multi-center medical imaging.","feed_headline":"Feature-level one-shot FL beats multi-round rivals on medical images","feed_subtitle":"One upload round reaches 60-86% accuracy on non-IID medical data, with faster training and stronger privacy.","key_machinery":"Feature-Guided Rectified Flow (FG-RF) plus Dual-Layer Knowledge Distillation (DLKD). In FG-RF, each client trains a lossy feature extractor (a convolutional layer followed by tanh) and a classifier; the rectified flow model learns the velocity field $g_\\phi(z_t, t)$ that transports Gaussian noise $z_T$ to target features $z_0$ along a linear interpolation path, and the server samples synthetic features $\\hat{z}$ by solving the ODE. In DLKD, the server averages uploaded classifiers into a teacher $\\bar{c}_\\gamma$ and trains a student $s_\\psi$ on synthetic features with $(1-\\alpha)$ cross-entropy, $\\alpha$ KL divergence against teacher logits, and $\\beta$ $\\ell_2$ alignment of the student's third-layer features to the teacher's; this two-depth alignment is the mechanism claimed to reduce both the synthetic-real distribution gap and the logits-only distillation error.","core_discovery":"The central claim is that single-round aggregation can converge under non-IID medical data if the synthetic data are generated in a lossy feature space rather than pixel space, and if the student model imitates teachers at two depths. The paper shows this concretely: on three datasets, the framework exceeds the accuracy of multi-round federated learning baselines and of a comparable one-shot medical baseline, while training and inference are far faster than a pixel-level DDPM. Theoretically, the authors argue from the data-processing inequality that a Markov chain $x \\to z \\to \\hat{z}$ obeys $I(x; \\hat{z}) \\leq I(x; z) < I(x; \\hat{x})$, so feature-level generation leaks less about the original image than pixel-level generation, and from an $H$-divergence bound that aligning intermediate features reduces both the distribution gap and the distillation error. Experimentally, feature-level synthetic images have larger $\\ell_2$ distance from original images under a memorization threshold, which the paper interprets as evidence of reduced privacy leakage.","pith_inferences":["A natural next step would be to measure mutual information or reconstruction error for the actual conv+tanh extractor on each dataset; a numeric bound would convert the qualitative privacy argument into a testable guarantee.","Since DLKD only requires a chosen intermediate layer in student and teacher, the same scheme could in principle aggregate clients with different backbone architectures once a layer correspondence is fixed; the paper does not test this.","The reported speedups suggest that the efficiency advantage of feature-level rectified flow will grow with image resolution, making the approach a plausible fit for higher-resolution or volumetric medical scans."],"forward_implications":["A single communication round is enough to match or exceed 100-round federated learning on the three datasets tested, so communication costs drop by roughly two orders of magnitude.","Feature-level rectified flow is much faster than pixel-level DDPM: training time roughly halves and per-image inference drops from tens of seconds to under a second on the reported datasets.","Feature-level synthetic images stay farther from original images under the $\\ell_2$ memorization metric used, giving the method a measurable privacy margin over pixel-level generation.","The intermediate-feature alignment in DLKD is load-bearing: removing it lowers accuracy, for example from 86.32% to 84.74% on chest X-ray.","The method reproduces across MRI, chest X-ray, and dermoscopy, indicating the framework is not restricted to a single imaging modality."],"supporting_citations":[{"why":"Defines the rectified flow generative backbone used to synthesize features.","marker":"[23]"},{"why":"Introduces logits-based knowledge distillation, which DLKD extends with feature alignment.","marker":"[12]"},{"why":"Medical-imaging one-shot baseline that the method is compared against and outperforms.","marker":"[14]"},{"why":"Data-free adversarial one-shot method used as a comparison baseline.","marker":"[40]"},{"why":"Pixel-level DDPM baseline for the efficiency and generation-quality comparisons.","marker":"[13]"},{"why":"Domain-adaptation bound used to justify the generalization argument for DLKD.","marker":"[3]"},{"why":"Memorization metric and $\\ell_2$ threshold used in the privacy evaluation.","marker":"[5]"},{"why":"Shannon entropy and data-processing inequality used in the privacy proof.","marker":"[32]"}],"fun_headline_variants":["Feature-level one-shot FL tops multi-round medical imaging","One-shot FL: 21% better than multi-round on non-IID medical","Feature-guided rectified flow: faster, more private one-shot FL","One-shot FL: feature-level synthesis beats pixel-level for privacy"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The privacy guarantee rests on the claim that the conv+tanh feature extractor is truly lossy — that it destroys enough image information so no decoder can reconstruct the original image; the paper asserts this lossiness but does not measure or bound it for the actual extractor.","fun_headline_variants_meta":{"raw":{"variants":["Feature-level one-shot FL tops multi-round medical imaging","One-shot FL: 21% better than multi-round on non-IID medical","Feature-guided rectified flow: faster, more private one-shot FL","One-shot FL: feature-level synthesis beats pixel-level for privacy"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001564,"raw_usage":{"total_tokens":6290,"prompt_tokens":1033,"completion_tokens":5257,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":649,"completion_tokens_details":{"reasoning_tokens":5183}},"tokens_in":649,"tokens_out":5257,"duration_ms":38843,"temperature":1.0,"reasoning_tokens":5183,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T18:01:34.763748+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train a powerful, unconstrained reconstruction decoder against the synthetic features produced by FG-RF and measure the minimum $\\ell_2$ distance between reconstructed and original training images; if any original image is recovered at or below the paper's own 0.1 memorization threshold, the claimed strict privacy advantage of feature-level generation over pixel-level generation fails.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Medical-imaging one-shot baseline that the method is compared against and outperforms."},{"cited_title":"Zhang, C","cited_arxiv_id":null,"evidence_quote":"Data-free adversarial one-shot method used as a comparison baseline."},{"cited_title":"Ben-David, J","cited_arxiv_id":null,"evidence_quote":"Domain-adaptation bound used to justify the generalization argument for DLKD."},{"cited_title":"Carlini, J","cited_arxiv_id":null,"evidence_quote":"Memorization metric and $\\ell_2$ threshold used in the privacy evaluation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Shannon entropy and data-processing inequality used in the privacy proof."}],"review_version":2}