{"id":"13f47975-2355-400e-9426-709ab25a52ab","arxiv_id":"2507.20060","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Designed shifts that make the eavesdropper's Fisher information matrix singular hide one component of a federated model from network eavesdroppers.","lead":"Federated learning trains a shared model without exposing anyone's data, but an eavesdropper on the network can still reconstruct the model. This paper adds carefully designed shifts to each update that hide part of the model from the eavesdropper while letting the server undo the shift.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The FIM derivation assumes Eve knows the shift design, but the paper never states this; if the shifts are secret, Lemma IV.1 is not the FIM of Eve's actual problem.","rationale":"The paper's core linear algebra is correct: for a known shift function satisfying ∇f^T 1 = -1, the FIM in Eq. (9) is singular with nullspace along the all-ones vector, and the transmitted matrix I + 1γ^T has rank d-1. That part holds up under scrutiny. The load-bearing gap is the connection between this calculation and the actual adversary. The text repeatedly describes the shifts as being secretly shared with Bob, but the FIM derivation presupposes that Eve knows the function f_{k,n}. If γ is secret, then Eve's estimation problem has additional unknown parameters, and Eq. (9) is not the FIM of Eve's problem. A clarifying sentence that the shift design is public (Kerckhoffs-style) would close most of the gap, because the realized shift values sent to Bob are deterministic functions of δ. However, the paper does not say this, and the secure-channel phrasing supports the opposite reading. This ambiguity is central rather than cosmetic: it determines whether Proposition 1 describes Eve's information bound or a different, better-informed estimator's bound. The reader flagged exactly this point, and I agree with that assessment. Secondary concerns about the one-dimensional nature of the guarantee and the favorable simulation setup are real but less load-bearing, since the mathematical construction itself is sound; they affect the strength of the claimed privacy, not the validity of the derivation under its implicit assumptions.","tokens_in":7477,"tokens_out":18237,"duration_ms":205134,"concrete_test":"For the model y = δ + γ^T δ 1 + z with z Gaussian, γ unknown and constrained by γ^T 1 = -1, compute the joint Fisher information matrix for (δ, γ) and then the efficient FIM for δ by taking the Schur complement of the γ block. If this δ-block is nonsingular along the all-ones direction, Proposition 1's singular matrix is not Eve's FIM and the privacy claim does not follow; if it has a zero eigenvalue along 1, the hidden-direction conclusion survives, but Lemma IV.1 still needs an explicit threat-model statement before it can be cited as the eavesdropper's FIM.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Lemma IV.1 computes the Fisher information for the model in Eq. (5) treating the shift function f_{k,n} as a fixed, known function of the parameter δ_{k,n}. The paper never states that Eve knows f_{k,n}, and the contribution list says each agent 'secretly shares shift information' with Bob, while the secure-channel framing suggests the shift design (or at least the realized shift values) is hidden from Eve. If γ_{k,n} is unknown to Eve, then Eve's likelihood is not Eq. (5) with known f, but a model with nuisance parameters γ_{k,n} constrained by γ^T 1 = -1. The relevant FIM for δ is then the δ-block of the joint FIM for (δ, γ), not Eq. (9), and Proposition 1 does not by itself show that Eve's actual estimation problem is hard. The central claim therefore rests on an unstated threat-model choice: either the design γ is public and only the scalar shift values are secretly shared with Bob, or a different FIM computation is needed. As written, the gap between the stated adversarial model and the model used in the proof is left unresolved.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes ModShift, a scheme in which each federated-learning agent adds a designed shift f_{k,n}(δ_{k,n})1 to its local model update before transmission, with the shift shared with the server Bob over a secure channel. The authors model Eve's estimation of δ from the shifted update as a Gaussian parameter-estimation problem, derive the Fisher information matrix, and show that the shift condition ∇f^T 1 = -1 makes the FIM singular; a family of solutions f(δ)=γ^Tδ+g(Dδ) with γ^T1=-1 is given. They also propose a convergence-based tamper test, prove that ModShift passes it, and provide simulations comparing ModShift with noise injection on a linear regression task.","tokens_in":7549,"tokens_out":13039,"duration_ms":136161,"significance":"If the claims are taken at face value, the FIM-singularity technique is an interesting and potentially useful way to create a statistically unidentifiable direction in the transmitted model updates. The mathematical core (Lemma IV.1, Propositions 1 and 2) is correct: the FIM formula checks out, the eigenvalue computation is valid under the stated condition, and the solution family indeed satisfies the PDE. Proposition 3 is also a correct boundedness statement. However, the significance is substantially tempered by the fact that only a one-dimensional subspace of each update is hidden, and by an unresolved threat-model ambiguity about whether the shift design is known to Eve; these issues affect how the result should be interpreted and what is actually claimed as model privacy. The paper would be a useful contribution if these scope issues are addressed.","major_comments":[{"comment":"The likelihood in Eq. (5) treats f_{k,n}(·) as a known function of δ_k(n) when Eve forms her estimator, but the paper never states that Eve knows the shift design. The introduction and contribution list state that agents secretly share shift information with Bob, and the secure-channel framing suggests the shift design or its realized values are hidden from Eve. If Eve does not know γ_k(n) (or the nonlinear component g), then her unknown parameters include the shift parameters, and the FIM of her actual problem is the δ-block of the joint FIM for (δ, γ), not Eq. (9). Proposition 1 would then not establish singularity of Eve's actual FIM. The authors must explicitly adopt a threat model: either the design is public and only the scalar shift values are secret, or, if the design is secret, they must recompute the relevant FIM or prove that the public-design FIM is a valid lower bound. This is the load-bearing step for the paper's central privacy claim.","section":"III (Eq. (5)) and IV (Lemma IV.1)"},{"comment":"The proved result is that the FIM has exactly one zero eigenvalue, hence only one linear combination of the entries of δ_k(n) is unidentifiable. For the whole family in Eq. (17), the transmitted vector is invariant under δ → δ + c1 for every real c, since γ^T1 = −1 and D(δ+c1) = Dδ; therefore Eve cannot determine the all-ones component of δ_k(n), while the other d−1 components are identifiable with positive Fisher information. The accumulated ambiguity over agents and rounds is a single scalar multiple of the all-ones vector in the global model. Calling this model privacy or a hard estimation problem overstates the guarantee. The paper should restate the privacy claim as one-dimensional unidentifiability along the all-ones vector and discuss what this implies for the global model, rather than implying that the entire model update is protected.","section":"IV, Eq. (19), Proposition 1"},{"comment":"The protocol for Bob's compensation is underspecified. The transmitted vector is Mδ_k(n) with M = I + 1γ_k(n)^T, a rank-(d−1) matrix under the design condition. Knowing γ_k(n) alone does not allow Bob to invert M and recover δ_k(n) from y_B^k(n); Bob also needs the scalar shift value f_{k,n}(δ_k(n)) (or an equivalent piece of information) over the secure channel. The paper says after compensating for shifts, Bob's received signal remains as in Equation (3), but it does not say what is sent on the secure channel or how the compensation is computed. This is needed both for the threat model (what Eve does not know) and for the claim that server accuracy is preserved.","section":"III and IV, Eq. (19)"}],"minor_comments":[{"comment":"In the proof, 'Proposition IV.1' should be a reference to Lemma IV.1; the current wording is confusing.","section":"IV, proof of Proposition 1"},{"comment":"Equation (17) is not numbered; Proposition 2 should include an equation number for easy reference.","section":"IV, Eq. (17)"},{"comment":"Figures 2 and 3 report single quantities without error bars or a description of how many random seeds were used; please clarify whether these are representative runs or averaged curves.","section":"VI, Figures 2 and 3"},{"comment":"The definition of α(n) is undefined when the denominator ||Σ (m_k/m)δ_k(n)|| is zero; add a convention or state that the bound is vacuous in that case.","section":"V, Proposition 3"},{"comment":"The claim that ModShift requires less secret-channel bandwidth should be made quantitative: the Max scheme appears to require only an index (log2 d bits) plus possibly the shift value, whereas the noise-injection comparison sends d-dimensional noise; state the bit counts explicitly.","section":"VI, secret-channel comparison"}],"recommendation":"major_revision","confidential_remarks":"The paper's core mathematical derivation is correct but the privacy claim is significantly narrower than the abstract suggests, and the threat model needs to be stated explicitly. I recommend major revision rather than rejection because the fixes (adopting a Kerckhoffs-style public-design assumption, restating the guarantee as one-dimensional unidentifiability, and specifying Bob's compensation protocol) are within the manuscript's scope. I do not see grounds for questioning the authors' integrity or the novelty of the FIM-singularity idea."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a legitimate extension of the authors' earlier FIM-shaping work to a new domain, and the core derivation is correct. But the privacy guarantee is one-dimensional and the threat model is underspecified; as written, it should not be sold as 'model privacy.'\n\nWhat's new: treating the federated learning update as a parameter to be estimated, designing a shift f(δ)1 with ∇fᵀ1 = -1 to make Eve's FIM singular, and the family γᵀδ + g(Dδ). Lemma IV.1, Proposition 1, and Proposition 2 check out for the stated Gaussian model: the transmitted update (I + 1γᵀ)δ has rank d-1, so Eve cannot identify the component along the all-ones vector. The convergence test is a reasonable tamper-detection heuristic, and the paper honestly notes that only g = 0 is explored and that the condition is sufficient, not necessary.\n\nSoft spots, in order of importance. First, the threat model: Lemma IV.1 assumes Eve's likelihood has a known f_k,n. The paper never states whether γ is public or secret. If γ is secretly shared with Bob, then Eve's estimation problem includes nuisance parameters γ, and the relevant FIM is the δ-block of the joint FIM for (δ, γ), not Eq. (9). The stress-test note is right, and this is not a minor footnote: Proposition 1 alone does not establish that Eve's actual problem is hard. The paper needs to either state that the shift design is public or redo the FIM under secret γ. Second, overreach: a singular FIM implies only that the all-ones component of each update is unidentifiable. An eavesdropper still learns the other d-1 dimensions of every update. Calling that 'model privacy' is too strong; the abstract and conclusions need the one-dimensional caveat. Third, the empirics are favorable: the true model w = [1, 2, ..., 60] has a large mean pointing exactly along the hidden direction, and Eve is modeled as an update-follower rather than a smarter estimator. No code, no data, no error bars; the comparison to noise injection is illustrative, not a benchmark. These are fixable.\n\nOverall: the mathematical core is sound and the application is a real extension of prior work, but the paper needs revision on the threat model and the claims before I would trust it as a privacy result. It deserves peer review, with a request for major revision.","headline":"A correct but narrowly scoped FIM-singularity trick ported to federated learning; the math holds, but the privacy claim and threat model need honest tightening.","tokens_in":8210,"tokens_out":1814,"would_cite":false,"duration_ms":17535,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["62B10","68T05"],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper proposes ModShift, in which each client adds a designed shift to its federated-learning update, making the eavesdropper's Fisher information matrix singular so one component of the global model cannot be estimated.","keywords":["model privacy","federated learning","Fisher information matrix","model shift","eavesdropper","parameter estimation","singular Fisher information","secure channel"],"falsifier":"If an eavesdropper who knows $\\gamma$ observes the exact, noiseless transmitted updates $(I+\\mathbf{1}\\gamma^{\\mathsf T})\\delta$ for many rounds, the all-ones component of $\\delta$ never appears, so it cannot be recovered; a more decisive calculation is to form the Fisher information matrix for the joint parameter $(\\delta,\\gamma)$ when $\\gamma$ is secret and check whether it is singular.","tokens_in":7123,"feed_emoji":"🔒","tokens_out":11308,"duration_ms":103786,"temperature":0.7,"pith_summary":"This paper asks whether a federated-learning server and its clients can keep the global model secret from an eavesdropper who intercepts every update. Its answer is to have each client add a designed shift to its update before transmission, with the shift shared only with the server. Treating the eavesdropper as a statistician estimating the update, the authors show a condition on the shift that makes the eavesdropper's Fisher information matrix singular. A singular information matrix means one direction in parameter space cannot be estimated at all; here the unidentifiable direction is the one in which all entries of the update move together. If the scheme works as claimed, model privacy is obtained without changing what the server learns and with only one scalar per client transmitted over the secret channel.","feed_headline":"One scalar shift blinds an eavesdropper in federated learning","feed_subtitle":"A singular Fisher information matrix keeps one component of the global model unidentifiable.","key_machinery":"The load-bearing object is the shift function $f_{k,n}(\\delta)$ added to each update as $f_{k,n}(\\delta)\\mathbf{1}$, chosen so that the eavesdropper's Fisher information matrix becomes singular. The design condition $\\nabla f_{k,n}^{\\mathsf T}\\mathbf{1}=-1$ is a first-order linear PDE, solved by the family $f_{k,n}(\\delta)=\\gamma_{k,n}^{\\mathsf T}\\delta + g(D\\delta)$ with $\\gamma_{k,n}^{\\mathsf T}\\mathbf{1}=-1$. With $g=0$ the transmitted update is $(I+\\mathbf{1}\\gamma_{k,n}^{\\mathsf T})\\delta$, a rank $d-1$ matrix whose nullspace is the span of $\\mathbf{1}$; this is the concrete mechanism that confines the eavesdropper to $d-1$ dimensions while the server, knowing $\\gamma_{k,n}$, removes the shift exactly.","core_discovery":"The central claim is Proposition 1: for the shifted observation model $y_k^{E}(n) = \\delta_k(n) + f_{k,n}(\\delta_k(n))\\mathbf{1} + z_k^{E}(n)$, the Fisher information matrix $J(\\delta_k(n))$ is singular whenever $\\nabla f_{k,n}(\\delta_k(n))^{\\mathsf T}\\mathbf{1} = -1$. Under this condition one eigenvalue of $J$ is zero, so the data carry no information about the sum of the entries of $\\delta_k(n)$. Proposition 2 exhibits a family of shifts satisfying the condition, $f_{k,n}(\\delta) = \\gamma_{k,n}^{\\mathsf T}\\delta + g(D\\delta)$ with $\\gamma_{k,n}^{\\mathsf T}\\mathbf{1}=-1$; in the linear case $g=0$ the transmitted update is $(I + \\mathbf{1}\\gamma_{k,n}^{\\mathsf T})\\delta$, a rank $d-1$ transformation. The eavesdropper can therefore estimate at most $d-1$ dimensions of each update and never the component along $\\mathbf{1}$. The paper also proves the scheme passes the convergence test an eavesdropper might use to detect tampering: whenever the true updates converge, the norm of the eavesdropper's update is bounded by a constant multiple of the true update norm.","pith_inferences":["Beyond the paper: the threat model for $\\gamma$ is implicit. If $\\gamma$ is a per-round secret, the eavesdropper's estimation problem is a composite model and the singular-Fisher-information argument conditions on the unknown shift; a Bayesian extension over $\\gamma$ would show whether the protected direction becomes partially identifiable across rounds.","Beyond the paper: the protected direction is tied to the all-ones vector by construction. A direct generalization is to replace $\\mathbf{1}$ by a secret subspace $U$ and shift by $U\\psi$, hiding an arbitrary subspace of the model rather than a fixed coordinate direction.","Beyond the paper: the comparison with noise injection suggests a sharper metric, namely privacy per bit of secret-channel bandwidth or estimation error per secret bit. Under such a metric the scalar shift is likely to dominate, but the paper does not formalize that tradeoff."],"forward_implications":["An eavesdropper who intercepts every client-server update in every round still cannot estimate the component of any update along the all-ones direction, so the global model is only partially identified.","The server's estimate of the global model is unchanged by ModShift, because Bob knows the shift and removes it before aggregation.","ModShift passes the convergence test an eavesdropper could use to detect tampering: whenever Bob's updates converge, Eve's updates converge at a bounded multiple rate, so the shift is not flagged.","Privacy is obtained by sending one scalar $\\gamma$ per client per round over the secret channel instead of a $d$-dimensional noise vector, and the simulations show a larger model shift for Eve than unshifted or noise-injected training at comparable settings.","The family of valid shift functions is large (any $g$ with zero derivative sum, for example $g=0$), so the design can be tuned while preserving the singularity condition."],"supporting_citations":[{"why":"Defines the federated averaging procedure whose per-client update structure ModShift modifies.","marker":"[15]"},{"why":"Supplies the Fisher information formula for estimating a parametric mean in Gaussian noise, giving Lemma IV.1.","marker":"[20]"},{"why":"Provides the Matrix Determinant Lemma used to compute eigenvalues and the singularity condition.","marker":"[21]"},{"why":"Provides the method of characteristics used to solve the PDE and obtain the shift family.","marker":"[22]"},{"why":"Establishes the signal-shaping approach of driving an eavesdropper's Fisher information to singularity that this paper adapts to model privacy.","marker":"[11]"}],"fun_headline_variants":["Shift blinds eavesdropper in federated learning","Singular Fisher info conceals model from Eve","Designed shifts keep model private from eavesdropper","One scalar shift hides a component of the model","Model privacy via Fisher-singular shifts"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the eavesdropper's estimation problem is exactly the one in Equation (5), with the shift function f known to her; if the shift parameters are instead secret, as the secure-channel phrasing suggests, the true estimation problem includes the unknown $\\gamma$ and the singular-Fisher-information argument does not directly apply.","fun_headline_variants_meta":{"raw":{"variants":["Shift blinds eavesdropper in federated learning","Singular Fisher info conceals model from Eve","Designed shifts keep model private from eavesdropper","One scalar shift hides a component of the model","Model privacy via Fisher-singular shifts"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000186,"raw_usage":{"total_tokens":1315,"prompt_tokens":922,"completion_tokens":393,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":538,"completion_tokens_details":{"reasoning_tokens":322}},"tokens_in":538,"tokens_out":393,"duration_ms":3957,"temperature":1.0,"reasoning_tokens":322,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T17:53:13.424952+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"If an eavesdropper who knows $\\gamma$ observes the exact, noiseless transmitted updates $(I+\\mathbf{1}\\gamma^{\\mathsf T})\\delta$ for many rounds, the all-ones component of $\\delta$ never appears, so it cannot be recovered; a more decisive calculation is to form the Fisher information matrix for the joint parameter $(\\delta,\\gamma)$ when $\\gamma$ is secret and check whether it is singular.","supporting_citations":[{"cited_title":"Pinchover and J","cited_arxiv_id":null,"evidence_quote":"Provides the method of characteristics used to solve the PDE and obtain the shift family."},{"cited_title":"Guaranteed private communication with secret block structure,","cited_arxiv_id":null,"evidence_quote":"Establishes the signal-shaping approach of driving an eavesdropper's Fisher information to singularity that this paper adapts to model privacy."}],"review_version":1}