{"id":"3525bca4-6e36-48ca-a016-264929acebb3","arxiv_id":"2507.22849","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":5,"one_line_summary":"A decentralized power method for PCA with row-wise data partitioning is augmented with Gaussian noise to claim differential privacy; the algorithm and experiments are plausible but the privacy proof is incomplete.","lead":"The paper proposes a fully decentralized, differentially private power method for PCA in which each agent holds a block of rows of the data matrix and shares only noised projections. The contribution is a privacy-utility analysis for a setting without a central aggregator, but the proof of the differential privacy guarantee has a significant gap in how local randomness is treated.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 2 does not prove (epsilon,delta)-DP: its privacy-loss probability conditions on agent i's private randomness and is unbounded in q_i^0 and p_i, so the claimed marginal guarantee never follows.","rationale":"The paper's advertised contribution has two load-bearing theorems. I focused on Theorem 2 because the headline is a formal (epsilon,delta)-DP guarantee, and that guarantee is not established by the text. The concern is not 'outside consensus'; it is internal to the argument. The proof in Appendix B1 fixes q_i^0 and p_i and treats them as known constants. Under Definition 2, however, the probability must be taken over all randomness of the algorithm, including agent i's initialization and per-iteration noise. The theorem's delta_i is a conditional tail probability; the RHS is just the standard Chernoff bound for that fixed conditional pair. Unless the Renyi divergence is bounded uniformly in q_i^0,p_i, the conditional tail can be large for some realizations, and no averaging argument is supplied. In fact, the conditional Gaussian means in (29) shift linearly with q_i^0,p_i under adjacency, so the equal-covariance Renyi divergence grows quadratically in those variables; it is not uniform. This exposes exactly the gap the reader identified. I also checked Theorem 3: the bound's Delta is defined through an inequality involving ||Q - Theta*Omega||, with Theta itself defined in terms of Delta, so the displayed bound is not an explicit computable quantity; this is another genuine defect. I nonetheless did not make it the primary attack because the DP theorem is the more central and more consequential failure. The proposed concrete test is deliberately small: a 2-agent, 1-dimensional, single-iteration instance is enough to exhibit the non-uniformity. If the unconditional delta matches the claimed bound, the concern would be refuted; if it does not, the paper needs a fundamentally different privacy argument.","tokens_in":15431,"tokens_out":9745,"duration_ms":122783,"concrete_test":"Simulate the minimal instance m=2, d=1, n_i=1, T=1 of Algorithm 1 with data rows placed on the unit ball and fixed epsilon, sigma_q, sigma_p, alpha. For a grid of q_i^0 and p_i values, evaluate the Renyi divergence in Theorem 2 and the conditional delta_i; show it grows with ||q_i^0||. Then Monte-Carlo the unconditional PDP delta_uncond = Pr_{q_i^0,p_i,y_i}[ln f(y_i|X)/f(y_i|X') > epsilon] (with f the marginal density obtained by integrating over q_i^0,p_i) and compare to the conditional bound. If delta_uncond exceeds the claimed delta while the conditional delta_i at typical draws is below it, Theorem 2's conditional analysis does not establish Algorithm 1's DP guarantee.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that Algorithm 1 is (epsilon,delta)-DP is unsupported. In Sec. III.A.1, Theorem 2 bounds delta_i := Pr[ln f(y_i | X, q_i^0, p_i^(1..T)) / f(y_i | X', q_i^0, p_i^(1..T)) > epsilon], where q_i^0 and p_i are agent i's own Gaussian randomness. The densities in this ratio are conditional, not the marginal densities that enter Definition 1 or Definition 2; Theorem 2 only inserts the closed-form Renyi divergence (33)-(34) into a Chernoff bound. No step controls that divergence uniformly over q_i^0 and p_i, and no marginalization over them is provided. For an adjacent pair differing in one row of X_i, both the mean and covariance in (29) depend on X_i and on q_i^0, p_i; in the equal-covariance case the Renyi term is monotone in ||q_i^0||^2 + sum ||p_i^(t)||^2, so for large private-noise realizations the conditional delta_i can be arbitrarily close to 1. Since the adversary (node j) does not know q_i^0 or p_i, the relevant object is the mixture over that randomness; a per-realization Chernoff bound does not imply the mixture is (epsilon,delta)-DP unless the bound is uniform, which it is not. Theorem 2 is therefore vacuous as a privacy guarantee, and the delta values reported in Fig. 3 are not evidence for the headline claim.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes D-DP-PM, a decentralized differentially private power method for PCA when the data matrix is partitioned row-wise across agents. Each agent maintains a local portion q_i of the eigenvector iterate, computes local projections z_i = X_i^T q_i, aggregates them via average consensus, adds Gaussian noise, and rescales by a fixed factor alpha instead of normalizing, in order to preserve Gaussianity. The paper claims an (epsilon,delta)-DP guarantee via a Renyi-divergence argument on the stacked releases, and a high-probability convergence bound that separates the effects of consensus error and DP noise. Experiments on four datasets compare the method against a local-noise baseline.","tokens_in":1706,"tokens_out":1566,"duration_ms":159944,"significance":"If the analysis were correct, the paper would make a meaningful contribution: it appears to be the first decentralized DP power method for row-wise partitioned data without a central aggregator, and the Gaussian-preserving design yields a clean separation of utility and privacy terms. The convergence theorem's explicit dependence on the mixing matrix and the consensus steps is also valuable. However, both main theorems have serious flaws, so the paper does not currently establish its claimed privacy or utility guarantees.","major_comments":[{"comment":"Theorem 2 bounds the tail of the privacy-loss random variable L_XX'(y_i) := ln[f(y_i | X, q_i^(0), p_i^(1..T)) / f(y_i | X', q_i^(0), p_i^(1..T))], conditioning on agent i's private randomness. This is not the privacy-loss random variable of the mechanism: Definitions 1 and 2 require the output distributions f(y_i | X) = E_{q_i,p_i}[f(y_i | X, q_i, p_i)] and f(y_i | X'), with all algorithm randomness marginalized. Because the adversary node j does not know q_i^(0) or p_i^(t), the conditional distributions are not the release distributions. The Renyi divergence in (33)-(34) depends on q_i^(0) and p_i^(t) through the mean of (29), and is not bounded uniformly; in the equal-covariance case the divergence grows with ||q_i^(0)||^2 + sum_t ||p_i^(t)||^2, which is unbounded. A per-realization Chernoff bound therefore does not imply a DP guarantee for the mixture. Thus Theorem 2 is vacuous as a privacy proof, and the delta values in Fig. 3 are not evidence for the headline privacy claim.","section":"Section III.A.1, Theorem 2, Eqs. (25)-(30), Appendix B1"},{"comment":"The manuscript claims to bound node j's ability to infer node i's data, but the analysis bounds the privacy loss of y_i, agent i's own stacked releases, conditional on agent i's randomness. Node j's actual view consists of the messages it receives over the network (e.g., neighbors' z_j^(t) at each consensus step and the final shared q^(T)); this view is not defined or analyzed as a random variable. A bound on the privacy of y_i alone cannot bound inference from a different, potentially more informative, observation set. The conditional distribution in (29) is particularly inappropriate because it conditions on information the adversary does not possess.","section":"Section II.A threat model and Section III.A"},{"comment":"The quantity Theta is defined as Theta = 1 - v^T v / Tr(Omega) + Delta, with Delta required to satisfy Delta >= [2||(Q - Theta Omega)||_F sqrt(log(1/gamma)) + 2||(Q - Theta Omega)||_2 log(1/gamma)] / Tr(Omega). Since Q - Theta Omega depends on Theta and hence on Delta, the displayed inequality is an implicit condition on Delta. The proof does not show that a Delta satisfying this condition exists, nor does it provide a value for the first term of (40). Consequently, the high-probability bound (40) is not established. Additionally, the theorem statement uses v^T v where the derivation leading to (70) uses v^T Omega v; the statement should be corrected.","section":"Section III.B, Theorem 3, Appendix C1"},{"comment":"The proof asserts E = ||Xi - X X^T|| <= n_i m lambda_c^2(W) without derivation. Eq. (14) and the consensus error bound in Appendix A1 only give ||Xi - X X^T|| = O(lambda_2(W)^c), with a constant depending on the local data through ||z - zbar||; the bound n_i m is not obtained. Since Assumption 3 only postulates E <= lambda_1 - lambda_2, the final additive term in (40) is unsupported.","section":"Section III.B, Appendix C1, Eqs. (79)-(80)"}],"minor_comments":[{"comment":"The deflation step uses q_{l-1} z^{(T-1/2)}; for l=1, q_0 is undefined, and Section II.C indicates the update should use z^{(T+1/2)}. Please clarify.","section":"Algorithm 1, line 3"},{"comment":"The notation lambda_c^2(W) should be lambda_2(W)^c to avoid ambiguity with an eigenvalue squared.","section":"Eq. (14)"},{"comment":"The subscript i in delta_i is introduced for the conditional probability in (30), but the connection to the unconditional delta in Definition 2 is not stated.","section":"Theorem 2 and Definitions 1-2"},{"comment":"The printed 4x4 mixing matrix W does not have all rows summing to 1 as displayed; please fix the formatting.","section":"Section IV.B"},{"comment":"The claim that PDP is 'a strictly tighter notion of DP' is not justified; Definition 2 is a different privacy formulation, not necessarily a tightening of Definition 1.","section":"Section I.A"},{"comment":"The experimental section does not report how the LDP noise variance was calibrated to the same (epsilon,delta) guarantees, nor how the parameter grid search used the unproven privacy bound; a reproducibility statement would be helpful.","section":"Section IV"}],"recommendation":"reject","confidential_remarks":"The manuscript has a novel setup and a clean algorithmic idea, but the central theoretical claims are not supported: the privacy proof conditions on private randomness rather than marginalizing, and the convergence proof contains a self-referential definition. These are load-bearing errors affecting the two main theorems, and correcting them would require a fundamentally different privacy analysis rather than a local fix. I recommend rejection, though I would be open to reconsidering if the authors provide a correct marginal privacy analysis and a valid convergence bound."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nRead the D-DP-PM paper. Short version: the setup is real and the algorithm is clever, but the central privacy theorem does not establish (ε,δ)-DP as stated, and the convergence theorem has a circular constant. I'd send it to review but expect a major revision.\n\nWhat's genuinely new: row-wise partition is not covered by the existing DP-PM literature (they use column-wise or XiXi^T partitions), and the paper is explicit about that difference. The design choice to keep iterates Gaussian by skipping normalization and using a fixed α is elegant, and it buys closed-form Rényi divergences. The proof strategy via Hanson-Wright is a legitimate departure from the Hardt-Price line. Experiments on four datasets show a consistent advantage over adding local Gaussian noise, especially for ε∈[2,5]. The comparison is only against a \"naive LDP\" baseline, but that is an honest choice given the different partition.\n\nThe soft spots are load-bearing. Theorem 2 conditions on agent i's private randomness qi^0 and pi and bounds the conditional likelihood ratio. The actual release is a mixture over that randomness, and the adversary does not know it. The paper never marginalizes, and the Rényi divergence in (33)-(34) is not uniformly bounded in qi^0 and pi; in the equal-covariance case it grows with ||qi^0||^2 + Σ||pi^t||^2. So the Chernoff bound applies to each conditional experiment, not to the mechanism the adversary actually sees. This is not a nit; it is the main result. I think it can be repaired—integrate out the local randomness and pay a penalty in δ—but that work is not in the manuscript. Theorem 3 also defines Δ through an inequality that involves Θ, which itself depends on Δ, so the bound is not actually solved; the statement writes \"1− v^T v / Tr(Ω)\" where the proof needs \"1− v^T Ω v / Tr(Ω)\"; and the step E ≤ n_i m λ_c^2(W) appears without derivation. These are fixable, but the two headline theorems are not airtight as submitted.\n\nThe \"first decentralized DP-PM\" claim is a bit loose given [13], but [13] uses a different partition and the text qualifies. I do not see a citation-pattern problem.\n\nWho this is for: people working on private distributed PCA and DP mechanisms for networked data. It deserves a serious referee; a good referee can tell the authors exactly how to fix the marginalization. But as submitted, the privacy guarantee should not be taken at face value.","headline":"A clever algorithm for a genuinely underexplored row-wise decentralized PCA setting, but the central privacy proof conditions on hidden local randomness and never delivers the claimed marginal (ε,δ)-DP guarantee; the convergence theorem has its own unresolved fixed-point issue.","tokens_in":16291,"tokens_out":5378,"would_cite":true,"duration_ms":66374,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["62H25","68P27","68W15"],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that a power method for PCA can be made differentially private in a fully decentralized network with row-wise partitioned data, and that preserving Gaussianity yields a closed-form (ε,δ)-DP bound and a convergence rate…","keywords":["differential privacy","power method","principal component analysis","decentralized optimization","gossip consensus","Gaussian mechanism","Rényi divergence","row-wise data partitioning"],"falsifier":"For a fixed two-agent ring graph, fix a pair of adjacent datasets differing in one row, run Monte Carlo draws of $q^{(0)}$ and all $p^{(t)}$, compute the release $y^{(T)}$ under both datasets, and estimate the tail probability $\\Pr(\\ln(f(y|X)/f(y|X')) > \\epsilon)$; if this exceeds the paper's $\\delta$ for any privacy schedule, then the conditional argument in Theorem 2 does not yield a valid marginal DP guarantee.","tokens_in":15192,"feed_emoji":"🔐","tokens_out":9263,"duration_ms":95645,"temperature":0.7,"pith_summary":"The paper claims that the classical power method for principal component analysis can be made differentially private in a fully decentralized setting where each agent holds only a subset of the data rows and no central aggregator exists. It proposes D-DP-PM, in which agents exchange only local projections during consensus and add calibrated Gaussian noise, keeping every released quantity a Gaussian. Because Gaussianity is preserved, the full network release can be written as a linear function of two Gaussian vectors, giving a closed-form Rényi divergence bound that yields (ε,δ)-DP. The same linear structure yields a high-probability convergence bound whose rate matches the centralized power method plus additive terms from consensus error and noise. The argument would matter because it is the first DP power method for row-wise partitioned data without a central aggregator.","feed_headline":"Decentralized power method satisfies (ε,δ)-DP with no central server","feed_subtitle":"Agents share only local projections; Gaussianity gives provable privacy and fast convergence.","key_machinery":"The central mechanism is the Gaussian-process representation of the algorithm: with $q^{(0)} \\sim \\mathcal{N}(0, \\sigma_q^2 I)$ and per-iteration $p^{(t)} \\sim \\mathcal{N}(0, \\sigma_{p(t)}^2 I)$, the consensus-augmented linear dynamics give $y^{(T)} = M q^{(0)} + L P$ for an explicit block matrix pair $(M, L)$, and the final iterate satisfies $q^{(T)} \\sim \\mathcal{N}(0, \\Omega)$ with $\\Omega = \\alpha^{2T} \\sigma_q^2 (\\Xi\\Xi^\\top)^T + \\sum_{k} \\alpha^{2(T-k)} \\sigma_{p(k)}^2 (\\Xi\\Xi^\\top)^{T-k}$. This single identity carries both analyses: the privacy bound computes the Rényi divergence between two such Gaussians after conditioning on the agent's own randomness, and the convergence bound applies Hanson–Wright to the quadratic form $s^\\top Q s / s^\\top \\Omega s$ with $s \\sim \\mathcal{N}(0, I)$.","core_discovery":"The central discovery is that a deliberately Gaussian-preserving design—random Gaussian initialization, a fixed rescaling α instead of normalization, and Gaussian per-iteration noise—lets the entire decentralized power iteration be treated as a Gaussian process. The stacked vector of all releases $y^{(T)}$ satisfies $y^{(T)} = M q^{(0)} + L P$, so each agent's observed release conditional on its own randomness is Gaussian, and Theorem 2 bounds the privacy loss through the closed-form Rényi divergence of two Gaussians, establishing $(\\epsilon,\\delta)$-DP. The same representation gives $q^{(T)} \\sim \\mathcal{N}(0, \\Omega)$, and applying Hanson–Wright and Davis–Kahan yields Theorem 3: the sine of the angle between the iterate and the true principal eigenvector is bounded by a Hanson–Wright term plus an explicit consensus-error term proportional to $\\lambda_2(W)^c$ and a power-iteration term proportional to $(\\mu_2/\\mu_1)^{2T}$, showing convergence at essentially the centralized rate with additive floors set by consensus and DP noise.","pith_inferences":["If the conditional-privacy argument can be upgraded to a marginal one, the same Gaussian structure would likely yield a concentrated differential privacy (zCDP) bound for the full mechanism, connecting directly to the DP toolkit used in federated PCA.","The Gaussian-preserving trick may extend beyond the power method: any linear iterative algorithm with Gaussian initialization and additive Gaussian noise, such as decentralized SGD or ADMM, could inherit the same closed-form Rényi divergence analysis.","A testable extension is to replace the fixed rescaling $\\alpha$ with a per-iteration schedule that keeps the iterate norm near 1 while preserving Gaussianity, potentially reducing the saturation floor in Theorem 3.","The empirical comparison is only against naive local DP; a head-to-head with column-partitioned DP-PCA methods on adapted data would clarify whether the row-partition setting is intrinsically harder or easier in terms of privacy-utility tradeoffs."],"forward_implications":["Practitioners can run private PCA on row-partitioned data in peer-to-peer networks without trusting any central node, with a formal $(\\epsilon,\\delta)$-DP guarantee.","The convergence rate matches the centralized power method up to additive errors, so for moderate privacy budgets ($\\epsilon \\in [2,5]$) the method empirically beats adding Gaussian noise directly to the data.","Agents can trade iterations for privacy: fast convergence means fewer power iterations reduce the number of noisy releases and lower $\\delta$ for fixed $\\epsilon$.","Consensus rounds cost no extra privacy, since values shared during consensus are already part of the public release, so topology-induced error can be shrunk by increasing the number of consensus steps $c$."],"supporting_citations":[{"why":"Supplies the decentralized power method and consensus inner-product protocol that Algorithm 1 adapts to the differentially private setting.","marker":"[1]"},{"why":"Defines the (ε,δ)-probabilistic differential privacy notion that Theorem 2 uses for the privacy guarantee.","marker":"[18]"},{"why":"The prior centralized noisy power method that the paper explicitly does not build on; it sets the performance baseline that the new proof technique must match.","marker":"[20]"},{"why":"Provides the Hanson–Wright concentration inequality used for the high-probability convergence bound in Theorem 3.","marker":"[23]"},{"why":"Gives the closed-form Rényi divergence between Gaussians used to compute the privacy loss bound in Theorem 2.","marker":"[25]"},{"why":"The Davis–Kahan sine theorem used to split the convergence error into a consensus-perturbation term and a power-iteration term.","marker":"[26]"}],"fun_headline_variants":["Decentralized power method achieves (ε,δ)-DP without server","Provably private PCA over networks via Gaussian noise","Row-wise partitioned PCA meets differential privacy","Gaussian representation yields tight DP bounds for power method","Distributed PCA with (ε,δ)-DP using Gaussian noise"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The privacy proof conditions on each agent's own random initialization and per-iteration noise as if the adversary knew them, and the paper does not supply the marginalization step that would turn those conditional Gaussian privacy losses into a uniform (ε,δ)-DP guarantee for the algorithm as a whole.","fun_headline_variants_meta":{"raw":{"variants":["Decentralized power method achieves (ε,δ)-DP without server","Provably private PCA over networks via Gaussian noise","Row-wise partitioned PCA meets differential privacy","Gaussian representation yields tight DP bounds for power method","Distributed PCA with (ε,δ)-DP using Gaussian noise"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000855,"raw_usage":{"total_tokens":3736,"prompt_tokens":987,"completion_tokens":2749,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":603,"completion_tokens_details":{"reasoning_tokens":2670}},"tokens_in":603,"tokens_out":2749,"duration_ms":27139,"temperature":1.0,"reasoning_tokens":2670,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T11:14:31.870980+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"For a fixed two-agent ring graph, fix a pair of adjacent datasets differing in one row, run Monte Carlo draws of $q^{(0)}$ and all $p^{(t)}$, compute the release $y^{(T)}$ under both datasets, and estimate the tail probability $\\Pr(\\ln(f(y|X)/f(y|X')) > \\epsilon)$; if this exceeds the paper's $\\delta$ for any privacy schedule, then the conditional argument in Theorem 2 does not yield a valid marginal DP guarantee.","supporting_citations":[{"cited_title":"The decentralized estimation of the sample covariance,","cited_arxiv_id":null,"evidence_quote":"Supplies the decentralized power method and consensus inner-product protocol that Algorithm 1 adapts to the differentially private setting."},{"cited_title":"Privacy: Theory meets practice on the map,","cited_arxiv_id":null,"evidence_quote":"Defines the (ε,δ)-probabilistic differential privacy notion that Theorem 2 uses for the privacy guarantee."},{"cited_title":"The noisy power method: A meta algorithm with applications,","cited_arxiv_id":null,"evidence_quote":"The prior centralized noisy power method that the paper explicitly does not build on; it sets the performance baseline that the new proof technique must match."},{"cited_title":"Vershynin,High-Dimensional Probability: An Introduction with Ap- plications in Data Science, ser","cited_arxiv_id":null,"evidence_quote":"Provides the Hanson–Wright concentration inequality used for the high-probability convergence bound in Theorem 3."},{"cited_title":"On r ´enyi divergence measures for continuous alphabet sources,","cited_arxiv_id":null,"evidence_quote":"Gives the closed-form Rényi divergence between Gaussians used to compute the privacy loss bound in Theorem 2."},{"cited_title":"The rotation of eigenvectors by a perturbation. iii,","cited_arxiv_id":null,"evidence_quote":"The Davis–Kahan sine theorem used to split the convergence error into a consensus-perturbation term and a power-iteration term."}],"review_version":1}