{"id":"0e3e688a-070c-405a-bfcb-bdc4ed14fc95","arxiv_id":"2508.17697","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"In over-the-air federated learning, increasing the number of participating clients simultaneously reduces information leakage, induces channel hardening that removes fading distortions, and improves the convergence rate.","lead":"This paper analyzes over-the-air federated learning, where hundreds of clients transmit analog gradient signals that combine automatically in the wireless channel. It argues that scaling up the number of clients improves privacy, removes small-scale fading effects, and speeds up convergence.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 1's privacy bound relies on a false decorrelation step: random sign flipping does not make dependent gradient entries independent, so the O(1/N) mutual-information claim is unproven for general correlated gradients.","rationale":"The reader identified the decorrelation assumption as untested; my concern sharpens this to a concrete false statement in the proof. The random-flipping preprocessing cannot manufacture independence from arbitrary dependence, so the entropy decomposition used to derive Eq. (10) is not valid for general correlated gradient entries. This is the most load-bearing weakness because Theorem 1 is the sole theoretical support for the paper's headline privacy benefit. The convergence and channel-hardening results are less affected: Lemma 1 and Theorems 2-3 follow from standard concentration and SGD arguments, and the non-vanishing gradient-drift term in Theorem 3 is an acknowledged local-SGD effect rather than a communication-noise term. The experimental curves are consistent with the qualitative claims but cannot substitute for a correct proof of the O(1/N) privacy bound. A conditional acceptance is appropriate: the paper's main idea is plausible and likely salvageable, but Theorem 1 needs either a repaired proof through a multivariate entropic CLT or an explicit assumption of entrywise independence of preprocessed local gradients. Without that, the privacy result remains a conjecture rather than a theorem.","tokens_in":21998,"tokens_out":13980,"duration_ms":158422,"concrete_test":"Construct X = (Z, Z+W) with Z, W iid N(0,1) and independent Rademachers S1, S2. Verify that U = S1 Z and V = S2(Z+W) fail independence, e.g., E[U^2 V^2] = 4 versus E[U^2] E[V^2] = 2. Then check the proof's asserted identity h(S*X) = h(S1 Z) + h(S2(Z+W)) by numerical integration; the nonzero difference demonstrates that the coordinate-wise entropy argument in Appendix A is invalid for this valid d* = 2 distribution. If the authors instead invoke a multivariate entropic CLT or restrict Theorem 1 to entrywise-independent gradients, re-derive Eq. (10) under that explicit assumption and verify numerically that the O(1/N) decay still holds for the examples reported in the paper.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"In Appendix A, specifically Eqs. (32)-(35), the proof of Theorem 1 asserts that multiplying each entry of the local gradient by an independent Rademacher variable yields entries that are mutually independent, allowing the entropy of the aggregate to be written as a sum of coordinate entropies and bounded below by the univariate entropic central limit theorem. This is not true for a general correlated vector. For example, let X1 = Z and X2 = Z + W with Z and W independent standard Gaussians, and let S1, S2 be independent Rademacher variables. The transformed entries S1X1 and S2X2 have zero covariance, but they are dependent: E[(S1X1)^2 (S2X2)^2] = 4 whereas E[(S1X1)^2] E[(S2X2)^2] = 2. Random flipping only diagonalizes the covariance matrix; it does not make the joint distribution a product distribution. Consequently, the decomposition h(bs_n,t) = sum_i h(bs_n,t,i) and the Berry-Esseen lower bound in Eq. (35) do not follow for correlated gradient entries. The bound in Eq. (10) is therefore not established as stated. Since Theorem 1 is the paper's justification for the enhanced-privacy pillar, the central O(1/N) privacy claim currently rests on an unproven independence assumption. A multivariate entropic CLT or an explicit entrywise-independence assumption could repair the argument, but neither is supplied. The MINE experiments show the trend on two networks, but they do not close the proof gap or quantify the approximation error. This concern does not undermine the channel-hardening or convergence results, which are supported by Lemma 1 and Theorems 2-3, but it makes the first advertised contribution conditional.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper studies an over-the-air federated edge learning system in which N clients transmit accumulated local gradients as analog signals over i.i.d. fading channels and the server receives a noisy linear combination. The authors derive three sets of analytical results: a mutual-information upper bound on privacy leakage that is claimed to scale as O(1/N) (Theorem 1, Section III-A), a concentration inequality for the aggregated gradient that is used to claim a channel-hardening effect (Lemma 1, Section III-B), and convergence rates for strongly convex (Theorem 2, Corollary 1) and non-convex (Theorem 3, Corollary 2) objectives in which thermal noise and SGD noise terms vanish with N. Section III-D analyzes truncated channel-inversion power control under imperfect CSI (Theorem 4) and concludes that instantaneous power control is unnecessary in large-scale systems. The theoretical claims are supplemented with experiments on EMNIST and CIFAR-10 using CNN, ResNet-18, and logistic-regression/L-BFGS setups.","tokens_in":22221,"tokens_out":18578,"duration_ms":197195,"significance":"If the results held as stated, the paper would make a useful contribution to over-the-air federated learning by showing that a large number of clients improves privacy, suppresses fading, and accelerates convergence, rather than only exacerbating communication cost. The paper's strengths are the clarity of the system model, the use of a standard FedAvg proof template for the convergence analysis, the explicit treatment of power control with imperfect CSI, and the experimental section that directly checks the predicted privacy, channel-hardening, and convergence trends. The main reservations are proof gaps in Theorem 1 and in the convergence proofs, which are central to the paper's three headline claims rather than presentation issues.","major_comments":[{"comment":"The proof of Theorem 1 asserts that after multiplying entries of s_{n,t} by independent Rademacher variables S, the entries of \\hat s_{n,t} are mutually independent. This is false for a general correlated vector. For example, take X1=Z and X2=Z+W with independent standard Gaussians Z,W and independent Rademachers S1,S2; then S1X1 and S2X2 have zero covariance but are dependent because E[(S1X1)^2(S2X2)^2]=4 while E[(S1X1)^2]E[(S2X2)^2]=2. Consequently, the coordinate-wise entropy decomposition and the Berry-Esseen entropic CLT lower bound in Eq. (35) do not follow for correlated gradient entries, and the O(1/N) privacy bound in Eq. (10) with its consequence in Eq. (25) is not established as stated for general local gradients. The footnote about random flipping reducing correlations is insufficient; the proof needs either an explicit entrywise-independence assumption on the preprocessed gradient or a genuinely multivariate entropic CLT argument. The MINE experiments provide empirical evidence but do not close this gap.","section":"Appendix A, Eqs. (32)-(35)"},{"comment":"The convergence proofs replace the random fading coefficients c_{n,t} in the global update (6) by their mean \\mu_c without a residual term. In Appendix C, the line before Eq. (44) writes \\eta_t/N \\sum_n \\mu_c(w_t-w_{n,t}^{(E)})/\\eta_l, which equals the true update only when c_{n,t}=\\mu_c; similarly, Eq. (48) in Appendix E computes E[\\|\\hat g_t\\|^2] from an expression containing no c_{n,t}. As a result, the bounds in Theorems 2 and 3 (and Corollaries 1 and 2) are proved for a channel-mean system, not for the random-fading model of Section II-B; a term of order \\sigma_c^2 G^2/N would enter the residual. Lemma 1 provides only a high-probability concentration statement and is not integrated into the expectation bounds in these proofs. The claim that communication impairments vanish as N grows may survive a repair, but the theorem statements as proved are not supported.","section":"Appendix C, Eq. (44); Appendix E, Eq. (48); Theorems 2-3"},{"comment":"The displayed algebra in the proof of Corollary 1 is inconsistent with the stated \\kappa. Under the stated condition \\eta_0\\le 1/(4\\mu_c L), we have \\lambda\\mu_c\\eta_0-1<0 because \\lambda\\le L, so the first argument in the max in Eq. (22) is negative; then \\kappa collapses to \\|w_0-w^*\\|^2 and all noise and heterogeneity terms disappear from the bound. The induction step in Eq. (46) requires \\kappa to be at least on the order of \\mu_c^2\\eta_0^2 Q1/(\\lambda\\mu_c\\eta_0), not the expression with \\lambda\\mu_c\\eta_0-1 in the denominator. Please correct the formula or the proof; as printed, Corollary 1 is not derived.","section":"Corollary 1 and Appendix D, Eqs. (45)-(46)"}],"minor_comments":[{"comment":"The statement that 'after certain preprocessing steps, the local gradient entries can be statistically independent of each other' is an assumption in all but name; since it drives Theorem 1, it should be stated as an explicit assumption with a precise description of the preprocessing.","section":"Section III-A"},{"comment":"The privacy metric conditions on the past gradients {g_p}, but the proof of Theorem 1 computes entropies without making the conditioning visible in every step; please make the conditioning explicit and explain why past public models do not change the bounds.","section":"Eq. (8) and Appendix A"},{"comment":"The notation for the term involving \\beta_\\nu is typeset ambiguously; please define \\beta_\\nu^N (or the intended expression) explicitly and state the dependence of the final bound on \\nu.","section":"Eq. (18)"},{"comment":"The MI estimates in Fig. 2 are obtained with MINE, an approximate estimator with known bias, and no error bars or seeds are reported; the O(1/N) privacy law is therefore only qualitatively validated. In addition, increasing N in Fig. 4 also increases the total amount of training data, so part of the observed accuracy gain may be a data-volume effect rather than the noise-reduction effect claimed in the analysis.","section":"Section IV, Figs. 2 and 4"},{"comment":"The statement that the gradient discrepancy 'decreases at the rate of O(exp(-N))' is stronger than what Lemma 1 proves; Lemma 1 is a high-probability large-deviation bound, so the conclusion should be phrased as an exponential concentration statement rather than a bound on the mean discrepancy.","section":"Section III-C.2"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is in scope for the journal and addresses a timely problem. My recommendation is driven by three proof gaps: the false independence step in Theorem 1, the omission of the fading residual in the convergence proofs, and the inconsistent induction in Corollary 1. I do not see grounds for rejection if the authors can repair these points, either by adding the missing assumptions (and adjusting the claims accordingly) or by supplying the missing technical arguments; the convergence gap in particular should be fixable by carrying a residual fading term through the proofs."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is worth a serious look, but you should know up front that its first advertised contribution, the O(1/N) privacy bound in Theorem 1, is not proven. The proof in Appendix A (Eqs. 32-35) asserts that multiplying each entry of a local gradient by an independent Rademacher variable makes the entries mutually independent. That is false for a general correlated vector. Even with zero covariance, the squares remain dependent, so the entropy decomposition and the Berry-Esseen lower bound do not follow. The paper explicitly cites \"random flipping\" as a decorrelation technique, but that only diagonalizes the covariance matrix; it does not make the joint distribution a product. This is a load-bearing flaw, since the privacy pillar is a major part of the paper's message.\n\nWhat is actually new and good: the channel-hardening effect in the client-count dimension, rather than the antenna-count dimension, is a real insight, and Lemma 1's concentration inequality is a reasonable way to capture it. The convergence analysis (Theorems 2-3) follows standard templates and the noise terms shrinking as N grows are correctly identified. The experiments align with the qualitative predictions, and the power-control discussion is honest about its own conditions. The paper also does a fair job of positioning itself relative to prior work.\n\nSoft spots beyond the privacy proof: the power-control claim is conditional on a specific truncated channel-inversion scheme and on large N, and their own N=10 experiment shows power control still helps. That is a minor overstatement, not a fatal flaw. There is no code or data shipped, which limits reproducibility, but the theory is mostly self-contained. The MINE-based MI estimates show trends but do not repair the proof gap, and the paper does not quantify the approximation error.\n\nWho is this for? Researchers working on over-the-air federated learning, especially those interested in whether power control can be dropped in large-scale systems. The convergence and hardening results are likely to be useful even if the privacy theorem is fixed or weakened to a conjecture with an explicit independence assumption.\n\nRecommendation: send it to peer review, because the core question is important and most of the analysis is sound. But the referee should demand a corrected or substantially weakened statement of Theorem 1. As it stands, the privacy result is unproven, and the authors should either add a genuine independence assumption or provide a multivariate entropic CLT argument.","headline":"Solid convergence and channel-hardening results, but the privacy theorem relies on a false decorrelation claim and should not be trusted as stated.","tokens_in":22915,"tokens_out":1335,"would_cite":false,"duration_ms":16637,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"In over-the-air federated learning, scaling up the client count shrinks privacy leakage, fading, and convergence error.","keywords":["over-the-air computation","federated learning","privacy leakage","mutual information","channel hardening","convergence rate","power control","large-scale systems"],"falsifier":"Compute or measure the mutual information between one client's gradient and the server's aggregated gradient for $N = 10$, $50$, $100$, and $500$ on the same task, but skip the random-flipping decorrelation step; if the decay flattens or the bound breaks once gradient entries stay correlated, the $O(1/N)$ privacy result rests on preprocessing rather than on the number of clients. A smaller-scale check: at $N = 10$, compare convergence with and without instantaneous-CSI power control; the paper's own experiments already show power control helps there, so the \"not essential\" claim is limited to large $N$.","tokens_in":1675,"feed_emoji":"📡","tokens_out":6241,"duration_ms":136385,"temperature":0.7,"pith_summary":"Federated learning over the air sends client updates as analog signals that add together on the wireless channel, so the server receives a noisy but automatically aggregated gradient. This paper argues that the standard worry about that noise is inverted: when many clients participate, the aggregation itself becomes a blessing. The mutual information between one client's local gradient and the server's aggregated gradient is bounded by a term of order $O(1/N)$, so each participant hides better in a larger crowd. A concentration inequality shows channel hardening, meaning small-scale fading is averaged away as $N$ grows, and the convergence error contributions from thermal noise and mini-batch sampling carry $N^2$ denominators and vanish at scale. If these results hold, over-the-air federated learning becomes attractive precisely in the large-scale regime where digital communication would be most costly.","feed_headline":"More clients, less leakage: scaling up over-the-air federated learning","feed_subtitle":"Three theorems show privacy, fading, and convergence all improve as the participant count grows.","key_machinery":"The mechanism is the averaging of $N$ independent, channel-faded client gradients at the server; $N$ independent fading coefficients make the effective channel concentrate at its mean. Formally, the argument rides on three pieces: a Berry–Esseen-style entropic central limit theorem that lower-bounds the differential entropy of the aggregated signal and yields the $O(1/N)$ mutual-information upper bound; a Bernstein/McDiarmid concentration inequality (Lemma 1) showing the difference between the faded and mean-faded gradients is exponentially small in $N$; and standard smoothness and SGD-drift bounds that place sampling noise into terms with $1/(N^2 B)$ denominators. Together these convert \"more clients\" from an added communication burden into a noise-reduction and privacy-enhancing resource.","core_discovery":"On the paper's own terms, the central claim is that the wireless impairments in over-the-air federated learning—fading, thermal noise, and sampling noise—are progressively neutralized as the number of participating clients $N$ grows, so scale improves privacy, robustness, and convergence simultaneously. Theorem 1 bounds the per-client mutual information between a local gradient and the aggregated gradient by $C_{\\bar{g}} d^*/N$ plus a logarithmic term, decaying as $O(1/N)$ under an honest-but-curious server and average-case leakage. Lemma 1 establishes exponential concentration of the channel-corrupted aggregated gradient around the mean-fading aggregated gradient, a channel-hardening effect that removes small-scale fading from the global update. Theorem 3 bounds the non-convex convergence rate by a leading term plus $d\\sigma_z^2/(\\mu_c^2 N^2)$ and $\\sum \\sigma_{s,n}^2/(N^2 B)$, so the noisy analog update becomes equivalent to a noiseless global gradient as $N$ grows. The paper concludes that instantaneous channel estimation and power control are not essential in this regime, since the averaging already does the work that power control was designed to do.","pith_inferences":["Because the mutual-information bound is average-case and assumes preprocessing decorrelates gradient entries, a natural next test is whether worst-case gradient-inversion attacks on a single client also decay with $N$; the paper's own framing suggests they are not covered by the bound.","The channel-hardening logic suggests that client population size can substitute for many-antenna hardware in suppressing fading, which would change deployment cost calculations for edge-learning infrastructure.","The $N^2$ denominators in the convergence bounds imply a design trade-off not explored in the paper: for a fixed communication budget, operators could trade client count against local epochs and batch size to reach a target error floor."],"forward_implications":["Per-client privacy leakage, measured by mutual information, falls as $O(1/N)$, so larger systems can achieve the same average privacy with less added artificial noise.","Small-scale fading disappears from the global gradient through channel hardening, so blind transmission without instantaneous CSI becomes nearly as accurate as ideal power control.","The non-convex convergence error from thermal noise and mini-batch sampling vanishes as $N$ grows, meaning over-the-air training with many clients behaves like noiseless training.","Instantaneous-CSI power control is not essential at scale: Theorem 4 shows it introduces client dropout and channel-estimation-error penalties, and the experiments show its benefit nearly vanishes for large $N$.","Larger client populations also make training more robust to label-flipping and noisy-label attacks and allow second-order updates such as L-BFGS to work, as the experiments show."],"supporting_citations":[{"why":"Supplies the mutual-information approach and the entropy-based proof template used to upper-bound privacy leakage in Theorem 1.","marker":"[31]"},{"why":"Supplies the FedAvg convergence recursion and the heterogeneity measure $\\Gamma$ used in the strongly convex analysis.","marker":"[37]"},{"why":"Establishes the blind-transmission baseline without instantaneous CSI and the massive-antenna channel-hardening result that this paper extends to client-number scaling.","marker":"[19]"},{"why":"Defines the truncated channel-inversion power control strategy that Theorem 4 analyzes and compares against.","marker":"[14]"},{"why":"Provides the Berry–Esseen-style entropic central limit theorem giving the entropy lower bound at the heart of the $O(1/N)$ mutual-information bound.","marker":"[52]"},{"why":"Gives the vector Bernstein inequality used to establish the concentration lemma behind channel hardening.","marker":"[53]"},{"why":"Supplies the McDiarmid-type inequality used for the large-deviation regime in the concentration proof.","marker":"[54]"},{"why":"Bounds the client drift term $(E-1)\\eta_l^2 \\sum \\sigma_{s,n}^2/(NB)$ appearing in the convergence proofs.","marker":"[55]"},{"why":"Introduces broadband analog aggregation, the transmission model whose aggregated gradient appears in equation (6).","marker":"[4]"},{"why":"Frames over-the-air aggregation as secure aggregation under an honest-but-curious server, supporting the privacy interpretation.","marker":"[30]"}],"fun_headline_variants":["Scale up over-the-air FL: fading and leakage fade away","More clients, less wireless noise: over-the-air FL scales","Scaling over-the-air FL: the crowd cancels channel noise","Bigger client pools purify over-the-air FL gradients","Over-the-air FL: scale cures fading, cuts privacy loss"],"cache_read_input_tokens":24832,"weakest_assumption_plain":"The argument assumes the system is large ($N$ big) and that privacy is measured as average mutual information after a preprocessing step that makes each client's gradient entries statistically independent; if $N$ is only in the tens or an adversary needs worst-case guarantees, the $O(1/N)$ privacy decay and the dismissal of power control do not follow.","fun_headline_variants_meta":{"raw":{"variants":["Scale up over-the-air FL: fading and leakage fade away","More clients, less wireless noise: over-the-air FL scales","Scaling over-the-air FL: the crowd cancels channel noise","Bigger client pools purify over-the-air FL gradients","Over-the-air FL: scale cures fading, cuts privacy loss"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000703,"raw_usage":{"total_tokens":3213,"prompt_tokens":1028,"completion_tokens":2185,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":644,"completion_tokens_details":{"reasoning_tokens":2099}},"tokens_in":644,"tokens_out":2185,"duration_ms":16217,"temperature":1.0,"reasoning_tokens":2099,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T17:00:15.411007+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute or measure the mutual information between one client's gradient and the server's aggregated gradient for $N = 10$, $50$, $100$, and $500$ on the same task, but skip the random-flipping decorrelation step; if the decay flattens or the bound breaks once gradient entries stay correlated, the $O(1/N)$ privacy result rests on preprocessing rather than on the number of clients. A smaller-scale check: at $N = 10$, compare convergence with and without instantaneous-CSI power control; the paper's own experiments already show power control helps there, so the \"not essential\" claim is limited to large $N$.","supporting_citations":[{"cited_title":"How much privacy does federated learning with secure aggrega- tion guarantee?","cited_arxiv_id":null,"evidence_quote":"Supplies the mutual-information approach and the entropy-based proof template used to upper-bound privacy leakage in Theorem 1."},{"cited_title":"On the convergence of FedAvg on non-iid data,","cited_arxiv_id":null,"evidence_quote":"Supplies the FedAvg convergence recursion and the heterogeneity measure $\\Gamma$ used in the strongly convex analysis."},{"cited_title":"Blind federated edge learning,","cited_arxiv_id":null,"evidence_quote":"Establishes the blind-transmission baseline without instantaneous CSI and the massive-antenna channel-hardening result that this paper extends to client-number scaling."},{"cited_title":"Berry-esseen bounds in the entropic central limit theorem,","cited_arxiv_id":null,"evidence_quote":"Provides the Berry–Esseen-style entropic central limit theorem giving the entropy lower bound at the heart of the $O(1/N)$ mutual-information bound."},{"cited_title":"Sub-sampled cubic regularization for non- convex optimization,","cited_arxiv_id":null,"evidence_quote":"Gives the vector Bernstein inequality used to establish the concentration lemma behind channel hardening."},{"cited_title":"Tighter theory for local SGD on identical and heterogeneous data,","cited_arxiv_id":null,"evidence_quote":"Bounds the client drift term $(E-1)\\eta_l^2 \\sum \\sigma_{s,n}^2/(NB)$ appearing in the convergence proofs."},{"cited_title":"Practical secure aggregation for privacy-preserving machine learning,","cited_arxiv_id":null,"evidence_quote":"Frames over-the-air aggregation as secure aggregation under an honest-but-curious server, supporting the privacy interpretation."}],"review_version":1}