{"id":"a7d279d3-783b-41fb-9866-2e56d116c28d","arxiv_id":"2509.09787","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"ZORRO uses interactive zero-knowledge proofs to force split-learning clients to run a frequency-domain poison check, pruning suspicious model updates before passing them on.","lead":"This paper presents ZORRO, a defense for split learning in which each client must prove, using zero-knowledge proofs, that it checked its own part of the neural network for a backdoor in the frequency domain. It claims to cut backdoor attack success below 6 percent with under 10 seconds of added latency for client-side models with up to a million parameters.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Algorithm 2's ZK circuit never constrains which model is pruned; a malicious prover can satisfy every assertion while forwarding the poisoned model, voiding the paper's core enforcement claim.","rationale":"The reader's weakest assumption concerns the frequency-domain heuristic: whether backdoor updates reliably have larger low-frequency DCT magnitudes than benign non-IID updates. That is a real limitation, but it is secondary to a more basic problem: as written, the ZKP does not even prove that the client executed the pruning step. The paper's headline contribution is cryptographic enforcement of the client-side defense, summarized in the abstract as 'clients prove their correct execution of a client-located defense algorithm.' If the proof does not bind the pruning decision, then even a perfectly accurate poison-scoring function provides no security, because a malicious client can compute honest scores and still forward the poisoned model while passing verification. This is not a question of heuristic quality; it is a soundness gap in the cryptographic protocol. The concrete witness in the test shows the gap is real for the printed circuit. The MNIST anomaly (BA 36.99%) and the abstract's 'less than 6%' overstatement are important but would be moot if the enforcement itself is broken. I therefore disagree with the reader's identification of the frequency-separation assumption as the single most load-bearing concern: the circuit soundness issue is more fundamental and more readily falsifiable from the manuscript alone. A revised paper could fix this by committing to the outgoing model list inside the circuit and asserting that the argmax model is absent and the BM pointer is the argmin; until then, the central claim is unsupported as stated.","tokens_in":27765,"tokens_out":8329,"duration_ms":66111,"concrete_test":"Extract the circuit from Algorithm 2 and search for an accepting witness that violates pruning. Concretely, fix k=3 with scores S_old=10, S_2=5, S_3=6, S_new=7, β=0.7; Algorithm 1 would remove the oldest model (adjusted score 10/0.7=14.29). Let the prover instead forward the poisoned oldest model and drop the benign S_2 model. All Algorithm 2 assertions hold: hashes match, scores are computed correctly, S_WM = max(10/0.7, 5, 6, 7) = 14.29, and S_BM = min(10, 5, 6, 7·0.7) = 4.9. The proof accepts despite the protocol violation. If the actual emp-zk implementation contains additional membership or pointer constraints not shown in Algorithm 2, the paper must state them explicitly; as written, the described circuit does not enforce the defense. A second check: re-derive the β-adjusted max/min exactly as in Algorithm 1 and confirm whether the circuit's formulas match.","verdict_should_be":"REJECT","load_bearing_attack":"The paper's central novelty is that a malicious client cannot deviate from the defense protocol without failing ZKP verification (§4.1, §6.1). The circuit in Algorithm 2 does not actually enforce the pruning step. Its only aggregate assertions are S_WM = max(S_{i-k}/β, ..., S_i) and S_BM = min(S_{i-k}, ..., S_i · β). There is no assertion that the model attaining S_WM is excluded from the forwarded top-k list, nor that the BM pointer corresponds to the argmin model. The forwarded list is never committed as a public input or output of the circuit. The prose in §4.5 claims the proof 'proves that it [the worst model] is not included in the top-k models,' but the pseudocode encodes no such membership check. A malicious prover can compute all scores honestly, then forward the high-scoring poisoned model and drop a benign one; every printed assertion still holds because all Hash(M_t) and Hash(DCT(M_t)) match the public hashes and the max/min equalities are satisfied. The receiving client's hash check (Step 2) only confirms that received models are among the public hash set, not that the correct subset was chosen. Thus the ZKP does not attest to correct execution of Algorithm 1 lines 16–19, which is the specific computational integrity the paper claims. Additionally, the β-adjustment in Algorithm 2 is inconsistent with Algorithm 1: the max expression divides only the oldest score by β, while the min expression multiplies only the newest score by β, instead of applying both adjustments to the same score list before taking argmax/argmin.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents ZORRO, a client-side backdoor defense for U-shaped split learning. In ZORRO, each client computes discrete-cosine-transform (DCT) based poison risk scores for a queue of recent head/tail checkpoints, prunes the highest-scoring model, updates a best-model pointer, and uses an interactive VOLE-based zero-knowledge proof (built on Wolverine/emp-zk) to attest that this computation was performed honestly. The paper evaluates ZORRO on six datasets, several architectures, different IID degrees, client counts, and adaptive attacks, and reports low backdoor accuracy and modest ZKP overhead for models with up to roughly one million client-side parameters.","tokens_in":28035,"tokens_out":7549,"duration_ms":66529,"significance":"If the cryptographic enforcement claim were correct, ZORRO would be the first client-side, ZKP-enforced backdoor defense for split learning, and the empirical study is genuinely broad: it covers multiple datasets, architectures, poisoning rates, and adaptive attack strategies, and it includes runtime and memory measurements on realistic hardware. The use of Freivald's algorithm to probabilistically verify the DCT inside the ZK circuit is a sensible and potentially useful optimization. However, the central claim that the ZKP forces correct execution of the defense is not supported by the protocol as written: Algorithm 2 does not constrain the pruning/forwarding decision, and the abstract's headline attack-success bound is contradicted by the paper's own MNIST result. These are load-bearing issues, not presentation concerns.","major_comments":[{"comment":"The circuit in Algorithm 2 does not attest to the pruning and forwarding decisions, which are the core of the claimed enforcement. The only aggregate assertions are on the numeric values S_WM and S_BM (max and min of the score list); there is no assertion that the model attaining S_WM is the one excluded from the forwarded top-k list, no assertion that BM corresponds to the argmin model, and no public input committing to the actual subset of hashes that is forwarded. A malicious prover can compute all hashes and scores honestly, then forward the high-scoring poisoned model and drop a benign one; every assertion in the circuit still holds, and the verifier's hash check in Step 2 only confirms that the received models belong to the committed hash set. This invalidates the claims in §4.1 and §6.1 that a deviating client cannot produce a valid proof, and it invalidates the formal soundness statement in Eq. (2) as applied to \"correct execution of Alg. 2.\" The circuit must take the forwarded hashes as public inputs and enforce the subset/exclusion and argmax/argmin relations. Separately, Step 7's statement that the proof verifies the update is the difference M_i - M_{i-1} is not reflected in Algorithm 2, which has no update inputs at all.","section":"§4.5, Algorithm 2"},{"comment":"The beta-adjustment encoded in Algorithm 2 is inconsistent with Algorithm 1. Algorithm 1 adjusts the entire score vector before computing argmax and argmin: S[0] <- S[0]/beta and S[k] <- S[k]*beta, and both extrema are taken over this adjusted vector. Algorithm 2, however, asserts S_WM = max(S_{i-k}/beta, ..., S_i) and S_BM = min(S_{i-k}, ..., S_i*beta), using the unadjusted oldest score in the minimum. For beta < 1 these differ whenever the oldest score is the minimum after adjustment, so the ZKP can attest to a different BM than the defense procedure would compute. The circuit should use S_{i-k}/beta in the minimum as well, or the prose should explicitly define BM over the unadjusted scores; as written, the circuit does not match the described defense.","section":"§4.3, Algorithm 1, Algorithm 2"},{"comment":"The abstract's headline claim that ZORRO \"reduces the attack success rate to less than 6%\" is contradicted by Table 2, which reports ZORRO achieving BA = 36.99% on MNIST. The Appendix F explanation (benign-model distraction) may be plausible, and PRR = 100% shows that poisoned models were removed, but the metric BA is exactly the attack success rate, and 36.99% is not less than 6%. This is not a minor wording issue: a reader relying on the abstract would wrongly conclude that the defense bounds the backdoor accuracy on every reported configuration. The claim should be qualified, for example by stating the bound holds on all datasets except MNIST, or by reporting a different metric that supports the advertised bound.","section":"Abstract, Table 2"},{"comment":"The default configuration used for the headline results was selected using ablations on the same CIFAR-10/ResNet-18 setup that later serves as the principal evidence of effectiveness. Specifically, beta = 0.7, k = 3, and the Taxicab norm are chosen based on Tables 9-11 in Appendix D, which are CIFAR-10 results, while Table 2 and Table 7 report the CIFAR-10 configuration as the main demonstration of low BA and high MA. This creates a selection-circularity: the reported numbers for the default setting are not an out-of-sample evaluation of the defense. The authors should either fix all hyperparameters before running any experiments and treat every dataset as held out, or report the parameter selection procedure separately with a clear statement of the degrees of freedom used and their effect on the headline metrics.","section":"§5.2.1, App. D, Tables 2 and 7"},{"comment":"The security analysis in Section 6.2 assumes without proof that the DCT/Taxicab scoring separates poisoned from benign updates. The ZKP only enforces that the scoring and pruning computations were performed; it does not prove that the highest-scoring model is actually poisoned, nor that the forwarded model is benign. The paper's empirical evidence supports the heuristic for the tested attacks, but the invariant argument in §6.2 that \"one benign model remains in the queue\" depends on this detection heuristic rather than on the cryptographic protocol. This should be stated explicitly as an assumption, and the abstract's phrases claiming the proof attests to the \"benign nature\" of local model portions should be softened accordingly.","section":"§6.2, §4.1"}],"minor_comments":[{"comment":"Reference [17] contains a formatting error: the author name should be \"Rūsiņš Freivalds,\" not \"R¯usin, š Freivalds.\"","section":"References"},{"comment":"The sentence \"As the table shows ZORRO effectively mitigates the attack.ZORRO effectively mitigates the attack for all datasets\" is duplicated and should be merged.","section":"§5.3"},{"comment":"Section 5.2.2 states that all experiments were repeated 3 times with different seeds, while Appendix C says the experiment was conducted on each server 5 times; these statements should be reconciled.","section":"§5.2.2, App. C"},{"comment":"The legend entry \"ResNet-18. 34 (CIFAR10)\" appears to be a formatting artifact and should read \"ResNet-18, ResNet-34 (CIFAR-10).\"","section":"Fig. 6"},{"comment":"The expressions max(S_{i-k}/beta, ..., S_i) and min(S_{i-k}, ..., S_i*beta) are ambiguous because the ellipsis does not make explicit which scores are adjusted. The pseudocode should list the adjusted score vector explicitly, especially given the inconsistency with Algorithm 1 noted above.","section":"Algorithm 2"}],"recommendation":"reject","confidential_remarks":"The central cryptographic-enforcement contribution is not supported by the submitted protocol: Algorithm 2 does not bind the forwarded top-k list to the pruning decision, and the beta-consistency bug shows the circuit and defense are not even aligned for honest execution. The MNIST result further undercuts the abstract's quantitative headline. I do not see a path to acceptance without redesigning and re-proving the core protocol and re-running the evaluation; this is beyond a normal revision. I would encourage the authors to consider a revised submission after addressing these issues."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Punchline: ZORRO is a real idea with a strong empirical story, but the precise thing that makes it novel—a zero-knowledge proof that enforces the client-side defense—does not hold up as specified. I checked the stress-test concern against Algorithm 2 and it lands. The circuit verifies hashes, checks DCT consistency with Freivald's trick, and asserts max/min poison scores, but it never commits to which model is dropped or forwarded. A malicious client can compute every score honestly, forward the poisoned model, drop a benign one, and still produce a valid proof. The prose in §4.5 says the proof shows the worst model is excluded from the top-k list, but Algorithm 2 has no membership or argmax/argmin assertion tying the forwarded subset to the scores. That is a load-bearing gap. There is also a smaller internal inconsistency: the beta-adjusted max/min expressions in Algorithm 2 do not match Algorithm 1's application of beta to both oldest and newest scores before argmax/argmin.\n\nCredit where it is due: this is the first client-side, ZKP-backed backdoor defense for U-shaped split learning, and the frequency-domain DCT scoring is a sensible adaptation of the SafeSplit intuition. The evaluation is broad—six datasets, several architectures, adaptive attacks, client counts up to 1000—and the default CIFAR-10 results are strong. The MNIST 36.99% BA is honestly reported, and the \"benign model distraction\" appendix is a plausible explanation. But the abstract's blanket \"less than 6%\" claim does not survive contact with the paper's own MNIST table.\n\nOther soft spots, in proportion: the default beta, queue length, and scoring norm are selected by ablations on the same CIFAR-10 configuration used for the headline numbers, so the headline effectiveness is partly tuned. No code or data are released, which matters because the ZKP implementation is a central artifact. And the paper occasionally says the proofs attest to the \"benign nature\" of models; they only attest that a particular scoring/pruning heuristic was executed, not that the surviving model is actually benign. The latter is an empirical assumption, not a cryptographic guarantee.\n\nBottom line: this is worth reading for anyone working on split-learning security, and the defense may work in practice. But the central enforcement claim needs a real fix: commit the forwarded subset as a public input/output, assert the pruned index matches the argmax, align the beta adjustments, and temper the abstract. I would not accept the soundness claim as written, but the paper deserves a serious referee and a major-revision path rather than a desk reject.","headline":"Genuinely novel client-side split-learning defense with solid experiments, but the ZKP enforcement of the pruning step is not actually encoded in Algorithm 2, and the abstract overstates the attack-success claim.","tokens_in":28644,"tokens_out":3500,"would_cite":true,"duration_ms":388429,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"ZORRO claims zero-knowledge proofs can enforce a client-side frequency-domain defense that reduces split-learning backdoor attack success below 6%.","keywords":["split learning","backdoor defense","poisoning defense","zero-knowledge proofs","interactive zero-knowledge","discrete cosine transform","client-side defense","frequency-domain analysis"],"falsifier":"An adaptive attacker who adds a frequency-shaping term to the backdoor objective, minimizing the $\\ell^1$ norm of the low-frequency DCT coefficients of the poisoned update, could be tested against ZORRO; if the poisoned checkpoint survives pruning and the defended model still misclassifies triggered inputs, the core detection assumption fails.","tokens_in":27536,"feed_emoji":"🛡️","tokens_out":10701,"duration_ms":94662,"temperature":0.7,"pith_summary":"ZORRO sets out to establish a way to defend split learning against backdoor attacks launched by malicious clients, without making the server the security bottleneck. In the U-shaped split setting, each client owns the head and tail layers, so ZORRO makes the client itself score its freshly trained update by the magnitude of the low-frequency discrete cosine transform coefficients, remove the worst checkpoint from a sliding window, and then generate an interactive zero-knowledge proof that these steps were performed correctly on the exact models the server has committed to. The proof does not reveal model parameters. If it works as claimed, the scheme turns backdoor defense into a cryptographic enforcement problem: a malicious client must either let its poisoned update be pruned or fail verification and be exposed. The paper's evaluation supports this position with backdoor accuracy below 6% in most settings, minimal utility loss, and client-side overhead of under 10 seconds for models with $10^6$ client-side parameters.","feed_headline":"ZKP-enforced client defense cuts split-learning backdoors below 6%","feed_subtitle":"Each client must prove it ran the frequency-based poison check, so bad updates are pruned before they spread.","key_machinery":"The argument rides on three interlocking pieces. First, a frequency-domain scorer: each head/tail update $U_t$ is viewed as a matrix, transformed by the 2D discrete cosine transform, and the magnitude of the low-frequency coefficients satisfying $u+v<N/2$ is summed with the taxicab ($\\ell^1$) norm to give a poison risk score $s_t$; the oldest score is divided by $\\beta$ and the newest score is multiplied by $\\beta$ to keep training moving when no poison is present. Second, a sliding queue: each client holds $k$ checkpoints plus its new model, removes the highest-scoring checkpoint, and advances a best-model pointer to the lowest-scoring remaining checkpoint. Third, an interactive zero-knowledge proof built on vector oblivious linear evaluation (VOLE) commitments, whose circuit asserts that each model hashes to the server-published commitment, that the claimed DCT is consistent with the committed model through a verifier-chosen randomized matrix-vector check rather than a full in-circuit transform, and that the reported maximum and minimum scores are the true ones. The proof, verified by the next client and the server, is what converts the heuristic scoring rule into an enforceable protocol.","core_discovery":"The central claim is that backdoor poisoning of split learning can be stopped at the client by requiring each client to prove, through an interactive zero-knowledge proof, that it ran a specified frequency-domain hygiene step on its own head and tail update. Concretely, ZORRO appends the freshly trained model $M_i$ to a queue of $k$ checkpoints, computes each update's two-dimensional discrete cosine transform, sums the magnitude of the low-frequency coefficients in the triangle $u+v<N/2$ with the taxicab norm, prunes the highest-scoring checkpoint, and points the next client to the lowest-scoring one; a bias parameter $\\beta\\in(0,1]$ nudges selection toward recent benign checkpoints. The interactive ZKP attests, without revealing model parameters, that the hash of each model matches the server-committed hash, that the claimed DCT is consistent with the committed model (checked probabilistically with verifier randomness), and that the reported worst and best scores are the true maximum and minimum. The paper claims this forces a malicious client into a dilemma: follow the protocol and let the poison be pruned, or deviate and fail verification, exposing the client. This is the first client-side, ZKP-enforced backdoor defense for split learning, and the reported experiments put backdoor accuracy below 6%, main-task accuracy close to the undefended model, and client-side runtime for $10^6$ parameters under 10 seconds.","pith_inferences":["The ZKP can prove only that the scoring and pruning were executed faithfully; it cannot prove that low-frequency DCT magnitude separates poison from benign non-IID drift, so the defense's real security bound lives in that empirical separation rather than in the cryptography.","A natural attack not explicitly covered would shape the poisoned update to minimize low-frequency DCT energy while preserving trigger effectiveness; if such an attack succeeds, the frequency heuristic itself would be the point of failure, not the proof system.","The same enforcement pattern could plausibly be extended to server-side defenses or to other distributed training paradigms, since the circuit verifies generic scoring, argmax, argmin, and pointer updates, although the paper only claims the scheme for its own split-learning setting.","The MNIST distraction result suggests that a defended model can still classify triggered inputs into the attacker's target class when no poison survives, so reported backdoor accuracy may overstate residual poisoning in datasets with strong positional or structural bias."],"forward_implications":["A malicious client can no longer keep a poisoned checkpoint in the training chain without detection: either the enforced pruning removes it or the failed proof identifies the client.","The defense scales with client count, with the paper reporting low backdoor accuracy even at 1000 clients and with poisoning rates up to 80%.","The per-client cost fits edge-device constraints: under 10 seconds of proof overhead for a $10^6$-parameter local model and roughly 0.9 GB peak memory for the largest tested client-side partition.","Privacy survives the defense: neither the server nor the next client ever sees raw head or tail parameters, only commitments of those models and proofs of correct processing.","Because the ZK circuit is modular, the same enforcement mechanism can attest to other client-side scoring rules, such as an $\\ell^2$-norm or clustering-based score, without a new cryptographic design."],"supporting_citations":[{"why":"Defines the sequential U-shaped split-learning threat model and provides the server-side defense baseline ZORRO is compared with.","marker":"[39]"},{"why":"Supplies the VOLE-based interactive zero-knowledge protocol that makes proofs of correct defense execution sound and practical.","marker":"[53]"},{"why":"Provides the arithmetic-to-boolean conversion techniques used inside the ZK circuit for hashing and scoring.","marker":"[54]"},{"why":"Gives the randomized matrix-vector equality check used to verify the DCT of each model without recomputing the transform in the circuit.","marker":"[17]"},{"why":"Supports the paper's claim that backdoor-induced behavioral changes in a network appear as shifts in low-frequency spectral components.","marker":"[38]"},{"why":"Introduces the split-learning paradigm with client-side model partitions that ZORRO inherits.","marker":"[49]"},{"why":"Defines the U-shaped split-learning configuration with client head and tail and server backbone used throughout the paper.","marker":"[30]"},{"why":"Provides the VOLE-based zero-knowledge implementation used to build and benchmark the proof circuit.","marker":"[52]"}],"fun_headline_variants":["Zero-knowledge defense prunes split-learning backdoors to <6%","Clients must prove cleanup: split-learning backdoors drop below 6%","First client-side ZKP cuts split-learning backdoors to under 6%","Prove you're clean: split-learning backdoors fall below 6%"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that a poisoned client-side head or tail update reliably produces larger low-frequency DCT magnitudes than a benign update trained on non-IID data, so always pruning the highest-scoring checkpoint leaves a benign model in the queue and removes the poison.","fun_headline_variants_meta":{"raw":{"variants":["Zero-knowledge defense prunes split-learning backdoors to <6%","Clients must prove cleanup: split-learning backdoors drop below 6%","First client-side ZKP cuts split-learning backdoors to under 6%","Prove you're clean: split-learning backdoors fall below 6%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000877,"raw_usage":{"total_tokens":3892,"prompt_tokens":1140,"completion_tokens":2752,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":756,"completion_tokens_details":{"reasoning_tokens":2670}},"tokens_in":756,"tokens_out":2752,"duration_ms":15756,"temperature":1.0,"reasoning_tokens":2670,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T15:59:28.455618+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"An adaptive attacker who adds a frequency-shaping term to the backdoor objective, minimizing the $\\ell^1$ norm of the low-frequency DCT coefficients of the poisoned update, could be tested against ZORRO; if the poisoned checkpoint survives pruning and the defended model still misclassifies triggered inputs, the core detection assumption fails.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the sequential U-shaped split-learning threat model and provides the server-side defense baseline ZORRO is compared with."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the VOLE-based interactive zero-knowledge protocol that makes proofs of correct defense execution sound and practical."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the arithmetic-to-boolean conversion techniques used inside the ZK circuit for hashing and scoring."},{"cited_title":"Hamprecht, Yoshua Bengio, and Aaron Courville","cited_arxiv_id":null,"evidence_quote":"Supports the paper's claim that backdoor-induced behavioral changes in a network appear as shifts in low-frequency spectral components."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines the U-shaped split-learning configuration with client head and tail and server backbone used throughout the paper."},{"cited_title":"2025.EMP-zk","cited_arxiv_id":null,"evidence_quote":"Provides the VOLE-based zero-knowledge implementation used to build and benchmark the proof circuit."}],"review_version":1}