{"id":"3e647469-5e25-440c-9ea8-580c9bf78349","arxiv_id":"2509.10041","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"FedRP claims to preserve FedAvg-level accuracy while sending only a few numbers per client per round and providing an (epsilon, delta)-DP guarantee.","lead":"FedRP combines random projection with ADMM so that federated learning clients send only low-dimensional projections of their models to the server. The paper claims this gives differential privacy, cuts communication costs, and retains near-FedAvg accuracy.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Unproven bridge from projected consensus to full-model consensus undermines FedRP's utility and communication claims.","rationale":"The paper's central claim is a triple: strong DP, near-FedAvg accuracy, and drastically reduced communication. The DP theorem (Thm 3.1) has independent issues, but the utility and communication claims rest entirely on the assertion that consensus in the low-dimensional projected space forces the full model parameters to be similar. This is not a standard property of random projections: the Johnson-Lindenstrauss lemma preserves pairwise distances but says nothing about identifying points from a single projection. In FedRP, the ADMM consensus penalty (Eq. 9) acts only on A^t w_i, so the null space of each A^t is invisible to the server. With m=1 and finitely many rounds, the accumulated projections impose far fewer constraints than dimensions, so client models can differ in the null space while projections match. The paper explicitly labels this as 'highly likely' rather than proving it, and the experimental protocol may circumvent the issue by using full client models for evaluation (Sec. 4.3.1). If this bridge fails, FedRP cannot deliver near-FedAvg accuracy while transmitting only m-dimensional vectors, voiding the paper's primary advertised advantage. The proposed concrete test directly measures full-model convergence in the provided code and would settle the question empirically, with an analytical fixed-point analysis as a complementary check. This concern is the same as the reader's weakest assumption, and it is sufficient to reject the central claim as currently supported.","tokens_in":19272,"tokens_out":15496,"duration_ms":189406,"concrete_test":"Using the released code, run the LeNet5/MNIST configuration with 10 clients and RPD=1. Instrument the client update to record the full model vectors w_i at the last round. Compute the maximum pairwise Euclidean distance between the 10 client models, and compare it to the same quantity under FedAvg (or at initialization). If projections are aligned but full-model distances remain large, the claimed bridge is false. Alternatively, analytically solve the fixed-point conditions for a two-client, two-parameter quadratic with m=1 to exhibit w_1 ≠ w_2 satisfying A w_1 = A w_2.","verdict_should_be":"REJECT","load_bearing_attack":"Section 3.2 asserts: 'Since the projected parameters are aligned, it is highly likely that the original model parameters w_i are also similar across clients.' This bridge is required for the server to use one client's full model as the global model without receiving full models. But the ADMM objective (Eq. 9) penalizes only A^t w_i − z̄^t; the null space of A^t is unpenalized. With m=1 and T << n, the sequence of random projection constraints imposes at most T linear conditions on each n-dimensional w_i, leaving a large subspace in which client models can differ while their projections agree. The paper provides no analysis showing the null-space components converge. If the bridge fails, the server either picks a client model far from others (accuracy loss) or averages full models (defeating the communication savings in Table 2). The test-phase ambiguity in Sec. 4.3.1 ('average of all client models') suggests the reported accuracy may rely on full-model transmission.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes FedRP, a federated learning algorithm that combines random projection with ADMM. Each client transmits a low-dimensional projection z_i = A w_i of its model parameters to the server, which averages the projections and returns the aggregate. The authors claim that this scheme yields a strong (epsilon, delta)-differential privacy guarantee (Theorem 3.1), reduces communication cost, and achieves accuracy close to FedAvg. Experiments compare FedRP to FedAvg, FedADMM, FedAvg+DP, and FWC on MNIST, CIFAR-10, and CIFAR-100 with LeNet-5, ResNet-18, and VGG16. The paper also makes a communication-efficiency claim in Table 2 and includes a proof of the privacy theorem in Appendix A.","tokens_in":19435,"tokens_out":3881,"duration_ms":50461,"significance":"If the central claims were correct, FedRP would be an interesting contribution: it promises privacy without adding noise, strong communication savings, and accuracy competitive with FedAvg. The paper is also commendable for providing code and for testing across several model architectures. However, the load-bearing elements of the paper are not supported by the current analysis. The privacy theorem uses a different distribution for the projection matrix than the algorithm, the privacy bound depends on an unreported and uncontrolled parameter sigma_min, and the utility/communication argument relies on an unproven bridge from consensus in the projected space to consensus in the full parameter space. These issues affect the core claims, not just the presentation.","major_comments":[{"comment":"The algorithm in Section 3.2 generates A with entries drawn from N(0,1/n), while Appendix A states 'A is a random matrix whose elements are drawn from standard normal distribution.' Consequently, the distributional claim in the proof, z ~ N(0, ||w||_2^2 I_m), is incorrect for the actual mechanism. With entries of variance 1/n, the covariance is (||w||_2^2 / n) I_m, which changes the density ratio and the resulting epsilon expression in Eq. (15). The proof must be reworked to match the algorithm's scaling or the algorithm must use a standard normal matrix.","section":"Section 3.2 vs. Appendix A"},{"comment":"Eq. (15) expresses epsilon in terms of Delta and sigma_min, but sigma_min is not a parameter the algorithm enforces or reports. The algorithm does not clip model parameters, does not bound their L2 norm away from zero, and does not compute or enforce the claimed sensitivity Delta. As a result, the numbers labeled epsilon/Delta in Table 3 cannot be reproduced from the manuscript and appear to be controlled by an unreported sigma_min. Since sigma_min can be chosen to make epsilon arbitrarily small, the reported privacy guarantee is partly a restatement of an assumed constant rather than a property of the mechanism. The authors need to specify exactly how sigma_min and Delta are computed, or provide a mechanism that enforces them.","section":"Theorem 3.1 and Table 3"},{"comment":"The claim 'Since the projected parameters are aligned, it is highly likely that the original model parameters w_i are also similar across clients' is load-bearing and unsupported. The ADMM objective in Eq. (9) penalizes only A w_i - zbar; the null space of A is unpenalized. With m=1 and T rounds, the transmitted projections impose at most T linear constraints on each n-dimensional w_i, leaving a large subspace in which client models can differ while their projections agree. If the server selects a single client's model, there is no guarantee it is near consensus; if the server averages full client models, it must receive the full models, which contradicts the communication savings in Table 2. A formal convergence or concentration argument is needed for the null-space components, and no such argument appears in the paper.","section":"Section 3.2, paragraph 5"},{"comment":"The test-phase description is ambiguous and directly affects the utility/communication claim. The paper states that 'the central server can use either a randomly selected client model or the average of all client models,' but Algorithm 1 transmits only z_i, not the full model w_i. If the reported accuracies use the average of all full client models, then the server must receive all full models, invalidating the communication-cost comparison. If they use a randomly selected client model, the accuracy results depend on the unproven full-space consensus assumption. The experiments should clarify which option was used and report communication costs accordingly.","section":"Section 4.3.1 and Algorithm 1"}],"minor_comments":[{"comment":"Notation is inconsistent: Section 3.2 defines A as m x n and z = A w, while Appendix A uses A in R^{n x m} and z = A^T w. This should be harmonized.","section":"Section 3.2 and Appendix A"},{"comment":"Definition 2 says epsilon and delta are in [0,1], but Theorem 3.1 later allows delta in (0,1). The ranges should be stated consistently.","section":"Section 3.3, Definition 2"},{"comment":"Algorithm 1 says 'Randomly generate A^{t+1}' but the text describes a secure seed-sharing scheme via the server. The pseudocode should reflect the intended protocol for generating and distributing A.","section":"Algorithm 1 and Section 3.2"},{"comment":"The resistance-to-reconstruction-attack claim is not supported by experiments or a formal argument. The statement that 'there is no analytical and error-free solution' does not rule out approximate reconstruction attacks; this should be substantiated or softened.","section":"Section 4.5"},{"comment":"The table uses the abbreviation 'RPD' without defining it, and the units 'Byte' vs 'KB' should be checked for consistency (e.g., RPD=1000 for LeNet-5 is listed as 4 KB, which is plausible, but the header formatting is unclear).","section":"Table 2"}],"recommendation":"reject","confidential_remarks":"The manuscript has several load-bearing technical flaws: the privacy proof does not match the algorithm's projection scaling, the privacy numbers depend on an unreported free parameter, and the central utility/communication claim relies on an unproven consensus-in-null-space assumption. These are not merely presentational issues and would require substantial new analysis and possibly redesign of the method to address. I therefore recommend rejection, although I would not rule out a future substantially revised version if these issues are resolved."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: FedRP is built on a legitimate idea—running consensus ADMM in a shared random-projection space so the server never sees a full model—but the two advertised guarantees, the DP bound and the communication savings, are not supported as written.\n\nWhat's actually new and worth keeping: the formulation where clients optimize against a projected shared vector and the server never reconstructs the original model. That's a genuine variant of sketching/ADMM methods, and the paper surveys FedSKETCH, FetchSGD, and iterative sketching fairly. The authors provide code and run a reasonably broad set of experiments across MNIST, CIFAR-10/100 and models from LeNet to VGG16. That is real effort.\n\nThe soft spots: The privacy proof in Appendix A assumes the random matrix has standard normal entries, while the algorithm (Eq. 8) draws entries from N(0,1/n). That scaling changes the distribution of the projected messages and the sensitivity the proof relies on. The theorem's epsilon depends on sigma_min, a lower bound on the norm of the parameter vector that the algorithm never enforces and that is never reported for Table 3—so the impressively small epsilon/Delta values are effectively tunable by choice of sigma_min. The utility claim leans on the unproved assertion in Section 3.2 that agreement in projection forces agreement in parameter space. With projection dimension 1, T rounds give at most T linear constraints on each n-dimensional model; the null space is unpenalized and there's no analysis showing the client models converge there. The test-phase sentence says the server can average all client models, but the server never receives full models under the protocol, so either that's a different protocol or the reported accuracy depends on full-model transmission that cancels the communication savings in Table 2. The communication comparison also omits server-to-client broadcasts and the encrypted seed-sharing overhead, which are non-negligible at m=1. And the only DP baseline is FedAvg+DP with sigma=0.1 and no clipping, which is not a calibrated DP mechanism, making the comparison favorable to FedRP.\n\nNone of this kills the underlying idea—with a corrected proof that accounts for the actual scaling and a norm-clipping step, plus an honest communication accounting, FedRP could be worth revisiting. But the current manuscript does not establish its advertised claims. I'd send it to a serious referee rather than desk-reject; they can push on the privacy analysis and the projected-consensus bridge.","headline":"FedRP's core idea is interesting, but the DP proof and the projected-consensus bridge don't hold up as written; with corrections it could be worth another look.","tokens_in":19977,"tokens_out":5676,"would_cite":false,"duration_ms":60405,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"FedRP claims that sending only low-dimensional random projections of model weights can keep federated accuracy near FedAvg while adding a formal differential-privacy guarantee and shrinking communication cost.","keywords":["federated learning","differential privacy","random projection","ADMM","consensus optimization","communication efficiency","reconstruction attack","dimensionality reduction"],"falsifier":"Train any of the reported setups with m=1 and record the accuracy of the single client model chosen as the global model, then compare it with the accuracy of the FedAvg global model; if the chosen model lags FedAvg by a large margin while the projected values agree, the consensus-in-projection assumption is what failed. More directly, the assumption is false whenever two valid solutions w1 != w2 satisfy A w1 = A w2 for the same random A, which for m=1 happens for any difference vector in the null space of A.","tokens_in":19054,"feed_emoji":"🔒","tokens_out":3497,"duration_ms":38658,"temperature":0.7,"pith_summary":"FedRP tries to solve two federated-learning pains at once: the cost of sending full model updates and the privacy risk of sending gradients that can be reverse-engineered. The algorithm has each client multiply its local model by a shared random matrix and send only the low-dimensional projected vector to the server; the server averages these vectors, and ADMM drives the clients toward agreement in the projected space. The paper's central theoretical claim is that this scheme is (epsilon, delta)-differentially private with epsilon = (Delta/sigma_min)(m + sqrt(8m ln(1/delta))) per round, where m is the projected dimension. Experiments on MNIST and CIFAR-10/100 with LeNet-5, ResNet-18, and VGG16 indicate accuracy close to standard FedAvg, better than FedAvg with added DP noise, and communication reduced to a few bytes per round when m=1. If these claims hold, privacy and bandwidth no longer have to be traded against accuracy in cross-silo federated learning.","feed_headline":"One-number model updates claim FedAvg accuracy with privacy","feed_subtitle":"Random-projection ADMM cuts per-client communication to bytes while bounding privacy loss.","key_machinery":"The random projection matrix A, shared among clients but hidden from the server, is the load-bearing object. It simultaneously compresses the model from n to m dimensions (the communication saving), hides the full model from the server and attackers (the privacy mechanism), and defines the consensus target in the ADMM loss. The DP proof treats the projected vector z = A w as a Gaussian random variable whose covariance is determined by ||w||^2, and uses the ratio of densities between neighboring models to bound the privacy loss.","core_discovery":"For each communication round, clients generate a common random projection matrix A (m x n, entries i.i.d. N(0,1/n)), project local weights w_i to z_i = A w_i, send z_i to the server, and receive the average bar-z. The local update objective is augmented with the term (rho/2)||A w_i - bar-z||^2 so that ADMM pushes the projections to consensus. The paper proves Theorem 3.1: the mechanism is (epsilon, delta)-DP with epsilon = (Delta/sigma_min)(m + sqrt(8m ln(1/delta))), using the fact that z_i is Gaussian with covariance scaled by ||w_i||^2 and bounding the ratio of densities of z and z' for neighboring datasets. It then asserts that because the projected parameters are aligned, the original pa","pith_inferences":["The biggest unproven step is the inference from consensus in the projected space to consensus in the full parameter space; with m=1, any two models differing only in the null space of A produce identical projected values, so the server cannot certify that the picked client's model represents the group.","A direct test of that step would be to record the full-model distance between clients under FedRP and compare it with FedAvg; if FedRP's client models remain far apart while their projections agree, the final-model selection is not justified.","The current analysis assumes all clients participate every round (cross-silo); extending the same projection trick to cross-device FL with partial participation and dropouts is an open direction the paper explicitly leaves out.","The per-round DP proof bounds the ratio of densities for a single projected message; the server actually sees an average of projected models, so the exact privacy guarantee of the aggregated output is left at the level of composition rather than a direct sensitivity analysis of the average."],"forward_implications":["Per client per round, communication drops from n parameters to m scalars; with m=1 that is a few bytes regardless of model size.","The per-round DP guarantee is quantified; total privacy loss over T rounds accumulates roughly linearly as T*epsilon under composition.","Because full gradients and model snapshots never reach the server, common reconstruction attacks that need those signals lose their input.","Reduced projection dimension improves the stated privacy bound; the paper reports accuracy remains near FedAvg down to m=1 in its experiments.","Noise-free projection avoids the accuracy collapse that the paper observes when DP noise is added to pre-trained models such as VGG16."],"fun_headline_variants":["Project before sending: DP-FL with truncated updates","Random projection shrinks FL traffic while adding DP","FedRP: low-dim updates for private federated averaging","One matrix multiply less: FedRP's efficient private FL","Send only projections: privacy and savings in FL"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The claim that agreement among clients in the low-dimensional projected space implies the high-dimensional local models are similar enough that one client's full model can be returned as the global model; with m=1 many different full models share the same projected value.","fun_headline_variants_meta":{"raw":{"variants":["Project before sending: DP-FL with truncated updates","Random projection shrinks FL traffic while adding DP","FedRP: low-dim updates for private federated averaging","One matrix multiply less: FedRP's efficient private FL","Send only projections: privacy and savings in FL"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000941,"raw_usage":{"total_tokens":3852,"prompt_tokens":734,"completion_tokens":3118,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":478,"completion_tokens_details":{"reasoning_tokens":3042}},"tokens_in":478,"tokens_out":3118,"duration_ms":21509,"temperature":1.0,"reasoning_tokens":3042,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-04T18:15:44.133749+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train any of the reported setups with m=1 and record the accuracy of the single client model chosen as the global model, then compare it with the accuracy of the FedAvg global model; if the chosen model lags FedAvg by a large margin while the projected values agree, the consensus-in-projection assumption is what failed. More directly, the assumption is false whenever two valid solutions w1 != w2 satisfy A w1 = A w2 for the same random A, which for m=1 happens for any difference vector in the null space of A.","supporting_citations":[],"review_version":1}