{"id":"e9b236e5-aacd-467f-87eb-d01a765d673f","arxiv_id":"2509.10385","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"The paper proposes CAPE-assisted federated DP-CDA for private synthetic data generation, but the privacy analysis is flawed.","lead":"This paper combines two earlier privacy techniques, DP-CDA and CAPE, to generate differentially private synthetic data in a federated setting. The authors claim the new method matches centralized performance, but the privacy proof contains a critical error that may invalidate the guarantee.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 1 uses global subsampling probability p=lK/N but Algorithm 1 samples l records from each local class subset of size N/(SK), so the true inclusion probability is q=S·lK/N; the claimed ε is optimistic by a large factor.","rationale":"The reader's weakest assumption identifies exactly the same issue: Theorem 1 uses the global sampling probability p = lK/N, while the per-record probability in Algorithm 1 is the local class-level probability S·lK/N. This is load-bearing because the privacy-utility trade-off claimed in the paper (e.g., MNIST 0.795 at ε=10) depends directly on the amplified RDP bound. Using the wrong (smaller) sampling probability makes the claimed ε look much better than the mechanism actually provides. I considered whether the more fundamental problem is that the proof analyzes only the aggregate and ignores the server's view of local outputs; that is also serious, but the sampling-probability error is independent, concrete, and sufficient to reject the theorem as stated. A single recomputation of the theorem's ε with the correct q, using the paper's own formulas and experimental parameters, would settle whether the concern lands. Since this matches the reader's verdict, no adjustment is needed.","tokens_in":12928,"tokens_out":19533,"duration_ms":234630,"concrete_test":"Recompute Theorem 1's ε for an experimental configuration (e.g., MNIST, S=10, N=60000, K=10, l=4, T=Ts, δ as in the paper) using the paper's own ε'(α) formula but replacing p = lK/N with q = S·lK/N, leaving τ_g at the value the authors calibrated for the claimed ε=10. If the resulting ε is materially larger than 10 (or if τ_g must be scaled by approximately S to restore ε=10), the privacy analysis in Theorem 1 is incorrect and the central claim fails. A complementary audit would be a membership-inference test on the released synthetic dataset to measure the empirical privacy loss at the claimed budget.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central privacy claim is Theorem 1, which applies subsampling RDP amplification with p = lK/N, described as the probability of subsampling l points from a dataset of size N. Under Algorithm 1, however, the l records are drawn from each client's local class-specific set X_{s,k}, whose size is N/(SK) under the stated uniform partition assumption (N_s = N/S, K classes). A fixed record therefore has inclusion probability q = l / (N/(SK)) = S·lK/N = S p, not p. The RDP amplification bound is strongly sensitive to this probability: for small q the amplified cost scales roughly with q^2, so the paper's ε is optimistic by a factor on the order of S (if analyzing the aggregate) to S^2 (if analyzing the local messages the server receives). This is not a minor calibration issue: it directly invalidates the reported ε=10, since the noise τ_g was evidently chosen to satisfy the theorem with the smaller p. Correcting q to S·p requires either accepting a much larger ε or increasing τ_g substantially, which would erase the utility gains claimed in Table 1. The proof also never accounts for the server's observation of all S local outputs before aggregation, but the sampling-probability error alone is sufficient to break the stated guarantee.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes CAPE Assisted Federated DP-CDA, a protocol for decentralized differentially private synthetic data generation. Each client z-score normalizes and clips its local data, then for each class randomly selects l samples, averages them, and adds two noise vectors: an independent Gaussian g_s and a correlated zero-sum Gaussian e_s. The server averages the received noisy synthetic samples, canceling the correlated noise, and releases the aggregate. The central theoretical claim is Theorem 1, which states that the released dataset is (ε,δ)-DP with ε = min_α T ε'(α) − log δ/(α−1), where ε'(α) is the RDP subsampling amplification bound applied with sampling probability p = lK/N. Experiments on MNIST and FashionMNIST report accuracy close to centralized DP-CDA (e.g., 78.07% on MNIST at ε=10), attributed to the cancellation of correlated noise.","tokens_in":13300,"tokens_out":8155,"duration_ms":99656,"significance":"If the privacy guarantee in Theorem 1 were correct, the paper would provide a useful decentralized protocol that achieves centralized-level utility for synthetic data. The experimental setup is clear, and the paper is explicit that the utility match is achieved by intentionally setting the local noise so that the aggregate variance equals the centralized case (Section 4, 'We intentionally set the local noise...'). This transparency is a strength, but it also means the empirical comparison is not an independent validation; everything rests on the privacy accountant. The paper ships no code and the proof is the main technical contribution. Unfortunately, the proof has two load-bearing gaps: the subsampling probability is wrong by a factor of S, and the composition ignores the server's observation of all local messages. These are not presentation issues; they invalidate the reported ε values.","major_comments":[{"comment":"Theorem 1 sets p = lK/N and applies the subsampling amplification bound of [23] as if l points were sampled from the entire global dataset of size N. In Algorithm 1, however, each client samples l points from its local class-specific set X_{s,k}. Under the paper's own uniform partition assumption (N_s = N/S, K classes), |X_{s,k}| = N/(S K), so the inclusion probability of a fixed record is q = l / (N/(S K)) = S·lK/N = S p, not p. The RDP amplification bound is strongly increasing in p (roughly quadratically for small p), so the reported ε is optimistic by a factor on the order of S^2. Since the noise τ_g in the experiments is calibrated to satisfy the claimed ε (Appendix A), correcting q either requires a much larger ε or a larger τ_g, which would erase the accuracy advantage in Table 1. This is a load-bearing error in the central privacy claim.","section":"Theorem 1, Algorithm 1 Step 4"},{"comment":"The proof composes only over T synthetic samples, but the protocol transmits S local outputs for each t and class, and the honest-but-curious server observes all of them. The CAPE zero-sum property cancels e_s only in the aggregate average; the individual messages received by the server still contain e_s and are not covered by an analysis that 'reduces to analyzing the local noise component with variance τ_g^2'. A correct analysis for the released dataset in this threat model must either compose over S·T local mechanisms (in which case the relevant local noise variance is τ_e^2 + τ_g^2, not τ_g^2) or assume secure aggregation and analyze the aggregate mechanism directly. The manuscript does neither, so the stated (ε,δ) guarantee for the server's view is unsupported.","section":"Theorem 1 proof, Algorithm 1 Steps 8–11"}],"minor_comments":[{"comment":"The input preprocessing step says 'Preprocess local dataset D_i' but the input is D_s; the subscript is inconsistent with the rest of the algorithm.","section":"Algorithm 1, line 2"},{"comment":"The expression 'ε = min_{α∈{3,4,...}} T ε′(α) − log δ/(α−1)' is ambiguous; it should be 'min_α (T ε′(α) − log δ/(α−1))' (or equivalently with log(1/δ)). As written, it could be read as (min_α T ε′(α)) − log δ/(α−1), which is not a valid conversion from RDP.","section":"Theorem 1 statement"},{"comment":"The formula for τ_pool is written as τ_pool = (1/N) sqrt(2 log(1.25/δ)), omitting the ε dependence from the Gaussian mechanism (Definition 3). If the intention is sensitivity 1 and ε=1, that should be stated; otherwise the expression is dimensionally and information-theoretically incomplete.","section":"Appendix A, variance calculation"},{"comment":"The entry 'FashionMnist' should be 'FashionMNIST' for consistency. Also, the comparison with [19] would benefit from stating whether the centralized DP-CDA numbers are taken from [19] or reproduced; the current text does not clarify this.","section":"Table 2"}],"recommendation":"reject","confidential_remarks":"The paper's novelty is essentially the combination of DP-CDA with the CAPE correlated-noise protocol. That combination could be a reasonable contribution, but the central privacy theorem is not valid as stated. The subsampling probability error is not a minor calibration issue; it changes the privacy guarantee by a factor of S^2, and correcting it would likely destroy the claimed utility at ε=10. The composition over the server-visible transcript is also missing. Both issues are load-bearing and would require a substantial reworking of the privacy analysis and experiments. I therefore recommend rejection, although I would be open to a revised submission with a correct privacy accountant and a matching experimental evaluation."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Hi, quick take on arXiv:2509.10385. The combination of DP-CDA with the CAPE protocol is new, and the experimental write-up is transparent about noise calibration, but the central privacy guarantee does not hold. The proof of Theorem 1 uses p = lK/N as the subsampling probability, correct for a centralized dataset of size N. In Algorithm 1, each client samples l records from a local class subset of size N/(SK), so the true inclusion probability is S·p. The RDP amplification bound is sensitive to that factor; using the correct probability would require a much smaller epsilon or more noise, erasing the utility match. The proof also composes over T samples rather than S·T local outputs and never accounts for the fact that the server sees all S noisy vectors before aggregation. The claim that privacy reduces to analyzing the local noise only is not right, because the adversary sees e_s + g_s, not just g_s.\n\nWhat the paper does well: the experimental section is honest—the authors state that they set the local noise to match centralized variance, so the utility equivalence is by construction. The CNN and training details are reproducible. The idea of using correlated noise to cancel the sqrt(S) penalty is sound in principle, but it's borrowed from [20].\n\nAs written, the paper's main claim is unsupported, and the gaps are not patchable by a sentence change—they change the privacy-utility trade-off qualitatively. I'd desk reject rather than spend referee time on it. The idea might be salvageable with a correct analysis, but this version is not there.","headline":"The federated CAPE-DP-CDA proposal has a load-bearing privacy flaw: the proof uses the global subsampling rate for local subsampling and ignores the server's view, so the claimed epsilon does not follow.","tokens_in":13701,"tokens_out":4037,"would_cite":false,"duration_ms":43518,"reading_group":"no","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that CAPE-assisted Federated DP-CDA releases an (ε,δ)-differentially private synthetic dataset in a federated setting, with utility matching centralized DP-CDA (MNIST 0.795 at ε=10), by adding correlated zero-sum noise at e","keywords":["differential privacy","synthetic data","federated learning","correlated noise","class-centric data aggregation","Rényi differential privacy","randomized mixing","dataset synthesis"],"falsifier":"Re-run the Rényi amplification calculation with p replaced by S·lK/N for the paper's settings (e.g., S=10, K=10, N=60,000, l=4) and compare the resulting ε with the paper's ε=10; if the inflated ε exceeds the claimed budget, the guarantee as stated is false. A second direct check: inspect the per-client transmitted values at the server before averaging and test whether a membership-inference adversary can distinguish a client's records using the individual noisy vectors, since the correlated component does not cancel in that view.","tokens_in":12858,"feed_emoji":"🔒","tokens_out":8674,"duration_ms":86625,"temperature":0.7,"pith_summary":"This paper proposes a way to generate a differentially private synthetic copy of data that lives on many separate clients, without moving the raw data to a server. It extends the centralized DP-CDA method — which averages a few randomly chosen same-class samples and adds Gaussian noise — to the federated setting. The proposed fix splits each client's added noise into independent Gaussian noise and correlated Gaussian noise that is generated jointly across clients and sums to zero. When the server averages the clients' outputs, the correlated part cancels, leaving only the independent noise, so the aggregate is as clean as if all data had been pooled. The paper claims this brings federated utility to the same level as centralized DP-CDA (79.5% MNIST accuracy at ε=10) while retaining a formal (ε,δ)-DP guarantee on the released dataset.","feed_headline":"Correlated noise restores central-level utility in federated DP","feed_subtitle":"Clients add zero-sum DP noise; the server averages it away, matching centralized MNIST accuracy at ε=10.","key_machinery":"The load-bearing object is the two-component noise structure: each client adds g_s ~ N(0, τ_g^2) independently and e_s ~ N(0, τ_e^2) jointly with the other clients under the constraint Σ_s e_s = 0. The zero-sum identity means that when the server forms the average (1/S)Σ_s, the e terms vanish and the variance of the aggregate equals the centralized case if τ_g^2 = τ_pool^2. The privacy proof then treats the random selection of l samples from each class as subsampling and applies a Rényi differential privacy amplification bound with probability p=lK/N, then composes over T synthetic samples.","core_discovery":"The central claim is that the CAPE-assisted Federated DP-CDA mechanism releases a synthetic dataset D̃ that is (ε,δ)-differentially private, with ε = min_α T ε'(α) − log δ/(α−1), where ε'(α) is a subsampled Rényi divergence bound using the per-class sampling probability p=lK/N. Empirically, the synthetic data trains a small CNN to 78%+ accuracy on MNIST at ε=10, matching the centralized DP-CDA baseline, while conventional federated DP-CDA (independent noise only) falls to about 66%. The discovery is that the zero-sum correlated noise lets each client satisfy local differential privacy while the server-side average cancels the correlated component, removing the √S noise penalty that otherwise","pith_inferences":["The subsampling amplification in Theorem 1 uses p = lK/N, but each client samples l records from a local class set of size N/(SK); the true per-record inclusion probability is S·lK/N, so the numerical ε values are only as tight as that substitution is valid.","A practical prerequisite the paper does not cost out: generating the zero-sum correlated noise across clients requires either a trusted coordinator or a secure multi-party random generation step; the privacy argument assumes the server never sees the individual e_s values before aggregation.","If the cancellation is exact, the aggregate noise covariance should equal the centralized case, which could be verified by measuring sample covariance over repeated runs with the same τ_g; this would empirically separate the privacy-accounting question from the utility-cancellation question."],"forward_implications":["If the guarantee holds, federated synthetic data can match centralized DP data utility, so downstream models can be trained on the synthetic release instead of on the raw distributed data.","The √S noise inflation that forces conventional federated DP mechanisms to degrade with more clients disappears, making the method's accuracy roughly independent of S (as the paper's client-scaling experiments show).","Because the released synthetic dataset satisfies DP, the synthetic data can be reused for many downstream tasks without consuming additional privacy budget beyond the original ε.","The parameter l serves as a trade-off dial: small l preserves more sample detail but raises sensitivity; the experiments identify l≈4 as a sweet spot for MNIST and FashionMNIST.","The computational cost O(T·S·l·d_x) grows linearly in the number of clients, so scaling to larger federations does not add a separate algorithmic overhead."],"fun_headline_variants":["Zero-sum noise closes federated DP utility gap","Anti-correlated noise cancels out, boosting federated DP","Federated DP matches central accuracy with clever noise","Correlated noise tricks: federated DP on par with central","DP data synthesis: federated catches up via noise cancellation"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The proof assumes a local record's chance of entering a mix is the global per-class probability lK/N, but because a client holds only N/(SK) examples per class, the true chance is S·lK/N; a larger sampling probability means weaker subsampling amplification, so the reported ε may be understated.","fun_headline_variants_meta":{"raw":{"variants":["Zero-sum noise closes federated DP utility gap","Anti-correlated noise cancels out, boosting federated DP","Federated DP matches central accuracy with clever noise","Correlated noise tricks: federated DP on par with central","DP data synthesis: federated catches up via noise cancellation"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00019,"raw_usage":{"total_tokens":1208,"prompt_tokens":809,"completion_tokens":399,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":553,"completion_tokens_details":{"reasoning_tokens":329}},"tokens_in":553,"tokens_out":399,"duration_ms":4190,"temperature":1.0,"reasoning_tokens":329,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-04T17:53:03.320503+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the Rényi amplification calculation with p replaced by S·lK/N for the paper's settings (e.g., S=10, K=10, N=60,000, l=4) and compare the resulting ε with the paper's ε=10; if the inflated ε exceeds the claimed budget, the guarantee as stated is false. A second direct check: inspect the per-client transmitted values at the server before averaging and test whether a membership-inference adversary can distinguish a client's records using the individual noisy vectors, since the correlated component does not cancel in that view.","supporting_citations":[],"review_version":1}