{"id":"5c925341-5018-4d83-9316-a285bf75e10a","arxiv_id":"2509.22082","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"NL-SME uses a learnable quadratic Bezier curve, a control point, and per-parameter scaling to reconstruct private images from aggregated multi-step FedAvg updates, matching update directions far more closely than the linear SME baseline.","lead":"Federated learning protects privacy by sharing model updates instead of raw data, but this paper shows an attacker can reconstruct a client's private images with high fidelity even after many local training steps. The authors fit a smooth mathematical curve to the client's training path and use it to turn the shared update back into near-original images.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Per-parameter scaling d_i, not the Bézier trajectory, explains the reported gains: the ablation already shows the Bézier-only variant is worse than SME, and Lcos is computed on d-scaled gradients, making the headline Lsim comparison unfair.","rationale":"The reader's weakest assumption identifies the same load-bearing concern: the per-parameter scaling factors d_i can inflate both matching accuracy and reconstruction metrics independently of the nonlinear trajectory model. My stress-test sharpens this into a concrete technical mechanism: Lcos in Eq. (10) is defined on the d-scaled gradient, so NL-SME's reported Lsim is not comparable to the raw-gradient Lsim of the baselines. The paper's own Table 5 provides direct internal evidence: the nonlinear-path-only variant performs worse than SME, while the scaling-only variant performs substantially better. This means the central scientific claim—that quadratic Bézier trajectory modeling is the key innovation enabling order-of-magnitude improvements—is not established by the experiments as reported. The full method may still be a useful attack and the computational-efficiency claims are plausible, and the paper deserves credit for running an ablation that reveals this confound. However, the headline empirical comparison needs an SME+dvec control and unscaled-Lsim reporting before the contribution can be accepted as stated. This matches the reader's conditional verdict, so no verdict change is needed.","tokens_in":11773,"tokens_out":7233,"duration_ms":69351,"concrete_test":"Implement an SME+dvec baseline: keep the linear surrogate (Eq. 4) exactly as in SME, add the per-parameter scaling factors d_i with the same initialization (d=1), bounds [0.1, 10], regularization λd, and optimization schedule as NL-SME, and rerun all Table 1 configurations. Also recompute NL-SME's reported Lsim with d_i frozen to 1. If SME+dvec reaches NL-SME's PSNR/SSIM, or if NL-SME's unscaled Lsim collapses to SME levels, the Bézier trajectory is not responsible for the headline gains.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 4.2's Eq. (13) defines the scaled gradient as elementwise multiplication by per-parameter factors d_i ∈ [0.1, 10], and Eq. (10) computes the cosine-similarity loss on this scaled gradient. Because d_i adds one free parameter per model weight, the optimizer can reweight gradient coordinates to point toward w0 − wT even when the raw gradient direction is poor. The baselines (IG, SME, FEDLEAK) optimize and report the raw gradient direction, so NL-SME's Lsim values in Table 1 are not measuring the same quantity, and the claimed order-of-magnitude matching improvement is not an apples-to-apples comparison. The paper's own ablation confirms where the gain comes from: in Table 5, removing the per-parameter scaling and control-point regularization (Variant A, nonlinear path only) makes Lsim worse than SME (0.104 vs 0.056), whereas keeping scaling without the nonlinear path (Variant B) improves Lsim to 0.026. Thus the nonlinear surrogate is not the driver of the reported performance; the added per-parameter capacity is. Unless the baselines are given the same scaling capacity and Lsim is recomputed with d_i = 1, the central claim that nonlinear trajectory modeling enables the order-of-magnitude gains is unsupported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes NL-SME, a gradient-inversion attack for multi-step FedAvg settings. NL-SME replaces the linear interpolation surrogate of SME with a learnable quadratic Bézier curve parameterized by a control point P1 and curve parameter t, and adds per-parameter scaling factors d_i plus regularization. The paper claims that NL-SME achieves order-of-magnitude reductions in cosine-similarity loss and large PSNR/SSIM gains over FEDLEAK, IG, and SME on FEMNIST and CIFAR-100 (Table 1), while remaining computationally comparable to SME. The authors also provide robustness experiments under more complex training settings and an ablation study (Table 5).","tokens_in":12084,"tokens_out":3246,"duration_ms":31009,"significance":"If the central claim is established, the work is relevant to the federated-learning privacy community because it suggests that observable multi-step FedAvg updates still contain reconstructable signals and that nonlinear trajectory modeling can improve surrogate-model attacks. The paper also ships code, includes a broad comparison, and its ablation structure is a useful step. However, the significance currently hinges on the fairness of the comparison and on the attribution of the gains to the nonlinear trajectory model; as reported, the ablation actually suggests that the per-parameter scaling, not the Bézier path, drives most of the improvement. This needs to be resolved before the empirical claims can be accepted.","major_comments":[{"comment":"The headline comparison in Table 1 is not apples-to-apples. Equation (13) defines the matched gradient as an elementwise product with per-parameter scaling factors d_i ∈ [0.1, 10], and Eq. (10) computes the cosine-similarity loss on this scaled gradient. This adds one free parameter per model weight that can rotate the gradient direction toward w0 − wT independently of the surrogate trajectory. The baselines IG, SME, and FEDLEAK do not appear to have this extra capacity, so the Lsim values reported for NL-SME are not measuring the same quantity as the baselines. To support the central claim, the authors should either give the baselines the same scaling capacity or report Lsim computed with d_i = 1 for NL-SME.","section":"§4.2, Eq. (13), Eq. (10)"},{"comment":"The ablation study undermines the paper's attribution of the gains to nonlinear trajectory modeling. Table 5 shows that Variant A (nonlinear path without the regularization/scaling mechanism) is worse than SME (Lsim 0.104 vs. 0.056), while Variant B (scaling/regularization without the nonlinear path) improves Lsim to 0.026. This indicates that the per-parameter scaling, not the quadratic Bézier surrogate, is the main driver of the reported improvements. The text acknowledges this partially but still concludes that 'nonlinear trajectory modeling provides geometric modeling capabilities'; the experiment as reported does not support that conclusion, and the paper needs either a different ablation design or a revised claim.","section":"§5.4, Table 5"},{"comment":"Many experimental details that are load-bearing for reproducibility are omitted. The manuscript does not state the model architecture, the number of attack iterations, the learning rates for D, t, and P1, the values of λ_TV, λ_P, λ_d, and λ_cls, or whether the classification consistency loss L_cls was active in the Table 1 numbers. Since L_cls directly uses ground-truth labels and can improve PSNR/SSIM independently of trajectory matching, the reader cannot determine whether the headline results are due to the proposed trajectory model or to an auxiliary loss. These details should be provided for all settings.","section":"§5.1, §4.2"},{"comment":"The theoretical claims are asserted rather than demonstrated. Equation (7) states that the linear surrogate's gradient-direction bias has a lower bound ε_bias > 0, but no proof or precise assumptions are given; for an arbitrary non-convex loss it is not obvious that such a uniform positive lower bound exists. Similarly, §4.3 claims that 'under appropriate regularization parameter settings, control point regularization terms ensure bounded Hessian matrix condition numbers, guaranteeing local convergence,' but the conditions are not specified. Because the introduction explicitly claims a theoretical demonstration of the limitation of linear assumptions, these statements need to be either proved or clearly labeled as conjectures.","section":"§3.3, Eq. (7); §4.3"},{"comment":"Table 4 contains a result that is not consistent with the text's robustness claims. At R=20, NL-SME reports PSNR 8.05 and SSIM 0.180, which are worse than SME's 9.27 and 0.201. The text states that 'NL-SME exhibits stable high performance' and that its advantages persist under increasing training complexity, but this row shows a reversal. The authors should discuss this failure case and moderate the robustness claims accordingly.","section":"§5.3, Table 4"}],"minor_comments":[{"comment":"Several table entries appear to be typographically corrupted, e.g., '0.78850' and '0.74120' should presumably be '0.7885' and '0.741'.","section":"Table 1"},{"comment":"The norm notation in Eq. (7) is garbled in the manuscript; the double vertical bars around the difference are missing or misplaced.","section":"Eq. (7)"},{"comment":"The paper should state explicitly, for every experiment, whether L_cls is included. The current phrasing 'can be selectively added' leaves the reader unsure which table numbers use it.","section":"§4.2, §5.2"},{"comment":"The convergence plot reports a single setting or a representative run; it would be clearer to state this in the caption and to report variance across random seeds.","section":"Figure 3"},{"comment":"The paper uses R=1, 10, 20 to denote training-complexity levels but does not define the construction precisely until the later text; a short description of how R is implemented (e.g., which optimizer changes and which perturbations) should appear before Table 3.","section":"§5.3"}],"recommendation":"major_revision","confidential_remarks":"The paper is worth pursuing if the authors can re-establish the comparison on equal footing. In particular, the ablation in Table 5 is the key piece of evidence, and it currently supports the skeptic's reading that the d_i scaling factor, not the Bézier trajectory, is responsible for the gains. I would ask the editor to require a revised version where Lsim is reported without scaling and where the baselines are given equivalent capacity, before sending the paper back for review."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nIf you only read one thing about this paper, read the ablation. Table 5 shows that the nonlinear Bézier path alone (Variant A) is worse than the linear SME baseline (L_sim 0.104 vs 0.056), while the parameter regularization alone (Variant B) improves over SME (0.026). The paper still claims that nonlinear trajectory modeling is the key insight, but its own numbers point elsewhere.\n\nThe method itself is a reasonable extension: a quadratic Bézier surrogate for multi-step FedAvg updates, with a learnable control point and per-parameter scaling factors d_i. The experiments are broad — FEMNIST and CIFAR-100, several E/N/B settings, robustness to defenses, and a complexity table showing NL-SME is cheap. The code is available. That is more than many papers in this space provide.\n\nThe soft spots matter. First, the cosine-similarity loss in Eq. (10) is computed on the d-scaled gradient from Eq. (13), while the baselines are evaluated on their raw gradients. The comparison in Table 1 is therefore not measuring the same quantity. L_sim of 0.0009 looks impressive, but it partly reflects the optimizer's ability to reweight coordinates via d_i ∈ [0.1,10]. Combine that with the ablation, and the order-of-magnitude claim is not established as a property of the trajectory model.\n\nSecond, too many experimental details are missing: no model architecture, no attack iteration counts, no learning rates or loss weights, and no statement about whether the optional classification consistency loss L_cls is active in the headline numbers. There are no error bars or multiple runs, so we cannot know whether the gains are stable.\n\nThird, the theory is mostly asserted. Equation (7) is stated without proof, and the contribution list claims a theoretical demonstration of linear interpolation's limitations that the body does not deliver.\n\nNone of this makes the paper worthless. The full method (Bézier plus d-vector scaling) does achieve high PSNR/SSIM, and those metrics are not directly optimized by matching, so there is signal here. But the paper's central narrative needs to be reworked: the d-vector scaling should be credited as the main contributor, and the baselines need the same capacity.\n\nFor a FL privacy researcher, this is a useful data point. For the paper to make its case, it needs a fair evaluation: L_sim with d_i = 1, baselines with equivalent scaling, full hyperparameters, and a clear statement of L_cls's role. I would send it to peer review with major revisions rather than desk-reject it, but I would not cite the current version's claims without verification.","headline":"The Bézier trajectory isn't doing the work in this paper: the d-vector scaling is, and the headline metric is computed on scaled gradients, so the main empirical claim needs a fairer test before it should be taken at face value.","tokens_in":12614,"tokens_out":3129,"would_cite":false,"duration_ms":26958,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that NL-SME, a quadratic Bezier surrogate trajectory with a learned control point and per-parameter scaling, makes multi-step FedAvg updates reconstructable, cutting gradient-matching loss to as low as 0.0009 and raising…","keywords":["federated learning","gradient inversion attack","multi-step FedAvg","surrogate model","quadratic Bezier curve","privacy leakage","trajectory modeling","non-convex optimization"],"falsifier":"Run NL-SME and SME with identical per-parameter scaling and classification-loss components; if their reconstruction quality converges, the Bezier trajectory itself is not the cause of the gains, and if SME still lags, the curve is load-bearing.","tokens_in":11535,"feed_emoji":"🔓","tokens_out":7981,"duration_ms":61749,"temperature":0.7,"pith_summary":"Federated learning shares model updates instead of raw data, but this paper argues that the multi-step updates produced by FedAvg are still leaky if an attacker models the client's parameter path as a curve rather than a straight line. NL-SME replaces the linear interpolation used by prior surrogate-model attacks with a learnable quadratic Bezier trajectory, adds per-parameter gradient scaling, and matches the resulting surrogate gradient to the observable server-side weight change. Across FEMNIST and CIFAR-100 experiments with 20-50 local epochs and up to 50 local samples, the method cuts cosine-similarity loss from the 0.04-0.06 range to below 0.01 and lifts PSNR past 20 dB, reaching 28.8 dB in the strongest setting. If the claim holds, federated systems that treat FedAvg updates as safe under linear-surrogate analyses have been overestimating their privacy.","feed_headline":"Quadratic Bezier curves crack multi-step FedAvg data leakage","feed_subtitle":"A learnable nonlinear surrogate trajectory reconstructs private images from aggregated FedAvg updates on FEMNIST and CIFAR-100.","key_machinery":"The load-bearing object is the quadratic Bezier surrogate trajectory $\\hat{w}(t,P_1)=(1-t)^2 w_0+2(1-t)tP_1+t^2 w_T$ for $t\\in[0,1]$, with a learnable control point $P_1$ in parameter space. Setting $P_1=(w_0+w_T)/2$ recovers linear interpolation, so the model strictly generalizes SME, and the control point encodes the curvature of the SGD path. NL-SME optimizes dummy data $\\tilde{D}$, the curve parameter $t$, and $P_1$ together, using a cosine-similarity loss between the surrogate gradient and the observed update $w_0-w_T$, total-variation smoothing, control-point regularization toward the linear midpoint, per-parameter scaling factors $d_i\\in[0.1,10]$ that reweight each gradient coordinate, and optionally a classification-consistency loss.","core_discovery":"On the paper's own terms, the central discovery is that a nonlinear parametric surrogate, specifically a quadratic Bezier curve $\\hat{w}(t,P_1)=(1-t)^2 w_0+2(1-t)t P_1+t^2 w_T$, can approximate the hidden sequence of SGD states inside a FedAvg round well enough for gradient inversion to recover private images. The learned control point $P_1$ gives the surrogate extra dimensions of freedom compared with the single interpolation parameter $\\alpha$ of SME, and the per-parameter scaling factors $d_i$ reweight gradient coordinates during matching. The paper reports order-of-magnitude reductions in similarity loss and large PSNR/SSIM gains over IG, SME, and FEDLEAK, and shows the attack stays computationally cheap: memory cost independent of local step count and runtime comparable to SME. The conclusion drawn is that observable multi-step FedAvg updates still carry reconstructable signals, contradicting the implicit security assumption behind linear surrogate models.","pith_inferences":["The paper leaves open whether the per-parameter scaling factors $d_i$ or the Bezier geometry do the heavy lifting; a control experiment giving SME the same $d_i$ vector and the same classification-consistency loss would separate the two.","The same nonlinear-surrogate idea should transfer to other multi-step aggregation rules where the server observes only the cumulative parameter change, such as FedProx or SCAFFOLD; whether it helps will depend on how curved those client trajectories are.","A direct test on a quadratic convex objective, where SGD trajectories are straight, would show whether NL-SME's advantage vanishes; if it does not, the gain comes from added optimization capacity rather than trajectory shape.","Defenses built around linear surrogate attacks need re-evaluation under the nonlinear surrogate, since the attack's threat model differs from what linear-assumption evaluations assumed."],"forward_implications":["Multi-step FedAvg updates remain invertible: NL-SME recovers readable images even when clients run 20-50 local epochs with 50 local samples on FEMNIST and CIFAR-100.","Security audits that assume straight-line surrogate trajectories understate the real privacy risk of federated learning.","The attack's memory cost is independent of the number of local steps, so it remains feasible as federated training scales.","Adaptive optimizers such as AdamW can push NL-SME's PSNR below the visual corruption threshold, which points to a defense direction the paper documents."],"supporting_citations":[{"why":"Defines FedAvg multi-step aggregation, the exact observation setting the attack targets.","marker":"(McMahan et al., 2017)"},{"why":"Defines the DLG gradient-matching formulation that all gradient inversion attacks build on.","marker":"(Zhu et al., 2019)"},{"why":"Supplies the cosine-similarity loss and total-variation regularization that NL-SME adopts as its core objective.","marker":"(Geiping et al., 2020)"},{"why":"Proposes the linear-interpolation surrogate model SME that NL-SME directly extends and beats.","marker":"(Zhu et al., 2023)"},{"why":"Offers FEDLEAK, a recent strong baseline for gradient leakage in realistic FL settings.","marker":"(Fan et al., 2025)"},{"why":"Demonstrates quadratic Bezier curves connect modes in non-convex loss landscapes, justifying the curve model.","marker":"(Garipov et al., 2018)"},{"why":"DLFA full simulation shows the exponential cost of step-by-step inversion, motivating surrogate trajectories.","marker":"(Dimitrov et al., 2022)"},{"why":"iDLG establishes analytical label recovery, letting the paper focus on image reconstruction quality.","marker":"(Zhao et al., 2020)"},{"why":"Establishes the numerical stability and differentiability of the Bernstein basis used by Bezier curves.","marker":"(Farouki, 2012)"}],"fun_headline_variants":["Bezier curve approximates FedAvg trajectory to recover private images","NL-SME Learnable nonlinear trajectory bypasses FedAvg privacy defenses","Quadratic Bezier control point enables multi-step gradient inversion","Nonlinear surrogate trajectory recovers private data from FedAvg","Learnable Bezier curve models FedAvg internal steps for better inversion"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The headline result assumes the improvement comes from the curved surrogate trajectory and not from extra free per-weight scaling factors that only NL-SME has, plus an optional classification loss that baselines are not given.","fun_headline_variants_meta":{"raw":{"variants":["Bezier curve approximates FedAvg trajectory to recover private images","NL-SME Learnable nonlinear trajectory bypasses FedAvg privacy defenses","Quadratic Bezier control point enables multi-step gradient inversion","Nonlinear surrogate trajectory recovers private data from FedAvg","Learnable Bezier curve models FedAvg internal steps for better inversion"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00114,"raw_usage":{"total_tokens":4755,"prompt_tokens":990,"completion_tokens":3765,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":606,"completion_tokens_details":{"reasoning_tokens":3679}},"tokens_in":606,"tokens_out":3765,"duration_ms":23719,"temperature":1.0,"reasoning_tokens":3679,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T15:45:13.665546+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run NL-SME and SME with identical per-parameter scaling and classification-loss components; if their reconstruction quality converges, the Bezier trajectory itself is not the cause of the gains, and if SME still lags, the curve is load-bearing.","supporting_citations":[],"review_version":2}