{"id":"7033b1b8-00a4-4ac2-8e1e-f2fbc43538de","arxiv_id":"2602.18396","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Random partial parameter sharing attenuates Byzantine poisoning energy in proportion to M/D and, combined with histogram-based calibration filtering, preserves nominal conformal coverage and tightens intervals.","lead":"PRISM-FCP is a federated learning method that defends against malicious clients during both model training and uncertainty calibration by having clients share only a random subset of model parameters and by filtering suspicious calibration reports. It matters because it targets a real failure mode: adversarial clients can silently destroy the reliability of uncertainty estimates in distributed medical or financial systems.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The M/D attenuation that underlies all robustness claims assumes the Byzantine noise is added before masking and is independent of the mask; a mask-aware Byzantine with a fixed energy budget suffers no such attenuation.","rationale":"The reader's weakest assumption concerned f_min and the separation condition in the quantile-derivation chain. That is a real issue, but it only bites once the M/D attenuation is accepted. The more fundamental question is whether the attenuation itself holds for the intended threat model. The paper's Theorem 2 computes the expected energy of a masked Gaussian perturbation, but the Byzantine adversary in federated learning is typically arbitrary and knows the mask. A fixed-energy adversary can concentrate its entire budget on the transmitted coordinates, eliminating the M/D benefit. This is not an internal contradiction—the paper is explicit about its stochastic attack model in Remark 2—but it directly limits the scope of the central claim. The proposed A/B test with a mask-aware attack is decisive: it cleanly separates 'stochastic-noise attenuation' from 'Byzantine robustness'. If the advantage vanishes, the title-level claims and Corollaries 4-5 must be rescoped; if it persists, the concern is resolved. Because the paper is already CONDITIONAL in the reader's verdict, my read does not shift the verdict label, but it identifies a different and more load-bearing condition to verify.","tokens_in":20939,"tokens_out":15077,"duration_ms":138429,"concrete_test":"Run the synthetic benchmark from Section V-A with a mask-aware Byzantine attack: Byzantine clients, on attack rounds, add a perturbation δ with fixed squared norm Dσ_B^2 whose support is exactly the set of M coordinates in their current mask S_{k,n} (so the transmitted, masked perturbation energy is Dσ_B^2 for both PRISM-FCP at M/D=0.3 and Rob-FCP at M/D=1). Compare steady-state MSE, coverage, and interval width. If PRISM-FCP no longer outperforms Rob-FCP (or does worse), the advertised M/D attenuation is specific to the Gaussian all-coordinate attack; if it still wins, the benefit survives a mask-aware adversary and the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Central mechanism: Theorem 2's exact M/D energy attenuation (Eq. 23-24) computes E||S_{k,n}δ||^2 = Mσ_B^2 under the Section II-C model where δ~N(0,σ_B^2 I_D) is added to the full local update and then masked. This expectation over S and δ is the only place the M/D factor enters the theory. A Byzantine client, however, knows the mask—it must know which M coordinates to transmit—and is free to choose δ. If the adversary's constraint is a fixed total perturbation energy (the standard bounded-norm Byzantine model), it can put that entire budget on the transmitted coordinates: the masked perturbation then has energy Dσ_B^2 (not Mσ_B^2), and partial sharing gives no attenuation. Remark 2 acknowledges that 'more powerful adversaries may be adaptive and concentrate perturbations on the shared coordinates if they observe the selection masks,' but that is not an exotic adversary; it is the canonical Byzantine one. Since Corollary 2, Proposition 2, Theorem 3, and Corollaries 4-5 all inherit this attenuation, the headline Byzantine-resilience claim is currently supported only for the narrow stochastic non-adaptive attack used in the experiments.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes PRISM-FCP, a federated conformal prediction framework that combines partial model sharing (PSO-Fed) with Rob-FCP-style histogram-based Byzantine filtering. The claimed contribution is end-to-end Byzantine robustness: during training, random partial sharing attenuates the expected energy of a Byzantine perturbation by a factor M/D, reducing steady-state MSE and thereby tightening conformal intervals; during calibration, distance-based maliciousness scores filter Byzantine score submissions. The paper provides a theoretical analysis (Theorems 1–3, Lemmas 1–7, Corollaries 1–5) and experiments on synthetic data and the UCI Superconductivity dataset, reporting near-nominal 90% coverage with narrower intervals than Rob-FCP and reduced communication.","tokens_in":21156,"tokens_out":7877,"duration_ms":74293,"significance":"If fully established, the paper's core idea—that a communication-compression mechanism can double as a Byzantine-defense mechanism—would be a useful and non-obvious contribution to federated conformal prediction. The empirical study is substantial: 100 Monte Carlo trials, three calibration attack types, a real benchmark, an M/D ablation, and a comparison against Rob-FCP and FCP. The paper also makes a concrete, falsifiable prediction (Fig. 5: quantile deviation decreases with smaller M/D) and is honest in Remark 2 about the limited adversary model. However, the central theoretical claim currently rests on the M/D attenuation of instantaneous stochastic perturbations, and the paper does not show that this attenuation propagates to the steady-state quantities used by the downstream theorems. The significance will depend on whether that gap can be closed or the claims appropriately restricted.","major_comments":[{"comment":"The exact M/D attenuation is derived under the assumption that δ_{k,n} ~ N(0, σ_B^2 I_D) is independent of the selection mask S_{k,n} and is injected before masking. A Byzantine client knows the mask—it must know which M coordinates to transmit—and, under the standard bounded-norm Byzantine model, it can place its entire perturbation budget on the transmitted coordinates. The masked perturbation energy is then Dσ_B^2, not Mσ_B^2, so partial sharing provides no attenuation. Remark 2 describes such an adversary as 'more powerful,' but this is the canonical Byzantine adversary. Since Corollary 2, Proposition 2, Theorem 3, and Corollaries 4–5 all inherit the claimed E_ω(M) reduction, the paper's headline Byzantine-resilience claim is currently established only for the narrow stochastic non-adaptive attack in Sec. II-C. The authors should either prove a bound for bounded-norm adaptive adversa","section":"Sec. II-C, Remark 2; Theorem 2, Eq. (23)–(24)"},{"comment":"Eq. (23)–(24) computes the instantaneous expected energy E||S_{k,n} δ_{k,n}||_2^2 = M σ_B^2 for a single masked attack vector. The central downstream result, Eq. (25), requires that this attenuation propagates into the steady-state Byzantine MSE term E_ω(M) in the decomposition E = E_φ(M) + E_ω(M) + E_Θ (Lemma 3, Eq. (13)). The paper does not derive an expression for E_ω(M) or prove any monotonicity with respect to M; Lemma 4 is cited to [16] and its statement repeats only the instantaneous expectation. Eq. (25) is therefore not established: the 'if' clause is essentially the desired conclusion, and the sentence about 'matrices whose spectral properties also depend on M' is not a derivation. Corollary 2 and the explanation of the empirical MSE gain (−26.4 dB vs. −21.4 dB) depend on this missing step. The authors should supply the steady-state E_ω(M) analysis or clearly mark the MSE reduc","section":"Sec. IV-C, Theorem 2, Eq. (25); Lemma 4"},{"comment":"The quantile-deviation bound requires inf_{t∈N} f^⋆(t) ≥ f_min > 0 in a neighborhood of the benign quantile q^⋆, and the final bound scales as 1/f_min. If benign nonconformity scores concentrate around a point mass—e.g., many near-zero residuals, or after the normalization/binning used in the calibration stage—f_min can be very small or zero, making the bound vacuous. The manuscript does not discuss how f_min behaves for the synthetic or UCI score distributions, nor does it provide any empirical estimate of f_min. Since the tight-interval claim is justified partly by this theorem, the authors should state this limitation explicitly and, if possible, validate the density condition in the experimental settings.","section":"Sec. IV-C, Theorem 1 and Corollary 1"}],"minor_comments":[{"comment":"The Byzantine update is written as w_{k,n+1} + β_k τ_{k,n} δ_{k,n} in one place and w_{k,n} + τ_{k,n} δ_{k,n} in the next; align the index and clarify whether δ is added before or after masking (the derivation assumes the former).","section":"Sec. II-C"},{"comment":"The quantile deviation is plotted versus M/D, but no error bars or confidence intervals are shown. Since the paper emphasizes Monte Carlo averaging, adding error bars would strengthen the monotonicity claim.","section":"Fig. 5"},{"comment":"The step 'Taking probabilities over (x,y)' is informal: F^⋆(t − Δ(x)) depends on the random quantity Δ(x). Please write the argument with conditional expectations so the bound in Eq. (29) is justified.","section":"Lemma 7, proof"},{"comment":"The score-separation condition (34) is plausible but is not validated in the experiments. Reporting the empirical values of Δ, r_a, and r_b (or at least the margin γ) for the three attacks would make the exact-filtering guarantee more convincing.","section":"Sec. III-B and Theorem 3"},{"comment":"The phrase 'Byzantine-resilient' overstates the proven scope: the training-phase proof covers stochastic additive Gaussian perturbations, not arbitrary Byzantine behavior. Consider using 'stochastic model-poisoning attacks' in the title/abstract or substantially extending the analysis.","section":"Abstract and Title"}],"recommendation":"major_revision","confidential_remarks":"The paper has a potentially interesting core idea and a solid experimental section, but the theoretical contribution is currently not load-bearing for the stated claims: the M/D attenuation is shown only for a stochastic, mask-independent attack, and the propagation from instantaneous attack energy to steady-state MSE is asserted rather than derived. The authors should be asked to either close these gaps or reframe the contribution as an empirical robustness study plus a limited-analysis paper. I saw no sign of misconduct; Remark 2 is transparent, and the external dependence on [16] is disclosed, though it further reduces the self-containedness of the theory."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The short version: PRISM-FCP has a genuine empirical result and a useful if fragile theoretical chain, but the theory currently backs the wrong threat model. The paper shows that partial sharing plus Rob-FCP-style filtering maintains 90% coverage and tightens intervals under a Gaussian model-poisoning attack and three calibration attacks. That part is credible. The genuinely new content is the analytical ladder connecting the PSO-Fed MSE decomposition to conformal quantile deviation bounds: Lemma 5, Theorem 1, Corollaries 1–2, and Proposition 1. This is a real link between communication efficiency and calibration quality, and the experiments support the trend that smaller M/D tightens intervals without breaking coverage.\n\nNow the soft spots, in proportion. The stress-test note is right: Theorem 2 computes the M/D attenuation as an expectation over a random mask that is independent of the injected noise. But the Byzantine client chooses its own update and, in practice, knows which coordinates it is transmitting. A standard bounded-energy adversary can put all its perturbation on those M coordinates, and then the masked energy is Dσ²_B, not Mσ²_B. That kills the headline mechanism. Remark 2 acknowledges adaptive adversaries but dismisses them as future work; that is the canonical Byzantine model, not a fringe case. So the theoretical guarantee is currently only for the narrow stochastic non-adaptive attack used in the experiments. This is a load-bearing caveat, though not a contradiction of the empirical results.\n\nThe next issue is the gap between Theorem 2 and the steady-state bounds. The paper states that E_ω(M) and E_ϕ(M) depend on M but never derives them. Corollary 2 and Proposition 2 inherit this. Theorem 3's separation condition (Eq. 34) is plausible but unmeasured; the paper does not report parameters like μ, binning rules, or the exact histogram normalization, which makes reproduction harder. Corollaries 4–5 also import Rob-FCP's certification machinery with several quantities left undefined. None of this is fatal—the empirical improvement over Rob-FCP would likely survive even if the theorem chain were weakened to Corollary 1—but it means the paper currently overclaims what is proven.\n\nThe writing has structural issues: the introduction promises Section II then jumps to IV, and notation drifts (e.g., the recursive update line in Section II-B looks mangled). Still, the authors are honest about their assumptions and cite prior work that they build on (PSO-Fed, Rob-FCP) without hiding the borrowed parts.\n\nWho gets value: anyone working on federated conformal prediction or communication-efficient FL with adversarial clients. This deserves a serious referee—yes, send it out—but I would ask for revision: either prove the steady-state attenuation for a bounded-energy adversary or explicitly reframe the contribution as resilience to non-adaptive stochastic poisoning, plus provide the missing parameter details and a trimmed-mean baseline. If they do that, it would be a solid addition to the field.","headline":"The empirical claim holds up for the stochastic attack they study, but the headline Byzantine-robustness theory leans on an M/D attenuation that a mask-aware adversary can sidestep, so the paper needs revisions before it can stand as a general defense.","tokens_in":21790,"tokens_out":1735,"would_cite":true,"duration_ms":19784,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Randomly sharing only M of D model parameters per round attenuates Byzantine poisoning energy by exactly M/D, letting federated conformal prediction keep nominal coverage with tighter intervals.","keywords":["federated learning","conformal prediction","Byzantine robustness","partial model sharing","model poisoning","prediction intervals","uncertainty quantification","histogram filtering"],"falsifier":"Construct a calibration scenario where all benign clients produce identical residuals that concentrate exactly at the target quantile, so the benign density near q* is zero; then compute the quantile under a small training perturbation. If the observed quantile shift exceeds the fourth-root bound by a wide margin, the density assumption fails. Alternatively, run an adaptive Byzantine client that observes which M parameters are shared and injects all its perturbation energy into those coordinates; under the paper's stochastic attack model the measured interval width should remain near the M/D-a","tokens_in":20673,"feed_emoji":"🛡️","tokens_out":2379,"duration_ms":38939,"temperature":0.7,"pith_summary":"PRISM-FCP argues that the same mechanism used to cut communication cost—each client transmitting only a random subset of model parameters each round—acts as a built-in defense against Byzantine model poisoning. Because a Byzantine client's injected perturbation is masked before it enters the server aggregation, its expected energy drops by the factor M/D, which propagates through the steady-state mean-square error into the residual distribution and finally into the width of conformal prediction intervals. The paper derives this chain formally: exact per-iteration attenuation, a fourth-root quantile-deviation bound, and an exact-filtering guarantee for the calibration stage, provided benign score histograms separate from adversarial ones. Empirically, the method holds 90% coverage under efficiency, coverage, and random attacks while producing intervals about 1.8 times narrower than the calibration-only baseline on synthetic data and about 13 percent narrower on the UCI Superconductivity dataset. The central insight is that adversarial influence shrinks simply because a random mask hides a fraction of the poisoned coordinates from the aggregate, at no extra computational cost to clients.","feed_headline":"Partial sharing cuts Byzantine attack power by exact M/D","feed_subtitle":"Federated conformal prediction keeps 90% coverage with tighter intervals while sending fewer parameters per round.","key_machinery":"The random selection matrix Sk,n, a diagonal matrix with exactly M ones, is the central object: it masks which coordinates clients upload and receive. When a Byzantine client adds noise of variance σ²_B to its update, the masked perturbation has expected squared norm Mσ²_B, exactly M/D times the full-sharing value. This stochastic filter reduces the Byzantine-induced component of steady-state MSE, which in turn tightens residual distributions. The calibration stage uses histogram characterization vectors in the probability simplex, pairwise ℓ₂ distances, and a maliciousness score summing distances to the K_b−1 farthest clients; the paper proves these filters exactly identify Byzantine client","core_discovery":"The paper establishes that partial model sharing—exchanging only a randomly chosen M of D parameters per client per round—reduces the expected energy of a Byzantine perturbation entering the federated aggregation by the exact factor M/D (Theorem 2, Eq. 23–24). Combined with the steady-state MSE decomposition (Lemma 3) and a quantile-stability bound that depends on the benign residual density near the target quantile (Theorem 1), this yields a bound on the shift of the conformal quantile that scales as the fourth root of the steady-state parameter error (Corollary 1–2). The mechanism also improves calibration-phase Byzantine detection: lower training error concentrates benign client score his","pith_inferences":["The M/D attenuation argument is purely statistical and does not rely on the linear model: any federated system that randomly masks a fraction of the shared update before aggregation should dilute additive poisoning energy proportionally, so the mechanism plausibly extends to neural networks even though the paper only proves it for linear regression.","An adaptive adversary that observes the selection masks could concentrate its perturbation on the shared coordinates, defeating the attenuation; the paper explicitly leaves this case open. A testable extension is to keep masks secret or refresh them rapidly, which would preserve the statistical dilution against even adaptive poisoning.","The coverage bounds could be sharpened by replacing the worst-case benign error erms with a distributional assumption on training trajectory errors, which would tighten the separation margin and possibly prove exact filtering in regimes where the current condition fails.","Since the M/D attenuation also reduces the observation-noise-driven error component E_φ in the MSE decomposition, the benefits of partial sharing may extend beyond Byzantine attacks to ordinary noisy clients, suggesting a broader regime where communication reduction helps accuracy as well as robustness."],"forward_implications":["If partial sharing attenuates Byzantine energy by M/D, then communication efficiency and poisoning robustness become aligned goals: transmitting fewer parameters per round simultaneously saves bandwidth and dilutes adversarial influence.","The quantile-deviation bound implies that any training-phase defense that reduces steady-state parameter error will translate into narrower conformal intervals at the same nominal coverage, giving a concrete link between optimization robustness and uncertainty calibration.","The exact-filtering guarantee means that, under the stated separation condition, the server can reliably remove all Byzantine calibration submissions without removing benign ones, so post-filtering coverage deviates from nominal only by the training-phase residue.","Because the attenuation factor is exact per iteration, the theory suggests that the benefit persists even with a small number of participating clients per round, a regime where many robust aggregation rules degrade.","The empirical saturation around M/D≈0.5 indicates that most of the robustness benefit is obtainable with only a modest reduction in communication, and the diminishing returns define a practical operating range for the sharing ratio."],"fun_headline_variants":["Byzantine attacks lose M/D energy with partial model sharing","Federated conformal prediction: exact M/D attack attenuation","Partial sharing slashes Byzantine power by exact ratio","Robust conformal prediction without the communication cost","End-to-end Byzantine defense in federated conformal prediction"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The entire quantile and coverage argument collapses if the benign residual distribution has negligible density near the target quantile, because the constants involve 1/f_min and the bounds become vacuous; likewise, the exact-filtering guarantee requires that benign and Byzantine score histograms are actually separable in the sense of the score-separation condition.","fun_headline_variants_meta":{"raw":{"variants":["Byzantine attacks lose M/D energy with partial model sharing","Federated conformal prediction: exact M/D attack attenuation","Partial sharing slashes Byzantine power by exact ratio","Robust conformal prediction without the communication cost","End-to-end Byzantine defense in federated conformal prediction"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000167,"raw_usage":{"total_tokens":1101,"prompt_tokens":760,"completion_tokens":341,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":504,"completion_tokens_details":{"reasoning_tokens":262}},"tokens_in":504,"tokens_out":341,"duration_ms":3539,"temperature":1.0,"reasoning_tokens":262,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-02T21:54:20.310757+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Construct a calibration scenario where all benign clients produce identical residuals that concentrate exactly at the target quantile, so the benign density near q* is zero; then compute the quantile under a small training perturbation. If the observed quantile shift exceeds the fourth-root bound by a wide margin, the density assumption fails. Alternatively, run an adaptive Byzantine client that observes which M parameters are shared and injects all its perturbation energy into those coordinates; under the paper's stochastic attack model the measured interval width should remain near the M/D-a","supporting_citations":[],"review_version":1}