{"id":"d5fda81e-c7b3-4f33-9ef0-fbef2c3cc3f2","arxiv_id":"2606.04399","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":4.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"DPDL perturbs cross-gradients with Gaussian noise for DP and applies cosine similarity calibration to support linear speedup in decentralized training on non-IID data.","lead":"The paper proposes DPDL, a decentralized learning method that adds Gaussian noise to cross-gradients for differential privacy and uses cosine similarity to calibrate the noisy values before aggregation, aiming to maintain training performance on non-IID data. Smart generalists might read it to see how privacy protections can be added to distributed ML without a central server while handling realistic uneven data distributions.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"Cosine similarity calibration on noisy cross-gradients may invalidate either the DP guarantee or the linear speedup convergence bound","rationale":"The reader's weakest assumption directly isolates the single point where both the privacy and optimization claims could fail simultaneously. Because the full manuscript was not supplied in the initial query, the current UNVERDICTED status remains appropriate; the concrete test above is the minimal verification that would either confirm or refute the load-bearing step.","tokens_in":1787,"tokens_out":327,"duration_ms":11552,"concrete_test":"Extract the exact privacy and convergence theorems (including all assumptions on the calibration operator); re-derive both bounds while treating the cosine similarity as an explicit function of the noisy inputs. If either the minimum noise variance increases or the speedup factor drops below linear for at least one non-IID partition used in the experiments, the headline claim does not hold.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires that the similarity-based calibration step (applied after Gaussian perturbation of cross-gradients) preserves both the (ε,δ)-DP guarantee and the convergence analysis that yields linear speedup under arbitrary non-IID partitions. Standard DP composition does not automatically extend to a subsequent deterministic post-processing step whose output is then used in a momentum-style aggregation; the calibration can correlate the effective noise across neighbors or introduce data-dependent bias that the existing noise-level derivation does not bound. Likewise, the linear speedup proof implicitly assumes unbiased or controlled-variance updates; the cosine rescaling can violate this under heterogeneous data distributions.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper proposes DPDL, a decentralized stochastic learning algorithm for non-IID data that perturbs cross-gradients with Gaussian noise to enforce (ε,δ)-DP and then applies cosine-similarity calibration before momentum-style aggregation; it claims a rigorous derivation of the minimum noise level needed for a target privacy budget together with a proof that linear speedup is retained under arbitrary non-IID partitions, supported by experiments on real-world datasets.","tokens_in":1915,"tokens_out":453,"duration_ms":13770,"significance":"If the privacy and convergence claims hold after the calibration step, the work would supply a concrete, analyzable mechanism for trading privacy against convergence rate in fully decentralized non-IID settings, an area where existing DP-SGD analyses do not directly apply.","major_comments":[{"comment":"§4 (Theoretical Analysis): the derivation of the minimum noise variance σ^{2} for (ε,δ)-DP must be shown to remain valid after the deterministic cosine-similarity rescaling of the noisy cross-gradients; standard DP composition theorems do not automatically cover a subsequent data-dependent post-processing step whose output is fed into the momentum update.","section":"§4"},{"comment":"§4, Theorem on linear speedup: the convergence bound assumes that the calibrated updates remain unbiased (or have controlled bias) under arbitrary non-IID partitions; the cosine rescaling can introduce distribution-dependent scaling factors that violate this assumption, and the proof must explicitly bound the resulting bias term.","section":"§4"}],"minor_comments":[{"comment":"The experimental section should report the exact baselines, privacy budgets, and statistical significance tests used to claim superiority over prior decentralized DP methods.","section":"Experiments"},{"comment":"Notation for the calibrated gradient ̂g and the momentum coefficient should be introduced before the first use in the algorithm description.","section":"Algorithm 1"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive comments on the theoretical analysis in Section 4. We address each major comment below and indicate the corresponding revisions.","responses":[{"response":"We appreciate this clarification. The Gaussian perturbation mechanism satisfies (ε,δ)-DP by construction. The subsequent cosine-similarity calibration is a deterministic post-processing function applied to the mechanism's output. By the post-processing property of differential privacy, any function of an (ε,δ)-DP output (data-dependent or otherwise) remains (ε,δ)-DP. Consequently, the minimum noise variance derived for the perturbation step continues to guarantee the target privacy budget for the calibrated cross-gradients. We will add an explicit remark invoking the post-processing theorem in Section 4 to make this connection clear.","revision_made":"yes","referee_comment":"[§4] §4 (Theoretical Analysis): the derivation of the minimum noise variance σ^{2} for (ε,δ)-DP must be shown to remain valid after the deterministic cosine-similarity rescaling of the noisy cross-gradients; standard DP composition theorems do not automatically cover a subsequent data-dependent post-processing step whose output is fed into the momentum update."},{"response":"We agree that the cosine rescaling introduces a data-dependent scaling factor whose effect on bias must be controlled. In the existing proof we bound the deviation of the calibrated direction from the true cross-gradient using the fact that cosine similarity lies in [0,1] and the bounded gradient assumption; however, an explicit bias term arising from the scaling was not isolated. We will revise the proof of the linear-speedup theorem to introduce and bound this additional bias term, showing that it remains controlled under arbitrary non-IID partitions and does not alter the linear speedup rate.","revision_made":"yes","referee_comment":"[§4] §4, Theorem on linear speedup: the convergence bound assumes that the calibrated updates remain unbiased (or have controlled bias) under arbitrary non-IID partitions; the cosine rescaling can introduce distribution-dependent scaling factors that violate this assumption, and the proof must explicitly bound the resulting bias term."}],"tokens_in":1378,"tokens_out":461,"duration_ms":15290,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The central point is that DPDL perturbs cross-gradients with Gaussian noise before sharing, then applies cosine similarity calibration to the received noisy values so they can be used in a momentum-style local update. This targets privacy leakage during neighbor exchanges while trying to keep convergence under arbitrary non-IID partitions.\n\nThe approach is a straightforward combination of the Gaussian mechanism with an existing similarity-based adjustment. It correctly identifies that plain DP on gradients can hurt performance more in heterogeneous data, and the calibration is meant to restore useful signal. If the full derivations show how the minimum noise level is derived and how the speedup bound survives the rescaling, that would be a modest but usable extension of prior decentralized DP work.\n\nThe soft spot is exactly the interaction between noise and calibration. Cosine similarity is computed on the already-noisy cross-gradients, so the rescaling factor depends on the private data through the noise. Standard DP composition does not automatically cover this deterministic but data-dependent post-processing, and the effective noise across neighbors can become correlated. The linear-speedup argument also needs the updates to stay unbiased or variance-controlled; the calibration can introduce bias that scales with data heterogeneity, which the abstract does not visibly bound. Without the actual proof steps or assumption list, the claim that both DP and speedup hold simultaneously looks optimistic.\n\nExperiments are mentioned but the abstract gives no baseline details, metrics, or significance tests, so the practical improvement cannot be assessed yet.\n\nThis paper is for people already working on privacy mechanisms inside decentralized or federated training. A reader who needs a concrete starting point for non-IID DP extensions might borrow the calibration idea, but anyone relying on the stated guarantees would want the proofs checked first.\n\nIt should go to peer review so the theory can be examined directly against the post-processing concern.","headline":"The paper adds cosine-similarity calibration after Gaussian noise on cross-gradients for DP in decentralized non-IID learning, but the post-processing step likely weakens both the privacy bound and the linear-speedup claim.","tokens_in":2418,"tokens_out":453,"would_cite":false,"duration_ms":15694,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"DPDL perturbs cross-gradients with Gaussian noise and calibrates them via cosine similarity to achieve differential privacy while preserving linear speedup in decentralized learning on non-IID data.","keywords":["differential privacy","decentralized learning","non-IID data","stochastic optimization","cosine similarity","gradient aggregation","privacy preservation","linear speedup"],"falsifier":"An experiment that either measures a privacy leakage exceeding the bound implied by the added noise after calibration or records sub-linear speedup on non-IID data partitions would falsify the central claims.","tokens_in":2667,"feed_emoji":"🔒","tokens_out":637,"duration_ms":14665,"temperature":0.7,"pith_summary":"The paper seeks to protect individual data privacy during decentralized model training where agents exchange gradient information without any central coordinator and where local datasets follow different distributions. It introduces DPDL, which adds calibrated Gaussian noise to the cross-gradients that each agent computes from its neighbors' models on its own data, then uses cosine similarity to adjust the noisy values before a momentum-style update. The analysis supplies the smallest noise magnitude that meets a target privacy level and shows that convergence still scales linearly with the number of agents even under arbitrary non-IID partitions. A reader would care because many real distributed applications must share model information yet cannot tolerate privacy leaks or slow training when data are heterogeneous.","feed_headline":"Noise plus cosine calibration keeps privacy and linear speedup in decentralized learning","feed_subtitle":"DPDL perturbs cross-gradients with Gaussian noise then calibrates them by cosine similarity so that non-IID training still converges linearl","key_machinery":"cosine similarity calibration applied to noisy cross-gradients before momentum-style aggregation","core_discovery":"DPDL uses the Gaussian noise mechanism to perturb cross-gradients before sharing and then applies cosine similarity calibration to the perturbed values so that their aggregation updates the local model in a momentum-like manner. The analysis determines the minimum noise level for a given privacy guarantee and proves that linear speedup in training is retained even with arbitrary non-IID data partitions.","pith_inferences":["The same calibration step could be examined for use with other noise mechanisms or aggregation rules.","The momentum-style update suggests the method may combine naturally with existing optimizers that already employ momentum.","Testing on a wider range of network topologies would reveal whether the linear speedup holds beyond the topologies studied."],"forward_implications":["The minimum noise level required to reach a chosen privacy level is identified by the analysis.","Linear speedup in training time is retained despite non-IID data partitions.","The calibrated updates defend against privacy attacks while still producing accurate models.","The approach works in fully decentralized settings without any central server."],"fun_headline_variants":["Cosine-calibrated cross-gradient noise preserves privacy and linear speedup","Noise perturbation and cosine calibration secure non-IID decentralized privacy","DPDL noise on cross-gradients with cosine calibration keeps linear speedup","Calibrated noisy cross-gradients allow private training with linear speedup"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"The cosine similarity calibration step can be applied to noisy cross-gradients without violating the differential privacy guarantee or destroying the convergence properties that produce linear speedup under arbitrary non-IID partitions.","fun_headline_variants_meta":{"raw":{"variants":["Cosine-calibrated cross-gradient noise preserves privacy and linear speedup","Noise perturbation and cosine calibration secure non-IID decentralized privacy","DPDL noise on cross-gradients with cosine calibration keeps linear speedup","Calibrated noisy cross-gradients allow private training with linear speedup"]},"model":"grok-4.3","cost_usd":0.011661,"raw_usage":{"total_tokens":5131,"prompt_tokens":718,"num_sources_used":0,"completion_tokens":70,"cost_in_usd_ticks":116612000,"prompt_tokens_details":{"text_tokens":718,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":4343,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":718,"tokens_out":70,"duration_ms":21924,"temperature":1.0,"reasoning_tokens":4343,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-28T07:40:58.924106+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"An experiment that either measures a privacy leakage exceeding the bound implied by the added noise after calibration or records sub-linear speedup on non-IID data partitions would falsify the central claims.","supporting_citations":[],"review_version":1}