{"id":"8779c341-232d-4261-812a-6eba2f3da627","arxiv_id":"2606.08027","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"CausShield decomposes VFL representations via causal representation learning to resist sample reconstruction attacks while preserving utility and convergence.","lead":"CausShield proposes a defense for vertical federated learning that splits shared representations into task-relevant causal features and task-irrelevant private ones using structural causal models and unsupervised learning. A smart generalist might read it to see a potential way to improve privacy in collaborative machine learning without sacrificing performance.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"Unsupervised decomposition may fail to isolate task-irrelevant private features without utility loss or hidden supervision","rationale":"The reader's weakest_assumption matches the precise point where the argument is least secured; the abstract's claims of theoretical proofs and full-cycle protection all presuppose that this unsupervised decomposition succeeds as described.","tokens_in":1820,"tokens_out":281,"duration_ms":9714,"concrete_test":"Re-run the main VFL experiments with an ablation that replaces the unsupervised decomposition module by a random orthogonal projection of the same dimensionality; if privacy-utility metrics remain statistically indistinguishable from CausShield, the unsupervised separation is not load-bearing.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim requires that an unsupervised representation learner (no task labels or post-hoc tuning) can reliably extract a task-irrelevant component that captures exactly the sample-specific information enabling reconstruction attacks, while the task-relevant component preserves full utility. The SCM insight is invoked to justify that non-causal features are both task-irrelevant and reconstruction-enabling, yet the abstract provides no mechanism (e.g., identifiability conditions, auxiliary losses, or interventions) guaranteeing the separation occurs without supervision. If the learner cannot enforce this partition, either reconstruction succeeds on the retained component or accuracy degrades; the claimed theoretical foundation and convergence preservation then rest on an unverified separation guarantee.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper proposes CausShield, a defense mechanism for vertical federated learning (VFL) against active sample reconstruction attacks. Drawing on structural causal model (SCM) insights, it decomposes shared client-server representations into task-relevant (causal) components that preserve utility and task-irrelevant (non-causal) components that encode sample-specific private information enabling reconstruction. The decomposition is achieved via an unsupervised representation learning optimization problem; the manuscript claims theoretical proofs establishing the SCM insight and showing that CausShield preserves the convergence rate of standard VFL. Experiments compare against seven baselines (including InvL and URVFL) and report improved privacy-utility trade-offs and efficiency.","tokens_in":1957,"tokens_out":633,"duration_ms":15920,"significance":"If the theoretical separation guarantee and convergence preservation hold under the stated unsupervised setting, CausShield would address a recognized limitation in VFL defenses by avoiding both utility-destroying suppression and early-epoch supervised tuning. The SCM framing and explicit convergence analysis would constitute a substantive contribution to privacy-preserving distributed learning.","major_comments":[{"comment":"The central claim rests on an unsupervised learner reliably isolating task-irrelevant private features without utility loss or hidden supervision. The SCM justification (abstract and theoretical foundation section) asserts that non-causal features are both task-irrelevant and reconstruction-enabling, yet no identifiability conditions, auxiliary losses, or intervention-based guarantees are provided to ensure the partition occurs; if the separation fails, either reconstruction succeeds on the retained component or accuracy degrades, undermining both the privacy and convergence claims.","section":"theoretical foundation / optimization formulation"},{"comment":"Convergence preservation proof: the argument that the dual-objective unsupervised optimization does not alter the convergence behavior of standard VFL must be examined for any implicit assumptions on gradient flow or representation stability; without explicit bounds showing the task-relevant component remains equivalent in distribution to the original shared representation, the preservation result is not load-bearing.","section":"convergence analysis"},{"comment":"Experimental validation of the decomposition: the reported superiority over InvL (USENIX Security'25) and robustness to URVFL (NDSS'25) requires ablation studies isolating the effect of the unsupervised decomposition (e.g., utility with vs. without the task-irrelevant removal, reconstruction success rates on each component separately); current results do not yet confirm that the claimed separation, rather than other implementation choices, drives the gains.","section":"experiments section"}],"minor_comments":[{"comment":"Notation for the decomposed representations (task-relevant vs. task-irrelevant) should be introduced with explicit symbols and distinguished from standard VFL notation to avoid reader confusion.","section":"method section"},{"comment":"Dataset details, attack hyper-parameters, and exact reconstruction metrics (e.g., MSE or success rate thresholds) are needed for reproducibility of the seven-baseline comparison.","section":"experiments section"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive and detailed comments. We address each major comment point by point below, with clear indications of planned revisions to strengthen the manuscript.","responses":[{"response":"We appreciate the referee drawing attention to this aspect of the theoretical foundation. The manuscript's theoretical foundation section establishes via SCM that non-causal features are task-irrelevant yet encode sample-specific information. To directly address the identifiability concern, we will add a dedicated paragraph in the revised theoretical section referencing standard identifiability results from causal representation learning (e.g., under linear SCMs with independent noise) and stating the precise assumptions under which the unsupervised objective isolates the components. This clarifies the conditions without introducing supervision or auxiliary losses.","revision_made":"partial","referee_comment":"The central claim rests on an unsupervised learner reliably isolating task-irrelevant private features without utility loss or hidden supervision. The SCM justification asserts that non-causal features are both task-irrelevant and reconstruction-enabling, yet no identifiability conditions, auxiliary losses, or intervention-based guarantees are provided to ensure the partition occurs."},{"response":"We agree that the convergence analysis would benefit from greater explicitness. The current proof shows that the optimization leaves the task-relevant component unchanged in expectation, thereby preserving the original VFL convergence rate. In revision we will insert two additional lemmas providing explicit bounds on the distributional distance (via Wasserstein metric) between the task-relevant component and the original representation, confirming equivalence under the stated unsupervised objective and removing any implicit assumptions on gradient flow.","revision_made":"yes","referee_comment":"Convergence preservation proof: the argument that the dual-objective unsupervised optimization does not alter the convergence behavior of standard VFL must be examined for any implicit assumptions on gradient flow or representation stability; without explicit bounds showing the task-relevant component remains equivalent in distribution to the original shared representation, the preservation result is not load-bearing."},{"response":"We concur that targeted ablations are required to isolate the decomposition's contribution. We will add two new figures and accompanying text in the experiments section: (i) utility curves comparing the full CausShield against a variant that retains both components, and (ii) reconstruction attack success rates measured separately on the causal versus non-causal components. These ablations will be run on the same datasets and attack models (including URVFL) to demonstrate that the separation, rather than other design choices, accounts for the reported gains.","revision_made":"yes","referee_comment":"Experimental validation of the decomposition: the reported superiority over InvL and robustness to URVFL requires ablation studies isolating the effect of the unsupervised decomposition (e.g., utility with vs. without the task-irrelevant removal, reconstruction success rates on each component separately); current results do not yet confirm that the claimed separation, rather than other implementation choices, drives the gains."}],"tokens_in":1569,"tokens_out":619,"duration_ms":22540,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The main point is that this paper tries to solve sample reconstruction in vertical federated learning by decomposing shared representations into task-relevant causal features and task-irrelevant non-causal ones that supposedly carry the private sample information. They use a structural causal model insight to justify the split, set up an unsupervised optimization to achieve it, claim theoretical proofs for both the decomposition and preserved convergence, and report better results than seven recent baselines including InvL and URVFL.\n\nWhat is actually new is the explicit causal framing for full-cycle protection without early-epoch supervised training of a defense module. The paper correctly notes that prior approaches either suppress useful features or require end-to-end supervision that leaves the system exposed initially. The unsupervised route and the convergence preservation claim are distinct from the cited work.\n\nThe soft spot is the unsupervised separation itself. The argument assumes non-causal features can be isolated reliably as exactly the reconstruction-enabling private information, without task labels or post-hoc tuning, while keeping full utility. No identifiability conditions or auxiliary mechanisms are visible in the abstract to enforce that partition, so if the learner mixes the components the privacy or accuracy guarantee collapses. The theoretical foundation and convergence proof rest on this step holding; without seeing the actual equations or ablations it is hard to judge how tight the argument is.\n\nThis is for people working on privacy defenses in federated and distributed learning. A reader focused on VFL reconstruction attacks would find the framing and the experimental comparisons useful even if the core separation needs more scrutiny. It deserves peer review because the problem is practical and the approach differs from existing lines, though the central unsupervised claim will need verification.","headline":"CausShield frames VFL defense around an SCM-based unsupervised split of representations into causal and non-causal parts, but the separation guarantee looks under-supported.","tokens_in":2452,"tokens_out":408,"would_cite":false,"duration_ms":16288,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"CausShield splits shared VFL representations into causal task-relevant features and non-causal task-irrelevant ones via unsupervised learning to block sample reconstruction while preserving utility and convergence.","keywords":["vertical federated learning","causal representation learning","sample reconstruction attacks","privacy protection","unsupervised learning","structural causal model","convergence preservation"],"falsifier":"A controlled test in which an advanced reconstruction attack such as URVFL recovers identifiable samples from the representations after CausShield decomposition at a success rate comparable to undefended VFL.","tokens_in":2713,"feed_emoji":"🔒","tokens_out":680,"duration_ms":13371,"temperature":0.7,"pith_summary":"The paper shows that in vertical federated learning, raw samples contain causal features that drive the learning task and non-causal features that are irrelevant to the task yet often carry sample-specific details usable for reconstruction attacks. By adopting a structural causal model, CausShield decomposes the representations exchanged between client and server into these two components through an optimization problem solved by unsupervised representation learning. This yields full-cycle privacy protection without the early-epoch exposure of supervised defense training. The authors provide theoretical proofs that the decomposition insight holds and that the method retains the convergence rate of ordinary VFL.","feed_headline":"CausShield splits VFL features to stop sample reconstruction","feed_subtitle":"Decomposing representations into causal and non-causal parts blocks reconstruction while keeping accuracy and convergence intact.","key_machinery":"Structural causal model decomposition of shared representations into task-relevant causal features and task-irrelevant non-causal features, realized by solving an optimization problem with unsupervised representation learning.","core_discovery":"From a task-learning standpoint, causal features within a raw sample are those that are directly relevant and contributory to the learning objective, whereas non-causal features are task-irrelevant but often encode sample-specific private information, thereby facilitating reconstruction. CausShield decomposes the shared representations between the client and the coordinating server in VFL into task-relevant and task-irrelevant components to ensure full-cycle privacy protection. The decomposition is solved through unsupervised representation learning, and theoretical analysis proves both the insight and preservation of standard VFL convergence behavior.","pith_inferences":["The same causal split could be tested in horizontal federated learning or other partitioned-data settings where reconstruction risks exist.","If the unsupervised decomposition proves stable across datasets, it may reduce reliance on differential privacy noise in federated pipelines.","The approach suggests that privacy mechanisms grounded in causal structure may generalize beyond VFL to other representation-sharing protocols."],"forward_implications":["CausShield achieves a superior privacy-utility trade-off against seven prior defenses including InvL.","The method remains robust under advanced reconstruction attacks such as URVFL.","No supervised end-to-end training of the defense is required, eliminating early-epoch leakage windows.","Convergence behavior of standard vertical federated learning is theoretically unchanged."],"fun_headline_variants":["CausShield decomposes VFL reps into causal and noncausal","Causal decomposition applied to vertical FL by CausShield","CausShield separates causal features in vertical federated learning","Unsupervised causal learning for VFL representations in CausShield","CausShield decomposes shared VFL representations causally"],"cache_read_input_tokens":64,"weakest_assumption_plain":"Non-causal features reliably encode the private sample-specific information that enables reconstruction attacks, and the causal/non-causal split can be recovered unsupervised without any post-training adjustment that reduces model utility.","fun_headline_variants_meta":{"raw":{"variants":["CausShield decomposes VFL reps into causal and noncausal","Causal decomposition applied to vertical FL by CausShield","CausShield separates causal features in vertical federated learning","Unsupervised causal learning for VFL representations in CausShield","CausShield decomposes shared VFL representations causally"]},"model":"grok-4.3","cost_usd":0.004329,"raw_usage":{"total_tokens":2140,"prompt_tokens":763,"num_sources_used":0,"completion_tokens":81,"cost_in_usd_ticks":43290500,"prompt_tokens_details":{"text_tokens":763,"audio_tokens":0,"image_tokens":0,"cached_tokens":64},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":1296,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":763,"tokens_out":81,"duration_ms":10750,"temperature":1.0,"reasoning_tokens":1296,"cache_read_input_tokens":64,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-27T20:11:45.091382+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"A controlled test in which an advanced reconstruction attack such as URVFL recovers identifiable samples from the representations after CausShield decomposition at a success rate comparable to undefended VFL.","supporting_citations":[],"review_version":1}