{"id":"ea16157e-9952-47c5-8d96-569a928c2769","arxiv_id":"2607.06860","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":7,"one_line_summary":"Integrating DDQN-based ransomware detection with multi-shard SISA enables privacy-compliant sample removal in 5-30 seconds while preserving F1 > 0.99 and limiting membership inference leakage.","lead":"This paper combines reinforcement learning with a sharded training method so ransomware detectors can selectively forget training data when privacy regulations require it. A smart generalist might read it to understand how machine learning systems can comply with GDPR-style deletion requests without being fully retrained.","discovery_kind":"unclear","skeptic_critique":{"model":"glm-5.2","headline":"The 2,000-step unlearning budget is less than half the 5,000-step initial training budget with no convergence verification; if retrained shards are undertrained, compressed Q-margins would artificially push MIA AUC toward 0.5, making the privacy claim appear stronger than it is.","rationale":"The reader correctly identified the budget mismatch as a concern (point 5 in the rationale) but treated it as a minor condition rather than the load-bearing issue. I elevate it because it simultaneously threatens three of the four evaluation dimensions: MIA scores near 0.5 could reflect compressed Q-margins from undertrained models rather than genuine privacy preservation; oracle disagreement could be distorted by the asymmetry between a 5,000-step oracle and a 2,000-step unlearned model; and utility preservation could be sustained by majority voting diluting the contribution of an undertrained shard rather than by genuine policy recovery. The reader's primary concern (pre-unlearning F1 degradation from 0.9925 to 0.968–0.980) is valid but less load-bearing: the paper does report these values transparently, and the central claim is about post-unlearning delta rather than absolute F1. The budget-convergence issue is more dangerous because it is invisible in the current results — all metrics look favorable, but potentially for the wrong reason. The verdict remains CONDITIONAL because the framework's architecture and systematic evaluation are sound, and the concern is testable with a single retraining-budget experiment. If the 2,000-step budget is shown to be sufficient (e.g., via loss-curve convergence or equivalent metrics at 5,000 steps), the paper's claims stand. If not, the privacy and oracle results need reinterpretation.","tokens_in":30647,"tokens_out":2621,"duration_ms":101100,"concrete_test":"For the M=10, 5% forget fraction, 1-round configuration, retrain the affected shards using the full 5,000-step budget (matching initial training) instead of 2,000 steps. Recompute (a) the ensemble Q-margin distribution (mean and variance) before and after unlearning, (b) the MIA AUC, and (c) oracle disagreement. If the MIA AUC increases by more than 0.02 from its current near-0.5 value, or if the Q-margin variance changes substantially, the current privacy claim is likely an artifact of undertraining and the 2,000-step budget must be justified or revised.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim is that M=5–10 provides a practical operating regime with MIA scores near 0.5 (indicating limited privacy leakage). This claim depends on the retrained shard models producing meaningful Q-value margins after unlearning. However, Table 4 specifies that initial SISA training uses 5,000 steps per shard while unlearning retraining uses only 2,000 steps per affected shard — a 60% reduction with no stated justification and no convergence diagnostic. If 2,000 steps is insufficient for the retrained DDQN to converge, the resulting Q-margins would be compressed toward zero (the network has not yet learned to discriminate confidently). This compression would directly affect the MIA proxy: the attack distinguishes members from non-members using ensemble Q-margin ROC-AUC (Eq. 24–25), and undertrained models with compressed margins would yield AUC values closer to 0.5 regardless of whether genuine unlearning occurred. In other words, the favorable privacy result (MIA ≈ 0.5) could be an artifact of undertraining rather than evidence of successful forgetting. This concern is compounded by the fact that the oracle model is trained with the full 5,000-step budget (Table 4), creating an asymmetry: the oracle is fully trained while the unlearned model may be undertrained, potentially distorting the disagreement metrics as well. The paper does not report loss curves, Q-value distributions, or any convergence check for the retrained shards. Without this, the four evaluation dimensions (utility, oracle, MIA, efficiency) could all be simultaneously biased toward favorable values by a single underlying cause: insufficient retraining.","agreement_with_reader":"partial"},"referee_report":{"model":"glm-5.2","summary":"This manuscript proposes integrating a Double Deep Q-Network (DDQN) ransomware detector with multi-shard SISA (Sharded, Isolated, Sliced, Aggregated) retraining to enable privacy-compliant machine unlearning under GDPR/CCPA-style deletion requests. The DDQN learns a reward-guided detection policy with asymmetric security costs (false negatives penalized more than false positives), while SISA localizes retraining to affected shards. The framework is evaluated across 270 configurations (shard counts M=5,10,20; forget fractions 1%,5%,10%; deletion rounds 1,5,10; single- and multi-shard scenarios) on a balanced 2,000-sample Windows 11 behavioral dataset with 103 features. Four evaluation dimensions are assessed: utility preservation, oracle-verified forgetting, membership-inference privacy risk via Q-margin ROC-AUC, and computational efficiency. The baseline DDQN achieves F1=0.9925 and AUC=0.9983. The authors find that moderate shard counts (M=5-10) provide the best efficiency-stability trade-off, reducing retraining time to 5-30s versus 80-330s for full retraining, while maintaining MIA scores near 0.5. The paper honestly reports failure modes, including ensemble collapse for M=20 under aggressive repeated deletions.","tokens_in":31063,"tokens_out":1967,"duration_ms":223171,"significance":"The integration of value-based deep reinforcement learning with SISA-based machine unlearning is a novel and practically motivated contribution, as prior SISA work has focused on supervised learning and the combination with RL-based cybersecurity detection is largely unexplored. The dual-audit protocol combining oracle-verified forgetting and Q-margin-based membership-inference auditing is a thoughtful evaluation design that goes beyond runtime-only metrics common in unlearning papers. The systematic deletion-stress evaluation (270 configurations with 5-fold CV) and transparent reporting of boundary-condition failures (M=20 collapse) are commendable. The practical relevance to compliance-oriented security operations is clear. However, the significance is tempered by the small dataset size (2,000 samples), the use of a lightweight MIA proxy rather than adaptive attacks, and an unresolved concern about retraining budget adequacy that potentially affects the privacy claims.","major_comments":[{"comment":"§3.5.3, Table 4: The unlearning retraining budget is set to 2,000 steps per affected shard, while initial SISA training uses 5,000 steps per shard and oracle retraining uses 5,000 steps. This 60% reduction for unlearning retraining is not justified, and no convergence diagnostic (loss curves, Q-value distributions, reward stabilization) is reported for the retrained shards. This is load-bearing for the privacy claim: the MIA proxy (Eqs. 24-25) distinguishes members from non-members using ensemble Q-margin ROC-AUC. If 2,000 steps is insufficient for the retrained DDQN to converge, Q-margins would be compressed toward zero, artificially pushing MIA AUC toward 0.5 regardless of whether genuine unlearning occurred. The favorable privacy result (MIA ≈ 0.5 across most configurations in Table 9) could thus be an artifact of undertraining rather than evidence of successful forgetting. The asymm_","section":null},{"comment":"§5.1, Table 5 vs. Tables 6-7: The baseline (non-SISA) DDQN achieves F1=0.9925, but the SISA ensemble's pre-unlearning F1 scores are notably lower: 0.97968 (M=5), 0.96802 (M=10), and 0.95257 (M=20) as shown in the 'F1 Before' columns of Tables 6-7. This represents a pre-unlearning degradation of 1.3-4.0 percentage points that is not analyzed in depth. The paper focuses on post-unlearning delta (ΔF1) but does not discuss why the SISA ensemble underperforms the global model before any deletion occurs. This matters because the central claim of 'high detection performance' is typically benchmarked against the non-SISA baseline. The authors should explicitly acknowledge and explain this pre-unlearning gap (e.g., reduced per-shard sample diversity, ensemble aggregation effects) and clarify whether the reported F1>0.99 claim in the abstract refers only to the non-SISA baseline.","section":null},{"comment":"§3.6.3, Eqs. 24-25: The membership inference 'attack' is a proxy based on Q-margin ROC-AUC between training and test samples. This is a lossless/loss-threshold MIA at best and does not represent an adaptive adversary. The paper states in §6 that 'relied on a Q-margin-based MIA proxy rather than stronger adaptive attacks' is a limitation, but the abstract and conclusions present MIA ≈ 0.5 as evidence of 'limited privacy leakage.' The gap between the proxy metric and actual adversarial privacy risk should be more clearly scoped: the current evaluation shows that Q-margin distributions do not distinguish members from non-members, but this does not rule out leakage detectable by more sophisticated attacks (e.g., neural-network-based MIA, calibration attacks). The claims in the abstract and §5.4 should be qualified accordingly.","section":null},{"comment":"§3.1, §5: The dataset comprises 2,000 samples (1,000 ransomware, 1,000 benign) with 103 features. While the paper acknowledges this as a limitation in §6, several claims depend on scale. The computational efficiency claim (5-30s vs. 80-330s for full retraining) is measured on a dataset where full retraining takes only ~34s for a single DDQN (Table 5). The 80-330s oracle times in Table 10 likely reflect 5-fold CV overhead. The scalability of SISA's efficiency advantage to larger datasets (where full retraining would take hours, not seconds) is not demonstrated. The paper should clarify whether the efficiency results are expected to hold proportionally at scale or whether the overhead of managing M independent shard models introduces fixed costs that would change the trade-off at larger N.","section":null}],"minor_comments":[{"comment":"§3.3, Eq. 9: The reward function uses values +1, -2, -0.5. These are listed as free parameters in the axiom ledger but their sensitivity is not analyzed. A brief note on why these specific ratios were chosen (e.g., 4:1 FN:FP ratio) would strengthen reproducibility.","section":null},{"comment":"Table 1: The family name 'GandCrab (Grancrab)' appears inconsistent. The parenthetical 'Grancrab' should be clarified or corrected.","section":null},{"comment":"§5.2: The explanation for M=20 collapse under 10%×10 rounds is well-reasoned (shard starvation below 10-sample minimum), but the minimum retained shard size threshold of 10 (Table 4) is introduced without prior justification. Why 10 and not 20 or 50?","section":null},{"comment":"Figure 6: The axis labels and configuration codes (e.g., 'S | M10-F5-R5') are compact but require careful parsing. A legend or more descriptive labels would improve readability.","section":null},{"comment":"§3.5.4, Eq. 18: Majority voting is used for aggregation, but the paper does not discuss ties (e.g., M=2 or even M with split votes). While M∈{5,10,20} avoids exact ties, the aggregation method should note this assumption.","section":null},{"comment":"Table 11: The comparison with prior work is contextual (different datasets/protocols), which the authors acknowledge. However, adding a column for dataset size or evaluation protocol would help readers assess comparability.","section":null},{"comment":"§3.3: The discount factor γ=0.1 is described as emphasizing immediate rewards. This is reasonable for per-sample classification, but the paper could note that this effectively reduces the MDP to a contextual bandit, which has implications for the 'reinforcement learning' framing.","section":null}],"recommendation":"major_revision","confidential_remarks":"The stress-test concern about the 2,000-step unlearning budget is the most critical issue. It is internally consistent and potentially undermines the privacy claim (MIA ≈ 0.5) if undertrained shards produce compressed Q-margins. The authors need to either (a) match the unlearning budget to the initial training budget, (b) provide convergence diagnostics, or (c) run a sensitivity analysis on the unlearning budget. Without this, the four evaluation dimensions are not independent: the privacy result may be a side effect of the efficiency optimization. The pre-unlearning SISA degradation (F1 0.953-0.980 vs. 0.9925 baseline) is also under-discussed and should be explicitly addressed. The paper is well-structured and the experimental design is systematic, but these two issues are load-bearing for the central claims."},"author_rebuttal":null,"desk_editor":{"model":"glm-5.2","letter":"Short version: this paper does something nobody else has done — combines multi-shard SISA unlearning with a DDQN ransomware detector and adds oracle-based forgetting verification plus Q-margin MIA auditing. The experimental design is systematic (270 configs, 5-fold CV) and failure modes are honestly reported. But there's a load-bearing concern about the unlearning retraining budget that the authors don't address, and it could undermine the privacy claim specifically. Worth a serious referee, but the reviewer needs to push hard on convergence evidence before accepting the MIA results at face value. The paper's real contribution is the integration and the dual-audit framework (oracle + MIA proxy), not any individual component. SISA, DDQN, and Q-margin-based auditing are all from existing literature. But combining them for privacy-compliant ransomware detection with systematic deletion-stress testing is genuinely new. The 270-configuration sweep across shard counts, forget fractions, and deletion rounds is solid work, and the honest reporting of M=20 collapse under aggressive deletion is commendable — they didn't hide the failure mode. The efficiency claim (5-30s vs 80-330s for full retraining) is well-supported by Table 10. Now the soft spots. The stress-test concern about the 2,000-step unlearning budget vs 5,000-step initial training is real and important. If retrained shards are undertrained, Q-margins compress toward zero, which would push MIA AUC toward 0.5 regardless of whether genuine unlearning occurred. The paper reports no loss curves, no Q-value distributions, no convergence diagnostics for retrained shards. This is the single biggest gap. The oracle model gets the full 5,000-step budget while the unlearned model gets 2,000 — that asymmetry could distort both the disagreement metrics and the MIA proxy. The 2,000-sample dataset is small but not disqualifying given the 5-fold CV and the systematic stress testing. The MIA proxy (Q-margin ROC-AUC rather than a trained attack model) is weak, but the authors acknowledge this as a limitation. The pre-unlearning F1 degradation from sharding (0.9925 baseline to 0.968-0.979 for SISA before any deletion) is under-analyzed — they focus on post-unlearning delta but don't dig into why sharding itself costs ~2-3 F1 points. No code or data released despite detailed methods. This paper is for security researchers and practitioners working on privacy-compliant ML deployment. It deserves a serious referee who should require: (1) convergence evidence for retrained shards, (2) justification for the 2,000 vs 5,000-step asymmetry, (3) ideally a sensitivity analysis showing MIA results hold when the unlearning budget matches the initial budget. If those hold up, the contribution is real.","headline":"Genuine integration of SISA unlearning with DDQN-based ransomware detection, but the favorable privacy result may be an artifact of undertrained retrained shards.","tokens_in":31721,"tokens_out":669,"would_cite":true,"duration_ms":111380,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"glm-5.2","headline":"Splitting a ransomware detector into shards lets you delete data in seconds","keywords":[],"falsifier":"If, on a larger or more heterogeneous dataset, the gap between the sharded-ensemble model and the full-data model widens substantially before any deletion occurs—say, F1 drops by more than 5 percentage points purely from sharding—then the entire utility-preservation argument weakens, because the post-deletion delta is measured against an already-degraded baseline.","tokens_in":30838,"feed_emoji":"🔓","tokens_out":1053,"duration_ms":128436,"temperature":0.7,"pith_summary":"Privacy laws like GDPR can require organizations to delete specific user data from trained machine learning models. For ransomware detectors trained on behavioral traces, the standard approach—retraining the entire model from scratch after each deletion request—takes minutes and disrupts the security pipeline. This paper proposes splitting the training data into independent partitions called shards, training a separate Double Deep Q-Network detector on each shard, and combining their predictions by majority vote. When a deletion request arrives, only the shard containing the targeted sample is retrained, reducing the operation from 80–330 seconds down to 5–30 seconds. The paper evaluates this system on a balanced dataset of 2,000 Windows 11 behavioral samples across 270 deletion-stress configurations, varying shard counts, deletion fractions, and repeated rounds. The central claim is that with a moderate number of shards (5 to 10), the framework preserves detection accuracy above an F1 of 0.96, keeps the unlearned model's behavior close to that of a from-scratch retrained reference model, and maintains membership-inference attack success near random guessing (0.5), all while cutting retraining cost by an order of magnitude. The paper also shows that pushing shard granularity too high (20 shards) under aggressive repeated deletions causes the ensemble to collapse, as individual shards run out of data.","feed_headline":"Splitting a ransomware detector into shards lets you delete data in seconds","feed_subtitle":"Shard-isolated reinforcement learning cuts GDPR-style data removal from minutes to seconds while keeping F1 above 0.96 and privacy leakage","key_machinery":"The framework rests on four components. First, a Double Deep Q-Network (DDQN) formulates ransomware detection as a Markov decision process where each behavioral feature vector is a state, the two actions are benign/ransomware, and the reward function is asymmetric—penalizing missed ransomware detections (false negatives) at −2 versus false positives at −0.5. Second, the SISA (Sharded, Isolated, Sliced, Aggregated) framework partitions the training data into M non-overlapping, class-balanced shards, trains an independent DDQN on each, and aggregates predictions via majority voting. Third, an oracle verification protocol compares the selectively unlearned model against a reference model re-re-","core_discovery":"The paper identifies a practical operating regime—5 to 10 shards—where shard-isolated reinforcement learning detectors can be selectively retrained after data deletion requests in 5–30 seconds while preserving F1 above 0.96, maintaining oracle disagreement below 0.04, and keeping membership inference scores near 0.5. The discovery is that this regime exists at all: that splitting a DDQN-based ransomware detector into independent shards does not destroy detection accuracy, and that localized retraining of only the affected shard approximates full retraining closely enough for compliance purposes under moderate deletion pressure. The paper also discovers and characterizes a boundary condition:","pith_inferences":[],"forward_implications":["Organizations deploying ML-based security tools could respond to GDPR/CCPA data deletion requests in seconds rather than minutes, without taking their detection systems offline for full retraining.","The shard-count sweet spot (M=5–10) provides a concrete deployment guideline: enough shards to localize retraining cost, but few enough that each shard retains sufficient data diversity for stable policy learning.","The Q-margin (the difference between Q-values for the two actions) serves as a natural confidence score for both ROC analysis and membership-inference auditing, suggesting that value-based RL methods have a built-in privacy audit signal that policy-gradient methods lack.","The collapse of the M=20 configuration under aggressive deletion reveals a fundamental data-budget constraint: shard-based unlearning systems must ensure that no shard's retained data falls below a minimum viability threshold, which scales with both shard count and expected cumulative deletion volume."],"fun_headline_variants":["5 to 10 shards cut ransomware detector retraining to under 30 seconds","Sharded ransomware detector deletes user data in seconds with minimal accuracy loss","Auditable ransomware unlearning keeps F1 above 0.96 with 5-10 shards","Multi-shard DDQN achieves GDPR-compliant deletion in 5-30 seconds","Shard-level retraining for ransomware detection preserves accuracy while cutting time 10x"],"cache_read_input_tokens":0,"weakest_assumption_plain":"The framework assumes that training a separate DDQN on each shard of roughly 200–400 samples produces a Q-value policy that, when aggregated by majority vote, approximates the performance of a single DDQN trained on the full dataset. The paper reports that SISA training already drops F1 from 0.9925 (full data) to 0.953–0.979 (sharded, before any unlearning), but treats this pre-unlearning degradation as a baseline rather than analyzing whether shard isolation fundamentally de","fun_headline_variants_meta":{"raw":{"variants":["5 to 10 shards cut ransomware detector retraining to under 30 seconds","Sharded ransomware detector deletes user data in seconds with minimal accuracy loss","Auditable ransomware unlearning keeps F1 above 0.96 with 5-10 shards","Multi-shard DDQN achieves GDPR-compliant deletion in 5-30 seconds","Shard-level retraining for ransomware detection preserves accuracy while cutting time 10x"]},"model":"glm-5.2","effort":"low","cost_usd":0.0,"raw_usage":{"total_tokens":777,"prompt_tokens":685,"completion_tokens":92,"prompt_tokens_details":null},"tokens_in":685,"tokens_out":92,"duration_ms":87933,"temperature":1.0,"reasoning_tokens":null,"cache_read_input_tokens":0,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-10T00:03:35.182209+00:00","model_set":{"reader":"glm-5.2"},"falsifier":"If, on a larger or more heterogeneous dataset, the gap between the sharded-ensemble model and the full-data model widens substantially before any deletion occurs—say, F1 drops by more than 5 percentage points purely from sharding—then the entire utility-preservation argument weakens, because the post-deletion delta is measured against an already-degraded baseline.","supporting_citations":[],"review_version":1}