{"id":"1b72c7a4-83c9-419a-b520-68cb0640631f","arxiv_id":"2607.07635","paper_version":2,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":4.5,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"DiRLU distills an A2C teacher into a lightweight student that detects BoT-IoT attacks at 99.6% accuracy with 2370 FLOPS and reversible post-hoc feature unlearning.","lead":"DiRLU is a compact reinforcement-learning system that detects botnet traffic on IoT devices and can erase selected input features after training without full retraining. It reaches high detection accuracy at very low compute cost while supporting privacy rules such as the right to be forgotten.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.5","headline":"Post-hoc first-layer zeroing does not guarantee residual-free unlearning under attention and distillation, so the GDPR privacy claim rests on an untested assumption.","rationale":"The Reader correctly isolates the weakest assumption: that first-layer zeroing constitutes complete, privacy-preserving unlearning. My stress-test confirms the same soft spot and sharpens it by noting the attention concatenation and distillation soft targets that the paper’s own architecture description (III-F/G) introduces but never accounts for in the unlearning proof. The concrete MI/reconstruction test is a minimal, code-level check that would either validate or falsify residual leakage without requiring new data collection. Because the engineering results (accuracy, FLOPS, reversibility of accuracy) remain solid and the code is public, the verdict stays CONDITIONAL rather than moving to REJECT; the privacy claim simply needs the additional leakage measurement before the GDPR alignment can be taken at face value.","tokens_in":23245,"tokens_out":511,"duration_ms":6561,"concrete_test":"After zeroing the flgs column, compute the mutual information I(model_output; flgs) (or a simple linear reconstruction MSE of flgs from the student logits) on a held-out set that still contains the original flgs values; if MI or reconstruction error remains statistically above the noise floor of a randomly-permuted control, residual leakage exists and the privacy claim fails.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central privacy claim (Section III-H, Eqs. 12–14, Algorithm 1) asserts that setting the first dense-layer column W:,j = 0 fully removes feature xj’s influence because later layers only see z. This is incomplete for the actual architecture: both teacher and student use a feature-level attention mechanism that produces attention-weighted inputs concatenated with the original features before the shared dense layers (Section III-F/G). Attention weights and any residual paths through the critic or soft-target distillation can still encode information about the “forgotten” feature. The paper only shows that accuracy/F1 drop modestly and that LIME no longer ranks flgs highly on one instance; it never measures mutual information, membership inference, or reconstruction risk between the unlearned model’s outputs and the removed feature. Consequently the GDPR “right to be forgotten” alignment remains informal and the reversibility experiment only re-inserts the same weights rather than proving absence of leakage.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.5","summary":"The paper proposes DiRLU, a knowledge-distillation framework in which both teacher and student are A2C actor–critic networks with feature-level attention, trained on 25% (and 30%) of the BoT-IoT dataset after SMOTE balancing. The student reaches 99.60% accuracy / 99.80% F1 while using only 2,370 FLOPS. A post-hoc weight-modification (PHWM) step zeros the first dense-layer column corresponding to a chosen feature (flgs), after which accuracy drops only modestly and is fully restored when the original weights are re-inserted. LIME explanations are supplied for a single attack instance before and after unlearning. The authors claim the combination yields a lightweight, GDPR-aligned (“right to be forgotten”) IoT botnet detector.","tokens_in":23550,"tokens_out":626,"duration_ms":5820,"significance":"If the efficiency numbers hold under realistic edge constraints and the unlearning claim can be made rigorous, the work would supply a practical, reversible privacy mechanism for resource-constrained IoT security models—something largely missing from prior botnet detectors that rely on full retraining. The public code link, the use of a larger data slice than many BoT-IoT baselines, and the explicit FLOPS comparison with KronNet are concrete strengths that make the efficiency claim falsifiable and useful to the community.","major_comments":[{"comment":"Section III-H (Eqs. 12–14) and Algorithm 1 assert that setting the first dense-layer column W:,j = 0 completely removes feature xj because later layers only see z. Both teacher and student, however, employ a feature-level attention mechanism whose weighted inputs are concatenated with the original features before the shared dense layers (Sections III-F/G). Attention weights, residual paths through the critic, and soft-target distillation can therefore still encode information about the “forgotten” feature. The only evidence offered is a modest accuracy/F1 drop and a single LIME instance in which flgs disappears from the top ranks. No mutual-information, membership-inference, or reconstruction test is reported. Consequently the GDPR “right to be forgotten” claim remains informal and load-bearing for the paper’s privacy contribution.","section":null},{"comment":"The evaluation relies on a single 70/20/10 split of a heavily SMOTE-augmented 25% (and 30%) slice; no standard deviations across random seeds, no cross-validation, and no statistical significance tests accompany the 99.6% accuracy figures (Table VII). Given the extreme original imbalance (≈98:2) and the free parameters (T=2, α=0.5, decision threshold 0.8, SMOTE ratio), the reported margins over baselines cannot be assessed for robustness. At least multi-seed means and confidence intervals are required before the efficiency–accuracy trade-off can be trusted.","section":null}],"minor_comments":[],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"The core new thing here is the end-to-end DiRLU pipeline: A2C teacher-student distillation on 25% of BoT-IoT (more data than the usual 5% baselines), followed by post-hoc first-layer weight zeroing for a chosen feature, plus LIME, all aimed at a 2370-FLOPS student that still hits 99.6% accuracy / 99.8% F1. They also show the accuracy drop is small and fully reverses when the weights are restored. That combination, plus the public code link, is useful engineering for constrained IoT detectors.\n\nWhat works well is the empirical consistency. Teacher and student track each other across the three stages (full, unlearned, restored), confusion matrices and LIME plots line up with the story that flgs stops ranking high after zeroing, and the FLOPS claim versus KronNet is concrete. Using a larger slice of the public dataset and reporting both 25% and 30% runs is a step up from many BoT-IoT papers. The math is elementary (standard A2C losses, temperature-scaled KD, simple W:,j = 0), the data pipeline is transparent, and the citation pattern is ordinary survey-plus-baselines rather than self-serving.\n\nThe soft spots are real but proportional. Zeroing the first dense column does not automatically erase influence when the architecture still has feature-level attention that concatenates original inputs before the shared layers; residual paths through attention, the critic, or soft targets are not measured. They never check mutual information, membership inference, or reconstruction risk, so the GDPR “right to be forgotten” language is informal marketing rather than a demonstrated guarantee. SMOTE on a 98:2 imbalance, single random split, hand-chosen T/α/threshold, and no multi-seed error bars leave room for optimism. None of these sink the detection results, but they cap how far the privacy and robustness claims can travel.\n\nThis is for people building lightweight IoT NIDS who care about model size and a reversible “forget this feature” knob more than formal unlearning theory. It deserves a serious referee rather than a desk reject; the numbers and code are solid enough to be useful after tightening the unlearning claims and adding basic leakage checks. I would engage with the work if I were reviewing or if I needed a compact A2C baseline, but I would not treat the privacy story as settled.","headline":"Practical packaging of A2C distillation plus crude weight-zeroing unlearning for edge botnet detection, with strong empirical numbers and code, but the GDPR claim rests on an incomplete unlearning argument.","tokens_in":24121,"tokens_out":606,"would_cite":false,"duration_ms":17298,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.5","headline":"A distilled A2C student detects IoT botnet traffic at 99.6% accuracy with 2370 FLOPS and reversible post-hoc feature unlearning.","keywords":["botnet detection","IoT security","knowledge distillation","feature unlearning","A2C","LIME","edge deployment","GDPR"],"falsifier":"After PHWM is applied to a high-influence feature such as flgs, extract LIME explanations (or gradient attributions) on held-out attack samples; if that feature still ranks among the top contributors or if accuracy does not drop then recover upon weight restoration, the unlearning claim fails.","tokens_in":24152,"feed_emoji":"🛡️","tokens_out":914,"duration_ms":10246,"temperature":0.7,"pith_summary":"IoT devices remain exposed to botnets because most AI detectors are too heavy for edge hardware and cannot forget sensitive or outdated features without a full retrain. DiRLU answers both problems at once: a large A2C teacher is distilled into a compact A2C student that still reaches 99.60% accuracy and 99.80% F1 on a 25% slice of BoT-IoT, while a one-line weight edit (zeroing the first-layer column of a chosen feature) removes that feature’s influence. Restoring the same weights recovers the original scores, proving the edit is reversible. LIME explanations confirm the forgotten feature no longer appears among the top drivers, and the student needs only 2370 FLOPS—about 3.87 times fewer than the cited KronNet baseline—so the whole pipeline fits resource-constrained gateways and cameras.","feed_headline":"IoT botnet detector hits 99.6% accuracy at 2370 FLOPS","feed_subtitle":"Distilled A2C student forgets any feature by zeroing one weight column, then restores it on demand","key_machinery":"Post-hoc weight modification (PHWM): after training, set the entire first-layer weight column W:,j = 0 for the target feature so that feature never again reaches any later layer; the same column can later be restored from a saved copy.","core_discovery":"Knowledge distillation from an attention-augmented A2C teacher into a smaller A2C student yields a 2370-FLOP detector that matches the teacher’s 99.6% accuracy on BoT-IoT, while a post-hoc zeroing of the corresponding first-layer weight column cleanly erases any chosen feature’s contribution; reloading the original weights fully restores performance, satisfying a practical “right-to-be-forgotten” requirement without retraining.","pith_inferences":["If first-layer zeroing is later shown to leave residual traces in attention or critic heads, a stronger unlearning operator (e.g., also zeroing corresponding attention weights) would be required before the GDPR claim can be certified.","The same lightweight student could serve as the local model in a federated IoT setting, allowing devices to unlearn a feature without ever shipping raw traffic off-device.","Because the student already uses an attention mechanism, replacing LIME with attention-rollout maps could give real-time, zero-extra-cost explanations on the device itself."],"forward_implications":["Edge IoT gateways can run a 3 k-parameter botnet detector at full accuracy without cloud offload.","Operators can comply with GDPR-style erasure requests by a single matrix write rather than a multi-hour retrain.","Because the unlearning step is reversible, temporary privacy redactions can be rolled back when the legal basis for processing reappears.","The same teacher–student + PHWM pattern can be reused for any tabular network-traffic classifier that needs both size reduction and selective forgetting."],"fun_headline_variants":["2370-FLOP A2C student unlearns IoT features by zeroing one weight column","Distilled RL detector erases any BoT-IoT feature then fully restores 99.6%","Lightweight A2C forgets sensitive features on demand without retraining","Post-hoc weight zeroing gives reversible unlearning for IoT botnet defense","99.6% accurate edge detector meets right-to-be-forgotten via column wipe"],"cache_read_input_tokens":16512,"weakest_assumption_plain":"Zeroing only the first-layer weight column for a feature is enough to erase every trace of that feature from the model’s decisions and from any residual information that might remain in later layers, attention maps, or the distillation process itself.","fun_headline_variants_meta":{"raw":{"variants":["2370-FLOP A2C student unlearns IoT features by zeroing one weight column","Distilled RL detector erases any BoT-IoT feature then fully restores 99.6%","Lightweight A2C forgets sensitive features on demand without retraining","Post-hoc weight zeroing gives reversible unlearning for IoT botnet defense","99.6% accurate edge detector meets right-to-be-forgotten via column wipe"]},"model":"grok-4.5","effort":"low","cost_usd":0.007554,"raw_usage":{"total_tokens":1935,"prompt_tokens":918,"num_sources_used":0,"completion_tokens":115,"cost_in_usd_ticks":75540000,"prompt_tokens_details":{"text_tokens":918,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":902,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":918,"tokens_out":115,"duration_ms":9083,"temperature":1.0,"reasoning_tokens":902,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-10T18:26:33.368451+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"After PHWM is applied to a high-influence feature such as flgs, extract LIME explanations (or gradient attributions) on held-out attack samples; if that feature still ranks among the top contributors or if accuracy does not drop then recover upon weight restoration, the unlearning claim fails.","supporting_citations":[],"review_version":2}