{"id":"46a1bd7d-a953-466c-964f-acb042ca4e04","arxiv_id":"2607.27940","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":5,"one_line_summary":"TriShield claims to eliminate NeuroImprint-style privacy backdoors in federated fine-tuning, but its full-scale results are projections and its key theorems assume the very conditions they need to establish.","lead":"This paper proposes a three-layer client-side defense (TriShield) against NeuroImprint, a privacy attack that hides memory neurons in federated LLM fine-tuning. The headline promises—perfect privacy and zero accuracy loss—rest mostly on projected numbers and conditional proofs, not on full-scale measured experiments.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"ZUOP's I=0 claim rests on unproven exact orthogonality of memory gradients to the public-data subspace; Corollary 1's '0/0 ⇒ I=0' is an invalid inference.","rationale":"The reader's identified SVI momentum-secrecy concern is valid but secondary: even a perfect SVI does not establish zero MI; the I=0 theorem is entirely about ZUOP's projection. If the orthogonality premise fails, the uploaded gradient retains sample-dependent components regardless of momentum entanglement. Conversely, if orthogonality held, SVI would be unnecessary for the standard attack. The paper's own rank ablation demonstrates the premise is empirically fragile, so this is the load-bearing point. The reader and I agree that the paper's central claims are unsupported, but I locate the crux in the ZUOP orthogonality assumption and the invalid 0/0 argument rather than in SVI's secret momentum. This does not change the verdict: the paper should be rejected because the proof of its central claim is conditional on an unverified and implausible geometric assumption, and its own experiments contradict the universality of that assumption.","tokens_in":16009,"tokens_out":8341,"duration_ms":89332,"concrete_test":"Implement NeuroImprint on GPT-2/SST-2 with LoRA rank 8. (1) Compute G on D_aux (32 samples), take SVD, set U_k at rank fraction 0.80 (default) and also 0.95. (2) For each planted memory neuron, compute the private gradient g_mem (or record the pre-projection update Δφ_rj, Δφ_bj). Measure the angle δ between Δφ and U_k: δ = arccos(||U_k^T Δφ||/||Δφ||). (3) Apply ZUOP and compute the projected ratio Δφ*_rj / Δφ*_bj; check whether it is exactly 0/0, and whether nearest-neighbor token lookup from the projected gradient recovers the private token. If δ is not ≈ 90° for the default k, or if any token is recovered, or if the ratio is finite, the orthogonality premise fails and the I=0 claim is refuted. Report the distribution of δ across slots.","verdict_should_be":"UNCHANGED","load_bearing_attack":"TriShield's headline privacy claim—'mutual information between the uploaded gradient and any individual training sample is zero'—is derived from Theorem 3 and Corollary 1, which are conditional on an unproven geometric premise: that every NeuroImprint memory-neuron gradient g_mem lies exactly in U_main^⊥, the orthogonal complement of the span of gradients on D_aux. The paper asserts this 'by design' from LayerNorm invariance, but NeuroImprint's own mechanism requires memory neurons to receive nonzero gradients α·Embed(x_j) that affect the loss; no argument shows those gradients are orthogonal to gradients on a small public set. The fragility is exposed in the paper's own ablation (Sec. 7.E): at rank fraction 0.95 (k=14), the SR1E variant leaks 50%, directly contradicting the 'zero leakage for all variants' claim. The 'safe' default (k≈3) is justified only by 15-sample demo experiments, not by theory. Furthermore, Corollary 1 claims x̂_j = 0/0 ⇒ I=0; an undefined ratio does not imply zero mutual information, and actual floating-point projections are not exactly zero. Even exact zero numerator/denominator would not prove that the projected gradient vector carries no information about x_j. Thus the central zero-MI guarantee is not established; at best it is a conditional result awaiting an orthogonality measurement that the paper never provides.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes TriShield, a three-layer client-side defense against the NeuroImprint privacy backdoor in federated fine-tuning of LLMs with PEFT adapters. Layer 1 (PAD) scans the received adapter for near-zero-variance memory rows and reinitializes them. Layer 2 (SVI) pre-warms the Adam optimizer state with K virtual steps on public auxiliary data, aiming to break NeuroImprint's closed-form inversion. Layer 3 (ZUOP) projects the local gradient update onto the top-k SVD subspace of gradients on public auxiliary data, aiming to remove memory-neuron components while preserving task-relevant updates. The paper claims a theoretical guarantee that after Layers 2 and 3 the mutual information between the uploaded gradient and any individual training sample is zero, together with zero utility loss and less than 5% overhead. Experiments are reported on GPT-2 and Llama-Guard-3-1B, with 0% reconstruction across attack variants and projected accuracy losses below 0.3%.","tokens_in":16418,"tokens_out":3845,"duration_ms":43785,"significance":"If the claims were established, TriShield would be a substantial contribution to federated learning privacy, because it targets a concrete and recent backdoor attack and proposes a layered, client-side defense that does not require server trust or data-level perturbation. The paper also provides a reproducible-looking local notebook and a thoughtful discussion of adaptive attack variants. However, the central privacy and utility guarantees are not currently supported. The zero-utility-loss theorem is circular, the zero-MI theorem rests on an unproven orthogonality premise, the SVI argument depends on an unjustified secrecy assumption, and the headline experimental numbers are partly projected rather than measured. For these reasons the significance of the work as a validated defense is not yet established.","major_comments":[{"comment":"Theorem 2 is circular. It defines U_main as the column space of G and then proves zero utility loss by assuming ∇_φ L_task lies in U_main. The proof states this is true 'by construction', but G is computed on public auxiliary data D_aux, while the actual task gradient comes from the private data D_i. No argument is given that private-data gradients lie in the span of gradients on a small public set. Without that, the zero-utility-loss claim collapses, and the projection may remove legitimate task signal.","section":"§IV-C, Theorem 2"},{"comment":"Theorem 3 assumes g_mem ⊥ U_main 'by design' and then proves the projection kills it. The premise is never established: NeuroImprint memory-neuron gradients are of the form α·Embed(x_j), and LayerNorm invariance does not imply orthogonality to gradients on D_aux. Corollary 1 then claims that because the reconstructed sample is 0/0, the mutual information is zero. This is an invalid inference: an undefined ratio does not imply zero information, and even an exactly zero numerator and denominator would not show that the projected gradient vector as a whole carries no information about x_j. Thus the central zero-MI claim is not proved.","section":"§IV-C, Theorem 3 and Corollary 1"},{"comment":"The SVI guarantee depends on the server not knowing m_K and v_K. The paper states these are 'never transmitted', but the server distributed the adapter and D_aux is explicitly public (§III-C). An attacker aware of TriShield can rerun the same K virtual iterations on D_aux if it knows the client's batch sampling and optimizer seeding. The paper provides no argument that these are secret. If the server can compute m_K and v_K, the 'under-determined system' of Theorem 1 becomes an element-wise invertible system, and SVI provides no closed-form-inversion protection.","section":"§IV-B, Theorem 1"},{"comment":"The full-scale reconstruction and utility numbers are projected, not measured. Table III and Table IV explicitly mark values as '[proj.]' based on NeuroImprint [1] attack rates and published benchmarks, and §VIII-B.6 admits that full-scale LLaMA experiments are left for future work. The abstract nevertheless states that 'Experiments on GPT-2 ... and Llama-Guard-3-1B verify' 0% reconstruction and maintained accuracy. The only measured local verification is on 15 samples, where one-sample swings equal 6.7% accuracy, and a separate n=256 token-reconstruction experiment. This is insufficient support for the headline zero-utility-loss and zero-reconstruction claims at scale.","section":"§VII-C and §VIII-B"},{"comment":"The ablation table is internally inconsistent: rank fraction 0.70 gives k=9, 0.80 gives k=3, and 0.90 gives k=8. Since k is defined as a fraction of the rank of G, it should be monotone in the fraction. This inconsistency undermines the explanation of why 0.80 is the 'safe default'. More importantly, the same table shows that rank fraction 0.95 yields a 50% SR1E reconstruction rate, which contradicts the paper's repeated claim of 0% reconstruction across all tested attack variants and undermines the universality of the defense.","section":"§VII-E"}],"minor_comments":[{"comment":"Table II lists 'Recon Rate' as 100% for PAD-only and PAD+SVI, with a note that this is expected because gradient-norm is not the right metric for those layers. This is confusing: a reader naturally reads 100% as a defense failure. The table should separate 'reconstruction rate under the correct metric' from the gradient-norm proxy, or relabel the columns.","section":"§VII-B, Table II"},{"comment":"There are several formatting and typographical issues: the abstract contains a stray brace ('Stateful Virtual Iteration}'), the running header shows 'arXiv:2607.27940v2 [cs.LG] 31 Jul 2026' inside the text, Table 0 appears before Table I, and the reference to 'Table V-L' does not correspond to a labeled table. Section references are also inconsistent (e.g., 'Section 7.3b' vs. '§VII-D').","section":"Throughout"},{"comment":"The text says 'Figure 1' presents the n-robust validation results, but what follows is a table, not a figure. The actual pipeline figure in §IV is not numbered. Please fix the cross-referencing.","section":"§VII-D"},{"comment":"The reported k values should be reconciled with the definition k = min(0.8·rank(G), n−1). With n=32 aux samples and rank fraction 0.80, k≈3, but the table lists k=9 at 0.70 and k=8 at 0.90. Either the formula, the data, or the notation is inconsistent, and this should be clarified.","section":"§VII-E"}],"recommendation":"reject","confidential_remarks":"The manuscript makes very strong claims — zero mutual information, zero utility loss, and 0% reconstruction — but the supporting arguments are circular or rest on unverified assumptions, and the large-scale experimental tables are explicitly projected. The internal inconsistency in the ablation table and the admitted lack of full-scale LLaMA measurements further weaken the paper. This is not a case where minor local fixes would suffice; the central privacy proof and the empirical evidence need to be reworked. I recommend rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"What you should know: this paper has a genuinely interesting three-layer defense idea, but the core privacy theorem is unproven and the headline full-scale results are projected from the attack paper, not measured. I'd send it to review only because the framework is worth discussing; the current manuscript is not close to acceptable.\n\nThe interesting part is the framework: PAD's artifact scan, SVI's optimizer-state poisoning, and ZUOP's reverse of GPM form a sensible stack for a client-side defense against server-planted memory neurons in PEFT. The paper clearly separates measured local numbers from projected full-scale ones, and includes a notebook. PAD detection on GPT-2 and Llama-Guard-3-1B is a concrete, plausible result.\n\nBut the load-bearing claims don't hold up. Theorem 2 is circular: it defines U_main as the span of task gradients and then proves zero utility loss by assuming the task gradient lies in that span. Theorem 3 similarly assumes what is at issue, that all memory-channel gradients are exactly orthogonal to the public-data subspace; no mechanism establishes this. Corollary 1 then concludes MI=0 from an undefined 0/0 ratio, which is invalid. SVI's security rests on the server not knowing the exact momentum state, yet D_aux is public and the server distributed the adapter; a server that knows about TriShield can simulate the virtual steps (or an approximation) and recover m_K and v_K up to batch-sampling uncertainty, then solve for the private gradient. The paper gives no argument that this is hard. The ablation table is internally inconsistent (rank fraction 0.70 -> k=9, 0.80 -> k=3, 0.90 -> k=8), which undermines confidence in the measured numbers. And the full-scale reconstruction and utility tables are labeled 'projected'; the only measured utility numbers come from 15 samples where one sample moves accuracy by 6.7%. That cannot support 'zero utility loss.'\n\nSo the central guarantee—provable zero mutual information and zero accuracy loss—is not established. The idea is still worth reading, particularly the SVI step as a concrete way to weaponize the fact that multi-step Adam histories complicate inversion. A reader working on FL privacy could get a useful research direction, but I wouldn't cite this version for the results.\n\nRecommendation: send to peer review if the venue wants a substantive interrogation of a defense framework; expect rejection or a major revision. The authors need to either prove the orthogonality condition, fix the rank-ablation inconsistency, and run real full-scale experiments, or substantially narrow their claims.","headline":"A creative three-layer defense idea, but the central privacy and utility proofs don't hold and the full-scale results are projected, not measured.","tokens_in":16865,"tokens_out":4258,"would_cite":false,"duration_ms":44126,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"TriShield claims to make sample-level reconstruction from federated gradients information-theoretically impossible while preserving model accuracy.","keywords":["federated learning","privacy backdoor","PEFT","gradient inversion","orthogonal projection","Adam momentum","client-side defense","NeuroImprint"],"falsifier":"Take a TriShield-protected client and a server that knows the defense: the server replays the K virtual Adam steps on the same public auxiliary dataset (or a close proxy) to estimate m_K and v_K, then runs NeuroImprint's reconstruction on the received update. If the server recovers any private token above the clean noise floor, the paper's mutual-information-zero claim is false. Alternatively, measure the Pearson correlation between the uploaded projected gradient and each private sample's embedding over many rounds; nonzero correlation contradicts I=0.","tokens_in":15913,"feed_emoji":"🛡️","tokens_out":5166,"duration_ms":49405,"temperature":0.7,"pith_summary":"The paper addresses a recent attack, NeuroImprint, in which a malicious parameter server plants 'memory neurons' in a PEFT adapter so that each client training sample writes into a dedicated slot, letting the server reconstruct 59–79% of client text from the uploaded gradient. TriShield is a client-side, three-layer defense: it scans the received adapter for planted memory-neuron signatures and resets them, runs several virtual optimizer steps on public data so Adam's momentum entangles gradients and breaks the attack's closed-form inversion, and projects the final gradient onto the main-task subspace computed by SVD so that any memory-neuron component is physically removed. The paper proves that after the second and third layers the mutual information between the uploaded gradient and any individual training sample is zero, and reports 0% reconstruction on GPT-2 and Llama-Guard-3-1B with under 0.3% accuracy loss and less than 5% GPU overhead. If correct, this would give federated fine-tuning a practical way to resist a strong server-side adversary without paying the utility cost of differential privacy.","feed_headline":"Zero-loss defense blocks privacy backdoors in federated LLM tuning","feed_subtitle":"Three client-side layers cut reconstruction to 0% without hurting accuracy or adding communication rounds.","key_machinery":"The load-bearing machinery is a trio of client-side operations, each aimed at a specific vulnerability. The Parameter Artifact Detector (PAD) reinitializes adapter rows whose within-row variance or cross-row correlation matches the planted memory-neuron signature. The Stateful Virtual Iteration (SVI) pre-runs K=3 Adam steps on a small public auxiliary dataset without updating weights, so that when real training gradients arrive they are mixed with an unobserved momentum state. The Zero-Utility Orthogonal Projection (ZUOP) computes an SVD of gradients on the same auxiliary data to form the main-task subspace U_main and replaces the uploaded gradient with its projection onto that subspace. The","core_discovery":"On the paper's own terms, the central claim is that NeuroImprint-style reconstruction becomes mathematically impossible once the client applies TriShield's last two layers. The Stateful Virtual Iteration turns the memorization neuron's update from a clean multiple of the sample embedding into a nonlinear mixture of that embedding with public-data momentum, so the server faces an under-determined system. The Zero-Utility Orthogonal Projection then projects the gradient onto the SVD-derived main-task subspace; because NeuroImprint's memory gradients are orthogonal to that subspace by design, their projected weight and bias updates both become zero, and the attacker's reconstruction formula eva","pith_inferences":["Editorial inference: The zero-mutual-information proof assumes the server cannot reconstruct the client's Adam momentum state after SVI, yet the auxiliary dataset is public and the server distributes the adapter; a TriShield-aware server could rerun the same K virtual steps on that public data to approximate m_K and v_K, potentially reducing the 'under-determined system' to a solvable one. This is","Editorial inference: The 'zero utility loss' result is only as good as the subspace estimate; if the public auxiliary data is not representative of the private task distribution, real task gradients will have off-subspace components and the projection will discard useful signal, so the <0.3% loss bound should be re-validated on domain-mismatched auxiliary sets.","Editorial inference: The defense narrative suggests a general design principle — make the attacker's inversion formula singular by ensuring the received signal has support only where the attacker's planted encodings have none. This could be adapted to other gradient-inversion attacks beyond NeuroImprint, e.g., by projecting onto a public-data task subspace before upload.","Editorial inference: A straightforward empirical test would measure the correlation between projected gradients and private-sample embeddings; if any private token recovers above the noise floor at large n or across many rounds, the claimed I=0 guarantee is falsified."],"forward_implications":["Clients could upload gradients that provably carry zero sample-level information, so a malicious server gets no raw text even with full access to the update.","The defense costs no extra communication rounds and keeps accuracy within 0.3% of vanilla FedAvg, making it usable in production FL pipelines.","Because ZUOP removes off-subspace components, any attack vector whose encoding is orthogonal to the main-task subspace is eliminated regardless of how it evades detection.","SVI's pre-poisoned momentum blocks closed-form single-step inversion even when the gradient direction itself is intact, adding a complementary barrier.","The paper's adaptive-variant evaluation suggests the defense also neutralizes memory-neuron designs that try to hide from PAD, as long as their signal is task-orthogonal."],"fun_headline_variants":["TriShield: zero-loss defense kills privacy backdoors","No utility loss, no privacy leak: TriShield defense","Block federated backdoors with zero accuracy cost","TriShield makes data reconstruction impossible in FL","Defend federated LLM tuning without utility trade-off"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The privacy guarantee rests on the server being unable to know or reliably estimate the client's virtual-iteration momentum state (the public auxiliary data and virtual-step details are treated as unobserved), and the zero-utility-loss guarantee rests on the private-task gradient lying entirely in the public-data subspace; if either assumption fails, the corresponding half of the claim collapses.","fun_headline_variants_meta":{"raw":{"variants":["TriShield: zero-loss defense kills privacy backdoors","No utility loss, no privacy leak: TriShield defense","Block federated backdoors with zero accuracy cost","TriShield makes data reconstruction impossible in FL","Defend federated LLM tuning without utility trade-off"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000201,"raw_usage":{"total_tokens":1270,"prompt_tokens":850,"completion_tokens":420,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":594,"completion_tokens_details":{"reasoning_tokens":342}},"tokens_in":594,"tokens_out":420,"duration_ms":4796,"temperature":1.0,"reasoning_tokens":342,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-03T01:36:39.916721+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a TriShield-protected client and a server that knows the defense: the server replays the K virtual Adam steps on the same public auxiliary dataset (or a close proxy) to estimate m_K and v_K, then runs NeuroImprint's reconstruction on the received update. If the server recovers any private token above the clean noise floor, the paper's mutual-information-zero claim is false. Alternatively, measure the Pearson correlation between the uploaded projected gradient and each private sample's embedding over many rounds; nonzero correlation contradicts I=0.","supporting_citations":[],"review_version":2}