{"id":"8c3f4177-13e3-41d1-8d9e-4fb2a091499c","arxiv_id":"2608.00872","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"DP-SimAgg claims per-round (epsilon, delta)-DP for federated brain tumor segmentation by adding Gaussian noise after similarity-weighted aggregation, but the noise scale relies on an empirically estimated sensitivity that is not a proven bound.","lead":"Federated learning trains on hospital data without moving it, and this paper adds random noise at the server to protect privacy while weighting updates by similarity. The catch is that its privacy guarantee depends on a sensitivity estimate that the authors admit is not a formal upper bound.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Per-round (ε0,δ0) is not the privacy of a round: Algorithm 1 independently noised every weight/bias tensor, so the round is m composed mechanisms; the paper's ε_total=20 accounting omits the factor m and the reported guarantee is unsupported even with exact per-tensor sensitivity.","rationale":"The central claim is the formal per-round (ε0,δ0)-DP guarantee. For that claim to hold, two independent conditions must both be true: the per-tensor sensitivity used to set σ must upper-bound the actual sensitivity, and the accounting must combine all Gaussian releases within a round. The paper's own Limitations section concedes the first condition is not met (Sec. III-D; Supplementary Remark VI.2). The second condition is also not met: Algorithm 1 is invoked per tensor, and Section III-F's 'one invocation of the Gaussian mechanism' is therefore incorrect unless exactly one tensor is processed per round. Since the residual U-Net has many trainable parameter tensors, the reported cumulative ε_total underestimates the composed privacy loss by a large factor. Even a reader who accepted the empirical sensitivity would have to reject the per-round guarantee as stated. I agree with the Reader's verdict and with its identification of empirical sensitivity as a valid weakness, but I see per-tensor composition as the more decisive defect because it holds regardless of how sensitivity is estimated. I am not claiming the experimental trend is fabricated; the coding and evaluation may be exactly as reported. The issue is that the formal privacy statement is not supported. A revision that applies a proven sensitivity bound, composes across all tensors and rounds with an appropriate accountant, and reports repeated runs with DP baselines could warrant reconsideration; the current claim cannot be accepted.","tokens_in":16311,"tokens_out":9678,"duration_ms":93374,"concrete_test":"Instrument the OpenFL aggregator to log each call to Algorithm 1 and count m, the number of tensor_names that receive AddGaussianNoise in one round of the actual FeTS 2022 run. Then recompute the round-level privacy under the paper's basic composition convention as (mε0, mδ0) and the 20-round total as (20mε0, 20mδ0). If m>1, as it must be for the described 95-layer U-Net, the reported ε_total=20 (ε0=1) understates the privacy loss by at least a factor of m; this settles the composition concern without retraining.","verdict_should_be":"REJECT","load_bearing_attack":"Section III-F states that 'each round applies one invocation of the Gaussian mechanism with per-round budget (ε0,δ0)' and then applies basic composition over the 20 rounds to obtain ε_total=20. Algorithm 1, however, is written for a generic tensor_name: whenever tensor_name 'corresponds to weight or bias' it clips, reweights, estimates Δf, and calls AddGaussianNoise (Algorithm 2), and the same branch also noise-perturbs the remaining tensors with Δf=C. A 95-layer, 33M-parameter residual U-Net has many tensors; if m such tensor-level mechanisms run in one round, the round is m composed mechanisms. Under the paper's own basic-composition convention the round-level guarantee is at best (mε0, mδ0), and the 20-round total is at least 20mε0, not 20ε0. This is independently fatal to the per-round claim: even if the empirical sensitivity in Algorithm 1 were an exact per-tensor bound, the claimed (ε0,δ0) per communication round does not follow. The unused 4C bound in Proposition VI.1 is a per-tensor bound and does not repair the composition gap. The paper also concedes in Sec. III-D that its sensitivity estimate is not a formal upper bound; that is a second, independent break in the privacy argument.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes DP-SimAgg, a server-side differentially private variant of similarity-weighted aggregation for federated brain lesion segmentation. The method clips collaborator updates, computes similarity weights, estimates the L2 sensitivity of the aggregation empirically via a simulated neighboring dataset, injects Gaussian noise calibrated to that estimate, and reports per-round (epsilon_0, delta_0)-DP with basic composition over 20 rounds. Experiments on the FeTS 2022 dataset with a 3D residual U-Net show Dice scores of 0.6357/0.5305/0.5274 for ET/TC/WT at epsilon_0=1 and near-baseline performance at epsilon_0=10. The central claim is that this mechanism provides formal per-round differential privacy guarantees while retaining competitive segmentation accuracy.","tokens_in":16594,"tokens_out":3170,"duration_ms":29209,"significance":"If the privacy guarantee were sound, the paper would be a useful engineering contribution: it provides a complete algorithmic specification, evaluates on a challenging multi-institutional benchmark using a standard architecture, and reports computational overhead that is genuinely small relative to training cost. The authors also deserve credit for explicitly acknowledging in the limitations section that the empirical sensitivity estimate is not a formal upper bound and that tighter accounting methods exist. However, the central privacy claim is the main selling point, and it is not supported by the mechanism as implemented. The paper cannot be accepted as a formal differential privacy contribution without correcting the sensitivity calibration and the composition accounting, and the experimental results would need to be regenerated under a valid mechanism.","major_comments":[{"comment":"The privacy accounting is incorrect because a single communication round is not one invocation of the Gaussian mechanism. Algorithm 1 applies the clipping, sensitivity estimation, and AddGaussianNoise steps separately to each weight/bias tensor (lines 1-21) and also noise-perturbs every non-weight tensor with Delta_f=C (lines 22-26). For a 95-layer, 33M-parameter network there are many tensors, so the round-level mechanism is the composition of m tensor-level Gaussian mechanisms. Section III-F states that each round applies one invocation with per-round budget (epsilon_0, delta_0), but under the paper's own basic-composition convention the round guarantee is at best (m*epsilon_0, m*delta_0) and the 20-round total is at least 20*m*epsilon_0, not 20*epsilon_0. This is a load-bearing error: the reported epsilon_total values (20 and 200) do not follow from the described mechanism.","section":"Section III-F and Algorithm 1"},{"comment":"The estimated sensitivity Delta_f is not a valid upper bound on the L2 sensitivity of the actual aggregation function. Algorithm 1 computes the neighboring aggregate pm' using the same similarity weights Wnorm that were derived from the original tensor set T (lines 14-18), whereas the true aggregation function recomputes the similarity weights from the neighboring tensor set. The paper itself concedes in Section III-D that this approach 'does not yield a formal tight upper bound on the sensitivity,' and Supplementary Remark VI.2 confirms that the analytical 4C bound is not used in Algorithm 1. Consequently, the Gaussian noise standard deviation sigma = Delta_f/epsilon_0 * sqrt(2 ln(1.25/delta_0)) is not guaranteed to satisfy (epsilon_0, delta_0)-DP even for a single tensor, and any real neighboring dataset that induces a larger weight change than the simulated one will have insufficient noise.","section":"Algorithm 1, lines 17-19, and Section III-D"},{"comment":"The analytical 4C bound cannot rescue the privacy claim as stated. Proposition VI.1 is a per-tensor bound, and it would still need to be combined with the missing composition across tensors within each round and across the 20 rounds. More importantly, the experimental results in Section IV were produced using the empirical sensitivity estimate, not the 4C bound. If the authors were to implement a valid mechanism using the 4C bound per tensor, the noise scale would increase substantially (by a factor related to 4C / Delta_f_empirical, and further by the tensor-count factor in composition), and the reported Dice scores at epsilon_0=1 and epsilon_0=10 would likely change materially. No evidence is provided that the utility results would be preserved under a correct privacy accounting.","section":"Supplementary Proposition VI.1 and Section IV"}],"minor_comments":[{"comment":"The abstract reports Dice scores of 0.6357/0.5305/0.5274 for ET/TC/WT at epsilon_0=1, but Table 2 labels these values as DICE LABEL1, DICE LABEL2, and DICE LABEL4, respectively. The mapping between the composite regions (ET, TC, WT) and the label-based rows is confusing and should be clarified, especially because the text in Section IV assigns label 1 to necrotic core, label 2 to edema, and label 4 to enhancing tumor.","section":"Table 2"},{"comment":"The sentence beginning 'While providing per-round (epsilon_0, delta_0)-DP guarantees' appears grammatically incomplete; a period is missing after 'sensitivity bound.' Also, the phrase 'minimal additional overhead computational cost' in Section VI should be reworded to 'minimal additional computational overhead.'","section":"Section V, Limitations and Future Directions"},{"comment":"The line 'T'[0] <- 1*C' is ambiguous: it is unclear whether this sets the entire first tensor to a constant tensor with norm C, a scalar, or a vector of ones scaled by C. The pseudo-code should specify the construction of the adversarial neighbor tensor explicitly, since the sensitivity estimate depends on this construction.","section":"Algorithm 1, line 17"},{"comment":"The statement that delta_total <= 20*10^-5 = 2*10^-4 assumes basic composition for delta, but the per-tensor composition issue also affects the delta accounting: if the round is m composed mechanisms, the round-level delta should be m*delta_0 under basic composition, so the total delta would be larger than reported.","section":"Section III-F"}],"recommendation":"reject","confidential_remarks":"The central privacy claim is mathematically unsupported for two independent reasons: the empirical sensitivity is not a valid worst-case bound for the actual aggregation function, and the composition accounting ignores the many Gaussian mechanisms applied within each round. These are not presentation issues; they invalidate the paper's main advertised contribution. A revision that fixes the privacy accounting would require redesigning the mechanism (e.g., applying a proven per-tensor bound with proper composition), rerunning all experiments, and likely observing substantially worse utility. This is beyond the scope of a normal major revision. The paper also leans heavily on the authors' own prior SimAgg line for the non-private baseline and does not compare against DP-FedAvg or a DP version of FedAvg, which weakens the empirical positioning even if the privacy issue were resolved."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's my read. The headline claim—formal per-round (ε0, δ0)-DP for DP-SimAgg—does not survive contact with Algorithm 1. The paper is nevertheless worth reading, and it deserves a proper review rather than a desk reject.\n\nWhat is genuinely new: DP-SimAgg is, as far as I can tell, the first combination of the authors' similarity-weighted aggregation with server-side central Gaussian DP in medical segmentation, and it requires no changes to collaborator training. The FeTS 2022 evaluation is real work, and the supplementary 4C sensitivity bound is correct as far as it goes, though the paper explicitly says Algorithm 1 does not use it. The paper is also candid about the empirical sensitivity limitation in Sec. III-D.\n\nThe main problem is the privacy accounting. Algorithm 1 is written for a generic tensor, and it noise-perturbs every weight and bias tensor (and all other tensors, with Δf = C). A 95-layer U-Net has a large number of such tensors. Each tensor gets its own noise draw. Claiming one invocation of the Gaussian mechanism per round ignores that the round is a composition of m tensor-level mechanisms. Under the paper's own basic-composition convention, the round guarantee is at best (mε0, mδ0), and the 20-round total is 20mε0, not 20ε0. This is fatal to the formal claim independent of the sensitivity-estimation issue.\n\nSecond, the empirical sensitivity in Algorithm 1 is not a worst-case bound. It replaces one collaborator with a C-norm tensor and, critically, does not recompute the similarity weights for the neighboring dataset. The paper concedes it is not a formal upper bound. A real neighboring dataset could produce a larger output change, and then the Gaussian noise is too small. The unused 4C bound does not repair this.\n\nWeaker but real: the experiments are a single run per setting, no error bars, and no differentially private baseline. That limits the utility claims. Heavy self-citation is not by itself a flaw; the DP extension is independent.\n\nMy verdict: reject in current form. The privacy claim is load-bearing and broken, twice over. A revised version that uses a formal per-tensor sensitivity bound, composes across all tensors properly, recomputes weights in the sensitivity estimate, and adds DP baselines and repeated runs could be acceptable. I would send this to peer review rather than desk reject; referees should be able to catch these issues. And I'd bring it to reading group as a sharp example of why per-tensor composition matters in DP-FL.","headline":"The DP claim is broken twice—per-tensor composition is not accounted for and the empirical sensitivity is not a worst-case bound—but the combination is new, the paper is honest, and it deserves a real review.","tokens_in":17148,"tokens_out":2645,"would_cite":false,"duration_ms":24409,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Similarity-weighted federated aggregation can carry per-round differential privacy while keeping brain-tumor segmentation competitive, with near-baseline Dice at a per-round budget of 10.","keywords":["federated learning","differential privacy","similarity-weighted aggregation","brain tumor segmentation","non-IID data","Gaussian mechanism","L2 clipping","privacy-utility trade-off"],"falsifier":"Run one round of Algorithm 1 on a small synthetic federated problem, enumerate all neighboring datasets that differ in one clipped collaborator update (including antipodal and zero replacements), recompute the similarity weights under each neighbor, and compare the largest observed change in the aggregate to the empirical $\\Delta_f$ the algorithm would use. If any neighbor moves the output by more than $\\Delta_f$, the noise injected for that round is too small and the stated per-round $(\\epsilon_0,\\delta_0)$-DP guarantee is violated.","tokens_in":16092,"feed_emoji":"🧠","tokens_out":7293,"duration_ms":58653,"temperature":0.7,"pith_summary":"DP-SimAgg is a federated-learning aggregation method that adds a differential-privacy layer to similarity-weighted averaging. The paper's central claim is that this combination preserves competitive brain-tumor segmentation on a multi-institution benchmark of 1251 MRI scans while giving per-round $(\\epsilon,\\delta)$ privacy guarantees. The mechanism clips every collaborator update, weights updates by similarity to the consensus, estimates the sensitivity of the weighted aggregate from a simulated neighboring update, and adds Gaussian noise calibrated to that estimate. A reader should care because the method addresses the two main obstacles to clinical federated learning at once—non-IID data and gradient leakage—without modifying collaborator-side training. The reported cost of privacy is modest: at a per-round budget of 10 the method nearly matches the non-private baseline, and at a strict per-round budget of 1 it stays within the range of reported inter-rater variability for glioblastoma segmentation.","feed_headline":"Federated tumor segmentation keeps Dice under differential privacy","feed_subtitle":"Adding per-round server-side Gaussian noise, epsilon=10 matches the non-private federated baseline; epsilon=1 stays competitive.","key_machinery":"The load-bearing object is Algorithm 1, the DP-SimAgg aggregation pipeline: (1) L2 clipping bounds each collaborator update to radius $C$, which makes sensitivity finite; (2) similarity-weighted averaging assigns normalized weights based on L2 distance from the unweighted mean, down-weighting divergent updates; (3) sensitivity is estimated empirically by replacing one clipped update with a vector of norm $C$ and measuring the L2 change in the weighted aggregate; (4) Gaussian noise is added with standard deviation $\\frac{\\Delta_f}{\\epsilon_0}\\sqrt{2\\ln(1.25/\\delta_0)}$. The paper's formal per-round $(\\epsilon_0,\\delta_0)$-DP claim rests on the Gaussian mechanism applied to this estimated sensitivity.","core_discovery":"The discovery is that server-side differential privacy can be layered onto similarity-weighted aggregation without destroying segmentation utility. Concretely, after L2-clipping every collaborator update to norm at most $C$, the server forms a weighted average in which updates close to the consensus receive higher weight; it then estimates the L2 sensitivity $\\Delta_f$ by swapping one collaborator's clipped update for a worst-case bounded tensor and measuring how much the aggregate changes; finally it adds Gaussian noise with standard deviation $\\frac{\\Delta_f}{\\epsilon_0}\\sqrt{2\\ln(1.25/\\delta_0)}$. On the benchmark, per-round $\\epsilon_0=10$ yields whole-tumor Dice 0.7962 versus 0.7896 for the non-private baseline, while per-round $\\epsilon_0=1$ yields whole-tumor Dice 0.5274, roughly 10–15 points below baseline. The privacy statement is explicit that the guarantee is per-round and holds under the assumed sensitivity bound.","pith_inferences":["If the empirical sensitivity estimate ever understates the true worst-case sensitivity—for example with colluding collaborators who alter both updates and similarity weights—the per-round privacy guarantee would not hold even though the accounting says it should; replacing the empirical estimate with the paper's own conservative $4C$ bound would make the guarantee unconditional at the price of muc","The paper reports only basic sequential composition; using Rényi DP or moments-accountant composition would lower the cumulative budget without changing the mechanism, so the reported privacy cost is conservative in that dimension.","A direct comparison against differentially private FedAvg under the same budgets would isolate how much of the retained utility comes from similarity weighting rather than from central DP; the paper lists this as future work.","The unused $4C$ analytical bound in the supplement is not what Algorithm 1 calibrates to; testing whether noise calibrated to the empirical estimate still protects all neighboring datasets could be done by exhaustively checking one-round outputs on a small synthetic federated problem."],"forward_implications":["At per-round $\\epsilon_0=10$ (cumulative 200 over 20 rounds), the whole-tumor Dice of 0.7962 slightly exceeds the non-private baseline of 0.7896, with all lesion Dice within a few points of baseline.","At per-round $\\epsilon_0=1$ (cumulative 20), Dice drops by roughly 10–15 points relative to baseline but remains in the range of reported inter-rater variability for glioblastoma segmentation.","Because clipping, weighting, sensitivity estimation, and noise injection all run server-side, collaborators need no changes to local training, and wall-clock time, memory, and energy stay within about 5% of non-private runs.","The formal guarantee is per-round $(\\epsilon_0,\\delta_0)$-DP under the assumed sensitivity bound; with basic sequential composition the 20-round cumulative budget is reported as 20 or 200.","The method does not depend on any collaborator-side modification, so it can be dropped into existing federated medical-imaging deployments that already use a central aggregator."],"supporting_citations":[{"why":"Defines the standard federated averaging protocol that DP-SimAgg extends and compares against as its baseline setting.","marker":"[7]"},{"why":"Introduces the similarity-weighted aggregation scheme that DP-SimAgg builds on and makes differentially private.","marker":"[17]"},{"why":"Supplies the Gaussian mechanism and the moments-accountant composition framework underlying the noise calibration and privacy accounting.","marker":"[29]"},{"why":"Provides the $(\\epsilon,\\delta)$-DP definition and the Gaussian mechanism theorem that the per-round privacy claim relies on.","marker":"[27]"},{"why":"Establishes the server-side client-level differential privacy model that DP-SimAgg adopts.","marker":"[30]"},{"why":"Provides the FeTS 2022 federated brain-tumor segmentation benchmark and partition used for evaluation.","marker":"[18]"},{"why":"Supplies the residual U-Net architecture and challenge configuration used in the experiments.","marker":"[44]"}],"fun_headline_variants":["DP-SimAgg: global DP for federated brain tumor segmentation","Similarity-weighted FL with global DP: ε=10 matches non-private Dice","Server-side DP on FL: whole-tumor Dice 0.7962 at ε=10","Federated brain lesion segmentation with global DP: ε=10 matches baseline"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The per-round privacy guarantee assumes that the sensitivity estimated from one simulated neighboring update is a valid upper bound on the true worst-case sensitivity of the similarity-weighted aggregate; if any real neighboring dataset moves the aggregate more than that estimate, the injected noise is too small and the stated $(\\epsilon,\\delta)$-DP guarantee does not hold.","fun_headline_variants_meta":{"raw":{"variants":["DP-SimAgg: global DP for federated brain tumor segmentation","Similarity-weighted FL with global DP: ε=10 matches non-private Dice","Server-side DP on FL: whole-tumor Dice 0.7962 at ε=10","Federated brain lesion segmentation with global DP: ε=10 matches baseline"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000326,"raw_usage":{"total_tokens":1875,"prompt_tokens":1048,"completion_tokens":827,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":664,"completion_tokens_details":{"reasoning_tokens":742}},"tokens_in":664,"tokens_out":827,"duration_ms":7704,"temperature":1.0,"reasoning_tokens":742,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T15:15:38.233019+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run one round of Algorithm 1 on a small synthetic federated problem, enumerate all neighboring datasets that differ in one clipped collaborator update (including antipodal and zero replacements), recompute the similarity weights under each neighbor, and compare the largest observed change in the aggregate to the empirical $\\Delta_f$ the algorithm would use. If any neighbor moves the output by more than $\\Delta_f$, the noise injected for that round is too small and the stated per-round $(\\epsilon_0,\\delta_0)$-DP guarantee is violated.","supporting_citations":[{"cited_title":"Communication-efficient learning of deep networks from decentralized data,","cited_arxiv_id":null,"evidence_quote":"Defines the standard federated averaging protocol that DP-SimAgg extends and compares against as its baseline setting."},{"cited_title":"Adap- tive weight aggregation in federated learning for brain tumor segmentation,","cited_arxiv_id":null,"evidence_quote":"Introduces the similarity-weighted aggregation scheme that DP-SimAgg builds on and makes differentially private."},{"cited_title":"Deep learning with differential privacy,","cited_arxiv_id":null,"evidence_quote":"Supplies the Gaussian mechanism and the moments-accountant composition framework underlying the noise calibration and privacy accounting."},{"cited_title":"Differentially private federated learning: A client level perspective,","cited_arxiv_id":null,"evidence_quote":"Establishes the server-side client-level differential privacy model that DP-SimAgg adopts."},{"cited_title":"Towards fair decentralized benchmarking of healthcare AI algorithms with the federated tumor segmentation (FeTS) challenge,","cited_arxiv_id":null,"evidence_quote":"Provides the FeTS 2022 federated brain-tumor segmentation benchmark and partition used for evaluation."},{"cited_title":"The federated tumor segmentation (FeTS) challenge 2022,","cited_arxiv_id":null,"evidence_quote":"Supplies the residual U-Net architecture and challenge configuration used in the experiments."}],"review_version":2}