{"id":"79604817-e49e-49dd-9a9c-5af2248797cd","arxiv_id":"2608.07274","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"TOFD defends split federated learning against five classes of poisoning attacks by combining class-wise target inference, sample purification, and adversarial feature decoupling.","lead":"TOFD, a three-stage defense for split federated learning, detects poisoned data early on the server, filters bad samples, and suppresses remaining attack effects. It reports higher accuracy and lower overhead than existing defenses across five image datasets, which matters for privacy-preserving edge AI.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Baseline contamination via Eq. (11) is unmodeled: undetected poisoned samples from the adaptive attack enter Z+ and update P_G,k, so the detection baseline drifts toward the attack, undermining MSDR and the convergence guarantee.","rationale":"The reader's weakest_assumption correctly identifies that the defense relies on historical global distributions staying reliable, but stops short of noting that TOFD's own update rule in Eq. (11) actively contaminates that baseline with any undetected poisoned samples. The adaptive attack in Section 6.2.6 is direct evidence that such samples exist, so the feedback loop is not hypothetical. This is the most load-bearing concern because the entire pipeline — target inference, sample purification, and decoupling — is triggered by detection quality, and the theoretical guarantee in Lemma 2/Theorem 3 treats alpha as a fixed bound without modeling baseline drift. The paper otherwise has strong empirical support (ablations, five datasets, comparison to many baselines) and the adaptive attack is honestly reported, but the absence of any analysis of baseline contamination leaves the main robustness claim conditional. The proposed test is a direct, low-cost check that would settle whether the feedback loop materially degrades MSDR and accuracy; if it does not, the concern is resolved. Given the reader already assigned CONDITIONAL based on missing code and error bars, this additional condition does not change the verdict category, so the verdict remains UNCHANGED in the sense that it should still be CONDITIONAL rather than ACCEPT or REJECT.","tokens_in":15014,"tokens_out":6741,"duration_ms":69583,"concrete_test":"Run the Section 6.2.6 adaptive attack on MNIST (Non-IID kappa=1, 20% malicious) for the full 300 rounds. Each round, compute (i) the 2-Wasserstein distance between the maintained P_G,k and a clean reference distribution P_ref,k estimated once at round 0 from a held-out set of benign clients' smashed data; and (ii) the MSDR on the malicious clients' poisoned samples. If dist(P_G,k, P_ref,k) grows monotonically beyond, say, twice its round-0 value, or if MSDR drops below 80% after round 100, the baseline contamination feedback is confirmed and the central robustness claim is conditional on a defense mechanism (e.g., robust baseline update) that TOFD does not include.","verdict_should_be":"UNCHANGED","load_bearing_attack":"TOFD's detection and purification stages assume that the maintained historical global class distribution P_G,k is a clean baseline (Eqs. (3), (9)). However, Eq. (11) updates P_G,k using Z+ = union of all samples that survive purification, including any poisoned samples whose D_k(z) falls below tau_k. Section 6.2.6 shows that an adaptive attacker can constrain its induced DCS to lie within MP_k, causing poisoned samples to pass purification and enter Z+. Those samples then update P_G,k via the EMA, progressively shifting the baseline toward the attack distribution. This feedback loop is not modeled in Lemma 2/Theorem 3: the bound alpha on undetected malicious fraction is treated as a constant, and the proof does not account for the baseline itself being contaminated by the undetected samples. Consequently, the theoretical convergence guarantee does not cover the regime in which the defense is claimed to be robust (sustained adaptive/composite attacks), and the empirical MSDR/accuracy results may degrade over rounds as P_G,k drifts. The central claim of high MSDR under non-IID conditions therefore rests on an assumption that the algorithm's own update rule can violate whenever any attack evades the threshold, which the paper's adaptive attack demonstrates is possible.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"TOFD is a three-stage defense for split federated learning: class-wise attack target inference builds refined safe zones via margin perturbation; class-calibrated sample purification filters poisoned smashed data with adaptive thresholds; and a decoupling loss with an adversarial guidance model suppresses residual adversarial influence. The paper claims convergence guarantees for TOFD and reports extensive experiments on five datasets against twelve baselines under single, composite, and adaptive attacks.","tokens_in":15290,"tokens_out":3633,"duration_ms":41746,"significance":"The framework is timely and well motivated: it exploits the smashed-data checkpoint unique to SFL, and the evaluation is broad, covering five datasets, multiple backbones, seven attack configurations, non-IID settings, and an adaptive attack. The ablation study in Table 4 supports the contribution of each component, and the adaptive-attack experiment in Section 6.2.6 is an honest stress test that many defenses omit. If the convergence guarantee and the detection claims hold, TOFD would be a practically useful defense with modest overhead (Lemma 1). However, the main comparison table lacks error bars, the compression map phi is unspecified, the adaptive attack is shown to partially evade purification, and the formal proofs are deferred to an appendix absent from the preprint, so the central theoretical and robustness claims are not yet fully supported.","major_comments":[{"comment":"The convergence guarantee is load-bearing for the abstract's claim of 'theoretical guarantees,' but the proofs are deferred to Appendix A, which is not included in the preprint. The reader cannot verify Lemma 2's bound on the gradient bias or Theorem 3's O(1/sqrt(T)) + O(eps^2) rate. The appendix must be supplied, or the theorem statement must be accompanied by a complete proof sketch that identifies exactly where each assumption is used.","section":"Section 5, Lemma 2 and Theorem 3"},{"comment":"The EMA update of the global class distribution P_G,k uses Z+ = union of all samples that survive purification, including undetected poisoned samples. Section 6.2.6 demonstrates that an adaptive attacker can constrain DCS within MP_k so that poisoned samples pass purification and enter Z+. Those samples then contaminate P_G,k through Eq. (11), shifting the detection baseline toward the attack. Lemma 2 treats the undetected malicious fraction alpha as a constant and does not model this feedback loop, so the convergence theorem does not cover the regime in which the defense is claimed to be robust. The authors should either model the baseline drift, restrict the theorem's scope, or update P_G,k using only samples from clients that passed both safe-zone and sample-level verification.","section":"Section 4.2, Eq. (11)"},{"comment":"The detection pipeline depends on the unspecified compression map phi and on the assumption that compressed class-wise smashed data are approximately diagonal Gaussian. The paper does not state what phi is (e.g., a fixed projection, a learned encoder, or a model layer), how its dimension S is chosen, or when the diagonal-Gaussian model is justified. Eq. (9) also requires the inverse of the diagonal covariance, which is ill-defined if any variance estimate is zero, a realistic risk with small class-wise batches under extreme non-IID partitions. A concrete definition of phi and a discussion of the validity of the Gaussian assumption are needed for the detection stage to be reproducible.","section":"Definition 1 and Eq. (9)"},{"comment":"The main performance comparison reports a single accuracy value per method/attack/setting without standard deviations or confidence intervals, while Table 4 shows that the authors do compute such statistics for the ablation. Given random client partitions, initialization, and attack sampling, single-run comparisons are insufficient to support the claim that TOFD 'consistently outperforms' all baselines, especially in cases where the margin to the second-best method is small. Multiple seeds with mean and standard deviation should be reported for the central comparison table.","section":"Table 2"},{"comment":"The default hyperparameters lambda = beta = 0.2 are chosen from Figure 7, which plots accuracy against these values, and this same default is then used in all other experiments. The authors should clarify whether the tuning was performed on a held-out validation split or on the test set, and whether the reported accuracies in Table 2 and Figures 3-6 are affected by this selection. If the tuning used test accuracy, the reported numbers are optimistically biased and the generalization claim needs to be qualified.","section":"Section 6.2.4 and Figure 7"},{"comment":"The adaptive-attack experiment shows that attackers who constrain perturbations inside the margin perturbation partially evade purification, and the text acknowledges that residual adversarial patterns accumulate through aggregation. This directly qualifies the earlier claim that MP 'disentangles adversarial behavior from benign non-IID variation.' The paper should state explicitly which of the central claims (high MSDR, high accuracy under composite attacks, or the convergence guarantee) remain valid under this partial-evasion regime, rather than implying that the defense is uniformly robust.","section":"Section 6.2.6"}],"minor_comments":[{"comment":"The display equation for Delta(S1,S2,k) is missing a closing period; also, the notation 'dist' is used without a definition, although it appears to refer to the 2-Wasserstein distance introduced in Eq. (3).","section":"Section 4.1, Eq. (5)"},{"comment":"The threshold formula is presented with a line break inside the parenthesized factor; please fix the typesetting so the expression is unambiguous. In addition, the definition of Q3,k and IQR_k as statistics over benign distances is correct, but the text should specify the sample size used to estimate these quantiles.","section":"Section 4.2, Eq. (10)"},{"comment":"Assumption 4 states that discard-induced deviation delta vanishes as the threshold tau_k tends to infinity, which is almost tautological: as tau_k grows, no samples are discarded. The assumption would be more meaningful if delta were defined explicitly in terms of the fraction of discarded benign samples and their distance from the retained distribution.","section":"Assumption 4"},{"comment":"The x-axis label appears as 'Value of / ' rather than specifying lambda and beta separately; please clarify which curve corresponds to which hyperparameter and whether the two are varied independently.","section":"Figure 7"},{"comment":"The non-IID parameter list '0.1, 0.5, 0.3, 1 (Default), 5' has 0.3 out of ascending order and is inconsistent with the values reported in Figure 5; please reconcile this list.","section":"Table 1"},{"comment":"The input line indexes smashed data as B^{(t)}_{i,k} with subscripts N,K but the loop over j is not defined; please align the notation with the problem setup in Section 3.1.","section":"Algorithm 1"}],"recommendation":"major_revision","confidential_remarks":"The paper is likely a strong candidate if the appendix with the convergence proof is provided and the feedback-loop issue in Eq. (11) is addressed. In its current form, the convergence claim is unverifiable because the proofs are absent, and the baseline-contamination concern is not merely stylistic: it directly affects the validity of the detection guarantee under the paper's own adaptive-attack results. I would also ask the editor to request code or, failing that, detailed hyperparameter and data-partition settings, since phi is not specified and the main comparison table has no error bars. The self-citation pattern (three papers by the same group, including two with overlapping authors) is not problematic by itself, but the authors should verify that all citations are necessary for the technical content."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know two things about TOFD up front: the empirical core is more careful than most SFL defense papers, and the convergence guarantee in the preprint is not actually checkable because the appendix is absent. The adaptive attack experiment is also the most honest part of the paper, because it shows the defense degrades when the attacker stays inside the margin perturbation.\n\nWhat's new: TOFD is the first SFL-specific defense I've seen that ties class-wise safe zones, a per-class purification threshold, and an adversarial guidance model into one pipeline. The components are standard outlier detection and KL-based decoupling, but the combination is tailored to the smashed-data checkpoint and the experiments back up each piece via ablations. Five datasets, non-IID sweeps, MSDR reporting, and a comparison against twelve baselines is solid work for a venue like ACM MM. The authors also don't oversell: they cite their own HealSplit and show TOFD beating it.\n\nThe real soft spot is the feedback loop the stress test identified. Eq. (11) updates the global class distribution P_G,k from Z+, which by construction contains any poisoned sample whose DCS lands below tau_k. Section 6.2.6 tells us such samples exist under the adaptive attack. So the baseline itself drifts toward the attack, and the bound in Lemma 2 treats alpha as a constant rather than modeling this contamination. The convergence theorem therefore doesn't cover the regime the paper claims robustness in. That doesn't sink the empirical claims, but it does mean the theory is weaker than presented.\n\nOther issues are smaller: the compression map phi is never specified; lambda and beta are tuned on the same benchmark suite; Table 2 has no error bars (the ablation table does, which is odd). The missing proof appendix should be public before this is reviewed.\n\nWho this is for: anyone working on split learning or FL poisoning defenses. It deserves a serious referee — send it out, but ask for the appendix, code, and an explicit treatment of baseline drift.","headline":"TOFD is a solid, architecture-aware SFL defense with strong empirical work, but the convergence proof is missing from the preprint and the baseline-drift feedback loop from undetected poisoned samples is a real unmodeled weakness.","tokens_in":15785,"tokens_out":1585,"would_cite":true,"duration_ms":16367,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"TOFD defends split federated learning by detecting poisoned smashed data at the server, filtering it per class, and decoupling residual attack influence.","keywords":["split federated learning","poisoning defense","feature decoupling","smashed data","adversarial guidance","non-IID data","outlier detection","Byzantine resilience"],"falsifier":"Run the adaptive attack of Section 6.2.6 with a stronger steering objective: perturb smashed data so that each sample's induced distributional consistency score stays inside the Margin Perturbation threshold while still flipping the model's predictions on the target class. If the malicious-sample detection rate collapses toward zero and test accuracy falls to the undefended baseline, the outlier-detection premise of the central claim is falsified.","tokens_in":14813,"feed_emoji":"🛡️","tokens_out":11370,"duration_ms":97597,"temperature":0.7,"pith_summary":"Split federated learning (SFL) moves intermediate representations, called smashed data, from clients to the server, and every common poisoning attack — data, weight, smashed, label, or a combination — has to distort those representations to hurt the model. TOFD claims this architectural fact can be turned into an early defense checkpoint: it builds per-class safe zones from historical distributions of benign smashed data, uses a Margin Perturbation threshold to distinguish malicious clients from merely non-IID benign ones, filters poisoned samples only within suspected classes, and then trains an adversarial guidance model whose decoupling loss suppresses any residual attack influence in server-side optimization. If the framework works as described, SFL would gain a low-overhead detection layer that preserves benign data diversity while guaranteeing convergence at the usual stochastic-gradient rate. The paper's experiments across five image datasets report over 92% accuracy under single attacks and over 83% under composite attacks in uniform settings, consistently ahead of existing defenses.","feed_headline":"Smashed-data checkpoint blocks poisoning in split federated learning","feed_subtitle":"Per-class safe zones and adversarial decoupling keep accuracy above 92% under single attacks, above 83% under composites.","key_machinery":"The load-bearing object is the per-class safe zone with its Margin Perturbation (MP) threshold: $\\mathrm{MP}_k$ is the largest distributional shift, measured in 2-Wasserstein distance on compressed class-wise Gaussians, caused by deleting any one benign client from class $k$'s safe zone, and it serves as the yardstick that separates benign non-IID variation from adversarial manipulation. Around it sit the class-calibrated purification threshold $\\tau_k$ (third quartile plus an IQR scaled by the min–max-normalized MP) and the adversarial guidance model $R$, which is fine-tuned on detected malicious smashed data and used in a decoupling loss $L_{\\mathrm{MFD}} = -\\mathbb{E}_{z\\in Z^-} \\mathrm{KL}\\big( f(z;R) \\,\\|\\, f(z;h_{\\theta_s}) \\big)$ so that the server model diverges from attack-induced feature patterns. The machinery is efficient because detection happens on compressed, per-class Gaussian statistics rather than raw high-dimensional features, and it is robust because the decoupling loss tolerates the poisoned samples that escape the filter.","core_discovery":"TOFD's central claim is that the split paradigm itself provides a reliable early checkpoint: because server-side optimization is driven directly by client-transmitted smashed data, all five classes of poisoning attacks manifest as class-wise statistical anomalies in that intermediate representation before reaching aggregation. The defense accordingly builds, for each class, an initial safe zone from the median and median absolute deviation of clients' 2-Wasserstein distances to the maintained global class distribution, then refines it with the Margin Perturbation (MP) — the maximum distributional shift produced by removing any single benign client from the zone — and re-admits suspicious clients whose distributional consistency score stays within it. Malicious clients' samples are then purified per class against a threshold built from the third quartile and an interquartile range scaled by the cross-class min–max-normalized MP, and a guidance model trained on the detected malicious features supplies a KL-divergence decoupling objective that pushes the server model away from attack-induced patterns. The paper asserts this three-stage pipeline preserves clean accuracy, keeps over 92% and 83% accuracy under single and composite attacks in uniform settings, and converges at rate $O(1/\\sqrt{T})$ plus a bias term bounded by the undetected-malicious fraction.","pith_inferences":["The diagonal-Gaussian assumption is the natural first place to probe: on class-conditional features that are multimodal or heavy-tailed, the covariance estimate and the Mahalanobis-style distance of Eq. (9) could mis-rank samples, so extending the MP calibration to non-parametric density estimates is a testable next step.","The framework predicts a concrete trade-off curve between detection rate and false-positive rate as data heterogeneity increases (safe zones widen, MP grows); a follow-up could measure that curve explicitly rather than only reporting average accuracy.","The min–max-normalized IQR threshold recipe is portable: any per-class anomaly score could be calibrated the same way, which may benefit federated-learning defenses beyond the split architecture.","Because the decoupling loss is trained on detected malicious features, an attacker who can pollute the negative set through false positives could in principle reverse the sign of the guidance; the paper does not test this adversarial-coupling scenario."],"forward_implications":["SFL can be defended without throwing away entire clients: only anomalous samples in suspected classes are filtered, so benign data contributed by malicious clients is still used.","Per-class threshold calibration, not a fixed global threshold, is what keeps benign non-IID clients from being misclassified as attackers, which is exactly the regime where adapted-FL defenses break down.","The adversarial guidance model converges into a stable module that can be re-used across rounds as a plug-and-play component of the server-side objective.","The convergence guarantee implies TOFD does not destabilize training: with stepsize $O(1/\\sqrt{T})$ the average gradient norm reaches the standard $O(1/\\sqrt{T})$ rate plus an error term that shrinks with the fraction of undetected malicious samples.","Fine-grained purification preserves data diversity, which explains why TOFD stays accurate under composite attacks such as DP+SP where coarse-grained defenses fall to near-random accuracy."],"supporting_citations":[{"why":"provides the modified Z-score with the 0.6745 constant used in the initial safe zone of Eq. (4).","marker":"[10]"},{"why":"documents the single-threshold outlier detection practice that TOFD's class-calibrated purification improves upon.","marker":"[1]"},{"why":"provides a dual-layer anomaly detection baseline whose fixed threshold the min–max-normalized IQR threshold replaces.","marker":"[4]"},{"why":"establishes the poisoning attack surfaces on smashed data in split FL that define the threat model and motivate interception at the server.","marker":"[28]"},{"why":"defines the SplitFed dual-aggregation setting that TOFD protects.","marker":"[26]"},{"why":"the SFL-specific defense baseline whose robustness and computational cost TOFD is designed to exceed.","marker":"[31]"},{"why":"canonical Byzantine-resilient aggregation baseline that represents the adapted-FL defenses the paper argues are insufficient.","marker":"[2]"},{"why":"another canonical robust aggregation baseline used in all comparisons, representing fixed-geometry defenses that fail under composite attacks.","marker":"[34]"},{"why":"trust-scoring model-validation baseline that does not inspect smashed data; part of the comparison set that motivates TOFD.","marker":"[3]"}],"fun_headline_variants":["Split learning defense decouples attack patterns early","TOFD blocks poisoning via class-wise safe zones","Feature decoupling thwarts poisoning in split federated learning","Early checkpoint in smashed data catches poison attacks","Robust split learning with target-oriented feature decoupling"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The framework assumes benign class-wise smashed data are well approximated by diagonal Gaussians after the compression step, that the historical global class distributions remain a trustworthy baseline, and that every poisoning attack moves the attacked class's distribution far enough outside the safe zone to be caught as an outlier; if any attack hides inside the zone, detection degrades.","fun_headline_variants_meta":{"raw":{"variants":["Split learning defense decouples attack patterns early","TOFD blocks poisoning via class-wise safe zones","Feature decoupling thwarts poisoning in split federated learning","Early checkpoint in smashed data catches poison attacks","Robust split learning with target-oriented feature decoupling"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000339,"raw_usage":{"total_tokens":1905,"prompt_tokens":1014,"completion_tokens":891,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":630,"completion_tokens_details":{"reasoning_tokens":818}},"tokens_in":630,"tokens_out":891,"duration_ms":8131,"temperature":1.0,"reasoning_tokens":818,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T11:16:01.020691+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the adaptive attack of Section 6.2.6 with a stronger steering objective: perturb smashed data so that each sample's induced distributional consistency score stays inside the Margin Perturbation threshold while still flipping the model's predictions on the target class. If the malicious-sample detection rate collapses toward zero and test accuracy falls to the undefended baseline, the outlier-detection premise of the central claim is falsified.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"provides a dual-layer anomaly detection baseline whose fixed threshold the min–max-normalized IQR threshold replaces."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"defines the SplitFed dual-aggregation setting that TOFD protects."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"the SFL-specific defense baseline whose robustness and computational cost TOFD is designed to exceed."}],"review_version":1}