{"id":"435c9480-6b01-49ab-ac7d-5e87b588c2b0","arxiv_id":"2608.09314","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Label-flipping and oversampling attacks on federated conditional GANs shift the generated target-class distribution toward the source class linearly in poisoning strength while only quadratically changing the true target distribution, making the attack hard to detect from aggregate metrics.","lead":"This paper studies how malicious participants in a federated learning system can corrupt a shared image generator by secretly changing image labels and upweighting the poisoned samples. The authors show that this attack damages the generator's output for the targeted class while leaving overall quality scores almost unchanged, making it hard to detect.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The linear/quadratic theory is proved for a training-label mixture, not for the trained generator; the paper never establishes that a federated cGAN converges to Eq. (1), and the experiments do not test the quantitative mixture prediction.","rationale":"The reader's weakest_assumption identifies the same load-bearing gap: Eq. (1) is assumed, not derived, and the empirical trends are consistent with many alternative mechanisms. My reading strengthens this concern by noting that the empirical KL curves are not merely missing error bars; their quantitative shape is inconsistent with the exact mixture prediction (the quadratic coefficient is not stable, and the low-beta points are often non-monotonic), so the experiments do not provide independent support for the specific mixture model. Nevertheless, the qualitative phenomenon that label flipping moves the target generator toward the source and leaves aggregate FID nearly flat is plausibly real and worth conditional acceptance pending a direct test of the mixture equivalence. The reader's CONDITIONAL verdict already reflects this uncertainty, so my recommendation is UNCHANGED. I do not see a basis for REJECT because the paper contains a clear, falsifiable prediction and a reproducible experimental protocol; the gap is in the theoretical derivation and in the strength of the empirical confirmation, both of which are addressable in revision.","tokens_in":15642,"tokens_out":6341,"duration_ms":76622,"concrete_test":"Train the federated cGAN exactly as in Section 6.2 for a fixed nontrivial beta (e.g., beta = 0.5 on FEMNIST, s=3, t=2). Draw a large sample from the generator conditioned on t, extract HOG features, and compare the result directly to the mixture (1 - beta) Q_t + beta Q_s, where Q_t and Q_s are HOG feature distributions of real target and source data, using a two-sample test with a fixed kernel (e.g., MMD) or a held-out classifier. If the generator distribution is not statistically indistinguishable from the mixture, then Eq. (1) is rejected, and the lemmas do not describe the attack. As a secondary check, compute the empirical ratios KL(P_t || gen_t)/beta^2 at beta = 0.3, 0.5, 0.7; if they vary by more than sampling error, the claimed quadratic law fails quantitatively.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central result, Lemmas 5.1 and 5.2, is a statement about the mixture P_tilde_t = (1 - beta) P_t + beta P_s: given that mixture, the KL expansions follow by calculus. The only link from the attack to this mixture is the paragraph 'Justifying Delta,' which computes the effective label distribution in the pooled training data. But the trained conditional generator's output is never shown to equal that label mixture. GANs do not in general converge to the empirical class-conditional distribution, especially with a projection discriminator, where label-feature alignment can induce non-convergence, mode collapse, or other fixed points that are not convex mixtures of the true class conditionals. The paper explicitly assumes this equivalence in Eq. (1) without deriving it from the GAN objective or FedAvg dynamics, and the Limitations section does not flag this gap. The experiments do not close the gap: they estimate KL(P_s || generator_t) and KL(P_t || generator_t) from generator samples, but any monotone shift of the target generator toward the source would produce similar qualitative trends. The quantitative predictions are not tested: no comparison of the linear slope to chi^2, no goodness-of-fit for the beta^2 law, and no direct test that the target generator's distribution equals (1 - beta)P_t + beta P_s. In fact, the reported ratios KL(P_t || generator_t)/beta^2 in Tables 1 and A.4 vary by factors of 4-5 over the beta range, which is hard to reconcile with the claimed exact mixture. The central claim that the attack is effective yet hard to detect rests on this unverified identification.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies targeted label-flipping and oversampling attacks on federated conditional GANs. It defines an effective poisoning strength beta and assumes that the poisoned target class-conditional generator distribution is the convex mixture P_tilde_t = (1-beta)P_t + beta P_s (Eq. (1)). Under this assumption, it proves two KL-divergence expansions: the source-to-poisoned-target KL decreases linearly in beta (Lemma 5.1), while the true-target-to-poisoned-target KL grows only quadratically (Lemma 5.2), giving an asymmetry between semantic damage and detectability. The authors report experiments on FEMNIST, MNIST, and CIFAR-10 with KL estimates from generator samples and aggregate/target FID values, claiming qualitative confirmation of the linear/quadratic laws.","tokens_in":15934,"tokens_out":7370,"duration_ms":76882,"significance":"If the main premise is granted, the paper identifies a clean and mechanistically interpretable vulnerability: a data-only attack can corrupt a chosen class-conditional distribution while leaving label-agnostic metrics nearly unchanged. The mathematical core given Eq. (1) is correct and clearly presented, with full proofs in Appendix B and a useful general confusion-matrix extension. However, the significance is conditional on Eq. (1) being an accurate description of what a trained federated cGAN actually produces, and that link is not established. The empirical validation is qualitative, lacks uncertainty quantification, and contains non-monotonic rows that are hard to reconcile with the predicted monotone laws. The paper could become a solid contribution if the mixture assumption is either derived from the training dynamics or directly tested, and if the empirical claims are made quantitative with repeated seeds and fits.","major_comments":[{"comment":"The central theoretical result is conditional on Eq. (1), which is asserted rather than derived. The 'Justifying Delta' paragraph computes the effective label distribution in the pooled training data, but it does not show that the trained generator's class-conditional output equals this mixture. GAN training, especially with a projection discriminator, need not converge to the empirical class-conditional mixture: non-convergence, mode collapse, or label-feature misalignment can produce fixed points outside the family (1-beta)P_t + beta P_s. Since Lemmas 5.1 and 5.2 are Taylor expansions of the assumed mixture, the linear/quadratic asymmetry is a property of Eq. (1) rather than an emergent consequence of federated cGAN training. The Limitations section does not flag this gap. To support the paper's claims, the authors would need either a derivation of Eq. (1) from the cGAN objective under FedAvg or an explicit empirical test that the trained target conditional is the mixture (1-beta)P_t + beta P_s.","section":"Section 5, Eq. (1) and 'Justifying Delta' paragraph"},{"comment":"The empirical evaluation does not test the quantitative predictions. The KL estimates are compared only by eye to 'approximately linear' and 'approximately quadratic'; no slope is estimated from the data, no chi-squared value is computed, and no goodness-of-fit test is reported. The data also contain non-monotonic rows inconsistent with the predictions: in Table 3, simple flipping on FEMNIST at beta=0.0909 gives KL(P_s||P_tilde)=222.87, above the beta=0 baseline of 220.99, and KL(P_t||P_tilde) falls from 39.87 at beta=0.0909 to 22.97 at beta=0.1667, contradicting a quadratic increase. The ratio KL(P_t||P_tilde)/beta^2 varies by a factor of roughly 4-5 over the beta range (e.g., MNIST Table 4: 18.42/0.0909^2 is about 2229, while 11.74/0.1667^2 is about 422), so the claimed beta^2 law is not supported at the stated precision. No error bars, seeds, or repeated runs are reported, so the significance of the observed trends cannot be assessed.","section":"Section 6.3-6.4, Tables 1, 3-5"},{"comment":"The claim that aggregate FID is insensitive to the attack because the per-class deviation is 'diluted by ~1/C' is not justified. FID is not an average of per-class conditional FIDs; it is computed from the mean and covariance of pooled deep feature vectors, so the dilution argument needs a derivation or a direct empirical check. Moreover, Table 2 reports single FID values without confidence intervals, and the 'less than 6%' movement is not statistically characterized. Since the conclusion that the attack is hard to detect from label-agnostic metrics is one of the paper's two main claims, this needs quantitative support, such as multiple seeds, a distribution of aggregate FID under attack versus benign training, or a derived bound on the aggregate FID shift.","section":"Section 6.4, Table 2 and the 'diluted by ~1/C' claim"}],"minor_comments":[{"comment":"The beta values in the tables are not reproducible from the described setup: the formula beta = alpha p r Pi_s / (Pi_t + alpha p r Pi_s) requires the class priors Pi_s and Pi_t, which are not reported and are not well-defined under client-specific non-IID Dirichlet partitions.","section":"Section 6.1 and Tables 3-5"},{"comment":"The instruction to upweight all source samples by r (not only flipped ones) is not reflected in Delta = alpha p r Pi_s, which counts only flipped samples; for p < 1 the unflipped source mass enters the source class pool but is absent from the model. All experiments use p=1, so the discrepancy does not affect the reported numerical results, but the algorithm and theory should be aligned.","section":"Algorithm 1, line 7"},{"comment":"The regularity assumptions (A1)-(A3) on shared support and bounded likelihood ratios are stated but not verified for the image distributions used in the experiments; the KL estimates are computed on HOG features, while the expansions are for distributions on images, so the connection between the theoretical and measured quantities is not made explicit.","section":"Appendix B.5"},{"comment":"The manuscript still contains ACM template artifacts, including the 2018 copyright line, placeholder conference name and DOI, and 'Conference acronym 'XX', and some reference dates are inconsistent; these should be cleaned before publication.","section":"Front matter and references"}],"recommendation":"major_revision","confidential_remarks":"This is close to a reject/major-revision borderline. The mathematical derivations are sound conditional on Eq. (1), but the paper's central claim is that the attack shifts the actual trained generator's conditional distribution in the predicted way, and that link is neither derived nor quantitatively tested. If the authors can either justify Eq. (1) from the training dynamics or substantially reframe the claims as 'under the mixture assumption' and add direct mixture tests with repeated seeds and error bars, the paper could be publishable. I would also ask the editor to weigh whether the current overclaiming in the abstract and introduction is acceptable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper makes a clean, if narrow, contribution: it formulates targeted label flipping—plus an oversampling variant—against federated conditional GANs and derives KL expansions showing semantic damage (KL from source) drops linearly in the poisoning strength beta, while the deviation from the true target distribution rises quadratically. Given the assumed mixture P_tilde_t = (1-beta) P_t + beta P_s, the lemmas are correct, and the asymmetry is a genuinely useful observation. The empirical results on FEMNIST, MNIST, and CIFAR-10 qualitatively match the predicted trends, and Table 2 shows aggregate FID staying nearly flat while target-class FID rises—exactly the detection-blindness claim.\n\nWhat is actually new is the application of data-only label flipping to the federated cGAN setting and the beta-based parameterization that unifies the flip probability, oversampling factor, adversarial fraction, and priors. The oversampling variant is a natural extension, and the paper is honest about its bounded-likelihood-ratio assumptions.\n\nThe soft spot is load-bearing: Eq. (1) is an assumption, not a consequence. The entire theory is about the training-label mixture; the paper never shows that a trained federated cGAN converges to that mixture. With a projection discriminator, label-feature entanglement, mode collapse, and non-convergence can all break the identification. The paragraph 'Justifying Delta' computes the pooled label distribution in the training data, which is not the same as the generator's output distribution. The Limitations section does not flag this gap.\n\nThe experiments don't close it. They estimate KLs on generator samples, but any monotone shift toward the source would produce similar qualitative shapes. There is no test of the quantitative mixture prediction: no comparison of the linear slope to chi^2, no fit of the beta^2 law, and no goodness-of-fit for the exact mixture. The reported ratios KL(P_t || generator_t)/beta^2 vary by factors of 4-5 over the beta range, which is hard to square with the claimed exact mixture. There are also no error bars or seeds, and the source-target pairs are chosen to be confusable, which is the favorable case for the attacker. Some rows are non-monotonic, e.g., FEMNIST simple flipping at beta=0.091.\n\nThese issues are addressable. A revision that directly tests the mixture assumption—e.g., by comparing generator samples to the predicted mixture at several betas—and reports repeated runs with error bars would make the central claim much more convincing. The core idea is not wrong, just not yet tied to what GANs actually do.\n\nFor whom: researchers in federated learning security and anyone building defenses for federated generative models. It deserves a serious referee, not a desk reject. I'd send it to review with a request for major revision, and I'd want the mixture-identification gap addressed before accepting.","headline":"A clean Taylor-expansion story about label-flipping attacks on federated cGANs, but the load-bearing assumption that the trained generator equals the poisoned training-label mixture is never verified, and the experiments are too coarse to close that gap.","tokens_in":16501,"tokens_out":3484,"would_cite":true,"duration_ms":34945,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Targeted label flipping in federated conditional GANs shifts a chosen class-conditional output toward the source class at a rate linear in the poisoning strength, while the deviation from the true target distribution grows only…","keywords":["federated learning","conditional GAN","label flipping","oversampling attack","poisoning attack","KL divergence","class-conditional distribution","projection discriminator"],"falsifier":"Estimate the generator's actual target-class conditional distribution at several values of $\\beta$ (for instance by drawing samples and computing density estimates or using a classifier to measure the source fraction), and test whether it matches $(1-\\beta)P_t + \\beta P_s$; if $\\mathrm{KL}(P_s \\| \\widetilde P_t)$ does not decrease linearly in $\\beta$, or if the generator's output deviates from the mixture, the central claim fails. A sharper test repeats the experiment with a concatenation-based conditional GAN instead of a projection discriminator, since the paper's mechanism relies on the label-feature inner product of the projection head.","tokens_in":15394,"feed_emoji":"🎯","tokens_out":9708,"duration_ms":85415,"temperature":0.7,"pith_summary":"This paper claims that a data-only attack on a federated conditional GAN—malicious clients relabel a fraction of source-class samples to the target label and optionally upweight them—distorts the target class toward the source class at a rate that is linear in an effective poisoning strength $\\beta$, while the deviation of the target class from its true distribution grows only quadratically in $\\beta$. Concretely, the poisoned target distribution is modeled as $\\widetilde P_t = (1-\\beta)P_t + \\beta P_s$, with $\\beta = \\Delta/(\\Pi_t+\\Delta)$ and $\\Delta = \\alpha p r \\Pi_s$, where $\\alpha$ is the fraction of adversarial clients, $p$ the flip probability, $r$ the oversampling factor, and $\\Pi_s,\\Pi_t$ the class priors. Under this mixture, $\\mathrm{KL}(P_s \\| \\widetilde P_t)$ decreases linearly and $\\mathrm{KL}(P_t \\| \\widetilde P_t)$ increases quadratically, an asymmetry the authors verify with non-parametric KL estimates on FEMNIST, MNIST, and CIFAR-10. The paper further reports that aggregate FID moves by less than six percent even at $\\beta \\approx 0.83$, meaning the attack is effective yet hard to detect from label-agnostic metrics. If the claim is right, defending federated conditional generators requires monitoring class-conditional statistics rather than aggregate generation quality.","feed_headline":"Label flips corrupt federated GANs at linear rate, evade FID","feed_subtitle":"Damage to the target class grows linearly while detection signals grow quadratically across three image benchmarks.","key_machinery":"The load-bearing object is the mixture identity of Eq. (1), $\\widetilde P_t = (1-\\beta)P_t + \\beta P_s$, together with the definition of the effective poisoning strength $\\beta = \\Delta/(\\Pi_t+\\Delta)$, $\\Delta = \\alpha p r \\Pi_s$, which folds the adversarial fraction, flip probability, oversampling factor, and class priors into one scalar. The proofs are Taylor expansions of the log-likelihood ratio around $\\beta=0$; the linear coefficient in $\\mathrm{KL}(P_s \\| \\widetilde P_t)$ turns out to be the negative Pearson chi-squared divergence $\\chi^2(P_s \\| P_t)$, and the vanishing first-order term in $\\mathrm{KL}(P_t \\| \\widetilde P_t)$ follows from $\\int P_s = \\int P_t = 1$. The same expansion, applied to the general mixture $\\widetilde P_t = (1-\\beta_t)P_t + \\beta_t \\bar P_{-t}$ with contamination profile $\\pi_{\\cdot|t}$, yields the multi-source results of Appendix B, where the second-order term is governed by $\\chi^2(\\bar P_{-t} \\| P_t)$ and is convex in the contaminating mixture.","core_discovery":"The paper's central claim is that the class-conditional output of a federated conditional GAN trained under targeted label flipping is the mixture $\\widetilde P_t = (1-\\beta)P_t + \\beta P_s$, with $\\beta = \\Delta/(\\Pi_t+\\Delta)$ and $\\Delta = \\alpha p r \\Pi_s$, so that the effective poisoning strength $\\beta$ subsumes every attack knob. From this mixture, Lemma 5.1 gives $\\mathrm{KL}(P_s \\| \\widetilde P_t) = \\mathrm{KL}(P_s \\| P_t) - \\beta\\,\\chi^2(P_s \\| P_t) + O(\\beta^2)$, and Lemma 5.2 gives $\\mathrm{KL}(P_t \\| \\widetilde P_t) = \\frac{\\beta^2}{2}\\chi^2(P_s \\| P_t) + O(\\beta^3)$, where $\\chi^2$ is the Pearson chi-squared divergence. The first-order term in the target deviation vanishes because the mixture contains $P_t$ itself, so to leading order the poisoned generator looks like the true target even though it has already collapsed substantially toward the source. Oversampling enters only through $\\beta$, which is why the two attack variants coincide analytically at matched $\\beta$. The appendix generalizes the expansion to arbitrary confusion matrices and shows that spreading contamination across source classes can shrink the second-order detection signal even further.","pith_inferences":["The mixture form (1) is a modeling assertion, so an immediate next step is to fit the mixture to real generator samples and measure the residual; if the residual grows with $\\beta$, the linear/quadratic gap would narrow accordingly.","Because the asymmetry is a property of the mixture objective, not of GAN training specifically, conditional diffusion or autoregressive models trained on the same relabeled data would likely inherit the same linear damage and quadratic detectability profile.","The source class itself loses training mass as its samples are relabeled, so a defender could monitor source-class degradation as a second detection channel; the paper does not test this.","Since $\\beta$ is proportional to the source prior $\\Pi_s$, rare source classes give the attacker more leverage per flipped sample, suggesting minority classes are the natural targets and per-class prior monitoring is a cheap defense signal."],"forward_implications":["If the generator converges to the mixture $(1-\\beta)P_t + \\beta P_s$, then the attacker can make the target class output resemble the source class at a rate linear in $\\beta$, while the deviation of the target class from its true distribution grows only as $\\beta^2$.","Oversampling by a factor $r$ amplifies the attack purely by increasing $\\beta$, so at matched $\\beta$ the oversampling and simple-flip attacks produce the same class-conditional distortion; the operational difference is that oversampling reaches large $\\beta$ with fewer adversarial clients.","Label-agnostic aggregate metrics such as FID are structurally insensitive: even at $\\beta \\approx 0.83$ the aggregate FID moves by less than 6% on FEMNIST and CIFAR-10, while the target-class FID grows roughly quadratically.","A defender who does not know the source-target pair must effectively scan $C(C-1)$ ordered pairs, which reduces to a label-agnostic per-pair check whose noise overwhelms the linear-in-$\\beta$ signal (per the paper's discussion).","Spreading contamination across multiple source classes can further suppress the second-order detection term, because the chi-squared divergence to the target is convex in the contaminating mixture (Appendix B)."],"supporting_citations":[{"why":"Supplies the FedAvg aggregation rule whose sample-size-weighted averaging yields the mixture coefficients in Eq. (1).","marker":"[16]"},{"why":"Defines the projection discriminator architecture whose label-feature inner product is directly perturbed by label flipping.","marker":"[18]"},{"why":"Provides the non-parametric k-nearest-neighbor KL estimator used to measure the predicted divergences empirically.","marker":"[19]"},{"why":"Defines conditional GANs, the class-conditional generation setup that the attack targets.","marker":"[17]"},{"why":"Establishes the GAN adversarial training framework underlying the federated conditional generator.","marker":"[8]"},{"why":"Supplies the FEMNIST benchmark with a natural per-writer non-IID partition used in the experiments.","marker":"[4]"},{"why":"Supplies the CIFAR-10 dataset used to validate the predicted divergence behavior on natural images.","marker":"[13]"},{"why":"Supplies the MNIST dataset used to validate the predicted divergence behavior on handwritten digits.","marker":"[14]"}],"fun_headline_variants":["Federated GAN label flips: linear damage, quadratic detection","GAN poisoning attacks: damage grows linearly, detection quadratically","Label-flip GAN attack: linear harm, quadratic red flags","Federated GAN attack: harm scales linearly, signal quadratically"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The analysis assumes the trained federated cGAN's target-class output exactly equals the corrupted training-label mixture $(1-\\beta)P_t + \\beta P_s$, an equality the paper asserts rather than derives from GAN optimization or FedAvg dynamics.","fun_headline_variants_meta":{"raw":{"variants":["Federated GAN label flips: linear damage, quadratic detection","GAN poisoning attacks: damage grows linearly, detection quadratically","Label-flip GAN attack: linear harm, quadratic red flags","Federated GAN attack: harm scales linearly, signal quadratically"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000281,"raw_usage":{"total_tokens":1703,"prompt_tokens":1024,"completion_tokens":679,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":640,"completion_tokens_details":{"reasoning_tokens":602}},"tokens_in":640,"tokens_out":679,"duration_ms":7040,"temperature":1.0,"reasoning_tokens":602,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T19:31:34.750345+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Estimate the generator's actual target-class conditional distribution at several values of $\\beta$ (for instance by drawing samples and computing density estimates or using a classifier to measure the source fraction), and test whether it matches $(1-\\beta)P_t + \\beta P_s$; if $\\mathrm{KL}(P_s \\| \\widetilde P_t)$ does not decrease linearly in $\\beta$, or if the generator's output deviates from the mixture, the central claim fails. A sharper test repeats the experiment with a concatenation-based conditional GAN instead of a projection discriminator, since the paper's mechanism relies on the label-feature inner product of the projection head.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the non-parametric k-nearest-neighbor KL estimator used to measure the predicted divergences empirically."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the MNIST dataset used to validate the predicted divergence behavior on handwritten digits."}],"review_version":1}