{"id":"f9f631cf-2831-4efc-85d1-87df3a917ec4","arxiv_id":"2608.09328","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A shift design that maximizes the eavesdropper's final model error under a power constraint is derived for federated learning, with simulations showing better privacy than ModShift at 24% of its power.","lead":"This paper hides the global model of a federated learning system from an eavesdropper by adding carefully designed shifts to each agent's update before transmission. The shifts are chosen to maximize the final model deviation at the eavesdropper while respecting a transmission power limit, and the authors report lower power use than earlier shift or noise-based methods.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Unproved Proposition 2 is load-bearing; direct algebra suggests it holds, but the omitted convergence and tamper-test proofs keep the central claim conditional.","rationale":"I read the central claim as having two pillars: (i) the FIM singularity for the per-round update, and (ii) the resulting model shift that protects the global model. The reader's weakest assumption, Proposition 2, is indeed load-bearing: if δ^T ∇h were not zero, the FIM would gain an extra term and the singularity argument would not go through. However, applying the formulas in Proposition 3 directly shows the condition holds algebraically, so the concern is a gap in presentation rather than a demonstrated error. The paper's own text admits that the convergence and tamper-test results are omitted 'due to space limitations,' and these are central to the claims that Eve cannot detect the shifts and that the algorithm converges. Additionally, the simulations lack code, seeds, and error bars, making the reported 24% power figure hard to verify. These are addressable but real gaps, so the CONDITIONAL verdict remains appropriate. I do not see a fatal flaw in the core mathematics, so I do not recommend REJECT or a lower confidence; the paper should be revised to include the missing proofs and reproducible experimental details.","tokens_in":8176,"tokens_out":27355,"duration_ms":290839,"concrete_test":"Use symbolic differentiation (e.g., SymPy or Mathematica) to verify that δ^T ∇h ≡ 0 identically for γ_max and γ_min in Proposition 3, using the definitions in Eqs. (22)–(27). If the identity fails for any non-degenerate δ, then Proposition 2 is invalid and the FIM analysis breaks down; if it holds, the omitted proof is confirmed and attention shifts to the missing convergence and tamper-test proofs.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim depends on the eavesdropper's FIM remaining J = (2h_E^2/σ_E^2) S^T S when the shift is a nonlinear function h(δ). Proposition 2 asserts this holds if δ^T ∇h = 0, and Proposition 3 states that the closed-form γ_max and γ_min satisfy this condition. The paper gives no proof of Proposition 2, and the reader flagged this as the weakest assumption. However, an independent check of Eqs. (22)–(27) shows the condition is actually satisfied: writing D = ||u||^2||δ||^2 − (u^Tδ)^2 and χ = sqrt((α′−1)/D), one obtains ∇χ = −χ(Uδ − (u^Tδ)u)/D and δ^T∇h = 0 for both γ_max and γ_min for every non-degenerate δ. Thus the specific mathematical concern is true, though unproved. The remaining gap is more serious: the paper itself states that the new schemes 'are shown to pass a convergence test at the eavesdropper' and that the algorithm 'can be proven to converge,' but these proofs are explicitly omitted. The abstract's guarantee that the eavesdropper 'cannot learn the model' and the claimed advantage over noise injection rely on these unproved convergence and tamper-test properties. Without those results, and without code or error bars for the simulations, the central claim is not fully supported.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes a privacy mechanism, MaxModShift, for federated learning against an eavesdropper who observes all uplinks. Agents transmit shifted updates of the form δ_k(n) + γ_k(n)^T δ_k(n) u, with the shift designed so that the eavesdropper's per-round Fisher Information Matrix (FIM) for estimating δ_k(n) is singular, while Bob compensates for the shift through a low-rate secret channel. The design is formulated as a constrained optimization that maximizes the resulting model shift at Eve under a transmission-power constraint. Two closed-form shift rules, γ_max and γ_min, are derived via Lagrange multipliers, and the paper reports simulations comparing them with the authors' earlier ModShift and with Gaussian noise injection.","tokens_in":8512,"tokens_out":11267,"duration_ms":119451,"significance":"If fully established, the FIM-singularity approach to model privacy would be an attractive alternative to noise-injection defenses: it requires no gradient clipping, uses only a scalar secret channel per update, and gives an explicit closed-form shift satisfying a power constraint. The paper's strengths are the clean problem formulation, the closed-form Lagrange-multiplier solutions, and the direct comparison against both ModShift and noise injection. However, the significance is conditional: the main theoretical bridge (Proposition 2) is unproved, the convergence and tamper-test claims are explicitly deferred, and the empirical evidence is a single synthetic scenario without error bars or code. The idea is promising, but the manuscript as written does not yet fully support the advertised guarantees.","major_comments":[{"comment":"Proposition 2 states that the FIM of the observation model in Eq. (4) remains unchanged when γ_k(n)=h(δ_k(n)) satisfies δ^T ∇h = 0, but no proof is given. This is the key result that lets the nonlinear MaxModShift designs inherit the singularity condition of Proposition 1. A short derivation using ∇(h(δ)^T δ) = h(δ) + (∇h(δ))^T δ would settle it; as written, the central FIM result for the proposed schemes is not self-contained. Please add the proof, and also show explicitly that the closed-form γ_max and γ_min in Proposition 3 satisfy Eq. (9).","section":"Section IV, Proposition 2"},{"comment":"The paper asserts that the new schemes 'are shown to pass a convergence test at the eavesdropper' and that the algorithm 'can be proven to converge,' but explicitly defers these results to space limitations and to approaches in [13]. These properties are load-bearing: the abstract's claim that Eve 'cannot learn the model' presumes that the shift does not reveal itself through detectable non-convergence or abnormal trajectories, and the comparison with noise injection depends on the same tamper test. The tamper test itself is never simulated or proved. Please include the deferred proofs or substantially weaken the corresponding claims in the abstract and conclusions.","section":"Sections I and VII"},{"comment":"The empirical comparison is based on a single synthetic linear-regression run with no error bars, no multiple seeds, and no code release. The claims that MaxModShift (Min) gives a higher Eve loss for every α, that MaxModShift uses 24% of ModShift's power, and that noise injection fails the tamper test are all point estimates from one scenario. Please report means and variances over independent runs (and ideally a second dataset or architecture), or provide the code so the curves can be reproduced.","section":"Section VI, Figures 2 and 3"},{"comment":"The adversary model is underspecified regarding Eve's knowledge of the shift function. The FIM in Propositions 1 and 2 is the FIM for δ_k(n) in the observation model (4) with a known shift rule; if the eavesdropper does not know h(·), α, or the exact form of the design, then the estimation problem includes additional unknown parameters and the per-round FIM is not simply S^T S. The sentence 'we assume Eve knows u' does not clarify whether Eve knows h(·). Please state explicitly that the adversary knows the shift rule (a Kerckhoffs-style assumption), or analyze the unknown-shift case.","section":"Sections III-V"}],"minor_comments":[{"comment":"The denominator in the displayed condition appears to be a typo: '||u^2||||δ||^2' should most likely read '||u||^2||δ||^2'.","section":"Section V, Eq. (28)"},{"comment":"The expression 'γk(n) = h(δk(n)' is missing a closing parenthesis; it should read h(δ_k(n)).","section":"Section IV, Proposition 2"},{"comment":"In the inequality preceding P1, the replacement of σ_max^2(S_k(n)) by ||u||^2||h||^2 uses the fact that max(1, ||u||^2||h||^2) = ||u||^2||h||^2 when α' ≥ 1. Please state this condition at the point of the inequality, since it is otherwise not obvious and is needed for the claimed implication from P1's constraint to Eq. (12).","section":"Section V, power constraint derivation"},{"comment":"The legends and captions use 'MaxModShift (Max)', 'MaxModShift (Min)', and 'Max scheme' with similar names; please define each scheme unambiguously in the caption and in the text, and check for the duplicated word 'than than' in the third paragraph.","section":"Section VI, Figures 2 and 3"}],"recommendation":"major_revision","confidential_remarks":"The paper leans heavily on the authors' own prior results [13], [16], and [21], particularly for the singular-value identity and the FIM computation. For journal publication, those results should either be publicly available or proved within the manuscript; the current dependence makes independent verification difficult. The core idea is sound and the closed-form designs are interesting, but the omitted proofs and the thin empirical evaluation justify a major revision rather than acceptance at this stage."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short take: this is a real but incremental extension of the authors' own ModShift line, and the new design-level math is the strongest part. The paper's core claim is that by picking shifts h(δ) satisfying h^T u = -1, ||h||^2 = α/(1+||u||^2), and δ^T∇h = 0, the eavesdropper's per-round FIM stays singular while the accumulated model shift is maximized under a power constraint. Proposition 3 gives two closed-form designs, γ_max and γ_min, and the stress-test algebra confirms the δ^T∇h = 0 condition holds for both for every non-degenerate δ. That check matters, because it means the FIM singularity argument is not quietly broken; it was just left unproved in the paper.\n\nWhat's genuinely new is the constrained optimization over shift functions and the power comparison: MaxModShift beats ModShift at about 24% of the transmission power and beats noise injection with lower secret-channel bandwidth. These are legitimate engineering contributions, and the comparison to noise injection is fair in that it biases power in the noise scheme's favor and still reports worse Eve loss.\n\nThe soft spots are where the reader put them. Proposition 2 is stated without proof; the convergence test and tamper-test proofs are explicitly deferred to 'space limitations'; and the singular-value identity from [16] that converts the power constraint is self-cited rather than re-derived. The simulations are one synthetic linear regression setup, no error bars, no code. These are addressable rather than fatal. The abstract's 'cannot learn the model' overstates what an unproved convergence property supports.\n\nI don't think the circularity burden is severe. The optimization objective is analytic, not fitted to Eve's loss, and the baselines are external. The self-citations are to the authors' prior work and are used as lemmas; that's acceptable practice, though the paper would be stronger with concise re-derivations.\n\nWho is this for? Researchers working on model privacy against passive eavesdroppers in federated learning, especially those who care about power and secret-channel budgets. A serious referee should see it, but the revision needs the omitted proofs and reproducibility artifacts before the central claim is trustworthy.","headline":"Plausible incremental extension of the authors' ModShift with closed-form shift designs; the FIM condition holds on direct check, but omitted proofs and thin simulation leave the main privacy claim conditional.","tokens_in":8981,"tokens_out":2702,"would_cite":false,"duration_ms":26788,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"In federated learning, designed nonlinear shifts of model updates can drive an eavesdropper's Fisher Information Matrix to singularity, preventing her from learning the global model while maximizing the model shift under a power constraint.","keywords":["federated learning","model privacy","Fisher Information Matrix","eavesdropper","designed shifts","MaxModShift","ModShift","transmission power"],"falsifier":"Run FedAvg on a real dataset, record every local update δ_k(n), and at each round compute the determinant of the eavesdropper's Fisher Information Matrix J(δ) = (2 $h_E^{2}$ / $σ_E^{2}$)(I + u h(δ)^T)^T (I + u h(δ)^T) using the proposed h; if the determinant is positive in any round, the matrix is not singular and the paper's privacy guarantee for that round does not hold.","tokens_in":7996,"feed_emoji":"🕵️","tokens_out":5606,"duration_ms":57079,"temperature":0.7,"pith_summary":"This paper argues that an eavesdropper who sees every uplink in a federated learning system can be stopped from learning the global model if agents transmit carefully designed shifts of their model updates. The central claim is that choosing a shift function h(δ) satisfying h^T u = -1 and δ^T ∇h = 0 keeps the eavesdropper's Fisher Information Matrix singular, while the accumulated model drift is maximized under a transmission power constraint. The resulting scheme, MaxModShift, is shown in simulations on a linear regression FedAvg problem to leave Eve with a higher final loss than the prior ModShift design and a noise injection baseline, while requiring about 24% of ModShift's average transmission power. If the claim holds, model privacy can be achieved without relying on large power overhead or a high-bandwidth secret channel.","feed_headline":"Designed shifts blind an eavesdropper in federated learning","feed_subtitle":"MaxModShift makes the eavesdropper's Fisher information singular while using a quarter of ModShift's power.","key_machinery":"The central object is the shift vector h(δ), a nonlinear function of each agent's local model update δ, chosen so that the eavesdropper's Fisher Information Matrix J(δ) = (2 $h_E^{2}$ / $σ_E^{2}$)(I + u h(δ)^T)^T (I + u h(δ)^T) remains singular. The singularity condition h^T u = -1 is preserved under the orthogonality condition δ^T ∇h = 0, and the power constraint ||h||^2 = α/(1 + ||u||^2) is enforced through a Lagrange multiplier solution that gives explicit formulas for γ_max and γ_min. These shifts are designed to maximize the model drift observed by Eve, which the paper links to a lower bound on Eve's loss through strong convexity.","core_discovery":"The paper's central discovery is a parameterized shift design that makes the eavesdropper's estimation problem statistically hard while actively enlarging the gap between the model she recovers and the true global model. For the observation model y_k^E = δ_k + γ_k^T δ_k u + z, the Fisher Information Matrix is J(δ) = (2 $h_E^{2}$ / $σ_E^{2}$) S^T S with S = I + uγ^T, and it is singular exactly when γ^T u = -1. The paper generalizes this by letting γ = h(δ), a nonlinear function of the local update, and shows the same FIM singularity holds when δ^T ∇h = 0. MaxModShift then solves a per-agent optimization that maximizes h^T δ subject to h^T u = -1 and ||h||^2 = α/(1 + ||u||^2), yielding closed-form maximizer and minimizer shifts. Simulations show both variants make Eve's final loss exceed that of ModShift and noise injection, with the MaxModShift (Min) variant performing best, while the average required power is about 24% of ModShift's.","pith_inferences":["A testable extension is to run MaxModShift on nonconvex models such as neural networks, where the δ trajectory may not satisfy δ^T ∇h = 0 at every round; if the condition fails, the FIM singularity and the privacy guarantee would need re-examination.","The paper leaves open a greedy per-round choice between γ_max and γ_min based on the angle between δ and u; such an adaptive choice could further increase Eve's drift without changing the power budget.","The reported power advantage is measured under a particular definition of average power Pavg; in practice, the secret-channel scalars may impose latency or bandwidth costs that a deployment would need to weigh separately.","A natural comparison is to measure Eve's final loss against the theoretical lower bound from strong convexity, which would indicate how much of the observed privacy gain is due to the singularity versus the magnitude of the drift."],"forward_implications":["If the design works as claimed, an eavesdropper who intercepts all uplink communications in a FedAvg system cannot estimate the global model, because the Fisher Information Matrix at each round is singular.","Model privacy can be achieved with substantially less transmission power than the earlier ModShift scheme, since MaxModShift uses about 24% of ModShift's average power in the reported simulations.","MaxModShift also outperforms a noise injection baseline that is inspired by differential privacy, giving Eve a lower final loss while requiring less bandwidth on the secret channel and lower average power.","Because the design makes no assumption about how gradients are generated, the same shift construction can be adapted to other federated or distributed optimization methods beyond FedAvg.","The paper's convergence and tamper-test claims imply that the eavesdropper would not be able to detect the presence of the shifts, making the privacy mechanism harder to reverse-engineer."],"supporting_citations":[{"why":"Supplies the Fisher Information Matrix formula and the singularity condition γ^T u = -1 for the shift observation model.","marker":"[21]"},{"why":"Defines the prior ModShift scheme that MaxModShift generalizes and improves upon in the simulations.","marker":"[13]"},{"why":"Provides the singular value identity σ_max^2(S) = max(1, ||u||^2 ||γ||^2) used to convert the power constraint into the closed-form shift design.","marker":"[16]"},{"why":"Specifies the FedAvg algorithm used as the exemplar federated learning scheme throughout the paper.","marker":"[17]"},{"why":"Motivates the noise injection baseline from differential privacy that MaxModShift is compared against.","marker":"[5]"}],"fun_headline_variants":["Blind Eve with designed shifts in federated learning","Singular Fisher info stops eavesdroppers in federated learning","MaxModShift: quarter the power, blind the eavesdropper","Designed shifts make eavesdropper's Fisher matrix singular","MaxModShift: lower power, higher privacy than ModShift"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole argument depends on the shift function h(δ) satisfying δ^T ∇h = 0 at every δ that the FedAvg trajectory produces; the paper states Proposition 2 without proof, and this condition is what keeps the eavesdropper's Fisher Information Matrix singular, so if any encountered δ violates it the privacy guarantee no longer follows.","fun_headline_variants_meta":{"raw":{"variants":["Blind Eve with designed shifts in federated learning","Singular Fisher info stops eavesdroppers in federated learning","MaxModShift: quarter the power, blind the eavesdropper","Designed shifts make eavesdropper's Fisher matrix singular","MaxModShift: lower power, higher privacy than ModShift"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000617,"raw_usage":{"total_tokens":2837,"prompt_tokens":892,"completion_tokens":1945,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":508,"completion_tokens_details":{"reasoning_tokens":1861}},"tokens_in":508,"tokens_out":1945,"duration_ms":12617,"temperature":1.0,"reasoning_tokens":1861,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T19:19:04.998141+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run FedAvg on a real dataset, record every local update δ_k(n), and at each round compute the determinant of the eavesdropper's Fisher Information Matrix J(δ) = (2 $h_E^{2}$ / $σ_E^{2}$)(I + u h(δ)^T)^T (I + u h(δ)^T) using the proposed h; if the determinant is positive in any round, the matrix is not singular and the paper's privacy guarantee for that round does not hold.","supporting_citations":[{"cited_title":"Block modshift: Model priva cy via dynamic designed shifts,","cited_arxiv_id":null,"evidence_quote":"Supplies the Fisher Information Matrix formula and the singularity condition γ^T u = -1 for the shift observation model."},{"cited_title":"Modshift: Model privacy via designed shifts,","cited_arxiv_id":null,"evidence_quote":"Defines the prior ModShift scheme that MaxModShift generalizes and improves upon in the simulations."},{"cited_title":"Block mo dshift: Model privacy via dynamic designed shifts,","cited_arxiv_id":null,"evidence_quote":"Provides the singular value identity σ_max^2(S) = max(1, ||u||^2 ||γ||^2) used to convert the power constraint into the closed-form shift design."}],"review_version":1}