REVIEW 4 major objections 3 minor 21 references
Detectability Thresholds for Network Attacks on Static Graphs and Temporal Networks: Information-Theoretic Limits and Nearly-Optimal Tests
T0 review · 4 major / 3 minor · reviewed 2026-08-04 · deepseek-v4-flash
Pith's one-line read Attack detection in networks turns on one balance: accumulated signal must exceed log n.
desk verdict Central threshold is wrong: the search penalty is log(n choose k), not log n, so the paper's main formulas fail for growing k (planted clique alone refutes them). read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The organizing identity is the comparison between accumulated information and search complexity: k²·χ² for static graphs and T·I for temporal streams, each balanced against a log n penalty for the unknown attacked set S. The achievability side uses the non-backtracking (Hashimoto) operator—whose spectral energy suppresses backtracking walk noise in sparse graphs—through a pruned power iteration that localizes the top-k coordinates; and the CUSUM recursion G_S(t)=max_{s≤t}(Λ_S(t)−Λ_S(s)) over candidate supports, which converts per-edge log-likelihood information into a near-optimal detection delay.
What would settle it
Simulate the static model with n=10⁵, k=5000, p=0.01 and set Δ so that k²·χ² = 2·log n. If a well-calibrated non-backtracking spectral scan does not approach power 1, the compact log n threshold is too low for large k; if it does, the boundary holds.
Extended reading notes
Core claim
The paper claims that under two canonical observation models—a static Erdős–Rényi graph with a planted attacked subset, and a temporal Poisson or Hawkes interaction stream—reliable detection is controlled by the same balance: accumulated information must exceed search complexity. In the static case the central quantity is k²·χ²(Bern(p+Δ)‖Bern(p)), which behaves like k²Δ²/[p(1−p)] for small lifts; detection is impossible below c·log n and a non-backtracking spectral statistic succeeds above C·log n. In the temporal case the boundary is T·I ≳ log n, where I is the per-time KL information rate on internal edges, and a likelihood-based CUSUM procedure achieves first-order optimal delay |log α|/I
Load-bearing premise
The argument assumes that not knowing which k nodes are attacked costs only a log n search penalty; in reality, scanning all k-node subsets costs k·log(n/k), so for large k the true threshold is higher.
Editorial extensions
If this is right
- If the static threshold k²·χ² ≳ log n is correct, then any attack whose accumulated edgewise divergence falls below c·log n is fundamentally undetectable by any test, regardless of computational power.
- For temporal streams, operators can set observation horizons by the rule T ≳ log n / I; below that, no alarm scheme can distinguish the attack from noise.
- Larger attacked sets make attacks easier to detect: the minimal additive lift scales as Δ_min ≈ sqrt(p(1−p)·log n / k²), so doubling the scope k quarters the required per-edge signal.
- The CUSUM delay formula delay ≈ |log α|/I means that tightening the false-alarm level by a factor of ten adds only about 2.3/I time units to the expected detection delay.
- Bounded adversarial edge rewiring or mild model drift shifts the thresholds by only constant factors, so practical detectors can stay near the information frontier with light regularization.
Reading between the lines
- The paper's compact log n penalty hides the exact search complexity k·log(n/k); if that exact penalty is used, the threshold becomes k²·χ² ≳ k·log(n/k), which is meaningfully larger for large k. Testing this corrected boundary would show where the paper's compact form understates the true requirement.
- The same accumulated-information-versus-search-complexity template likely extends to planted dense sub-hypergraphs and motif attacks, with the information summed over higher-order interactions and the search penalty still proportional to the log of the number of candidate structures.
- Side information that reduces the candidate support set from all k-subsets to a watchlist of size M would tighten the threshold to k²·χ² ≳ log M; this is a testable prediction that could be verified by running the same spectral scan with seeded candidate sets.
- The claimed statistical–computational gap suggests a conditional caveat: in sparse regimes the non-backtracking spectral test may require a constant slack above the information-theoretic boundary, so the operational threshold could be slightly higher than log n even though the lower bound is tight.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes a unified information-theoretic theory for detecting network attacks in static Erdős–Rényi graphs with a planted anomalous community and in temporal networks modeled by Poisson/Hawkes processes. The central claims are that detection is impossible when k²·χ²(Bern(p+Δ)‖Bern(p)) < c log n (static) or T·I < log n (temporal), and that a non-backtracking spectral scan (static) and a likelihood CUSUM (temporal) succeed within universal constants of these thresholds. The manuscript also discusses robustness to perturbations and statistical-computational gaps. The arguments are informal: Section 3 states the models and thresholds as rules of thumb, Section 4 sketches a mixture lower bound, and Section 5 asserts achievability without formal theorems or proofs.
Significance. If the claimed thresholds were correct, the paper would supply simple, actionable design rules for network anomaly detection, unifying static and streaming settings. The paper usefully connects planted-dense-subgraph detection, non-backtracking spectra, and sequential change-point detection, and the geometric intuition (accumulated information versus search complexity) is appealing. However, the central scaling is incorrect for growing attack sizes: the search cost is log C(n,k) ≈ k log(n/k), not log n, and the paper itself acknowledges this in §3.1 before dropping it. The consequence is that the claimed thresholds are wrong by a factor that grows with k, as the planted clique benchmark shows. The manuscript also lacks rigorous derivations for both the lower and upper bounds. These issues are load-bearing rather than presentational, so the current contribution does not meet the standard for a serious information-theory journal.
major comments (4)
- [§3.1, §4.1] The manuscript replaces the combinatorial search cost log C(n,k) ≈ k log(n/k) by log n (§3.1: 'we summarize by a log n penalty'), and then uses this in the central threshold k²χ² ≍ log n (§4.1). For growing k, k log(n/k) ≫ log n. A correct second-moment computation for the uniform mixture over S gives an impossibility regime k²χ² ≲ k log(n/k) (up to constants). The planted clique benchmark (p=1/2, Δ=1/2, χ²=1) illustrates the failure: the paper predicts detection for k ≈ sqrt(log n), whereas the information-theoretic threshold is k ≈ 2 log n; random G(n,1/2) contains many cliques of size sqrt(log n). The claimed threshold is therefore not merely unproven but false.
- [§4.1] The lower-bound 'mixture argument' is only a sketch: it says averaging over S,S′ makes r=|S∩S′| concentrate around k²/n and then jumps to a 'log-complexity term'. No explicit expression for χ²(P1‖P0) is given, and the diagonal term S=S′ is not analyzed. A direct calculation gives χ²(P1‖P0) = E_{S,S'}[(1+χ²)^{C(|S∩S′|,2)}]−1, which for k growing is dominated by r near k²/n plus a diagonal contribution; the resulting threshold involves k log(n/k), not log n. The claimed lower bound is therefore not established.
- [§5.1, §5.2] The achievability results are asserted rather than proven. §5.1 states 'the test succeeds whenever k²·SNR ≳ C log n' with SNR ≈ χ², but no theorem or analysis of the non-backtracking spectral scan is provided; no verification that the statistic concentrates or that pruning preserves the signal. §5.2 claims CUSUM delay ≈ |log α|/I, but this formula ignores the maximum over (n choose k) supports, which introduces at least log C(n,k) in the threshold and delay. These statements do not constitute an upper-bound proof.
- [§3.2, §4.2] The temporal threshold TI ≳ log n inherits the same unknown-support issue. Since S is unknown, the search penalty is log C(n,k) ≈ k log(n/k), not log n. The lower-bound paragraph in §4.2 simply asserts 'the same log-penalized boundary as in the static case' without a calculation. The reported example T ≈ 138 for n=10^6 and I=0.1 is not supported and would be incorrect for k of moderate size.
minor comments (3)
- [Title, §2] The title contains a stray space: 'T emporal Networks'. The reference list also has typos, e.g., 'IEEe Access' in [11].
- [Figures 1–3] The figures are described in the text but do not appear in the manuscript. The reader cannot verify the claimed contours or the CUSUM delay curve. Please include the actual figures or remove the references.
- [§5.1] Several objects are imprecisely defined, including the non-backtracking matrix B, the projection Π_S, and the 'SNR ≈ χ²' relation. The role of the universal constants c and C is never made explicit, making the stated thresholds difficult to test or falsify.
Circularity Check
Static achievability condition is defined to coincide with the lower-bound threshold; the non-backtracking test's power is asserted, not derived.
-
self definitional
[Section 5.1, 'Performance guarantee' (and Table 2)]
"In Bernoulli baselines with non-extreme p, the signal-to-noise ratio aligns with the per-edge χ² divergence; consequently the test succeeds whenever k2 · SNR(p, Δ) ≳ C · log n with SNR ≈ χ2 for non-extreme p, matching the detectability threshold up to constants."
The spectral statistic's success condition is not derived from any property of the non-backtracking operator; instead SNR is defined to approximate χ², so k²·SNR ≳ C·log n is exactly the lower-bound threshold k²·χ² ≳ log n with a different constant. The achievability thus restates the target condition rather than proving that the proposed test attains it. No analysis of the projection statistic T = max ||Π_S u|| is given that would independently establish power. Hence the 'nearly-optimal' claim is circular: the test is declared successful precisely when the paper's chosen information quantity exceeds the paper's chosen search penalty.
full rationale
The main circularity is in the static achievability argument (Section 5.1 and Table 2). The paper defines the signal-to-noise ratio to approximate χ² and then states that the non-backtracking spectral scan succeeds when k²·SNR ≳ C·log n. This is identical to the lower-bound threshold k²·χ² ≳ log n, so the upper bound is not independently derived; it is imposed by construction. No actual power analysis of the non-backtracking statistic is provided. The temporal CUSUM delay result, by contrast, relies on standard change-point literature and is not circular. There are no load-bearing self-citations (references [1–3] are by other authors) and no parameters are fitted to data. Separately, the paper acknowledges replacing the exact search penalty log(n choose k) ≈ k·log(n/k) with log n; this is a correctness issue (it changes the threshold for growing k) rather than a circularity. Because the static achievability claim reduces to the same condition as the lower bound by definition, the paper's central 'matching up to constants' claim is partially circular, warranting a score of 6.
Assumptions & free parameters
free parameters (1)
- Universal constants c and C in thresholds =
unspecified
assumptions (5)
- ad hoc to paper Search complexity for unknown attacked set S equals log n
- domain assumption Bernoulli edge independence under H0 and H1 with uniform mixture over S
- standard math Per-edge chi^2 divergence approximately Delta^2/[p(1-p)] for small Delta
- domain assumption Non-backtracking principal eigenvector localizes anomaly energy so projection onto top-k coordinates captures the planted community
- standard math Hawkes process stability with ||g||_1 < 1 and KL information rate I well-defined
Cite this review
Pith. "Pith review of Detectability Thresholds for Network Attacks on Static Graphs and Temporal Networks: Information-Theoretic Limits and Nearly-Optimal Tests." pith.science (2026). https://pith.science/paper/TONXSDOC
@misc{pith2026250910925,
author = {Pith},
title = {Pith review of: Detectability Thresholds for Network Attacks on Static Graphs and Temporal Networks: Information-Theoretic Limits and Nearly-Optimal Tests},
year = {2026},
howpublished = {\url{https://pith.science/paper/TONXSDOC}},
note = {Machine review of arXiv:2509.10925}
}
read the original abstract
We develop a consolidated theory for the detectability of network-borne attacks under two canonical observation models: (i) a static graph drawn from an Erdos-Renyi background with a planted anomalous community, and (ii) a temporal interaction network modeled by multivariate point processes (Poisson or Hawkes). Our main contribution is to match, up to universal constants, information-theoretic lower and upper bounds that govern when reliable testing is possible. In the static case, the core quantity is the accumulated edgewise signal k^2 * chi^2(Bern(p+Delta) || Bern(p)), where chi^2 ~ Delta^2 / [p(1-p)] for small Delta; detection is impossible when this falls below c * log n, and a non-backtracking spectral statistic succeeds above C * log n. In the temporal case, detectability is controlled by the KL information rate I contributed by internal edges over a window of length T, yielding a threshold T I >= log n; a likelihood-based cumulative-sum (CUSUM) test achieves first-order optimal delay approximately abs(log alpha) / I at false-alarm level alpha. We also quantify robustness to bounded edge perturbations and outline conditional statistical-computational separations. A brief case study shows how to turn these bounds into concrete design choices.
Figures
Reference graph
Works this paper leans on
-
[1]
Community detection with the Bethe-Hessian,
L. Stephan and Y. Zhu, “Community detection with the Bethe-Hessian,” June 11, 2025, arXiv: arXiv:2411.02835. doi: 10.48550/arXiv.2411.02835
-
[2]
Non-backtracking spectrum of random graphs: community detection and non-regular ramanujan graphs,
C. Bordenave, M. Lelarge, and L. Massoulié, “Non-backtracking spectrum of random graphs: community detection and non-regular ramanujan graphs,” presented at the 2015 IEEE 56th Annual Symposium on Foundations of Computer Science, IEEE, 2015, pp. 1347–1357
2015
-
[3]
Sequential change‐point detection: Computation versus statistical performance,
H. Wang and Y. Xie, “Sequential change‐point detection: Computation versus statistical performance,” Wiley Interdisciplinary Reviews: Computational Statistics, vol. 16, no. 1, p. e1628, 2024
2024
-
[4]
Sparse random hypergraphs: Non-backtracking spectra and community detection,
L. Stephan and Y. Zhu, “Sparse random hypergraphs: Non-backtracking spectra and community detection,” Information and Inference: A Journal of the IMA, vol. 13, no. 1, p. iaae004, 2024
2024
-
[5]
A proof of the block model threshold conjecture,
E. Mossel, J. Neeman, and A. Sly, “A proof of the block model threshold conjecture,” Combinatorica, vol. 38, no. 3, pp. 665–708, 2018
2018
-
[6]
Statistical and computational thresholds for the planted k-densest sub-hypergraph problem,
L. Corinzia, P. Penna, W. Szpankowski, and J. Buhmann, “Statistical and computational thresholds for the planted k-densest sub-hypergraph problem,” presented at the International Conference on Artificial Intelligence and Statistics, PMLR, 2022, pp. 11615–11640
2022
-
[7]
Detection of Dense Subhypergraphs by Low‐ Degree Polynomials,
A. Dhawan, C. Mao, and A. S. Wein, “Detection of Dense Subhypergraphs by Low‐ Degree Polynomials,” Random Structures & Algorithms, vol. 66, no. 1, p. e21279, 2025
2025
-
[8]
Online kernel CUSUM for change-point detection,
S. Wei and Y. Xie, “Online kernel CUSUM for change-point detection,” arXiv preprint arXiv:2211.15070, 2022
arXiv 2022
Show all 21 references
-
[9]
Neural network-based CUSUM for online change- point detection,
T. Gong, J. Lee, X. Cheng, and Y. Xie, “Neural network-based CUSUM for online change- point detection,” arXiv preprint arXiv:2210.17312, 2022
2022 arXiv
-
[10]
Sequential change-point detection for mutually exciting point processes,
H. Wang, L. Xie, Y. Xie, A. Cuozzo, and S. Mak, “Sequential change-point detection for mutually exciting point processes,” Technometrics, vol. 65, no. 1, pp. 44–56, 2023
2023
-
[11]
Graph anomaly detection with graph neural networks: Current status and challenges,
H. Kim, B. S. Lee, W.-Y. Shin, and S. Lim, “Graph anomaly detection with graph neural networks: Current status and challenges,” IEEe Access, vol. 10, pp. 111820–111829, 2022
2022
-
[12]
Graph anomaly detection in time series: A survey,
T. K. K. Ho, A. Karami, and N. Armanfard, “Graph anomaly detection in time series: A survey,” IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025
2025
-
[13]
Deep graph anomaly detection: A survey and new perspectives,
H. Qiao, H. Tong, B. An, I. King, C. Aggarwal, and G. Pang, “Deep graph anomaly detection: A survey and new perspectives,” IEEE Transactions on Knowledge and Data Engineering, 2025
2025
-
[14]
Multi-view change point detection in dynamic networks,
Y. Xie, W. Wang, M. Shao, T. Li, and Y. Yu, “Multi-view change point detection in dynamic networks,” Information Sciences, vol. 629, pp. 344–357, 2023
2023
-
[15]
State-of-the-art in community detection in temporal networks,
K. Christopoulos and K. Tsichlas, “State-of-the-art in community detection in temporal networks,” presented at the IFIP International Conference on Artificial Intelligence Applications and Innovations, Springer, 2022, pp. 370–381
2022
-
[16]
Laplacian change point detection for single and multi-view dynamic graphs,
S. Huang, S. Coulombe, Y. Hitti, R. Rabbany, and G. Rabusseau, “Laplacian change point detection for single and multi-view dynamic graphs,” ACM Transactions on Knowledge Discovery from Data, vol. 18, no. 3, pp. 1–32, 2024
2024
-
[17]
Spectra of some self-exciting and mutually exciting point processes,
A. G. Hawkes, “Spectra of some self-exciting and mutually exciting point processes,” Biometrika, vol. 58, no. 1, pp. 83–90, 1971
1971
-
[18]
D. J. Daley and D. Vere-Jones, An introduction to the theory of point processes: volume I: elementary theory and methods. Springer, 2003
2003
-
[19]
Continuous inspection schemes,
E. S. Page, “Continuous inspection schemes,” Biometrika, vol. 41, no. 1/2, pp. 100–115, 1954
1954
-
[20]
Optimal stopping times for detecting changes in distributions,
G. V. Moustakides, “Optimal stopping times for detecting changes in distributions,” the Annals of Statistics, vol. 14, no. 4, pp. 1379–1387, 1986
1986
-
[21]
Robust Score- Based Quickest Change Detection,
S. Moushegian, S. Wu, E. Diao, J. Ding, T. Banerjee, and V. Tarokh, “Robust Score- Based Quickest Change Detection,” IEEE Transactions on Information Theory, 2025
2025
Reviewed August 4, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.