Pith. sign in

REVIEW 4 major objections 3 minor 21 references

Detectability Thresholds for Network Attacks on Static Graphs and Temporal Networks: Information-Theoretic Limits and Nearly-Optimal Tests

T0 review · 4 major / 3 minor · reviewed 2026-08-04 · deepseek-v4-flash

Pith's one-line read Attack detection in networks turns on one balance: accumulated signal must exceed log n.

desk verdict Central threshold is wrong: the search penalty is log(n choose k), not log n, so the paper's main formulas fail for growing k (planted clique alone refutes them). read the letter →

arxiv 2509.10925 v1 pith:TONXSDOC submitted 2025-09-13 cs.IT math.IT

classification cs.ITmath.IT MSC 62F0362L1005C8060G55
keywords networkanomalydetectionplanteddensesubgraphnon-backtrackingspectrumCUSUMHawkesprocessesinformation-theoreticthresholdsequentialchangeErdős–Rényimodel
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish a single information-theoretic rule for when network attacks become detectable: the total statistical evidence an attack generates, summed over the attacked edges and over time, must exceed the cost of searching an unknown location. For a static random graph this evidence is k² times the per-edge chi-square divergence between normal and attacked edges, and the rule becomes k²·χ² ≳ log n. For a temporal stream the evidence accumulates as T times a per-time KL information rate, giving T·I ≳ log n. If true, these formulas unify static and streaming detection and tell operators exactly which attacks are impossible to catch, which are catchable, and how fast a nearly optimal test can react.

What carries the argument

The organizing identity is the comparison between accumulated information and search complexity: k²·χ² for static graphs and T·I for temporal streams, each balanced against a log n penalty for the unknown attacked set S. The achievability side uses the non-backtracking (Hashimoto) operator—whose spectral energy suppresses backtracking walk noise in sparse graphs—through a pruned power iteration that localizes the top-k coordinates; and the CUSUM recursion G_S(t)=max_{s≤t}(Λ_S(t)−Λ_S(s)) over candidate supports, which converts per-edge log-likelihood information into a near-optimal detection delay.

What would settle it

Simulate the static model with n=10⁵, k=5000, p=0.01 and set Δ so that k²·χ² = 2·log n. If a well-calibrated non-backtracking spectral scan does not approach power 1, the compact log n threshold is too low for large k; if it does, the boundary holds.

Watch

Extended reading notes

Core claim

The paper claims that under two canonical observation models—a static Erdős–Rényi graph with a planted attacked subset, and a temporal Poisson or Hawkes interaction stream—reliable detection is controlled by the same balance: accumulated information must exceed search complexity. In the static case the central quantity is k²·χ²(Bern(p+Δ)‖Bern(p)), which behaves like k²Δ²/[p(1−p)] for small lifts; detection is impossible below c·log n and a non-backtracking spectral statistic succeeds above C·log n. In the temporal case the boundary is T·I ≳ log n, where I is the per-time KL information rate on internal edges, and a likelihood-based CUSUM procedure achieves first-order optimal delay |log α|/I

Load-bearing premise

The argument assumes that not knowing which k nodes are attacked costs only a log n search penalty; in reality, scanning all k-node subsets costs k·log(n/k), so for large k the true threshold is higher.

Editorial extensions

If this is right

  • If the static threshold k²·χ² ≳ log n is correct, then any attack whose accumulated edgewise divergence falls below c·log n is fundamentally undetectable by any test, regardless of computational power.
  • For temporal streams, operators can set observation horizons by the rule T ≳ log n / I; below that, no alarm scheme can distinguish the attack from noise.
  • Larger attacked sets make attacks easier to detect: the minimal additive lift scales as Δ_min ≈ sqrt(p(1−p)·log n / k²), so doubling the scope k quarters the required per-edge signal.
  • The CUSUM delay formula delay ≈ |log α|/I means that tightening the false-alarm level by a factor of ten adds only about 2.3/I time units to the expected detection delay.
  • Bounded adversarial edge rewiring or mild model drift shifts the thresholds by only constant factors, so practical detectors can stay near the information frontier with light regularization.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's compact log n penalty hides the exact search complexity k·log(n/k); if that exact penalty is used, the threshold becomes k²·χ² ≳ k·log(n/k), which is meaningfully larger for large k. Testing this corrected boundary would show where the paper's compact form understates the true requirement.
  • The same accumulated-information-versus-search-complexity template likely extends to planted dense sub-hypergraphs and motif attacks, with the information summed over higher-order interactions and the search penalty still proportional to the log of the number of candidate structures.
  • Side information that reduces the candidate support set from all k-subsets to a watchlist of size M would tighten the threshold to k²·χ² ≳ log M; this is a testable prediction that could be verified by running the same spectral scan with seeded candidate sets.
  • The claimed statistical–computational gap suggests a conditional caveat: in sparse regimes the non-backtracking spectral test may require a constant slack above the information-theoretic boundary, so the operational threshold could be slightly higher than log n even though the lower bound is tight.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 3 minor

Summary. The paper proposes a unified information-theoretic theory for detecting network attacks in static Erdős–Rényi graphs with a planted anomalous community and in temporal networks modeled by Poisson/Hawkes processes. The central claims are that detection is impossible when k²·χ²(Bern(p+Δ)‖Bern(p)) < c log n (static) or T·I < log n (temporal), and that a non-backtracking spectral scan (static) and a likelihood CUSUM (temporal) succeed within universal constants of these thresholds. The manuscript also discusses robustness to perturbations and statistical-computational gaps. The arguments are informal: Section 3 states the models and thresholds as rules of thumb, Section 4 sketches a mixture lower bound, and Section 5 asserts achievability without formal theorems or proofs.

Significance. If the claimed thresholds were correct, the paper would supply simple, actionable design rules for network anomaly detection, unifying static and streaming settings. The paper usefully connects planted-dense-subgraph detection, non-backtracking spectra, and sequential change-point detection, and the geometric intuition (accumulated information versus search complexity) is appealing. However, the central scaling is incorrect for growing attack sizes: the search cost is log C(n,k) ≈ k log(n/k), not log n, and the paper itself acknowledges this in §3.1 before dropping it. The consequence is that the claimed thresholds are wrong by a factor that grows with k, as the planted clique benchmark shows. The manuscript also lacks rigorous derivations for both the lower and upper bounds. These issues are load-bearing rather than presentational, so the current contribution does not meet the standard for a serious information-theory journal.

major comments (4)
  1. [§3.1, §4.1] The manuscript replaces the combinatorial search cost log C(n,k) ≈ k log(n/k) by log n (§3.1: 'we summarize by a log n penalty'), and then uses this in the central threshold k²χ² ≍ log n (§4.1). For growing k, k log(n/k) ≫ log n. A correct second-moment computation for the uniform mixture over S gives an impossibility regime k²χ² ≲ k log(n/k) (up to constants). The planted clique benchmark (p=1/2, Δ=1/2, χ²=1) illustrates the failure: the paper predicts detection for k ≈ sqrt(log n), whereas the information-theoretic threshold is k ≈ 2 log n; random G(n,1/2) contains many cliques of size sqrt(log n). The claimed threshold is therefore not merely unproven but false.
  2. [§4.1] The lower-bound 'mixture argument' is only a sketch: it says averaging over S,S′ makes r=|S∩S′| concentrate around k²/n and then jumps to a 'log-complexity term'. No explicit expression for χ²(P1‖P0) is given, and the diagonal term S=S′ is not analyzed. A direct calculation gives χ²(P1‖P0) = E_{S,S'}[(1+χ²)^{C(|S∩S′|,2)}]−1, which for k growing is dominated by r near k²/n plus a diagonal contribution; the resulting threshold involves k log(n/k), not log n. The claimed lower bound is therefore not established.
  3. [§5.1, §5.2] The achievability results are asserted rather than proven. §5.1 states 'the test succeeds whenever k²·SNR ≳ C log n' with SNR ≈ χ², but no theorem or analysis of the non-backtracking spectral scan is provided; no verification that the statistic concentrates or that pruning preserves the signal. §5.2 claims CUSUM delay ≈ |log α|/I, but this formula ignores the maximum over (n choose k) supports, which introduces at least log C(n,k) in the threshold and delay. These statements do not constitute an upper-bound proof.
  4. [§3.2, §4.2] The temporal threshold TI ≳ log n inherits the same unknown-support issue. Since S is unknown, the search penalty is log C(n,k) ≈ k log(n/k), not log n. The lower-bound paragraph in §4.2 simply asserts 'the same log-penalized boundary as in the static case' without a calculation. The reported example T ≈ 138 for n=10^6 and I=0.1 is not supported and would be incorrect for k of moderate size.
minor comments (3)
  1. [Title, §2] The title contains a stray space: 'T emporal Networks'. The reference list also has typos, e.g., 'IEEe Access' in [11].
  2. [Figures 1–3] The figures are described in the text but do not appear in the manuscript. The reader cannot verify the claimed contours or the CUSUM delay curve. Please include the actual figures or remove the references.
  3. [§5.1] Several objects are imprecisely defined, including the non-backtracking matrix B, the projection Π_S, and the 'SNR ≈ χ²' relation. The role of the universal constants c and C is never made explicit, making the stated thresholds difficult to test or falsify.

Circularity Check

1 steps flagged · score 6.0 of 10

Static achievability condition is defined to coincide with the lower-bound threshold; the non-backtracking test's power is asserted, not derived.

  1. self definitional [Section 5.1, 'Performance guarantee' (and Table 2)]
    "In Bernoulli baselines with non-extreme p, the signal-to-noise ratio aligns with the per-edge χ² divergence; consequently the test succeeds whenever k2 · SNR(p, Δ) ≳ C · log n with SNR ≈ χ2 for non-extreme p, matching the detectability threshold up to constants."

    The spectral statistic's success condition is not derived from any property of the non-backtracking operator; instead SNR is defined to approximate χ², so k²·SNR ≳ C·log n is exactly the lower-bound threshold k²·χ² ≳ log n with a different constant. The achievability thus restates the target condition rather than proving that the proposed test attains it. No analysis of the projection statistic T = max ||Π_S u|| is given that would independently establish power. Hence the 'nearly-optimal' claim is circular: the test is declared successful precisely when the paper's chosen information quantity exceeds the paper's chosen search penalty.

full rationale

The main circularity is in the static achievability argument (Section 5.1 and Table 2). The paper defines the signal-to-noise ratio to approximate χ² and then states that the non-backtracking spectral scan succeeds when k²·SNR ≳ C·log n. This is identical to the lower-bound threshold k²·χ² ≳ log n, so the upper bound is not independently derived; it is imposed by construction. No actual power analysis of the non-backtracking statistic is provided. The temporal CUSUM delay result, by contrast, relies on standard change-point literature and is not circular. There are no load-bearing self-citations (references [1–3] are by other authors) and no parameters are fitted to data. Separately, the paper acknowledges replacing the exact search penalty log(n choose k) ≈ k·log(n/k) with log n; this is a correctness issue (it changes the threshold for growing k) rather than a circularity. Because the static achievability claim reduces to the same condition as the lower bound by definition, the paper's central 'matching up to constants' claim is partially circular, warranting a score of 6.

Assumptions & free parameters 1 free parameters · 5 assumptions · 0 invented entities

The paper's thresholds rest on two main assumptions: a log n search penalty and the localizability of the non-backtracking eigenvector. No new entities are introduced. The first assumption is the fragile one and breaks the central claim for growing k.

free parameters (1)
  • Universal constants c and C in thresholds = unspecified
    The paper claims lower and upper thresholds hold for some constants c, C but gives no values. The practical rule-of-thumb is only order-of-magnitude, and the constants are not derived or calibrated.
assumptions (5)
  • ad hoc to paper Search complexity for unknown attacked set S equals log n
    Invoked in Section 3.1 to replace log(n choose k) with log n. This is the central scaling assumption and is not valid for growing k.
  • domain assumption Bernoulli edge independence under H0 and H1 with uniform mixture over S
    Defines both static models in Section 3.1 and underlies the mixture lower bound in Section 4.1.
  • standard math Per-edge chi^2 divergence approximately Delta^2/[p(1-p)] for small Delta
    Used throughout the paper. It is valid for small Delta and non-extreme p, but the claimed threshold is applied beyond this regime, including the planted clique benchmark.
  • domain assumption Non-backtracking principal eigenvector localizes anomaly energy so projection onto top-k coordinates captures the planted community
    Central to Section 5.1 'Performance guarantee'; no proof is provided that the projection statistic has the claimed power at the information threshold.
  • standard math Hawkes process stability with ||g||_1 < 1 and KL information rate I well-defined
    Used in Sections 3.2 and 4.2 for temporal lower bounds.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Detectability Thresholds for Network Attacks on Static Graphs and Temporal Networks: Information-Theoretic Limits and Nearly-Optimal Tests." pith.science (2026). https://pith.science/paper/TONXSDOC

@misc{pith2026250910925,
  author       = {Pith},
  title        = {Pith review of: Detectability Thresholds for Network Attacks on Static Graphs and Temporal Networks: Information-Theoretic Limits and Nearly-Optimal Tests},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TONXSDOC}},
  note         = {Machine review of arXiv:2509.10925}
}
read the original abstract

We develop a consolidated theory for the detectability of network-borne attacks under two canonical observation models: (i) a static graph drawn from an Erdos-Renyi background with a planted anomalous community, and (ii) a temporal interaction network modeled by multivariate point processes (Poisson or Hawkes). Our main contribution is to match, up to universal constants, information-theoretic lower and upper bounds that govern when reliable testing is possible. In the static case, the core quantity is the accumulated edgewise signal k^2 * chi^2(Bern(p+Delta) || Bern(p)), where chi^2 ~ Delta^2 / [p(1-p)] for small Delta; detection is impossible when this falls below c * log n, and a non-backtracking spectral statistic succeeds above C * log n. In the temporal case, detectability is controlled by the KL information rate I contributed by internal edges over a window of length T, yielding a threshold T I >= log n; a likelihood-based cumulative-sum (CUSUM) test achieves first-order optimal delay approximately abs(log alpha) / I at false-alarm level alpha. We also quantify robustness to bounded edge perturbations and outline conditional statistical-computational separations. A brief case study shows how to turn these bounds into concrete design choices.

Figures

Figures reproduced from arXiv: 2509.10925 by the authors.

Figure 1
Figure 1. Static detectability heatmap for n=10^5, p=0.01. White contour: k²·χ² = log n; to its [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗
Figure 2
Figure 2. shows the temporal boundary T·I ≳ log n as n varies. Because the x-axis is log￾scaled, the curve is effectively linear in log n: for fixed per-time information rate I, the required horizon scales as T ≈ log n / I. For instance, at n=106 we need T·I ≈ 13.8; with I=0.1 this translates to T ≈ 138 time units [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. CUSUM expected delay ≈ |log α|/I at α=10^{ [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

21 extracted references · 2 linked inside Pith

  1. [1]

    Community detection with the Bethe-Hessian,

    L. Stephan and Y. Zhu, “Community detection with the Bethe-Hessian,” June 11, 2025, arXiv: arXiv:2411.02835. doi: 10.48550/arXiv.2411.02835

  2. [2]

    Non-backtracking spectrum of random graphs: community detection and non-regular ramanujan graphs,

    C. Bordenave, M. Lelarge, and L. Massoulié, “Non-backtracking spectrum of random graphs: community detection and non-regular ramanujan graphs,” presented at the 2015 IEEE 56th Annual Symposium on Foundations of Computer Science, IEEE, 2015, pp. 1347–1357

  3. [3]

    Sequential change‐point detection: Computation versus statistical performance,

    H. Wang and Y. Xie, “Sequential change‐point detection: Computation versus statistical performance,” Wiley Interdisciplinary Reviews: Computational Statistics, vol. 16, no. 1, p. e1628, 2024

  4. [4]

    Sparse random hypergraphs: Non-backtracking spectra and community detection,

    L. Stephan and Y. Zhu, “Sparse random hypergraphs: Non-backtracking spectra and community detection,” Information and Inference: A Journal of the IMA, vol. 13, no. 1, p. iaae004, 2024

  5. [5]

    A proof of the block model threshold conjecture,

    E. Mossel, J. Neeman, and A. Sly, “A proof of the block model threshold conjecture,” Combinatorica, vol. 38, no. 3, pp. 665–708, 2018

  6. [6]

    Statistical and computational thresholds for the planted k-densest sub-hypergraph problem,

    L. Corinzia, P. Penna, W. Szpankowski, and J. Buhmann, “Statistical and computational thresholds for the planted k-densest sub-hypergraph problem,” presented at the International Conference on Artificial Intelligence and Statistics, PMLR, 2022, pp. 11615–11640

  7. [7]

    Detection of Dense Subhypergraphs by Low‐ Degree Polynomials,

    A. Dhawan, C. Mao, and A. S. Wein, “Detection of Dense Subhypergraphs by Low‐ Degree Polynomials,” Random Structures & Algorithms, vol. 66, no. 1, p. e21279, 2025

  8. [8]

    Online kernel CUSUM for change-point detection,

    S. Wei and Y. Xie, “Online kernel CUSUM for change-point detection,” arXiv preprint arXiv:2211.15070, 2022

Show all 21 references
  1. [9]

    Neural network-based CUSUM for online change- point detection,

    T. Gong, J. Lee, X. Cheng, and Y. Xie, “Neural network-based CUSUM for online change- point detection,” arXiv preprint arXiv:2210.17312, 2022

  2. [10]

    Sequential change-point detection for mutually exciting point processes,

    H. Wang, L. Xie, Y. Xie, A. Cuozzo, and S. Mak, “Sequential change-point detection for mutually exciting point processes,” Technometrics, vol. 65, no. 1, pp. 44–56, 2023

  3. [11]

    Graph anomaly detection with graph neural networks: Current status and challenges,

    H. Kim, B. S. Lee, W.-Y. Shin, and S. Lim, “Graph anomaly detection with graph neural networks: Current status and challenges,” IEEe Access, vol. 10, pp. 111820–111829, 2022

  4. [12]

    Graph anomaly detection in time series: A survey,

    T. K. K. Ho, A. Karami, and N. Armanfard, “Graph anomaly detection in time series: A survey,” IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025

  5. [13]

    Deep graph anomaly detection: A survey and new perspectives,

    H. Qiao, H. Tong, B. An, I. King, C. Aggarwal, and G. Pang, “Deep graph anomaly detection: A survey and new perspectives,” IEEE Transactions on Knowledge and Data Engineering, 2025

  6. [14]

    Multi-view change point detection in dynamic networks,

    Y. Xie, W. Wang, M. Shao, T. Li, and Y. Yu, “Multi-view change point detection in dynamic networks,” Information Sciences, vol. 629, pp. 344–357, 2023

  7. [15]

    State-of-the-art in community detection in temporal networks,

    K. Christopoulos and K. Tsichlas, “State-of-the-art in community detection in temporal networks,” presented at the IFIP International Conference on Artificial Intelligence Applications and Innovations, Springer, 2022, pp. 370–381

  8. [16]

    Laplacian change point detection for single and multi-view dynamic graphs,

    S. Huang, S. Coulombe, Y. Hitti, R. Rabbany, and G. Rabusseau, “Laplacian change point detection for single and multi-view dynamic graphs,” ACM Transactions on Knowledge Discovery from Data, vol. 18, no. 3, pp. 1–32, 2024

  9. [17]

    Spectra of some self-exciting and mutually exciting point processes,

    A. G. Hawkes, “Spectra of some self-exciting and mutually exciting point processes,” Biometrika, vol. 58, no. 1, pp. 83–90, 1971

  10. [18]

    D. J. Daley and D. Vere-Jones, An introduction to the theory of point processes: volume I: elementary theory and methods. Springer, 2003

  11. [19]

    Continuous inspection schemes,

    E. S. Page, “Continuous inspection schemes,” Biometrika, vol. 41, no. 1/2, pp. 100–115, 1954

  12. [20]

    Optimal stopping times for detecting changes in distributions,

    G. V. Moustakides, “Optimal stopping times for detecting changes in distributions,” the Annals of Statistics, vol. 14, no. 4, pp. 1379–1387, 1986

  13. [21]

    Robust Score- Based Quickest Change Detection,

    S. Moushegian, S. Wu, E. Diao, J. Ding, T. Banerjee, and V. Tarokh, “Robust Score- Based Quickest Change Detection,” IEEE Transactions on Information Theory, 2025

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.