REVIEW 4 major objections 4 minor 22 references
MaxModShift: Model Privacy via Designed Shifts
T0 review · 4 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash
Pith's one-line read In federated learning, designed nonlinear shifts of model updates can drive an eavesdropper's Fisher Information Matrix to singularity, preventing her from learning the global model while maximizing the model shift under a power constraint.
desk verdict Plausible incremental extension of the authors' ModShift with closed-form shift designs; the FIM condition holds on direct check, but omitted proofs and thin simulation leave the main privacy claim conditional. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central object is the shift vector h(δ), a nonlinear function of each agent's local model update δ, chosen so that the eavesdropper's Fisher Information Matrix J(δ) = (2 $h_E^{2}$ / $σ_E^{2}$)(I + u h(δ)^T)^T (I + u h(δ)^T) remains singular. The singularity condition h^T u = -1 is preserved under the orthogonality condition δ^T ∇h = 0, and the power constraint ||h||^2 = α/(1 + ||u||^2) is enforced through a Lagrange multiplier solution that gives explicit formulas for γ_max and γ_min. These shifts are designed to maximize the model drift observed by Eve, which the paper links to a lower bound on Eve's loss through strong convexity.
What would settle it
Run FedAvg on a real dataset, record every local update δ_k(n), and at each round compute the determinant of the eavesdropper's Fisher Information Matrix J(δ) = (2 $h_E^{2}$ / $σ_E^{2}$)(I + u h(δ)^T)^T (I + u h(δ)^T) using the proposed h; if the determinant is positive in any round, the matrix is not singular and the paper's privacy guarantee for that round does not hold.
Extended reading notes
Core claim
The paper's central discovery is a parameterized shift design that makes the eavesdropper's estimation problem statistically hard while actively enlarging the gap between the model she recovers and the true global model. For the observation model y_k^E = δ_k + γ_k^T δ_k u + z, the Fisher Information Matrix is J(δ) = (2 $h_E^{2}$ / $σ_E^{2}$) S^T S with S = I + uγ^T, and it is singular exactly when γ^T u = -1. The paper generalizes this by letting γ = h(δ), a nonlinear function of the local update, and shows the same FIM singularity holds when δ^T ∇h = 0. MaxModShift then solves a per-agent optimization that maximizes h^T δ subject to h^T u = -1 and ||h||^2 = α/(1 + ||u||^2), yielding closed-form maximizer and minimizer shifts. Simulations show both variants make Eve's final loss exceed that of ModShift and noise injection, with the MaxModShift (Min) variant performing best, while the average required power is about 24% of ModShift's.
Load-bearing premise
The whole argument depends on the shift function h(δ) satisfying δ^T ∇h = 0 at every δ that the FedAvg trajectory produces; the paper states Proposition 2 without proof, and this condition is what keeps the eavesdropper's Fisher Information Matrix singular, so if any encountered δ violates it the privacy guarantee no longer follows.
Editorial extensions
If this is right
- If the design works as claimed, an eavesdropper who intercepts all uplink communications in a FedAvg system cannot estimate the global model, because the Fisher Information Matrix at each round is singular.
- Model privacy can be achieved with substantially less transmission power than the earlier ModShift scheme, since MaxModShift uses about 24% of ModShift's average power in the reported simulations.
- MaxModShift also outperforms a noise injection baseline that is inspired by differential privacy, giving Eve a lower final loss while requiring less bandwidth on the secret channel and lower average power.
- Because the design makes no assumption about how gradients are generated, the same shift construction can be adapted to other federated or distributed optimization methods beyond FedAvg.
- The paper's convergence and tamper-test claims imply that the eavesdropper would not be able to detect the presence of the shifts, making the privacy mechanism harder to reverse-engineer.
Reading between the lines
- A testable extension is to run MaxModShift on nonconvex models such as neural networks, where the δ trajectory may not satisfy δ^T ∇h = 0 at every round; if the condition fails, the FIM singularity and the privacy guarantee would need re-examination.
- The paper leaves open a greedy per-round choice between γ_max and γ_min based on the angle between δ and u; such an adaptive choice could further increase Eve's drift without changing the power budget.
- The reported power advantage is measured under a particular definition of average power Pavg; in practice, the secret-channel scalars may impose latency or bandwidth costs that a deployment would need to weigh separately.
- A natural comparison is to measure Eve's final loss against the theoretical lower bound from strong convexity, which would indicate how much of the observed privacy gain is due to the singularity versus the magnitude of the drift.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. This paper proposes a privacy mechanism, MaxModShift, for federated learning against an eavesdropper who observes all uplinks. Agents transmit shifted updates of the form δ_k(n) + γ_k(n)^T δ_k(n) u, with the shift designed so that the eavesdropper's per-round Fisher Information Matrix (FIM) for estimating δ_k(n) is singular, while Bob compensates for the shift through a low-rate secret channel. The design is formulated as a constrained optimization that maximizes the resulting model shift at Eve under a transmission-power constraint. Two closed-form shift rules, γ_max and γ_min, are derived via Lagrange multipliers, and the paper reports simulations comparing them with the authors' earlier ModShift and with Gaussian noise injection.
Significance. If fully established, the FIM-singularity approach to model privacy would be an attractive alternative to noise-injection defenses: it requires no gradient clipping, uses only a scalar secret channel per update, and gives an explicit closed-form shift satisfying a power constraint. The paper's strengths are the clean problem formulation, the closed-form Lagrange-multiplier solutions, and the direct comparison against both ModShift and noise injection. However, the significance is conditional: the main theoretical bridge (Proposition 2) is unproved, the convergence and tamper-test claims are explicitly deferred, and the empirical evidence is a single synthetic scenario without error bars or code. The idea is promising, but the manuscript as written does not yet fully support the advertised guarantees.
major comments (4)
- [Section IV, Proposition 2] Proposition 2 states that the FIM of the observation model in Eq. (4) remains unchanged when γ_k(n)=h(δ_k(n)) satisfies δ^T ∇h = 0, but no proof is given. This is the key result that lets the nonlinear MaxModShift designs inherit the singularity condition of Proposition 1. A short derivation using ∇(h(δ)^T δ) = h(δ) + (∇h(δ))^T δ would settle it; as written, the central FIM result for the proposed schemes is not self-contained. Please add the proof, and also show explicitly that the closed-form γ_max and γ_min in Proposition 3 satisfy Eq. (9).
- [Sections I and VII] The paper asserts that the new schemes 'are shown to pass a convergence test at the eavesdropper' and that the algorithm 'can be proven to converge,' but explicitly defers these results to space limitations and to approaches in [13]. These properties are load-bearing: the abstract's claim that Eve 'cannot learn the model' presumes that the shift does not reveal itself through detectable non-convergence or abnormal trajectories, and the comparison with noise injection depends on the same tamper test. The tamper test itself is never simulated or proved. Please include the deferred proofs or substantially weaken the corresponding claims in the abstract and conclusions.
- [Section VI, Figures 2 and 3] The empirical comparison is based on a single synthetic linear-regression run with no error bars, no multiple seeds, and no code release. The claims that MaxModShift (Min) gives a higher Eve loss for every α, that MaxModShift uses 24% of ModShift's power, and that noise injection fails the tamper test are all point estimates from one scenario. Please report means and variances over independent runs (and ideally a second dataset or architecture), or provide the code so the curves can be reproduced.
- [Sections III-V] The adversary model is underspecified regarding Eve's knowledge of the shift function. The FIM in Propositions 1 and 2 is the FIM for δ_k(n) in the observation model (4) with a known shift rule; if the eavesdropper does not know h(·), α, or the exact form of the design, then the estimation problem includes additional unknown parameters and the per-round FIM is not simply S^T S. The sentence 'we assume Eve knows u' does not clarify whether Eve knows h(·). Please state explicitly that the adversary knows the shift rule (a Kerckhoffs-style assumption), or analyze the unknown-shift case.
minor comments (4)
- [Section V, Eq. (28)] The denominator in the displayed condition appears to be a typo: '||u^2||||δ||^2' should most likely read '||u||^2||δ||^2'.
- [Section IV, Proposition 2] The expression 'γk(n) = h(δk(n)' is missing a closing parenthesis; it should read h(δ_k(n)).
- [Section V, power constraint derivation] In the inequality preceding P1, the replacement of σ_max^2(S_k(n)) by ||u||^2||h||^2 uses the fact that max(1, ||u||^2||h||^2) = ||u||^2||h||^2 when α' ≥ 1. Please state this condition at the point of the inequality, since it is otherwise not obvious and is needed for the claimed implication from P1's constraint to Eq. (12).
- [Section VI, Figures 2 and 3] The legends and captions use 'MaxModShift (Max)', 'MaxModShift (Min)', and 'Max scheme' with similar names; please define each scheme unambiguously in the caption and in the text, and check for the duplicated word 'than than' in the third paragraph.
Circularity Check
No circular derivation: the FIM singularity condition and the shift-optimization chain are self-contained; the admitted omitted tamper/convergence proofs are support gaps that lean on the authors' prior work, not circular reductions.
full rationale
The central derivation is not circular. The FIM formula (Proposition 1) is quoted from the authors' [21], but it follows directly from the signal model in Eq. (4)-(5): S=I+uγ^T and det(I+uγ^T)=1+γ^T u, so the singularity condition γ^T u=-1 is one line of algebra and not an imported conclusion that presupposes the target result. Proposition 2 is stated without proof, but the condition δ^T∇h=0 is a homogeneity condition, and the closed forms (22)-(27) satisfy it for every non-degenerate δ; this is independently checkable and does not build the claimed privacy into the ansatz. The σ_max identity from [16] is parameter-free linear algebra and is used under h^T u=-1, where it holds; no fitted values are involved. The optimization objective is the analytic model shift (sum h^Tδ)^2||u||^2 under explicit power constraints; Eve's final loss is measured in simulation against external ModShift and noise-injection baselines, so no fitted parameter is renamed as a prediction. The main caveat is correctly flagged by the paper itself: the Introduction and Conclusions state that the tamper/convergence results are 'not included... but can be shown' and 'can be proven to converge, following the approaches in [13].' Those are omitted proofs and load-bearing self-citations for the undetectability claim, and they are correctness/completeness gaps; they do not make the FIM/shift derivation equivalent to its inputs. Score 2 reflects this minor self-citation burden, not a circular derivation.
Assumptions & free parameters
free parameters (2)
- alpha (power constraint coefficient) =
varies with experiment; alpha above 1.2 for the main comparisons, requires alpha-prime >= 1
- u (shift direction vector) =
u = 1 (all-ones vector of dimension d=60) in simulations
assumptions (6)
- domain assumption The eavesdropper's signal model is y_E = S delta + z with S = I + u gamma^T and Gaussian z (Eq. 4-5).
- standard math FIM of delta for that model is J = (2 h_E^2 / sigma_E^2) S^T S, singular when gamma^T u = -1 (Prop. 1).
- ad hoc to paper Nonlinear h preserves FIM if delta^T nabla h = 0 (Prop. 2).
- standard math sigma_max^2(S) = max(1, ||u||^2 ||gamma||^2) for the shift matrices (from [16]).
- domain assumption The loss function is strongly convex, so the loss gap at Eve is lower bounded by the squared model-shift norm (Eq. 8).
- ad hoc to paper The shift algorithm converges and the scheme passes the tamper test claimed in Section VII.
Cite this review
Pith. "Pith review of MaxModShift: Model Privacy via Designed Shifts." pith.science (2026). https://pith.science/paper/7XOJFA32
@misc{pith2026260809328,
author = {Pith},
title = {Pith review of: MaxModShift: Model Privacy via Designed Shifts},
year = {2026},
howpublished = {\url{https://pith.science/paper/7XOJFA32}},
note = {Machine review of arXiv:2608.09328}
}
read the original abstract
Model learning by an eavesdropper is treated as an estimation problem in a federated environment. The Fisher Information Matrix for the eavesdropper's estimation problem is driven to singularity through a signaling design; this ensures that the eavesdropper cannot learn the model. Herein, the innovation of prior designs is that model shifts are designed to maximize the difference in the model learned by Eve and the central server while satisfying a transmission power constraint for the agents. Two shift schemes are provided. MaxModShift outperforms a prior ModShift design while requiring lesser transmission power. Compared to a noise injection scheme, MaxModShift performs better while requiring a lower bandwidth secret channel and a reduced average power consumption.
Figures
Reference graph
Works this paper leans on
-
[16]
Block mo dshift: Model privacy via dynamic designed shifts,
N. A. Kherani, S. P . Karimireddy, and U. Mitra, “Block mo dshift: Model privacy via dynamic designed shifts,” IEEE Journal on Selected Areas in Communications , vol. 44, pp. 3894–3908, 2026
work page 2026
-
[13]
Modshift: Model privacy via designed shifts,
N. A. Kherani and U. Mitra, “Modshift: Model privacy via designed shifts,” in 2025 59th Asilomar Conference on Signals, Systems, and Computers, 2025, pp. 124–128
work page 2025
-
[1]
Advances and open problems in federated learning,
P . Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. Bonawitz, Z. Charles, G. Cormode, R. Cummings et al. , “Advances and open problems in federated learning,” F oundations and trends® in machine learning , vol. 14, no. 1–2, pp. 1–210, 2021
work page 2021
-
[2]
Pri vacy- preserving aggregation in federated learning: A survey,
Z. Liu, J. Guo, W. Y ang, J. Fan, K.-Y . Lam, and J. Zhao, “Pri vacy- preserving aggregation in federated learning: A survey,” IEEE Transac- tions on Big Data , pp. 1–20, 2022
work page 2022
-
[3]
Practical secure aggregation for privacy-preserving machine learning,
K. Bonawitz, V . Ivanov, B. Kreuter, A. Marcedone, H. B. Mc Mahan, S. Patel, D. Ramage, A. Segal, and K. Seth, “Practical secure aggregation for privacy-preserving machine learning,” in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Secur ity, ser. CCS ’17. New Y ork, NY , USA: Association for Computing Machinery, 2017, p. 1175–1191
work page 2017
-
[4]
Fast- secagg: Scalable secure aggregation for privacy-preservi ng federated learning,
S. Kadhe, N. Rajaraman, O. O. Koyluoglu, and K. Ramchandr an, “Fast- secagg: Scalable secure aggregation for privacy-preservi ng federated learning,” arXiv preprint arXiv:2009.11248 , 2020
arXiv 2009
-
[5]
Deep learning with differential pr ivacy,
M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov , K. Talwar, and L. Zhang, “Deep learning with differential pr ivacy,” in Proceedings of the 2016 ACM SIGSAC conference on computer an d communications security , 2016, pp. 308–318
2016
-
[6]
N. Tasnim, J. Mohammadi, A. D. Sarwate, and H. Imtiaz, “Ap prox- imating functions with approximate privacy for applicatio ns in signal estimation and learning,” Entropy, vol. 25, no. 5, p. 825, 2023
work page 2023
Show all 22 references
-
[7]
Privfl: Practical privacy-preser ving federated regressions on high-dimensional data over mobile networks ,
K. Mandal and G. Gong, “Privfl: Practical privacy-preser ving federated regressions on high-dimensional data over mobile networks ,” p. 57–68, 2019
2019
-
[8]
Practical a nd bilat- eral privacy-preserving federated learning,
Y . Feng, X. Y ang, W. Fang, S. Xia, and X. Tang, “Practical a nd bilat- eral privacy-preserving federated learning,” ArXiv, vol. abs/2002.09843, 2020
2002 arXiv
-
[9]
On model protection in fede rated learning against eavesdropping attacks,
D. Maity and K. Chakrabarti, “On model protection in fede rated learning against eavesdropping attacks,” arXiv preprint arXiv:2504.02114 , 2025
2025 arXiv
-
[10]
Channel state information-free loc ation-privacy enhancement: Fake path injection,
J. Li and U. Mitra, “Channel state information-free loc ation-privacy enhancement: Fake path injection,” IEEE Transactions on Signal Pro- cessing, 2024
2024
-
[11]
Channel state information-free location-privac y enhancement: Delay-angle information spoofing,
——, “Channel state information-free location-privac y enhancement: Delay-angle information spoofing,” in ICC 2024 - IEEE International Conference on Communications , 2024, pp. 3767–3772
2024
-
[12]
Optimized parameter design for channel state info rmation-free location spoofing,
——, “Optimized parameter design for channel state info rmation-free location spoofing,” in 2024 IEEE International Symposium on Informa- tion Theory (ISIT) . IEEE, 2024, pp. 3695–3700
2024
-
[14]
Scaffold: Stochastic controlled averaging for fe derated learn- ing,
S. P . Karimireddy, S. Kale, M. Mohri, S. Reddi, S. Stich, and A. T. Suresh, “Scaffold: Stochastic controlled averaging for fe derated learn- ing,” in International conference on machine learning . PMLR, 2020, pp. 5132–5143
2020
-
[15]
Feddc: F ederated learning with non-iid data via local drift decoupling and co rrection,
L. Gao, H. Fu, L. Li, Y . Chen, M. Xu, and C.-Z. Xu, “Feddc: F ederated learning with non-iid data via local drift decoupling and co rrection,” in Proceedings of the IEEE/CVF conference on computer vision a nd pattern recognition, 2022, pp. 10 112–10 121
2022
-
[17]
Communication-efficient learning of deep networks from de centralized data,
B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Ar cas, “Communication-efficient learning of deep networks from de centralized data,” in Artificial intelligence and statistics . PMLR, 2017, pp. 1273– 1282
2017
-
[18]
Maximal dissent: a state-dependent way to agree in distributed convex optimi zation,
A. V erma, M. M. V asconcelos, U. Mitra, and B. Touri, “Maximal dissent: a state-dependent way to agree in distributed convex optimi zation,” IEEE Transactions on Control of Network Systems , vol. 10, no. 4, pp. 1783– 1795, 2023
2023
-
[19]
Goldsmith, Wireless communications
A. Goldsmith, Wireless communications. Cambridge university press, 2005
2005
-
[20]
Guaranteed private c ommunication with secret block structure,
M. F. Da Costa, J. Li, and U. Mitra, “Guaranteed private c ommunication with secret block structure,” IEEE Transactions on Signal Processing , vol. 72, pp. 3547–3561, 2024
2024
-
[21]
Block modshift: Model priva cy via dynamic designed shifts,
N. A. Kherani and U. Mitra, “Block modshift: Model priva cy via dynamic designed shifts,” in AI and ML for Next-Generation Wireless Communications and Networking, NeurIPS , December 2025, accepted
2025
-
[22]
Gradient-based learning applied to document recognition,
Y . LeCun, L. Bottou, Y . Bengio, and P . Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, no. 11, pp. 2278–2324, 2002
2002
Reviewed August 11, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.