Pith. sign in

REVIEW 3 major objections 6 minor 1 cited by

Anomaly Detection in Double-entry Bookkeeping Data by Federated Learning System with Non-model Sharing Approach

T0 review · 3 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A single-round, non-model-sharing federated audit approach outperforms FedAvg and FedProx on non-i.i.d. journal entry data.

desk verdict Useful experimental comparison, but the anchor protocol breaks the paper's own privacy guarantee; deserves major revision, not desk rejection. read the letter →

arxiv 2501.12723 v2 pith:4WFP23VX submitted 2025-01-22 cs.LG

Sota Mashiko , Yuji Kawamata , Tomoru Nakayama , Tetsuya Sakurai , Yukihiko Okada This is my paper · ORCID
classification cs.LG
keywords anomalydetectionfederatedlearningdatacollaborationjournalentriesauditingautoencodernon-i.i.d.privacy-preserving
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that anomaly detection for journal entries can be done collaboratively across audit firms without exposing the entries and without keeping the devices that hold them continuously online. The proposed scheme, based on data collaboration analysis, has each organization reduce its own data to low-dimensional projections, share only those projections plus projections of a common anchor matrix, and let an analyst build a collaboration representation used to train an autoencoder. On synthetic data and on real double-entry bookkeeping records from eight healthcare organizations, the method beats models trained on a single organization's data and, especially in non-i.i.d. settings that mimic real audits, outperforms FedAvg and FedProx on overall and local anomaly detection. If correct, this gives auditors a privacy-preserving way to pool knowledge across clients with one communication round and no raw-data exposure.

What carries the argument

The load-bearing object is the data-collaboration representation. Each organization applies its own PCA-based dimensionality reduction $f_i$ to its one-hot encoded, normalized journal entries, producing intermediate representations $\tilde{X}_i = f_i(X_i)$, and applies the same map to a shared random anchor matrix. The analyst concatenates the anchor projections, takes a low-rank singular value decomposition, and computes a linear map $G_i$ via the Moore-Penrose pseudoinverse; applying $G_i$ to each organization's projections yields the collaboration representation $\hat{X}$, on which the autoencoder is trained. This mechanism lets the analyst train a joint model without ever seeing raw entries, and it reduces the whole training process to one communication round; reconstruction error of the autoencoder then serves as the anomaly score.

What would settle it

An attempted reconstruction attack on the shared intermediate representations: use the PCA projection matrix, or paired raw and projected samples, to invert the projected representations of held-out journal entries and check whether the one-hot account codes and transaction amounts are recovered; if a meaningful fraction of entries is reconstructed to the correct accounts and amounts, the paper's privacy claim is false.

Watch

Extended reading notes

Core claim

The paper's central claim is that the data collaboration (DC) framework, a non-model-sharing federated approach, can train an anomaly-detection autoencoder on journal entries distributed across organizations in a single communication round while keeping raw data local, and that this method achieves higher detection performance than model-sharing federated learning methods under non-i.i.d. conditions. In the real-data non-i.i.d. experiment with four participating organizations, DC reaches an average precision of 0.562 for all anomalies and 0.256 for local anomalies, versus 0.402 and 0.169 for FedAvg and 0.424 and 0.087 for FedProx.

Load-bearing premise

The load-bearing premise is that sharing only PCA-projected versions of the journal entries makes it infeasible to reconstruct the original entries; the paper asserts this but provides no formal privacy bound, reconstruction attack, or leakage measurement, so if the projections can be inverted the confidentiality advantage of the method would collapse.

Editorial extensions

If this is right

  • Audit firms could train joint anomaly detectors on journal entries from many clients while keeping raw data on disconnected systems, since only one outgoing transfer of projections is needed.
  • The single communication round removes the main connectivity and bandwidth burden of federated learning, making the method practical for clients that cannot stay online.
  • In non-i.i.d. environments, where each client has different account usage and data volumes, the method should remain more stable than FedAvg, whose performance degrades sharply.
  • Local anomalies, which are unusual combinations of accounts or amounts and carry high fraud risk, are detected better by the proposed method than by FedAvg and FedProx in the non-i.i.d. experiments, although a gap to centralized analysis remains.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not test the privacy guarantee: the claim that PCA projections are infeasible to invert on sparse one-hot accounting data is asserted, so a reconstruction attack should be run before the confidentiality advantage is relied on in deployment.
  • The persistent gap between DC and centralized analysis on local anomalies suggests that PCA discards information needed for subtle combined-feature anomalies; a projection method that better preserves sparse structure could close part of that gap.
  • The same single-round DC pipeline could be applied to other sensitive tabular audit data, such as expense reports or procurement records, wherever reconstruction error is a usable anomaly signal.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes a data collaboration (DC) analysis-based anomaly detection framework for double-entry bookkeeping data. Each organization applies its own PCA-based dimensionality reduction to its local journal entries and to a shared random anchor matrix, and shares only the resulting intermediate representations with an analyst. The analyst constructs a collaboration representation, trains an autoencoder on it, and returns the transformation and model to the organizations, so the whole process requires a single training round and (per the authors) no exposure of raw data and no connection of raw-data devices to external networks. The framework is evaluated on a synthetic dataset and on real multi-year journal entry data from eight Japanese healthcare organizations, under both i.i.d. and non-i.i.d. partitions, and compared against individual analysis (IA), centralized analysis (CA), FedAvg, and FedProx using average precision metrics. The reported results show that DC outperforms IA everywhere and outperforms FedAvg and FedProx under most non-i.i.d. conditions, especially on local anomalies at λ=4, while FedAvg is stronger in the i.i.d. real-data setting.

Significance. If the claims held, the framework would address a genuine operational constraint: accounting data are often kept in air-gapped environments, and model-sharing FL requires repeated connectivity. The paper has real strengths: it uses actual multi-organization journal entry data (a scarce resource), matches total training effort across baselines, repeats each experiment 10 times with standard deviations, uses both synthetic and real data, and directs the evaluation at the AP metrics that matter for auditing. The experimental comparison is mostly well constructed. However, the paper's headline confidentiality claim is asserted, not established, and the protocol as written appears to make the asserted privacy guarantee false under the paper's own assumptions. Because both the Abstract and the Introduction frame 'raw data need not be exposed' as a core advantage over model-sharing FL, this is load-bearing. The performance claims also need some tempering at λ=8, where several differences are within one standard deviation.

major comments (3)
  1. [Section 4.2, Step 1; Algorithm; Conclusion] The confidentiality guarantee is unsupported and is internally contradicted by the protocol. The authors state that recovering the raw data would require access to f_i or to matched raw/projected pairs, and assert that inferring the original journal entries 'precisely from the shared representations would be infeasible' even if the analyst were an adversary. But in the very same protocol the analyst generates the anchor X_anc (Section 4.2, item 2; Algorithm line 1), shares it with every organization, and receives back X̃_i^anc = f_i(X_anc). Since f_i is PCA, it is affine: f_i(x) = (x − μ_i)V_i with V_i ∈ R^{m×(m−1)}, so X̃_i^anc = X_anc V_i − 1(μ_iᵀV_i). If X_anc has full column rank m (true with probability 1 for a continuous random matrix once r ≥ m; the paper does not specify or bound r), least squares recovers V_i and μ_iᵀV_i uniquely, i.e., the protocol hands the analyst exactly the matched raw/projected pairs whose absence the argument presupposes. Then every shared score row s yields candidate reconstructions x = V_i(s − b) + γn, with n spanning the omitted last principal component and only the scalar γ unknown. For one-hot encoded sparse journal entries, the 0/1 account structure and the valid debit-credit pair constraints resolve γ, giving near-exact recovery. The authors themselves concede in the Conclusion that the effectiveness of preventing raw-data inference via PCA on sparse data 'warrants further investigation,' so the unqualified guarantee in Section 4.2 and the Abstract's 'without exposing raw data' framing go beyond what is established. Please either provide a formal privacy analysis under an explicit adversary model (e.g., differential privacy with calibrated noise), or add a concrete reconstruction-attack evaluation that includes the anchor-based inversion described here, and weaken the claims to match the evidence.
  2. [Section 1; Section 6] The stated novelty 'the first application of DC analysis to unsupervised learning' is contradicted by the paper's own related-work section. Section 2.2 cites Imakura et al. (2021b) as having 'applied DC analysis to anomaly detection,' and novelty detection is an unsupervised learning task. Please rephrase the contribution claim (for example, as the first application of DC analysis to autoencoder-based anomaly detection on journal entry data) so that the novelty statement is accurate with respect to the cited literature.
  3. [Section 5.2, Table 4; Abstract] The claim that DC 'consistently outperforms FedAvg and FedProx on APall and APlocal' in the non-i.i.d. setting is not supported at λ = 8. In Table 4, APall is 0.495 ± 0.035 for DC versus 0.491 ± 0.035 for FedAvg, and APlocal is 0.188 ± 0.054 versus 0.187 ± 0.058; these differences are far below one standard deviation. Similarly, in the i.i.d. real-data setting (Table 3) FedAvg exceeds DC on both APall and APlocal, which the text acknowledges but the Abstract's phrasing does not qualify. Please add paired significance tests across the 10 repeats (e.g., a paired Wilcoxon test) for each condition, and temper the superiority claims where the differences are within noise.
minor comments (6)
  1. [Section 5.1] The FedProx proximal coefficient μ is never reported, even though it is a free parameter of a baseline used in the headline comparisons; please state the value used and, ideally, a small sensitivity check.
  2. [Section 4.2] The choice m̃_i = m − 1 means the PCA retains essentially all variance; this is a peculiar choice of 'dimensionality reduction' and directly weakens the privacy rationale, so it deserves justification and an ablation over smaller m̃_i.
  3. [Algorithm, line 5] The pseudocode says the analyst 'obtains ... Y_k for all user i,' which suggests test data are shared with the analyst, contradicting Section 4.2, Step 4, where each organization applies f_i and G_i locally for anomaly detection; please clarify whether test projections are sent to the analyst.
  4. [Section 3.3] The matrix C in Eq. (7) is described only as 'an invertible matrix,' which leaves the construction of the collaboration representation underdetermined; please specify the implementation choice used in the experiments for reproducibility.
  5. [Appendix B] The caption of Table B.2 says 'The presentation style is consistent with that of Table B.2' (self-referential), and the title of Table B.4 begins 'Table B.3:'; please correct these cross-reference errors.
  6. [Abstract; Section 4.2] The 'single round of communication' phrasing actually involves three transmissions: the initial broadcast of X_anc, the clients' upload of X̃_i and X̃_i^anc, and the analyst's return of G_i and the trained autoencoder; please clarify the counting, e.g., one training round with no iterative aggregation.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the DC framework is self-cited from the authors' prior work, but the central performance claims rest on independent empirical comparisons against external baselines.

full rationale

The paper's central claim is empirical: DC-based anomaly detection outperforms IA, FedAvg, FedProx, and approaches CA under i.i.d. and non-i.i.d. settings. These comparisons are evaluated on synthetic data and real journal entry data with externally defined baselines and metrics (AP, APglobal, APlocal), so the reported results are not constructed from the method's own assumptions. The DC analysis machinery is adopted from prior work by Imakura, Sakurai, and collaborators, some of whom are co-authors here, but that self-citation supplies the methodological framework and training hyperparameters, not the paper's outcome: no parameter appearing in the paper is fitted to the claimed AP scores, and no target quantity is defined in terms of the method's output. The privacy claim, by contrast, is asserted rather than derived and is even flagged by the authors as needing further investigation in the Conclusion; however, an unsupported or questionable privacy assertion is a correctness risk, not a circular derivation. No equation or protocol step reduces to its own input, and no fitted value is renamed as a prediction. Thus the paper exhibits only minor, non-load-bearing self-citation and no significant circularity.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central empirical comparison is not circular: it is evaluated against external baselines. The main uncharged assumptions are the privacy of PCA projections and the adequacy of synthetic anomalies as proxies for real fraud. Several hyperparameters are chosen by hand or left unspecified, notably FedProx mu, which limits reproducibility.

free parameters (4)
  • PCA intermediate dimension m_tilde_i = m-1 = m-1
    Chosen by hand as target dimensionality for intermediate representations; affects information preserved and the collaboration representation.
  • Autoencoder architecture per dataset = [6,4,2,4,6] synthetic; [128,64,32,16,8,4,8,16,32,64,128] real
    Follows Schreyer et al. 2022 for real data, but arbitrary for synthetic; a model choice that affects AP.
  • Anchor data random matrix = uniform [0,1] random entries, seed unspecified
    Anchor data define the collaboration mapping; randomness is not seeded, affecting reproducibility.
  • FedProx proximal coefficient mu = not reported
    Baseline comparison requires mu, but the paper never specifies its value; a missing control variable.
assumptions (5)
  • standard math DC analysis transformations via SVD and pseudoinverse are valid and preserve analyzable structure
    Invoked in Section 3.3 equations (6)-(7) without proof; foundational result from Imakura and Sakurai 2020.
  • domain assumption Autoencoder reconstruction error is a valid anomaly score for journal entries
    Adopted from Schreyer et al. 2017 and 2022; central to the AP evaluation metric.
  • domain assumption One-hot encoded debit and credit accounts plus a normalized amount sufficiently represent journal entries for anomaly detection
    Section 5.1 defines the features used; dates, personnel, and descriptions are ignored, as acknowledged in Section 6.
  • domain assumption Synthetically injected anomalies mimic real fraud for evaluation purposes
    Section 5.1 and Appendix A describe synthetic anomaly generation; actual fraudulent entries are unavailable, as acknowledged in Section 6.
  • ad hoc to paper PCA intermediate representations prevent reconstruction and protect privacy
    Section 4.2 step 1 asserts this without formal proof or attack experiments; it is load-bearing for the confidentiality claim.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Anomaly Detection in Double-entry Bookkeeping Data by Federated Learning System with Non-model Sharing Approach." pith.science (2026). https://pith.science/paper/4WFP23VX

@misc{pith2026250112723,
  author       = {Pith},
  title        = {Pith review of: Anomaly Detection in Double-entry Bookkeeping Data by Federated Learning System with Non-model Sharing Approach},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4WFP23VX}},
  note         = {Machine review of arXiv:2501.12723}
}
read the original abstract

Anomaly detection is crucial in financial auditing, and effective detection requires large volumes of data from multiple organizations. However, journal entry data is highly sensitive, making it infeasible to share them directly across audit firms. To address this challenge, journal entry anomaly detection methods based on model share-type federated learning (FL) have been proposed. These methods require multiple rounds of communication with external servers to exchange model parameters, which necessitates connecting devices storing confidential data to external networks -- a practice not recommended for sensitive data such as journal entries. To overcome these limitations, a novel anomaly detection framework based on data collaboration (DC) analysis, a non-model share-type FL approach, is proposed. The method first transforms raw journal entry data into secure intermediate representations via dimensionality reduction and then constructs a collaboration representation used to train an anomaly detection autoencoder. Notably, the approach does not require raw data to be exposed or devices to be connected to external networks, and the entire process needs only a single round of communication. The proposed method was evaluated on both synthetic and real-world journal entry data collected from eight healthcare organizations. The experimental results demonstrated that the framework not only outperforms the baseline trained on individual data but also achieves higher detection performance than model-sharing FL methods such as FedAvg and FedProx, particularly under non-i.i.d. settings that simulate practical audit environments. This study addresses the critical need to integrate organizational knowledge while preserving data confidentiality, contributing to the development of practical intelligent auditing systems.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. We Need to Rethink Benchmarking in Anomaly Detection

    cs.LG 2025-07 conditional novelty 5.0 of 10

    Evaluating anomaly detection by averaging over diverse datasets is misleading; the paper proposes scenario-based benchmarking organized by shared structural properties.

Reference graph

Works this paper leans on

3 extracted references · 3 canonical work pages · cited by 1 Pith paper

  1. [1]

    Federated Learning System without Model Sharing through Integration of Dimensional Reduced Data Representations

    Aftabi, S. Z., Ahmadi, A., & Farzi, S. (2023). Fraud detection in financial statements using data mining and GAN models. Expert Systems with Applications, 227, 120144. Bay, S., Kumaraswamy, K., Anderle, M. G., Kumar, R., & Steier, D. M. (2006). Large scale detection of irregularities in accounting data. In Sixth International Conference on Data Mining (IC...

    work page Pith review arXiv 2023

  2. [16]

    X., Gutierrez-Portela, F., Moreno Hernandez, J

    Hernandez Aros, L., Bustamante Molano, L. X., Gutierrez-Portela, F., Moreno Hernandez, J. J., & Rodríguez Barrero, M. S. (2024). Financial fraud detection through the application of machine learning techniques: a literature review. Humanities and Social Sciences Communications, 11(1), 1-22. Hilal, W., Gadsden, S. A., & Yawney, J. (2022). Financial fraud: ...

    work page 2024

  3. [450]

    Lu, H., & Wu, Z. (2025). Revisiting intelligent audit from a data science perspective. Neurocomputing, 129431. McMahan, B., Moore, E., Ramage, D., Hampson, S., & y Arcas, B. A. (2017). Communication- efficient learning of deep networks from decentralized data. In Artificial intelligence and statistics (pp. 1273-1282). Müller, R., Schreyer, M., Sattarov, T...

    work page Pith review arXiv 2025

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.