{"id":"6cd6961c-3000-4cb8-8683-5ca60ecdc186","arxiv_id":"2412.08282","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":5,"one_line_summary":"Generalization bounds are derived for federated adversarial learning under three smoothing methods, with randomized smoothing claimed best and the SFAL reweighting claimed to improve generalization.","lead":"This paper derives mathematical upper bounds on the generalization error of two federated adversarial learning algorithms under three ways of smoothing non-smooth loss functions. It claims randomized smoothing gives the best generalization and that the reweighted SFAL aggregation further reduces error under heterogeneous data.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 6's SFAL improvement rests on an algebraic error ('(24)x2−(23)' gives 1−3α, not 1−α) and on treating data-dependent α-slack weights as fixed; without these, the r_α denominator and Remark 7's claim that SFAL enhances generalization are unsupported.","rationale":"The reader's strongest claim correctly identifies Theorem 6 and Remark 7 as load-bearing, and the reader's weakest assumption correctly targets the unhandled data-dependence of the α-slack aggregation weights. My independent reading agrees with both, and I find an additional, even more immediate algebraic error in the same proof step: 'Using (24) ×2 − (23)' yields coefficient 1−3α, not 1−α. This is not a cosmetic typo, because the entire r_α improvement claimed for SFAL is manufactured by this step. Even if the algebra were corrected, the stability recursion treats φ_t as fixed across neighboring datasets; since SFAL's weights are defined by sorting local losses and by Eq. (9), a single sample replacement can change the weight vector, and no bound on this change is provided. Thus the proof of Theorem 6 does not establish the claimed SFAL generalization improvement. The VFAL bounds in Theorems 2–4 may be partly salvageable, as they follow standard stability analyses, but the paper's second headline conclusion—'SFAL enhances generalization'—rests on the flawed Theorem 6. The experiments compare SFAL to VFAL only through generalization-gap curves on SVHN/CIFAR10; they do not isolate the r_α scaling or probe the missing weight-change term, so they cannot compensate for the broken proof. The 'RSA is most effective' claim is also an order-only comparison whose constants are not controlled, but the SFAL issue is the decisive one. Given the centrality of this result and the absence of any formal verification or parameter-free derivation that avoids the error, the current manuscript does not support its central conclusions; a corrected proof, or at minimum a bound on the weight-change term, would be required before the recommendation can be accepted.","tokens_in":38775,"tokens_out":5258,"duration_ms":59811,"concrete_test":"Independently re-derive the step 'Using (24)×2−(23)' and the resulting bound in the proof of Theorem 6. Direct substitution gives coefficient 1−3α in front of the 2Kη_t e^{βKη_t}/(m̃ n_i)E∥g_i∥ term, not 1−α. Then recompute Theorem 6's SSA bound: with coefficient 1−3α, the denominator r_α in the heterogeneity and convergence terms cannot be factored as claimed, and for α>1/3 the coefficient is negative, making the displayed bound meaningless. This single algebraic check settles whether the SFAL improvement is established.","verdict_should_be":"REJECT","load_bearing_attack":"The paper's headline recommendation—that SFAL provably reduces generalization error via Theorem 6/Remark 7—depends entirely on the stability recursion in the proof of Theorem 6. Two defects undermine it. First, the algebra at the step 'Using (24) ×2 − (23)' is wrong: with A = e^{βKη_t}E∥θ_t−θ'_t∥ + e^{βKη_t}Kη_tξ and B = 2Kη_te^{βKη_t}/(m̃n_i)E∥g_i(θ_{i,k})∥, inequality (23) is A+(1+α)B and (24) is A+(1−α)B, so 2·(24)−(23) gives A+(1−3α)B, not A+(1−α)B. The claimed denominator r_α = 1+(α/(1−α))(2m̂/m) is obtained only from this incorrect coefficient. Second, and more structurally, (23)–(24) factor the aggregation weight φ_t^{(α,j)} out of the sum as though the weight vector were identical for S and its neighbor S^(i). But SFAL computes φ^{(α,j)} from the sorted local losses (Algorithm 4, Eqs. (8)–(9)); replacing a sample changes local losses, can change the up/down-weighted partition, and changes α itself. The proof never bounds the induced difference in the aggregation operator, so the stability argument is missing a term. Without bounding this term, the conclusion that SFAL improves on VFAL in Theorem 6 does not follow from the argument as written.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper studies the generalization performance of two federated adversarial learning algorithms, VFAL and SFAL, under three smoothness approximation methods: SSA, RSA, and OPSA. It derives on-average stability bounds for VFAL in Theorems 2–4 and for SFAL in Theorem 6, with the stated conclusions that RSA is the most effective smoothing method and that SFAL improves the generalization bounds relative to VFAL by a factor r_alpha = 1 + (alpha/(1-alpha))(2*hat_m/m). The paper also reports experiments on SVHN and CIFAR10 measuring generalization gaps for varying attack strength, heterogeneity, and number of clients.","tokens_in":39159,"tokens_out":6931,"duration_ms":64085,"significance":"If the theoretical results were correct, the paper would provide a useful framework for choosing smoothing methods in federated adversarial learning and for designing aggregation rules that mitigate heterogeneity. The VFAL bounds follow standard stability templates, and the decomposition of heterogeneity via total-variation metrics is a potentially valuable addition to the literature. However, the main novel claim—that SFAL provably reduces the generalization error—rests on a flawed proof, so the significance of the SFAL contribution is not established as written.","major_comments":[{"comment":"The step labeled 'Using (24) x2 - (23)' is algebraically incorrect. With A = e^{beta K eta_t}(E||theta_t - theta'_t|| + K eta_t xi) and B = 2 K eta_t e^{beta K eta_t}/(m_tilde n_i) E||g_i(theta_{i,k})||, inequality (23) reads E||theta_{t+1}-theta'_{t+1}|| <= A + (1+alpha)B and (24) reads the same quantity <= A + (1-alpha)B; combining them as 2*(24) - (23) yields A + (1 - 3alpha)B, not the displayed A + (1-alpha)B. Moreover, (23) and (24) bound two different cases (up-weighted client i vs. down-weighted client i), so a linear combination of these two separate upper bounds cannot serve as a bound for the recursion. The denominator r_alpha in Theorem 6 and the conclusion of Remark 7 are obtained solely from this invalid step.","section":"Theorem 6 and the appendix section 'Generalization Analyses of SFAL'"},{"comment":"The proof assumes the aggregation coefficients phi_t^{(alpha,j)} are identical for the dataset S and its neighboring dataset S^{(i)}. In Algorithm 4, the weights are computed from the sorted local losses via Eqs. (8)-(9) of the main text; replacing a training sample changes these losses, can change the up/down-weighting partition, and can change alpha itself. The recursion therefore contains an additional term sum_j (phi_t(S,j)/m_tilde(S) - phi_t(S',j)/m_tilde(S')) theta'_{j,K}, which is never bounded. Without a bound on this weight-perturbation term, the SFAL stability recursion is incomplete and Theorem 6 does not follow from the argument as written.","section":"Proof of Theorem 6, Eqs. (23)-(24), and Algorithm 4"},{"comment":"The OPSA bound is stated conditionally on the width s >= 16 eta_t^2 T^2 K^2 (b' H_K)^2 (1 + 2 eta_t zeta_theta)^2, but the displayed bound then contains a term O(T (rho^2 sqrt(s) + 1) D_max/(m n_min)). Since the condition forces s to grow with T^2, the dependence of the approximation term on the width is hidden by the big-O notation as written. The comparison in Remark 5 that OPSA has the largest generalization error due to sqrt(s) is only meaningful if this width constraint is made explicit in the stated bound.","section":"Theorem 4 and Remark 5"},{"comment":"The experiments do not directly compare VFAL and SFAL across values of alpha, and they do not report variance or multiple seeds. The claim in the Experiments section that 'under suitable alpha, SFAL effectively reduces the generalization error compared to VFAL' is not supported by a presented figure or table, which is especially important because the theoretical guarantee for SFAL is the central contribution of the paper.","section":"Experiments section"}],"minor_comments":[{"comment":"In the Conclusion, the sentence 'we also find that SFAL always performs better than SFAL due to its re-weighted aggregation strategy' should read 'better than VFAL'.","section":"Conclusion"},{"comment":"Definition 3 in the main text defines xi = 2 rho z; the subscript L_z is missing, and later xi is used as 2 rho L_z.","section":"Definition 3"},{"comment":"Lemma 2 in the appendix contains a broken cross-reference, 'defined in ??', for the adversarial surrogate loss.","section":"Appendix, Lemma 2"},{"comment":"In the statement of Theorem 6, item 2 repeats 'Under Assumption 1' twice; the second occurrence is redundant.","section":"Theorem 6 statement"},{"comment":"In the supplementary experiments, 'Fot simulating the Non-IID scenario' is a typo for 'For simulating the Non-IID scenario'.","section":"Supplementary experiments"}],"recommendation":"reject","confidential_remarks":"The manuscript's principal contribution is the SFAL comparison, and the proof of the relevant theorem is invalid. The VFAL results may be salvageable, but as submitted the manuscript does not establish its central claims and the required repair would need a substantially new stability analysis of the reweighting scheme."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper's real contribution is the first stability-based generalization analysis for federated adversarial learning (FAL) comparing three smoothing approximations under the VFAL algorithm. That part is decent and worth reading: the VFAL bounds (Theorems 2–4) follow known stability templates but add a heterogeneity term based on total variation between original and adversarial distributions, which is genuinely new for this setting. The decomposition of the generalization gap into approximation, convergence, and heterogeneity terms is clear, and the experiments qualitatively match the main qualitative predictions (larger ρ and heterogeneity increase the gap; RSA has smaller gap in the tested regimes).\n\nThe soft spot is the SFAL analysis. Theorem 6 and Remark 7, which claim that the α-slack reweighting provably improves generalization over VFAL, are not established. The proof of Theorem 6 contains an algebraic error at the step labeled 'Using (24) x2 - (23)'. With A = e^{βKη_t}E||θ_t−θ'_t|| + e^{βKη_t}Kη_tξ and B = 2Kη_t e^{βKη_t}/(m̃n_i)E||g_i||, inequality (23) is A + (1+α)B and (24) is A + (1−α)B. Then 2·(24)−(23) gives A + (1−3α)B, not A + (1−α)B. The claimed denominator r_α depends entirely on that wrong coefficient. Worse, the proof factors the aggregation weight φ^{(α,j)} out of the sum as though the weight vector were identical for the dataset and its neighbor. But SFAL computes φ from the sorted local losses (Algorithm 4, Eqs. (8)–(9)); changing one sample changes local losses, can change the up/down-weighted partition, and changes α. No term bounds the induced difference in the aggregation operator. Without that term, the stability argument for SFAL is missing a load-bearing piece.\n\nSmaller issues: the 'RSA is most effective' claim is an order-only comparison, not a uniform bound, so it is a heuristic conclusion. The OPSA bound hides a width condition (s ≥ ...) that is only stated as 'without loss of generality'. The experiments are thin: only generalization gap plots, no error bars, no ablations over α or m̂ beyond one default.\n\nWho is this for? Researchers working on robustness and generalization in federated learning, especially those who want to see how stability bounds behave with smoothing approximations. The VFAL half could be salvageable and deserves referee time. But the current manuscript overclaims SFAL improvement, and Theorem 6 cannot be accepted as written. My recommendation: send to peer review with an eye toward major revision, but flag the SFAL proof for correction before publication.","headline":"The VFAL generalization bounds are a plausible new contribution, but the SFAL improvement claim rests on a concrete algebra error and an unhandled data-dependent weighting.","tokens_in":39671,"tokens_out":2758,"would_cite":false,"duration_ms":32042,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper proves stability-based generalization bounds for federated adversarial learning and argues that randomized smoothness approximation plus slack-reweighted aggregation minimizes the generalization gap.","keywords":["federated adversarial learning","generalization bounds","algorithmic stability","smoothness approximation","randomized smoothing","data heterogeneity","adversarial training","slack reweighting"],"falsifier":"Recompute the SFAL stability recursion without the fixed-weight assumption: run SFAL on $S$ and on a one-sample-replaced neighbor, record the actual weights $\\phi_t(\\alpha,i)$ on both runs, and check whether $\\mathbb{E}\\|\\theta_{t+1}-\\theta'_{t+1}\\|$ still contracts at the claimed $r_\\alpha$ rate. In the algebra, the step labeled 'Using (24) x2 - (23)' yields a coefficient $1-3\\alpha$ on the last term rather than $1-\\alpha$, so for $\\alpha > 1/3$ the claimed contraction requires an additional argument.","tokens_in":38584,"feed_emoji":"🛡️","tokens_out":10955,"duration_ms":99537,"temperature":0.7,"pith_summary":"Federated adversarial learning trains models against adversarial examples across distributed clients, but its loss functions are non-smooth, which blocks standard generalization analysis. This paper claims that three common smoothness approximation methods — surrogate, randomized, and over-parameterized — each yield explicit stability-based generalization bounds for two federated adversarial algorithms, VFAL and SFAL. The bounds say that randomized smoothness approximation (RSA) gives the smallest generalization error, and that the slack-reweighted aggregation used by SFAL improves all three bounds by a factor larger than one whenever the slack parameter $\\alpha$ is positive. If these bounds hold, practitioners facing heterogeneous client data can choose RSA with SFAL-style reweighting to reduce the gap between training and test performance, and can justify that choice by a provable statement rather than by empirics alone. The paper also draws design insights from the bounds: use adversarial-loss-based metrics for aggregation, and control attack strength, noise level, and network width.","feed_headline":"Random smoothing wins for federated adversarial learning","feed_subtitle":"New stability bounds: randomized smoothing beats other approximations, and slack reweighting helps under heterogeneity.","key_machinery":"The load-bearing machinery is the on-average stability framework for federated adversarial learning: neighboring datasets replace one sample in one client, and the generalization gap is bounded by the expected change in the loss at that perturbed point. To handle non-smooth adversarial losses, the paper plugs in three smooth surrogates: the surrogate loss $h(\\theta; z) = \\max_{\\|z-z'\\|_p \\le \\rho} \\ell(\\theta; z')$, which is only approximately gradient-Lipschitz; randomized smoothing $\\ell_\\gamma(\\theta,z) = \\mathbb{E}_u[\\ell_\\rho(\\theta+\\gamma u,z)]$ with $Q$ Monte-Carlo gradient samples; and an over-parameterized shallow network whose Hessian is bounded, making the adversarial loss $\\zeta_\\theta$-smooth. The final piece is the $\\alpha$-slack decomposed mechanism: local adversarial losses are sorted, the low-loss clients are upweighted by $1+\\alpha$ and the high-loss clients downweighted by $1-\\alpha$, with weights normalized by $\\tilde m$, and the theorems claim this inserts the factor $r_\\alpha$ into the denominator of each generalization bound.","core_discovery":"The paper's central claim is that the generalization error of federated adversarial learning can be explicitly bounded through algorithmic stability once the non-smooth adversarial loss is replaced with a smooth approximation, and that the choice of approximation method and the aggregation scheme determine how small the bound is. For Vanilla FAL, the bounds depend on the attack radius $\\rho$, data heterogeneity $D_{\\max}$, the number of clients, and local data sizes; randomized smoothing makes the leading error grow like $T^{1/4}$ rather than like $T$, while over-parameterization removes the approximation error but introduces a width-dependent heterogeneity term. For Slack FAL, the same three bounds hold with the convergence- and heterogeneity-related denominators multiplied by $r_\\alpha = 1 + \\frac{\\alpha}{1-\\alpha}\\frac{2\\hat m}{m}$, which exceeds one for $\\alpha > 0$, so the paper concludes that SFAL strictly reduces the stated generalization bounds without changing which smoothness approximation is best. This is Remark 7's claim: SFAL enhances the generalization of these methods without altering their strengths and weaknesses. The paper further identifies RSA as the most effective of the three approximations and recommends SFAL when data heterogeneity is high.","pith_inferences":["Beyond the paper: the claimed SFAL improvement rests on treating the $\\alpha$-slack weights as unchanged when one sample is replaced, and the proof does not bound the weight-drift term; a stability proof that accounts for changing weights would either recover $r_\\alpha$ with an extra cost or show the improvement is smaller than stated.","Beyond the paper: the bound suggests an adaptive schedule in which $\\alpha$ grows with the estimated heterogeneity $D_i$ (or with the ratio of sorted local adversarial losses) would shrink the generalization gap further; this is testable by comparing fixed-$\\alpha$ SFAL with a per-round adaptive $\\alpha$ on the same federated adversarial benchmark.","Beyond the paper: the RSA result implies a smoothing-noise trade-off: increasing the smoothing radius $\\gamma$ flattens the loss landscape and improves the bound, but with finite $Q$ the Monte-Carlo variance term $T^{1/4}/\\sqrt{Q}$ sets a floor, so a practical rule of small $Q$ balances the bound with client computation, consistent with the reported experiments.","Beyond the paper: applying the same stability analysis to the paper's proposed total-variation-weighted aggregation rule would require bounding how the distance $d_{TV}(\\tilde P_i, P_i)$ drifts when a sample is replaced; if that drift can be bounded, the TV-weighted rule may outperform SFAL because it uses distributional geometry rather than loss ranks."],"forward_implications":["If the bounds are correct, RSA should be the default smoothness approximation for federated adversarial learning: its generalization error grows as $T^{1/4}\\log T/\\sqrt{Q}$, which is slower than SSA's $\\rho T \\log T$ term and avoids OPSA's width-dependent term.","Under high data heterogeneity, SFAL's reweighting yields a strictly smaller bound than VFAL for all three approximations because $r_\\alpha > 1$ for $\\alpha > 0$; the paper recommends SFAL in precisely that regime.","The bounds identify controllable levers: reducing the attack radius $\\rho$ cuts the SSA error, increasing the number of smoothing samples $Q$ cuts the RSA estimation error up to a computational limit, and controlling the over-parameterized width $s$ controls the OPSA heterogeneity term.","The analysis supports designing new aggregation metrics based on local adversarial loss, contrastive loss, or adversarial penalty to target the heterogeneity term $D_{\\max}$ directly.","In the limit $\\rho \\to 0$ the SSA and RSA bounds recover standard federated-learning heterogeneity terms, so the adversarial analysis contains the non-adversarial picture as a special case."],"supporting_citations":[{"why":"Supplies the stability-of-SGD template that the federated adversarial bounds extend.","marker":"Hardt, Recht, and Singer 2016"},{"why":"Establishes the stability-to-generalization connection used to convert on-average stability into generalization bounds.","marker":"Bousquet and Elisseeff 2002"},{"why":"Provides the federated-learning on-average stability analysis with a heterogeneity term that the paper adapts to adversarial losses.","marker":"Sun, Niu, and Wei 2023"},{"why":"Gives stability bounds for adversarial training, including the lemmas on surrogate loss approximate gradient Lipschitzness used in the SSA analysis.","marker":"Xiao et al. 2022a"},{"why":"Supplies the Hessian bounds and gradient-operator stability for over-parameterized shallow networks used in the OPSA analysis.","marker":"Lei, Jin, and Ying 2022"},{"why":"Introduces the randomized smoothing approximation method for non-smooth optimization that the paper calls RSA.","marker":"Alashqar et al. 2023"},{"why":"Introduces the Slack FAL algorithm and its $\\alpha$-slack decomposed mechanism that the paper analyzes.","marker":"Zhu et al. 2023"},{"why":"Introduces the Vanilla FAL algorithm and the label-skew data partition used in the experiments.","marker":"Shah et al. 2021"},{"why":"Provides the randomized smoothing gradient estimator and its variance bound, used for the $Q$ dependence in the RSA bound.","marker":"Duchi, Bartlett, and Wainwright 2012"}],"fun_headline_variants":["Random smoothing trims generalization error in federated adversarial learning","For federated adversarial learning, randomized smoothing is key to generalization","Slack reweighting helps heterogeneous federated adversarial learning","RSA beats other smoothness approximations for federated adversarial learning"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The proof of SFAL's advantage assumes the aggregation weights are the same for a dataset and its one-sample-replaced neighbor, even though those weights are computed from the local adversarial losses that change when the sample is replaced; the proof never bounds the drift in the weights.","fun_headline_variants_meta":{"raw":{"variants":["Random smoothing trims generalization error in federated adversarial learning","For federated adversarial learning, randomized smoothing is key to generalization","Slack reweighting helps heterogeneous federated adversarial learning","RSA beats other smoothness approximations for federated adversarial learning"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000869,"raw_usage":{"total_tokens":3812,"prompt_tokens":1043,"completion_tokens":2769,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":659,"completion_tokens_details":{"reasoning_tokens":2700}},"tokens_in":659,"tokens_out":2769,"duration_ms":19238,"temperature":1.0,"reasoning_tokens":2700,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T18:00:41.442780+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Recompute the SFAL stability recursion without the fixed-weight assumption: run SFAL on $S$ and on a one-sample-replaced neighbor, record the actual weights $\\phi_t(\\alpha,i)$ on both runs, and check whether $\\mathbb{E}\\|\\theta_{t+1}-\\theta'_{t+1}\\|$ still contracts at the claimed $r_\\alpha$ rate. In the algebra, the step labeled 'Using (24) x2 - (23)' yields a coefficient $1-3\\alpha$ on the last term rather than $1-\\alpha$, so for $\\alpha > 1/3$ the claimed contraction requires an additional argument.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the stability-of-SGD template that the federated adversarial bounds extend."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Establishes the stability-to-generalization connection used to convert on-average stability into generalization bounds."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the Hessian bounds and gradient-operator stability for over-parameterized shallow networks used in the OPSA analysis."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Introduces the randomized smoothing approximation method for non-smooth optimization that the paper calls RSA."},{"cited_title":"Combating Exacerbated Heterogeneity for Robust Models in Federated Learning","cited_arxiv_id":"2303.00250","evidence_quote":"Introduces the Slack FAL algorithm and its $\\alpha$-slack decomposed mechanism that the paper analyzes."},{"cited_title":"C.; Bartlett, P","cited_arxiv_id":null,"evidence_quote":"Provides the randomized smoothing gradient estimator and its variance bound, used for the $Q$ dependence in the RSA bound."}],"review_version":1}