{"id":"7db21a21-73eb-4e31-934a-ed1087cdd1be","arxiv_id":"2412.16083","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"DP-FedTabDiff wraps an existing federated tabular diffusion model with per-client DP-SGD and reports how the privacy budget, number of clients, and local update count affect synthetic data quality and empirical privacy risk.","lead":"Sattarov and colleagues combine differential privacy, federated learning, and diffusion models to generate synthetic tabular data, and they measure the privacy, utility, and fidelity trade-offs on four public datasets. The potential use is allowing banks or hospitals to train shared data generators without pooling raw records, provided the formal privacy accounting is corrected and the method is validated against baselines.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Reported ε=1 is a per-client Opacus budget; without composition over R=3,000 federated rounds, the global model's formal privacy loss is not established.","rationale":"The paper's headline is a formal DP guarantee for a federated diffusion synthesizer. The strongest claim requires that the released global model be (ε,δ)-DP with ε=1 at moderate privacy. The described mechanism is per-client DP-SGD (Eq. 6) with Opacus-based accounting, followed by FedAvg aggregation (Eq. 4). The missing step is composition: after R=3,000 communication rounds, a client's local data influences the global model through every round in which that client participates. No federated privacy accountant is described, and the paper does not even report noise scale or clipping norm. The empirical Anonymeter results demonstrate reduced singling-out/linkability/inference risk, but they do not establish a formal DP bound. The reader's weakest_assumption is exactly this missing composition, and I agree. I considered other concerns — absence of external baselines, missing error bars, ambiguous random-client selection — but none is as load-bearing as the unaccounted composition. Thus the REJECT verdict stands; with a proper federated accountant and reproducible noise/clipping parameters, the paper could become conditionally acceptable. Hence UNCHANGED relative to the reader's verdict.","tokens_in":12578,"tokens_out":4006,"duration_ms":37015,"concrete_test":"Recompute the privacy loss of the final global model under a standard federated DP accountant (e.g., DP-FedAvg with Rényi DP composition over all R=3,000 rounds, using δ=N^-1, the actual noise scale σ, clipping norm C, and participation schedule). If the composed ε_global exceeds the reported ε by more than a small additive constant (say 0.1), the claimed formal guarantee fails. The authors should release σ, C, and participation details; alternatively, instrument the federated training loop with a global privacy accountant and report ε_global alongside the per-client ε.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that the aggregated global model is ε-DP compliant, with ε=1 at moderate privacy. The only privacy mechanism described is per-client DP-SGD (Eq. 6) with Opacus accounting, followed by FedAvg aggregation (Eq. 4). Missing is any composition argument across communication rounds: after R=3,000 rounds, each client's data influences the global model through every round in which that client participates. Basic composition alone would multiply the per-round ε; even advanced composition or Rényi DP would yield a total ε substantially larger than the reported value for δ=N^-1. The paper also omits the noise scale σ, the clipping norm C, and the client participation schedule, so the claimed ε values cannot be reproduced or audited. Post-processing by the server does not remove the need to compose the privacy loss over all rounds. Thus the formal privacy guarantee — the paper's headline contribution — is unsupported by the evidence provided. The empirical Anonymeter risk reductions are real, but attack-based estimation is not a substitute for a formal DP composition proof.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes DP-FedTabDiff, a framework that combines denoising diffusion probabilistic models, federated learning, and differential privacy for synthetic tabular data generation. Each client applies Opacus-based DP-SGD locally during training, and the server aggregates the resulting model updates via Federated Averaging. The authors report experimental results on four real-world tabular datasets, measuring privacy risk with Anonymeter, utility via downstream classifier accuracy, and fidelity via distributional similarity. They claim that the aggregated global model generates ε-DP compliant synthetic data with formal privacy guarantees, and they present trade-offs across privacy budgets, numbers of clients, local update counts, and federated optimization strategies. The central formal claim is that a moderate privacy budget of ε=1 yields a 34% privacy-risk reduction with only 15% utility loss and 14% fidelity loss relative to the no-DP setting.","tokens_in":12732,"tokens_out":2003,"duration_ms":20156,"significance":"If the formal privacy guarantee were established, the paper would be a useful contribution to privacy-preserving synthetic tabular data generation in federated settings. The empirical framework is thoughtful: it evaluates three distinct privacy risk dimensions (singling out, linkability, inference) in addition to utility and fidelity, and it studies how DP interacts with federated hyperparameters such as local updates and client counts. However, the central technical claim — that the final global model is ε-DP compliant with ε values as reported — is not supported by the material in the manuscript. The paper also omits several DP hyperparameters required for reproducibility and provides no comparison against existing DP generative models. The empirical trade-offs are plausible and internally consistent, but the formal privacy guarantee is the load-bearing contribution, and it is not demonstrated.","major_comments":[{"comment":"The claimed privacy guarantee is not established because the paper does not compose privacy loss over the R=3,000 federated communication rounds. Equation (6) describes per-client DP-SGD with noise added to clipped gradients, and Equation (4) aggregates client updates via FedAvg. The reported ε values (e.g., ε=1) appear to be the per-client Opacus privacy budgets for local training, but each client's data influences the global model in every round in which that client participates. Basic composition would multiply the per-round ε by the number of rounds, and even advanced or Rényi composition would yield a total ε substantially larger than 1 for δ=N^{-1}. The paper provides no federated privacy accountant or moments-accounting argument across rounds. Consequently, the headline claim of an ε-DP compliant global model with ε=1 is unsupported.","section":"Section III, Eq. (6), Eq. (4); Section IV-B"},{"comment":"The manuscript does not report the Gaussian noise scale σ, the gradient clipping norm C, or the client participation schedule for the reported experiments. The text states that privacy settings are adopted from [34] and that Opacus is used, but the actual values of σ and C are absent. Without these parameters, the claimed ε values cannot be reproduced or audited, and it is impossible to verify whether the reported privacy budgets correspond to the actual noise injection. This is a load-bearing omission because the paper's central claim is a formal privacy guarantee.","section":"Section IV-B, Differential Privacy"},{"comment":"The experimental evaluation contains no comparison against existing differentially private generative models or centralized DP baselines. All comparisons are against the non-DP version of the authors' own framework (ε=∞). The paper claims 'optimal trade-offs between privacy budgets, client configurations, and federated optimization strategies' and 'significant improvements in privacy guarantees,' but without baselines such as PATE-GAN, DP-GAN, or a centralized DP diffusion model, these claims are not substantiated. The empirical results show internal trends, but they do not demonstrate that DP-FedTabDiff is competitive with or superior to prior work.","section":"Section V, RQ2 and RQ3"}],"minor_comments":[{"comment":"The aggregation equation contains notation errors: the term 'λX i=1' appears to be a corrupted summation sign, and '|Di| ⊆ |D|' should be '|Di| ≤ |D|' or similar. This should be corrected for readability.","section":"Equation (4)"},{"comment":"The heatmap labels show 'DP-' as a category (presumably denoting ε=∞), which is confusing. The label should be explicit, such as 'ε=∞ (no DP)'.","section":"Figure 5"},{"comment":"The Equation (7) aggregates three risk measures by simple averaging, but these measures have different scales and distributions (as seen in Figure 7). The aggregation scheme should be justified, or the individual components should be reported separately in the main results.","section":"Section IV-C, Privacy"},{"comment":"The formal DP definition in Equation (5) is standard and correctly stated, but the manuscript does not specify which DP variant (e.g., approximate DP) is used when referring to ε-DP compliance. Clarifying this would help readers interpret the claims.","section":"Section III, Differential Privacy"}],"recommendation":"major_revision","confidential_remarks":"The core issue is the missing composition argument for privacy over federated rounds. This is not a simple presentation fix; it requires either a proper privacy accountant (e.g., RDP composition over all client selections and rounds) or a revised claim that reports only the per-client local privacy guarantee. Given the paper's scope, this is fixable by redoing the privacy analysis (or reframing the contribution as empirical), but the current version cannot support the headline formal guarantee. The lack of baselines is also a significant weakness for a systems-oriented paper. I recommend major revision, not rejection, because the empirical framework and the underlying diffusion/federated setup are sound and potentially useful once the privacy accounting is corrected."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is a solid engineering integration: it is the first to combine DP-SGD with federated diffusion for mixed-type tabular data, and the empirical study is internally consistent and clearly presented. The authors measure privacy, utility, and fidelity across privacy budgets, client counts, local update counts, and four federated strategies, and the t-SNE and risk breakdown figures help make the trade-offs concrete. The writing is readable, and the use of standard libraries (Opacus, Flower, FinDiff/FedTabDiff) makes the pipeline reproducible in principle.\n\nThe soft spot is load-bearing. The paper claims the aggregated global model is ε-DP compliant, with ε=1 as a moderate budget, and the abstract promises \"formal privacy guarantees.\" What is actually computed is a per-client DP-SGD privacy loss from Opacus, applied to local updates (Eq. 6), then averaged by FedAvg (Eq. 4). There is no composition across the R=3,000 communication rounds. Each client's data influences the global model in every round it participates, so the true privacy loss of the released model is larger than reported. The paper also omits the noise scale σ, the clipping norm C, and the client participation schedule, so the claimed ε values are not auditable. The Anonymeter risk reductions are real empirical measurements, but attack-based estimation does not substitute for a DP composition argument.\n\nOther issues are minor by comparison: there are no external baselines against existing DP synthesizers (e.g., DP-CTGAN, PATE-GAN), and the utility/fidelity aggregates lack error bars, though the singling-out evaluation does report confidence intervals. The literature review is honest, including the authors' own prior work as a dependency rather than a circular step.\n\nThis paper should go to peer review because the integration is new and the empirical ablation is substantial, but it needs major revision. The authors should add a proper federated privacy accountant (RDP or advanced composition across all rounds), report all DP hyperparameters, and compare against existing differentially private tabular synthesizers. Without those additions, the central claim of formal privacy remains unsubstantiated.","headline":"Useful engineering integration with a clean ablation study, but the headline formal privacy guarantee is not established: reported epsilons are per-client DP-SGD budgets never composed over R=3,000 federated rounds.","tokens_in":13293,"tokens_out":1807,"would_cite":true,"duration_ms":17693,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper proposes DP-FedTabDiff, which merges differential privacy, federated learning, and diffusion models for synthetic tabular data; at epsilon=1 it measures a 34% drop in attack risk with 15% utility and 14% fidelity loss.","keywords":["differential privacy","federated learning","diffusion models","tabular data synthesis","synthetic data","privacy-utility trade-off","DP-SGD","non-IID data"],"falsifier":"Run a full federated privacy accounting (e.g., moments accountant or RDP composition) over the 3,000 communication rounds with the paper's noise scale, clipping norm, batch size, sampling rate, and $\\delta=N^{-1}$, and compare the resulting $\\varepsilon$ with the claimed 10, 1, and 0.2. If the composed $\\varepsilon$ is materially larger, the formal privacy guarantee stated for DP-FedTabDiff is false for the reported settings.","tokens_in":12337,"feed_emoji":"🔐","tokens_out":8644,"duration_ms":65509,"temperature":0.7,"pith_summary":"This paper sets out to prove that differential privacy, federated learning, and diffusion models can be combined to synthesize tabular data with a formal privacy guarantee while keeping the data usable. The proposed framework, DP-FedTabDiff, adds per-client DP-SGD noise to a tabular diffusion model and aggregates the noisy updates with federated averaging. In experiments on four real-world mixed-type datasets, a moderate privacy budget of $\\varepsilon=1$ lowers the measured risk of singling out, linkability, and inference by 34% compared with no DP, at the cost of 15% lower utility and 14% lower fidelity. The result promises a practical way for regulated institutions to share synthetic data without sharing raw records.","feed_headline":"DP-FedTabDiff cuts attack risk 34% at epsilon=1","feed_subtitle":"Formal DP meets federated diffusion: moderate privacy costs 15% utility, 14% fidelity.","key_machinery":"The central mechanism is the DP-FedTabDiff training loop. Each client optimizes a FinDiff denoising diffusion probabilistic model for mixed-type tabular data, applying per-sample gradient clipping and Gaussian noise (the DP-SGD update) during $\\gamma$ local steps; the server then combines the client models by Federated Averaging across $R$ communication rounds. The formal privacy claim rests on the Gaussian mechanism: the noise scale is chosen so that each local update satisfies $(\\varepsilon,\\delta)$-DP with $\\delta = N^{-1}$, and the aggregated model is asserted to inherit that guarantee.","core_discovery":"The discovery is that the three components can be layered without collapse, and that a clear privacy-quality frontier emerges. At $\\varepsilon=1$ the framework cuts empirical attack risk by roughly a third while degrading utility and fidelity by about 15% and 14%; lowering $\\varepsilon$ to 0.2 further suppresses attack risk but visibly distorts the synthetic data's structure, while raising $\\varepsilon$ to 10 approaches no-DP quality with higher re-identification risk. The paper frames this as a tunable trade-off for privacy-constrained settings rather than a single optimal operating point.","pith_inferences":["The stated 'formal guarantee' is only as strong as a per-client DP-SGD account; a proper composition across the 3,000 federated rounds is not reported, so the effective global epsilon may be larger than claimed.","The empirical privacy score is based on simulated attacks, not a mathematical proof; it is therefore a practical risk estimate that cannot replace a federated privacy accountant if a certified guarantee is the goal.","A natural next experiment is to fix a total privacy budget across all federated rounds and compare the resulting utility-fidelity frontier with a centralized DP diffusion baseline; the paper does not include this comparison.","The same client-side DP-SGD plus federated averaging recipe could be transferred to conditional tabular diffusion or time-series data, but the noise scale and clipping norm would need recalibration for each modality."],"forward_implications":["A moderate privacy budget ($\\varepsilon=1$) offers a workable operating point: one-third lower measured attack risk for about 15% utility loss and 14% fidelity loss.","Fewer local updates ($\\Gamma=100$) deliver the best privacy-quality trade-off and cut training time from 28 to 3.5 hours.","More federated clients improve privacy and, up to five clients, improve fidelity, with diminishing returns beyond that.","The four federated optimization strategies tested show nearly identical utility and fidelity, with dataset-dependent privacy differences."],"supporting_citations":[{"why":"Supplies the underlying FinDiff diffusion model for mixed-type tabular data that each client trains.","marker":"[13]"},{"why":"Provides the federated extension (FedTabDiff) that DP-FedTabDiff builds on for decentralized training.","marker":"[10]"},{"why":"Gives the formal definition of (epsilon, delta)-differential privacy that the framework claims to satisfy.","marker":"[7]"},{"why":"Defines the Gaussian mechanism used to add calibrated noise to clipped gradients.","marker":"[45]"},{"why":"Establishes the simplified denoising objective used to train the diffusion model.","marker":"[44]"},{"why":"Supplies the privacy settings (epsilon in {0.2, 1, 10}) and the precedent for differentially private diffusion models.","marker":"[34]"},{"why":"Defines Federated Averaging, the aggregation rule that combines client updates into the global model.","marker":"[5]"},{"why":"The implementation used for per-client DP-SGD training and privacy accounting in the experiments.","marker":"[51]"},{"why":"Provides the empirical attack-risk evaluator (singling out, linkability, inference) used for the privacy metric.","marker":"[52]"}],"fun_headline_variants":["DP-FedTabDiff: 34% less re-ID risk, 15% utility loss at eps=1","Federated diffusion + DP: attack risk cut 34% at epsilon=1","Privacy-quality frontier: DP-FedTabDiff's 34% risk cut at epsilon=1","DP-FedTabDiff trade-off: 34% risk drop for 15% utility loss"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the privacy loss of the per-client DP-SGD updates, measured by a single-client accountant, is also the privacy loss of the global model after $R=3{,}000$ federated averaging rounds; the paper provides no composition theorem or accountant for the federated process, so if that composition is invalid the formal $\\varepsilon$-DP claim collapses.","fun_headline_variants_meta":{"raw":{"variants":["DP-FedTabDiff: 34% less re-ID risk, 15% utility loss at eps=1","Federated diffusion + DP: attack risk cut 34% at epsilon=1","Privacy-quality frontier: DP-FedTabDiff's 34% risk cut at epsilon=1","DP-FedTabDiff trade-off: 34% risk drop for 15% utility loss"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001861,"raw_usage":{"total_tokens":7235,"prompt_tokens":799,"completion_tokens":6436,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":415,"completion_tokens_details":{"reasoning_tokens":6335}},"tokens_in":415,"tokens_out":6436,"duration_ms":42150,"temperature":1.0,"reasoning_tokens":6335,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T10:48:20.684754+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a full federated privacy accounting (e.g., moments accountant or RDP composition) over the 3,000 communication rounds with the paper's noise scale, clipping norm, batch size, sampling rate, and $\\delta=N^{-1}$, and compare the resulting $\\varepsilon$ with the claimed 10, 1, and 0.2. If the composed $\\varepsilon$ is materially larger, the formal privacy guarantee stated for DP-FedTabDiff is false for the reported settings.","supporting_citations":[{"cited_title":"Our data, ourselves: Privacy via distributed noise generation,","cited_arxiv_id":null,"evidence_quote":"Gives the formal definition of (epsilon, delta)-differential privacy that the framework claims to satisfy."},{"cited_title":"Denoising Diffusion Probabilistic Models,","cited_arxiv_id":null,"evidence_quote":"Establishes the simplified denoising objective used to train the diffusion model."},{"cited_title":"Communication-Efficient Learning of Deep Networks from Decentral- ized Data,","cited_arxiv_id":null,"evidence_quote":"Defines Federated Averaging, the aggregation rule that combines client updates into the global model."}],"review_version":1}