{"id":"735d9883-71ba-4286-9e54-d1ea78372cee","arxiv_id":"2506.09690","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"A differentially private mirror-peeling knockoff algorithm is introduced, with claimed exact FDR control and asymptotic power preservation.","lead":"This paper proposes a privacy-preserving version of model-X knockoffs, a method for selecting important variables while controlling the false discovery rate. It adds calibrated random noise to a filtered set of knockoff statistics and claims this keeps the finite-sample FDR guarantee intact.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Section 4's almost-sure boundedness assumption contradicts the Gaussian knockoff construction in Eq. (4): for X~N(0,Σ), the l1 sensitivity of W_j is infinite, so Algorithm 1's noise scale and the DP guarantee are undefined for the paper's main example.","rationale":"The reader's weakest assumption identifies exactly the boundedness-versus-Gaussian mismatch, and my independent check confirms it is load-bearing. The FDR sketch in Section 3.1 is plausible: the mirror-peeling selection depends only on absolute values and independent noise, so the sign-flip property of null statistics may survive. However, the privacy half of the central claim rests on a finite sensitivity Δ_n. The paper's own Section 4 assumes ||X||_∞ ≤ C_x and |Y| ≤ C_y almost surely, then derives bounds like 4n^{-1}C_xC_y, while Section 2.3 explicitly constructs Gaussian knockoffs under X~N(0,Σ). Because Gaussian variables are unbounded, no finite C_x exists, and the l1 sensitivity of the paper's flagship marginal-correlation statistic is infinite. Thus Algorithm 1's Gaussian mechanism is not well defined for the main example, Theorem 1's DP guarantee is vacuous, and Theorem 2's hypothesis 'sensitivity at most Δ_n' cannot be satisfied. Missing proofs and placeholder sections compound the issue, but the boundedness contradiction is the most concrete and fundamental flaw. A revision that adds full proofs, states sensitivity lemmas, and either handles unbounded covariates through truncation with a re-derived knockoff construction or restricts the entire paper to bounded distributions would be needed to change this assessment.","tokens_in":13530,"tokens_out":17410,"duration_ms":214129,"concrete_test":"Analytical check: take X~N(0,I_p), |Y|≤1, and fix any two neighboring datasets that differ only in the first row with x_{1,j}=M, x'_{1,j}=0, y_1=y'_1=1, using the same seed for knockoff generation. Show that |W_j(D)-W_j(D')| ≥ (M-1)/n, so the supremum over M is infinite and Δ_n = ∞, making the Gaussian noise variance in Algorithm 1 undefined. If the authors intend bounded covariates instead, they must provide a valid knockoff construction and FDR proof for bounded X that does not rely on Eq. (4).","verdict_should_be":"UNCHANGED","load_bearing_attack":"Definition 2 defines sensitivity as a supremum over all neighboring datasets. Under the Gaussian model X~N(0,Σ) used in Eq. (4), ||X||_∞ is unbounded, so no finite C_x exists. For the marginal-correlation statistic W_j = n^{-1}(|X_j^T y| - |\\tilde X_j^T y|) analyzed in Section 4.1, take neighboring datasets differing only in the first row, set x_{1,j}=M, x'_{1,j}=0, y_1=y'_1=1, and use the same knockoff seed. The term n^{-1}|X_j^T y - X_j'^T y'| is at least n^{-1}(M-1), which grows without bound as M increases, so sup sensitivity Δ_n = ∞. Consequently the Gaussian noise variances in Algorithm 1 (8mΔ_n^2/μ^2 and 2mΔ_n^2/μ^2) are undefined, Theorem 1's μ-GDP claim is vacuous, and Theorem 2 cannot be instantiated for the leading Gaussian example. Restricting to bounded X would require a different knockoff construction than Eq. (4), since exact Gaussian knockoffs rely on the Gaussian tail, and the paper provides no truncation analysis or alternative construction. The central claim of privacy-preserving exact FDR control is therefore not supported for the paper's primary setup.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a differentially private model-X knockoff framework. It introduces a mirror-peeling algorithm (Algorithm 1) that filters a subset of knockoff statistics before adding Gaussian noise, and claims both μ-GDP privacy (Theorem 1) and exact finite-sample FDR control (Theorem 2). A power analysis (Theorems 3 and 4) gives conditions under which the relative power loss vanishes asymptotically. Sensitivity analyses for several knockoff statistics are sketched in Section 4. The central proof of Theorem 2 is deferred to a non-included supplement, and Sections 4.1–4.6 are written as proofs of lemmas that are never stated; the promised simulation section is absent.","tokens_in":13804,"tokens_out":22807,"duration_ms":260222,"significance":"If the theorems were rigorously established and the assumptions reconciled, the paper would be a useful contribution: it is, to my knowledge, a plausible route to combining model-X knockoffs with differential privacy, and the mirror-peeling idea of releasing only a subset of noisy statistics is attractive for controlling noise variance. The power-analysis framework and the explicit sensitivity bounds for several statistics are also potentially valuable. However, in its current form the central FDR claim cannot be verified from the manuscript, the main Gaussian example contradicts the paper's own boundedness assumption, and the paper is incomplete in ways that go beyond presentation.","major_comments":[{"comment":"The almost-sure boundedness assumption ∥X∥∞≤C_x and |Y|≤C_y imposed in Section 4 is incompatible with the Gaussian knockoff construction in Eq. (4), which assumes X∼N(0,Σ). For unbounded Gaussian covariates, the l1 sensitivity in Definition 2 is infinite: for the marginal-correlation statistic W_j=n^{-1}(|X_j^T y|-|\\tilde X_j^T y|), neighboring datasets differing in a single row with x_{1,j}=M vs 0 and y_1=y'_1=1 give a difference growing without bound as M grows. Consequently the noise scales 8mΔ_n^2/μ^2 and 2mΔ_n^2/μ^2 in Algorithm 1 are undefined, Theorem 1 is vacuous for this example, and Theorem 2 cannot be instantiated for the paper's leading Gaussian setting. The authors need to either restrict the entire model to bounded covariates with a valid bounded knockoff construction or provide a truncation/relaxation analysis that makes the sensitivity finite.","section":"Section 2.3, Eq. (4); Section 4, p. 18"},{"comment":"The claim that \\tilde W_{i_j}=W_{i_j}+\\tilde Z_{i_j} 'still satisfies the coin flip property' is not established. Adding noise to W_j breaks the antisymmetry condition (5), because under a swap of feature j the noise \\tilde Z_j is not flipped. Moreover, the sign of \\tilde W_j is not fair conditional on |\\tilde W_j|: if a null W_j is ±a with a>0 and \\tilde Z_j=z>0, then the value |\\tilde W_j|=a+z occurs only when W_j=+a, so the conditional probability that \\tilde W_j>0 is 1. Since the threshold \\tilde T in (8) is a function of |\\tilde W_j|, the standard Barber–Candès martingale argument does not apply to \\tilde W_j in the way the sketch suggests. The supplement must supply a detailed proof showing how exact FDR control is restored for the noisy released statistics.","section":"Section 3.1 and Algorithm 1"},{"comment":"The manuscript is incomplete in ways that prevent verification of the central claims. Theorem 2's proof is deferred to 'Section ?? in the Supplement' (not included); Sections 4.1–4.6 are each titled 'Proof of Lemma ??', but no lemma statements are given; and the numerical section promised in the abstract is missing ('Section ??'). As a result, I cannot check the validity of the FDR control proof, the sensitivity bounds, or the claimed practical demonstrations.","section":"Sections 3.1, 4.1–4.6, and Section ??"}],"minor_comments":[{"comment":"There is a typo: 'obatin' should be 'obtain'.","section":"Section 4.3, Eq. (23)"},{"comment":"Several cross-references are unresolved placeholders ('Section ??', 'Lemma ??'), which makes it difficult to assess the logical structure of the paper.","section":"Throughout"},{"comment":"The paper borrows asymptotic decay results from Fan et al. (2025a) without stating the precise conditions; since that paper is co-authored by two of the current authors, the supplement should restate the needed results to make the dependence self-contained.","section":"Section 3.2"}],"recommendation":"major_revision","confidential_remarks":"This is a very early draft: multiple unresolved placeholder cross-references, a missing supplement for the main proof, and a direct contradiction between the Gaussian knockoff example in Eq. (4) and the boundedness assumption in Section 4. The concerns in the major comments are load-bearing; I would not consider the paper for publication until Theorem 2 has a complete, verifiable proof and the sensitivity/domain assumptions are reconciled. The editor may also wish to check that the cited results from Fan et al. (2025a), which is co-authored by two of the present authors, are available to the reviewers and are being used with their precise hypotheses."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe paper has a genuinely new algorithmic idea: the mirror-peeling mechanism for filtering and masking knockoff statistics under differential privacy. The observation that filtering on absolute values plus symmetric noise preserves the coin-flip property is correct, and I have not seen it in the DP-FDR literature. If the main theorem held, it would resolve an open problem for nonlinear high-dimensional models. That is the good part.\n\nThe bad part is that the posted version does not support its central claims. Theorem 2's proof is deferred to a missing supplement. The sensitivity lemmas in Section 4 are referenced as \"Lemma ??\" without statements. There are no simulations despite the abstract's promise of demonstrations. That alone justifies a desk rejection.\n\nThe stress-test note adds a more fundamental concern. Section 4 assumes covariates are almost surely bounded, but the paper's own Gaussian knockoff construction in Eq. (4) uses X ~ N(0, Σ), which is unbounded. For the marginal-correlation statistic, the l1 sensitivity is infinite under that model, so the noise variance in Algorithm 1 is undefined and the GDP guarantee is vacuous. The boundedness assumption is load-bearing, not a technical convenience. The paper offers no truncation analysis or alternative construction for the Gaussian example. The visible algebra in Section 4.3 is correct, but it concerns an unstated lemma applied in a setting where the sensitivity is infinite. That is a serious gap.\n\nThe citations are reasonable. The power analysis relies on Fan et al. (2025a), co-authored by two of the present authors, but that is borrowed prior work, not circular. The martingale sketch for Theorem 2 is plausible and follows the standard Barber-Candès technique.\n\nThis paper is for a reader interested in DP-FDR for variable selection who wants to understand the mirror-peeling idea, but they should not take the guarantees at face value. As posted, it is not ready for peer review. My recommendation: reject with encouragement to resubmit a full version with complete proofs, stated sensitivity lemmas, and a resolution of the boundedness issue.","headline":"Mirror-peeling DP knockoffs is a real new idea, but the posted paper has a load-bearing boundedness contradiction and no proofs, so it is not ready for peer review.","tokens_in":14334,"tokens_out":4176,"would_cite":false,"duration_ms":38119,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["62F03","62J07","68P27"],"pacs":[],"model":"deepseek-v4-flash","headline":"A differentially private knockoff procedure that peels away noisy statistics keeps exact finite-sample FDR control, regardless of the privacy noise level and sample size.","keywords":["knockoffs inference","differential privacy","false discovery rate control","variable selection","feature screening","mirror peeling","Gaussian differential privacy","finite-sample FDR"],"falsifier":"Evaluate the $\\ell^1$ sensitivity in Definition 2 for the marginal-correlation statistic $W_j = n^{-1}(|X_j^T y| - |\\tilde{X}_j^T y|)$ under the paper's own Gaussian construction $X \\sim N(0, \\Sigma)$ with unbounded $Y$. The first-row term $n^{-1}|X_{1,j}y_1 - X'_{1,j}y'_1|$ is unbounded over neighboring datasets, so $\\Delta_1(W_j) = \\infty$, the Gaussian-mechanism noise scale $8m\\Delta_n^2/\\mu^2$ in Algorithm 1 is undefined, and no $\\mu$-GDP certification exists for that construction; a simulation that draws unbounded Gaussian rows and reports the empirical supremum over neighboring pairs will confirm the divergence.","tokens_in":13310,"feed_emoji":"🔒","tokens_out":19963,"duration_ms":188925,"temperature":0.7,"pith_summary":"The paper sets out to show that the model-X knockoff framework — known for exact finite-sample false discovery rate (FDR) control with no model assumed for how the response depends on the covariates — can be made differentially private without surrendering that guarantee. Its DP-knockoff procedure injects Gaussian privacy noise through a mirror-peeling step that keeps only the $m$ largest-magnitude statistics, and Theorem 2 states that the selected set still satisfies $\\mathrm{FDR} \\le q$ for every sample size, every noise scale, and every dependence between $Y$ and $X$. The structural reason is that the peeling step and the added noise depend only on absolute values plus independent symmetric noise, so the null variables' sign-flip symmetry that powers the original FDR proof is preserved. The paper further proves that the privacy noise causes asymptotically vanishing relative power loss under mild sensitivity and dependence conditions, and it sorts common knockoff statistics into dimension-free versus dimension-dependent sensitivity classes with different dimensionality limits. A reader should care because this extends differentially private false-discovery control beyond p-value settings and linear models to model-free variable selection under general nonlinear dependence.","feed_headline":"Privacy-safe knockoffs keep exact FDR control at any noise level","feed_subtitle":"Adding Gaussian privacy noise via mirror peeling preserves the model-X knockoff guarantee for every sample size.","key_machinery":"The object that carries the argument is the mirror-peeling step inside Algorithm 1, combined with a fixed-seed knockoff construction. The knockoff variables are generated as $\\tilde{X}_{i,\\cdot} = f(X_{i,\\cdot}, R_i)$ with the exogenous randomness $R_i$ fixed by a seed, so that two neighboring datasets $[X, \\tilde{X}, y]$ and $[X', \\tilde{X}', y']$ differ in exactly one row and the $\\ell^1$ sensitivity $\\Delta_n$ of each statistic $W_j = w_j([X,\\tilde{X}], y)$ is well-defined. The algorithm then peels, for $j = 1, \\dots, m$, the index $i_j = \\arg\\max_k \\{|W_k| + Z_{k,j}\\}$ with $Z_{k,j} \\sim N(0, 8m\\Delta_n^2/\\mu^2)$, and releases only the masked values $\\tilde{W}_{i_j} = W_{i_j} + \\tilde{Z}_{i_j}$ with $\\tilde{Z}_{i_j} \\sim N(0, 2m\\Delta_n^2/\\mu^2)$. Because the peeling uses only magnitudes plus independent noise, and the masking noise is symmetric, each null statistic retains the 'coin flip' property — conditional on $|W_j|$, its sign is equally likely to be positive or negative — and the knockoff threshold $\\tilde{T}$ computed on $\\{\\tilde{W}_j : j \\in D_m\\}$ inherits the finite-sample FDR control of the original threshold in (6).","core_discovery":"The paper's central claim is Theorem 2: for any $m \\in [p]$, any sensitivity bound $\\Delta_n > 0$, any privacy parameter $\\mu > 0$, and any sample size $n$, the output $\\tilde{S}$ of Algorithm 1 satisfies $\\mathrm{FDR}(\\tilde{S}) \\le q$. In other words, the differentially private mirror-peeling knockoff procedure inherits the exact, model-free, finite-sample FDR control of the original model-X knockoff, regardless of the privacy noise level and regardless of how $Y$ depends on $X$. The proof shows that the filtered index set $D_m$ depends only on the absolute values $\\{|W_j| : j \\in [p]\\}$ and on the independent Gaussian noises $\\{Z_{k,j}\\}$, while each released statistic $\\tilde{W}_{i_j} = W_{i_j} + \\tilde{Z}_{i_j}$ adds a symmetric, independent noise; consequently the null statistics keep their sign-exchange property and the martingale argument of Barber and Candès (2015) and Candès et al. (2018) applies unchanged. On the privacy side, Theorem 1 certifies that the whole procedure is $\\mu$-GDP, and Theorems 3–4 give sufficient conditions — mainly a small noise budget $b_n = 8\\Delta_n \\mu^{-1}\\sqrt{3m\\log p}$ and a peeling size $m$ large enough to retain the would-be selected statistics — under which the relative power loss against the non-private knockoff is asymptotically zero.","pith_inferences":["The sign-exchange argument that makes Theorem 2 work is generic: any peeling rule that selects indices using only magnitudes plus independent symmetric noise, followed by symmetric independent masking noise, should preserve FDR control — so mirror peeling is a template that could be reused with other noise families, other statistics, or other sign-exchange selection procedures, with the same finit","A direct testable consequence of Theorem 2 that the paper does not run: simulate bounded data with a strongly nonlinear response, run Algorithm 1 at wildly different noise scales, and verify that the empirical FDR stays at or below $q$ in every configuration while power decays smoothly with $b_n$.","The boundedness assumption needed for finite sensitivity is a data-processing decision as much as a model assumption: clipping or truncating covariates and response to $[-C_x, C_x]$ and $[-C_y, C_y]$ before analysis would restore finite sensitivity for unbounded data (including the paper's own Gaussian example), and whether this pre-processing changes the FDR guarantee in practice is a question th","For practitioners, the sensitivity classification implies a design rule the paper states only implicitly: under a fixed privacy budget, use marginal or kernel-based statistics for ultra-high-dimensional screening and reserve joint-dependence statistics for moderate dimensions, accepting their polynomial-in-$p$ sensitivity cost."],"forward_implications":["Validity and privacy decouple: Theorem 2 says $\\mathrm{FDR}(\\tilde{S}) \\le q$ holds for every $n$, $m$, $\\Delta_n$, and $\\mu$, so the data curator may choose the privacy budget purely from power considerations without ever breaking the FDR guarantee.","The procedure is certified as $\\mu$-GDP (Theorem 1), so it composes with other differentially private analyses under the GDP composition rule rather than relying on heuristic noise addition.","Under the conditions of Theorem 3 and Lemma 1 — for instance $s^{-\\gamma} d_n d_{n,0}^{-1}\\sqrt{\\log(p/a_n)} = o(1)$ and $\\Delta_n d_n \\mu^{-1}\\sqrt{m\\log p} = o(1)$ — the relative power loss to the non-private knockoff vanishes asymptotically, meaning privacy can be asymptotically free in terms of selection power.","The sensitivity classification has a concrete dimensionality consequence: statistics with dimension-free sensitivity (marginal correlation, HSIC) tolerate much larger $p$ under a fixed privacy budget, while dimension-dependent statistics (ridge and SGD coefficient differences) restrict dimensionality but can carry higher power; the proposed two-step sample-splitting variant aims at unconditional F","The required peeling size is explicit: $m > (1 + 2(1+\\varepsilon)q)s$ suffices when almost all signals are strong (Theorem 4), while the general condition in Theorem 3 demands an additional allowance for null statistics whose tails reach near the threshold."],"supporting_citations":[{"why":"Supplies the model-X knockoff construction, the threshold (6), and the finite-sample FDR theorem whose guarantee Algorithm 1 preserves.","marker":"Candès et al. (2018)"},{"why":"Supplies the original knockoff statistics and the martingale 'coin flip' argument reused in the proof of Theorem 2.","marker":"Barber and Candès (2015)"},{"why":"Defines $\\mu$-GDP and the Gaussian mechanism, plus the post-processing and composition properties used in Theorem 1 and the noise calibration.","marker":"Dong et al. (2022)"},{"why":"Introduces differential privacy itself, the privacy standard the procedure is designed to satisfy.","marker":"Dwork et al. (2006)"},{"why":"Provides the concentration and coupling results (including the lemma invoked in Section 4.6) that drive the power analysis in Theorems 3–4.","marker":"Fan et al. (2025a)"},{"why":"The first DP-FDR procedure, based on Benjamini–Hochberg with conservative bounds, which the paper's exact-control result improves upon.","marker":"Dwork et al. (2021)"},{"why":"Prior exact finite-sample DP FDR control for p-values; the paper extends the same guarantee to model-free knockoff variable selection.","marker":"Xia and Cai (2023)"},{"why":"Prior DP-FDR for high-dimensional linear models via sample splitting and mirror statistics, the setting the paper moves beyond towards general nonlinear dependence.","marker":"Cai et al. (2023)"}],"fun_headline_variants":["DP knockoffs preserve exact FDR control","Privacy noise can't break knockoff FDR guarantee","Finite-sample FDR control meets differential privacy","Model-free knockoffs now privacy-preserving","Exact FDR control under differential privacy"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that changing a single data point can change each knockoff statistic by at most a fixed finite amount, which the paper secures by assuming both the covariates and the response are almost surely bounded ($\\|X\\|_\\infty \\le C_x$ and $|Y| \\le C_y$); the paper's own Gaussian model for $X$ is unbounded, and under that model the $\\ell^1$ sensitivity is not finite, leaving the privacy guarantee undefined for the paper's main example.","fun_headline_variants_meta":{"raw":{"variants":["DP knockoffs preserve exact FDR control","Privacy noise can't break knockoff FDR guarantee","Finite-sample FDR control meets differential privacy","Model-free knockoffs now privacy-preserving","Exact FDR control under differential privacy"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000194,"raw_usage":{"total_tokens":1377,"prompt_tokens":991,"completion_tokens":386,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":607,"completion_tokens_details":{"reasoning_tokens":317}},"tokens_in":607,"tokens_out":386,"duration_ms":3976,"temperature":1.0,"reasoning_tokens":317,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T04:42:17.479225+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Evaluate the $\\ell^1$ sensitivity in Definition 2 for the marginal-correlation statistic $W_j = n^{-1}(|X_j^T y| - |\\tilde{X}_j^T y|)$ under the paper's own Gaussian construction $X \\sim N(0, \\Sigma)$ with unbounded $Y$. The first-row term $n^{-1}|X_{1,j}y_1 - X'_{1,j}y'_1|$ is unbounded over neighboring datasets, so $\\Delta_1(W_j) = \\infty$, the Gaussian-mechanism noise scale $8m\\Delta_n^2/\\mu^2$ in Algorithm 1 is undefined, and no $\\mu$-GDP certification exists for that construction; a simulation that draws unbounded Gaussian rows and reports the empirical supremum over neighboring pairs will confirm the divergence.","supporting_citations":[{"cited_title":"Controlling the false discovery rate via knockoffs","cited_arxiv_id":null,"evidence_quote":"Supplies the original knockoff statistics and the martingale 'coin flip' argument reused in the proof of Theorem 2."},{"cited_title":"Gaussian differential privacy","cited_arxiv_id":null,"evidence_quote":"Defines $\\mu$-GDP and the Gaussian mechanism, plus the post-processing and composition properties used in Theorem 1 and the noise calibration."},{"cited_title":"Calibrating noise to sensi- tivity in private data analysis","cited_arxiv_id":null,"evidence_quote":"Introduces differential privacy itself, the privacy standard the procedure is designed to satisfy."},{"cited_title":"Differentially private false discovery rate control","cited_arxiv_id":null,"evidence_quote":"The first DP-FDR procedure, based on Benjamini–Hochberg with conservative bounds, which the paper's exact-control result improves upon."},{"cited_title":"Adaptive false discovery rate control with privacy guarantee","cited_arxiv_id":null,"evidence_quote":"Prior exact finite-sample DP FDR control for p-values; the paper extends the same guarantee to model-free knockoff variable selection."}],"review_version":1}