{"id":"36888cda-1f31-4429-8d4c-b57128210fed","arxiv_id":"2506.15112","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":5,"one_line_summary":"PDLRecover removes the influence of detected malicious or dropped clients from a decentralized model by approximating their missing gradient updates with secret-shared L-BFGS Hessian-vector products.","lead":"This paper proposes PDLRecover, a method for recovering a poisoned global model in decentralized learning without full retraining, using historical gradients and secret-shared L-BFGS approximations. It claims comparable accuracy to retraining with about one-third less runtime, while preserving client privacy.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Section VII-A's correctness proof only proves linearity of Shamir summation; SS-L-BFGS is nonlinear (ratios, matrix inverse), so local HVPs are not shares and Lagrange reconstruction of the global HVP is invalid.","rationale":"The reader's weakest_assumption is exactly the load-bearing issue: L-BFGS involves products, ratios, and matrix inversion, which are not linear homomorphic operations, so Shamir's linearity cannot be carried through the local HVP computation. My independent reading of Algorithm 2 and Section VII-A confirms and strengthens that concern. Each client's eG buffer is not a true gradient but a randomized Shamir evaluation; the local SS-L-BFGS output is a rational function of the share coordinate; and the theorem never proves that interpolating these nonlinear outputs reproduces the true global HVP. This is load-bearing because it is the only mechanism that simultaneously provides correctness (recovered model close to retraining) and privacy (no client gradients revealed). If this step fails, the experimental numbers may describe a non-private recovery procedure, but the paper's claimed privacy-preserving secret-shared L-BFGS construction is unsupported. The lack of code, error bars, and a backdoor success metric are secondary, as are the internal inconsistencies in the Theorem 1 bound of Section VII-C (the undefined quantity M, and the assumption of exact HVP in Corollary 1). The reader's REJECT verdict should stand unchanged.","tokens_in":19025,"tokens_out":9353,"duration_ms":102984,"concrete_test":"Run a 2-client, s=1 reconstruction check over F_q (or 64-bit reals with fixed-point rounding). Fix a global model-difference vector w and a direction v. Let y = g_1 + g_2 be the true aggregate gradient difference. Choose a random nonzero R and form the degree-1 Shamir polynomial F(x) = y + R*x; evaluate F(1) and F(2). Compute H_1 = SS-L-BFGS(w, F(1), v), H_2 = SS-L-BFGS(w, F(2), v), and Lagrange-interpolate at 0: H_interp = 2*H_1 - H_2. Also compute H_true = SS-L-BFGS(w, y, v). If H_interp != H_true for generic random R, then Eqs. (25)-(27) fail. A short script will confirm this; report ||H_interp - H_true|| / ||H_true||, and any nonzero value falsifies the claimed linear homomorphism of SS-L-BFGS.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that Lagrange interpolation of per-client SS-L-BFGS HVPs reconstructs the global HVP (Section VII-A, Eqs. 24-28). The proof establishes only that Shamir reconstruction is linear for sums of secrets (Eqs. 18-23); it then asserts that the same linearity applies to the output of Algorithm 2. It does not. In SS-L-BFGS, eG^{(x_j)} is a single Shamir evaluation F(x_j) of the aggregate gradient history; the local computation includes rho = (Delta g_s^T Delta w_s)/(Delta w_s^T Delta w_s) and the matrix inversion in Algorithm 2 line 5. These operations are rational, not polynomial, functions of x_j. Hence, the HVP returned by a client is not a Shamir share of the true global HVP. Equation (26) moves interpolation inside the Hessian-vector product without justification, and the resulting global Hessian approximation is not the L-BFGS curvature of the aggregate data. Worse, the local eG^{(x_j)} itself is a randomized share such as F(x_j) = Delta G + R_1 x_j + ..., so each client's local L-BFGS is computed on a masked vector, not on the true aggregate gradient. A correct construction would require a full secure multiparty protocol for L-BFGS (for example, Beaver-triple arithmetic over F_q), which the paper does not provide or cite.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes PDLRecover, a decentralized model-recovery framework that removes the influence of malicious or dropped clients from a poisoned global model without full retraining. The method combines historical gradient/model buffers, an L-BFGS-based Hessian-vector product approximation, and Shamir secret sharing. Each client computes a local approximate update direction on its secret-shared gradient history, and the global direction is reconstructed by Lagrange interpolation. The authors claim that the recovered model matches a retrained model in accuracy while saving roughly one third of the runtime, and that the secret-shared L-BFGS construction preserves privacy and gradient fidelity. Experimental results on MNIST, FashionMNIST, and HAR are reported, and a correctness proof plus two privacy theorems are given.","tokens_in":19391,"tokens_out":3311,"duration_ms":38492,"significance":"If the proposed construction were sound, this would be a useful contribution to machine unlearning and decentralized learning: it addresses an underexplored problem, recovering a compromised global model using historical information, and it attempts to add a privacy guarantee to the recovery procedure. The experimental comparison against drop-client retraining and existing unlearning baselines is a practical strength, and the paper states its efficiency claims clearly. However, the central privacy-preserving mechanism is not sound as presented: the correctness proof in Section VII-A establishes only linearity of Lagrange interpolation for sums, whereas the L-BFGS computation in Algorithm 2 is nonlinear. The global Hessian approximation is defined to be the interpolation of the local HVPs, making the claimed gradient fidelity a tautology rather than a derived property. Because this flaw undermines the paper's main technical claim, the current manuscript does not support the stated contribution.","major_comments":[{"comment":"The correctness proof does not establish that Lagrange interpolation of per-client SS-L-BFGS outputs recovers the true global Hessian-vector product. Eq. (18)-(23) prove only that Shamir reconstruction is linear for sums of secrets. The extension to L-BFGS is asserted: in Eq. (26), the term \\sum_j \\tilde{H}^{(x_j)}(\\hat{w}_t - \\bar{w}_t) \\ell_j(0) is relabeled as \\tilde{H}(\\hat{w}_t - \\bar{w}_t), and the global Hessian approximation is then defined as the Lagrange interpolation of the local HVPs, so Eq. (27) holds by definition. This is circular. More importantly, Algorithm 2 is not linear: line 4 computes a ratio \\rho = (\\Delta g^T \\Delta w)/(\\Delta w^T \\Delta w), and line 5 computes a matrix inverse. These are rational, not linear, functions of the secret-shared inputs. Therefore the local value \\tilde{H}^{(x_j)}v computed on a masked/share vector is not a Shamir share of the true global HVP, and the reconstruction in Eq. (16) does not yield the correct aggregate update direction.","section":"Section VII-A, Eqs. (24)-(28); Algorithm 2"},{"comment":"The convergence bound is not well-defined. Eq. (32) contains an undefined quantity M, while Assumption 2 (Eq. (31)) defines a bound Z on the HVP approximation error and Eq. (33) uses Z; the relationship between M and Z is never stated. The proof of Theorem 1 is a single sentence stating that PDLRecover recursively bounds the difference in each iteration, which does not substantiate the displayed inequality. Corollary 1 then concludes convergence to the retrained model when the HVP is computed exactly, but the antecedent is not established for the secret-shared L-BFGS procedure, and in light of the nonlinearity issue above it is not clear in what sense exactness could hold.","section":"Section VII-C, Theorem 1 and Eq. (32)"},{"comment":"The privacy analysis is informal and does not match the protocol. Theorem 1 claims that an external attacker who steals one client's stored subsecrets cannot recover complete local update information, but the argument appeals to collusion of k clients recovering only the sum; this does not quantify the number of shares needed or the threshold used in the Shamir scheme. Theorem 2 claims that a malicious client cannot obtain honest clients' local updates unless more than k malicious clients collude, but the protocol description in Section V has each client send shares of its gradient to all others, so every client holds one share of every other client's polynomial. The analysis does not state the reconstruction threshold, does not define the attacker model precisely, and does not address the recovery phase, where each client broadcasts its locally computed \\hat{g}^{(x_j)}_t. Even if the privacy statements were correct for sums of shares, they do not repair the correctness failure of the SS-L-BFGS reconstruction.","section":"Section VII-B, Theorems 1 and 2"}],"minor_comments":[{"comment":"The abstract contains the typo \"degradate\" instead of \"degrade.\" In the Introduction, the placeholder \"[references]\" appears after \"existing defenses [references]\" and should be replaced with actual citations.","section":"Abstract and Section I"},{"comment":"The secret-sharing polynomial in Eq. (11) is stated to have degree at most n, but the Shamir construction in Section III-B uses a polynomial of degree t-1 and the text later refers to a threshold t (or tth). The relationship among n, t, and the number of malicious clients is never made precise, which matters for the privacy claims in Section VII-B.","section":"Section V, Eq. (11)"},{"comment":"Line 19 uses t as both the iteration index and the number of shares in the Lagrange sum: \\hat{g}_t = \\sum_{j=1}^{t} \\hat{g}^{(x_j)}_t \\cdot \\prod_{1\\le i \\le t, i\\ne j} \\frac{0-x_i}{x_j-x_i}. This is confusing and likely a typo; the sum should be over the n clients and the Lagrange basis should use their distinct share points x_j.","section":"Algorithm 1, line 19"},{"comment":"The remarks state that real-valued vectors are quantized to fixed-point integers and mapped into F_q, but the paper does not analyze the error introduced by quantization or the handling of negative values and modular wraparound in the finite field. This matters because L-BFGS involves divisions and matrix inversions, which are sensitive to field-arithmetic precision.","section":"Section VII-A, Remarks on Quantization"},{"comment":"The experimental section reports accuracy and runtime for a single configuration but does not state the number of runs, variance, or error bars. Given that the recovery process involves randomized secret sharing and stochastic training, reporting mean and standard deviation across seeds would strengthen the comparison.","section":"Section VI"}],"recommendation":"reject","confidential_remarks":"The paper appears to be an early draft, with a placeholder citation in the introduction and several notation issues. More substantively, the central claim that secret-shared L-BFGS preserves gradient fidelity is not supported: the proof in Section VII-A is tautological, and L-BFGS is not a linear homomorphic operation, so the proposed reconstruction cannot compute the true global HVP. Fixing this would require a substantially different secure multiparty computation approach for L-BFGS, which is well beyond a revision. I therefore recommend rejection, despite the potentially useful experimental framing."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the paper tackles a real problem — recovering a poisoned global model in fully decentralized learning without a central server — and the experimental recovery scheme looks plausible. But the privacy-preserving core, secret-shared L-BFGS, is not sound. The proof in Section VII-A shows only that Shamir reconstruction is linear for sums of secrets. That is true, but it does not show that per-client L-BFGS outputs, which involve ratios and matrix inverses, are valid shares of the true Hessian-vector product. So Eq. (27) is a definition, not a derived result. Worse, each client runs L-BFGS on a randomized share vector, not on the aggregate gradient, so the local curvature estimate is not connected to the global curvature in any straightforward way.\n\nWhat is new here is the combination: applying the historical-information recovery idea from FedRecover to a serverless setting and wrapping it in Shamir secret sharing to keep client updates private. That is a genuine departure from prior work. The experimental section shows PDLRecover recovers accuracy close to drop-client retraining across MNIST, FashionMNIST, and HAR, with about a third less runtime. That part is credible and takes the idea seriously.\n\nThe soft spots beyond the core flaw: the convergence bound in Theorem 1 uses an M that is never defined — presumably it should be the Z from Assumption 2, but as written it is a gap. The experiments report no error bars, no code, and no backdoor success rate, which is the metric that actually matters for a backdoor attack. Table IV compares against centralized and federated unlearning baselines, not a decentralized one, so the comparison is somewhat apples-to-oranges.\n\nWho gets value from this? Researchers working on machine unlearning in decentralized settings will find the problem formulation useful, and the negative result about simple linear homomorphism is worth knowing. It is not a paper to cite as a working privacy-preserving protocol.\n\nMy recommendation: send it to peer review. The topic is important and the flaw is subtle enough that a formal treatment of L-BFGS over secret shares would be a real contribution. But the bar for acceptance should be a correct secure MPC construction or a clear argument that the linearity assumption is unnecessary. As it stands, I would reject.","headline":"A real decentralized-recovery problem with plausible experiments, but the privacy-preserving core doesn't hold up: L-BFGS is nonlinear, so Shamir shares don't reconstruct the way the proof claims.","tokens_in":19864,"tokens_out":3161,"would_cite":false,"duration_ms":33825,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that a poisoned decentralized model can be restored to near-retrained accuracy at about two-thirds the runtime, without exposing client updates.","keywords":["decentralized learning","machine unlearning","poison attack recovery","secret sharing","L-BFGS","Hessian-vector product","privacy preservation","federated learning"],"falsifier":"Compute the exact global Hessian-vector product for a small convex model with a known Hessian, then compare it with the value reconstructed from a few clients' SS-L-BFGS shares; if the two differ beyond quantization error, the identity in equation (27) fails and the recovery guarantee collapses.","tokens_in":18839,"feed_emoji":"🛡️","tokens_out":4092,"duration_ms":39043,"temperature":0.7,"pith_summary":"PDLRecover is a decentralized machine-unlearning method that removes the influence of malicious or dropped clients from an already trained global model without retraining from scratch. The paper claims that by combining an L-BFGS approximation of the Hessian-vector product with Shamir secret sharing, clients can jointly reconstruct the global update direction needed to roll the model back to a clean state, while each client's local gradients stay private. The intended payoff is that a poisoned global model recovers to accuracy comparable to retraining with the malicious clients removed, at roughly two-thirds the runtime, and the recovery works in a fully decentralized setting rather than requiring a trusted server. The method also includes periodic exact updates to keep curvature information fresh and a final exact phase to remove accumulated approximation error.","feed_headline":"Poisoned model recovery matches retraining at two-thirds the time","feed_subtitle":"A secret-shared L-BFGS method restores global models after poison attacks while keeping client updates private.","key_machinery":"The load-bearing object is SS-L-BFGS, an extension of the L-BFGS algorithm that computes an approximate Hessian-vector product on secret shares. In Algorithm 2, each client forms matrices from its local buffers, $\\tilde{W}$ and $\\tilde{G}$, and solves a small linear system to produce a local approximated direction $\\tilde{H}^{(x_j)}v$. The paper assumes that because every step of this computation is an affine combination, Lagrange interpolation of the local approximations yields the true global Hessian-vector product, so that equation (27) follows. The other key ingredient is the periodic exact update: every $T_r$ iterations clients recompute true gradients and refresh the buffers, preserving accurate local curvature information, and a final $T_f$ exact-update phase drives the recovered model to a stable, accurate state.","core_discovery":"The paper's central claim is that recovering a poisoned global model can be posed as a privacy-preserving, decentralized unlearning problem. The starting point is Cauchy's mean value theorem: a client's gradient at the recovered model equals its historical gradient plus a Hessian-vector product times the difference between the recovered and historical model parameters. Since the true integrated Hessian is intractable, the paper approximates it with L-BFGS using two buffers, global model differences and client gradient differences, and then protects those buffers with Shamir secret sharing. The core claim is that the secret-shared version, SS-L-BFGS, preserves gradient fidelity: aggregating each client's local approximated direction and interpolating gives the global direction, so the recovered model converges to the model that would be obtained by retraining with malicious clients removed. Experiments on MNIST, FashionMNIST, and HAR are offered as evidence, reporting recovery accuracy within about one to two percentage points of drop-client retraining while saving roughly 33 to 35 percent of runtime.","pith_inferences":["A direct testable extension would be to run SS-L-BFGS on a small quadratic problem with a known Hessian and compare the secret-shared Hessian-vector product against the exact global product; the paper's correctness claim predicts exact agreement, while any gap would expose the linearity assumption.","The privacy argument likely depends on the finite-field quantization of gradients not leaking information on its own, so checking how k-bit fixed-point rounding affects reconstructed model accuracy would show whether privacy and fidelity trade off in practice.","If the linearity assumption holds, the same share-then-interpolate trick could apply to other second-order or preconditioned updates, such as Newton steps or natural gradients, whenever they can be written as affine functions of the shares.","The paper leaves open how buffer staleness interacts with nonconvex loss surfaces; a practical stress test would measure recovery accuracy as the periodic refresh interval $T_r$ grows, since stale curvature buffers could degrade the recovered model."],"forward_implications":["If PDLRecover works as claimed, a compromised decentralized model can be restored without full retraining, cutting recovery time by about a third while keeping test accuracy close to drop-client retraining.","The method removes the privacy bottleneck of earlier server-based recovery schemes: individual local gradients are never revealed, only Shamir shares, so a curious aggregator cannot reconstruct a client's update unless enough clients collude.","Because recovery uses cached global model history and refreshed curvature buffers, it remains usable when clients drop out mid-training, not only after a detected attack.","The paper's convergence analysis gives an accuracy-cost trade-off: spending more recovery rounds shrinks the difference between the recovered and retrained model exponentially, so the number of recovery rounds can be tuned against budget."],"supporting_citations":[{"why":"Supplies the Hessian-vector product computation used to approximate model updates during recovery.","marker":"[7]"},{"why":"Provides Shamir secret sharing, the primitive that hides local gradients during transmission and reconstruction.","marker":"[8]"},{"why":"Supplies the multi-batch L-BFGS method that SS-L-BFGS extends to the secret-shared setting.","marker":"[9]"},{"why":"Introduces the historical-information recovery approach in federated learning that PDLRecover extends to a decentralized, privacy-preserving setting.","marker":"[35]"},{"why":"Defines FedAvg, the weighted aggregation rule used to combine local model updates in PDLRecover.","marker":"[38]"},{"why":"Provides the original L-BFGS algorithm whose buffer structure underlies the SS-L-BFGS curvature approximation.","marker":"[39]"},{"why":"Serves as an influence-function unlearning baseline whose accuracy PDLRecover compares against in the experiments.","marker":"[14]"},{"why":"Serves as a differentially private federated unlearning baseline in the accuracy comparison table.","marker":"[40]"}],"fun_headline_variants":["Secret-shared L-BFGS restores poisoned models privately","Poison recovery via unlearning: matches retraining, cuts cost","Private decentralized model recovery beats retraining speed","Unlearning poison: recover global model with secret sharing"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method depends on the assumption that each client's L-BFGS Hessian-vector product can be computed independently on secret shares, and that Lagrange interpolation of those local products reproduces the true global Hessian-vector product, even though L-BFGS involves products, ratios, and a matrix inversion that are not linear operations.","fun_headline_variants_meta":{"raw":{"variants":["Secret-shared L-BFGS restores poisoned models privately","Poison recovery via unlearning: matches retraining, cuts cost","Private decentralized model recovery beats retraining speed","Unlearning poison: recover global model with secret sharing"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000162,"raw_usage":{"total_tokens":1259,"prompt_tokens":988,"completion_tokens":271,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":604,"completion_tokens_details":{"reasoning_tokens":205}},"tokens_in":604,"tokens_out":271,"duration_ms":3127,"temperature":1.0,"reasoning_tokens":205,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T19:43:21.601397+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute the exact global Hessian-vector product for a small convex model with a known Hessian, then compare it with the value reconstructed from a few clients' SS-L-BFGS shares; if the two differ beyond quantization error, the identity in equation (27) fails and the recovery guarantee collapses.","supporting_citations":[{"cited_title":"The solution of nonlinear finite element equations,","cited_arxiv_id":null,"evidence_quote":"Provides the original L-BFGS algorithm whose buffer structure underlies the SS-L-BFGS curvature approximation."},{"cited_title":"A multi-batch l-bfgs method for machine learning,","cited_arxiv_id":null,"evidence_quote":"Supplies the multi-batch L-BFGS method that SS-L-BFGS extends to the secret-shared setting."},{"cited_title":"Fedrecover: Recovering from poisoning attacks in federated learning using historical information,","cited_arxiv_id":null,"evidence_quote":"Introduces the historical-information recovery approach in federated learning that PDLRecover extends to a decentralized, privacy-preserving setting."},{"cited_title":"Communication-efficient learning of deep networks from decentralized data,","cited_arxiv_id":null,"evidence_quote":"Defines FedAvg, the weighted aggregation rule used to combine local model updates in PDLRecover."}],"review_version":1}