{"id":"0d621a08-40c7-438c-97bb-66e8f37fae7b","arxiv_id":"2507.07258","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"FedP3E shares noisy class prototypes across federated clients plus SMOTE augmentation, reporting 95.1 to 99.6% accuracy on N-BaIoT under non-IID splits, beating FedAvg and FedProx.","lead":"The paper proposes FedP3E, a federated learning method where each participant shares noisy statistical summaries of its local classes instead of raw data, and tests it on IoT malware detection with unevenly distributed data. It reports large accuracy gains over FedAvg and FedProx when each silo holds only one class, but the privacy guarantee is asserted rather than proven.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Privacy claim rests on unexamined σ=0.01 Gaussian noise on unclipped GMM means; without a sensitivity bound, DP accounting, or inversion-attack evaluation, the title-level 'privacy-preserving' property is unsupported and likely false.","rationale":"I read the paper in good faith and agree that the empirical direction is plausible: under severe non-IID, giving each client synthetic views of missing classes via GMM prototypes plus SMOTE can plausibly lift accuracy from the collapsed baseline to roughly 95%. The strongest claim, however, is not just the accuracy figure but the 'privacy-preserving' property in the title. That property rests on the unexamined premise that adding Gaussian noise with σ=0.01 to 115-dimensional [0,1]-scaled GMM means prevents sample reconstruction. The paper provides no formal privacy accounting, no sensitivity bound, no threat model, and no evaluation against known prototype or gradient inversion attacks. Because the means are not clipped, the standard Gaussian mechanism cannot be applied without first bounding sensitivity, and the chosen noise scale is so small that averaging over the few transmitted prototypes per class leaves an accurate estimate of class centroids. This is a load-bearing defect independent of the accuracy results: even if every reported number is reproducible, the paper's stated contribution to privacy-preserving FL is not established. The split-leakage concern identified by the reader is also real and should be disclosed, but it is a protocol-clarity issue that a revision could fix; the privacy gap requires substantive new analysis or a weakened claim. A concrete attack experiment, or a failed attempt at one, would settle whether the concern lands, and the verdict should remain REJECT/UNCHANGED until that evidence appears.","tokens_in":21113,"tokens_out":8779,"duration_ms":102087,"concrete_test":"Run a concrete honest-but-curious attack on N-BaIoT under the FedP3E protocol: give the adversary the perturbed prototypes {μ̃_j^(c)} (σ=0.01) and the number of components per class, then measure (i) the L2 error between the averaged received prototype and the true training-split class mean, and (ii) the AUROC of a membership-inference classifier that uses distance-to-prototype as a feature. If the mean-estimation error is below 0.05 per coordinate or the AUROC exceeds 0.8, the σ=0.01 mechanism fails to provide the claimed protection. Complement this with an analytical check: derive the global sensitivity of an unclipped GMM mean; if no finite bound exists, no finite ε can be claimed for the Gaussian mechanism at σ=0.01.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central contribution is a privacy-preserving prototype exchange, but Section IV.D only asserts that adding Gaussian noise (Eq. 2, σ=0.01) to GMM component means 'thwarts sample reconstruction.' No threat model is defined, no sensitivity bound is derived, no differential-privacy budget is computed, and no attack is evaluated. Since features are min-max scaled to [0,1] and the GMM means are not clipped, the sensitivity of a released mean to one sample is not bounded by the stated mechanism, so even a formal Gaussian-mechanism guarantee cannot be invoked. The noise is also tiny relative to the data range: with σ=0.01, one perturbed prototype differs from the true component mean by about 1% of the feature range, and averaging the m_k=3 prototypes per class (Section V.A.6) reduces the effective noise further. A honest-but-curious server or a malicious client that receives the global prototypes could estimate other clients' class centroids accurately and mount reconstruction or membership-inference attacks. If this concern lands, the title-level 'privacy-preserving' property collapses, leaving only a heuristic prototype-sharing accuracy booster. The separate train/test split ambiguity in Algorithm 1 (GMM fit on training-only versus full local data) also threatens the accuracy numbers, but the privacy gap is the more fundamental defect for the paper's stated contribution.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes FedP3E, a federated learning framework for IoT malware detection in which clients periodically share Gaussian-noise-perturbed GMM component means (\"prototypes\") with a server; the server aggregates them via Mini-Batch K-Means, broadcasts global prototypes back to clients, and clients then use SMOTE to synthesize additional training samples for underrepresented classes. The method is evaluated on N-BaIoT with three clients under IID and three non-IID scenarios, comparing accuracy, F1, loss, training time, and communication overhead against FedAvg and FedProx. The central claims are that the one-time prototype exchange improves accuracy under non-IID conditions and that additive Gaussian noise preserves privacy.","tokens_in":21263,"tokens_out":5949,"duration_ms":60638,"significance":"FedP3E addresses a real problem—class imbalance and label skew in cross-silo FL—and the paper has some clear strengths: the communication-cost analysis in Section V.C.6 quantifies the one-time exchange as less than 10% of a model round, the data-partition tables are detailed, and Algorithm 1 gives a concrete procedural description. However, the manuscript's headline properties are not yet established. The privacy guarantee rests on an unexamined noise mechanism with no threat model, sensitivity bound, or differential-privacy accounting, and the empirical comparison gives FedP3E additional synthetic training data that the baselines do not receive, so the reported gains do not isolate the proposed mechanism. If the authors add a rigorous privacy analysis, error bars, and controlled ablations, the core idea could be a useful contribution to the cross-silo FL literature.","major_comments":[{"comment":"The claim that perturbed prototypes 'thwart sample reconstruction' is not supported. The mechanism adds Gaussian noise with σ=0.01 to GMM component means of min-max-scaled [0,1] features, but no sensitivity bound is derived, no differential-privacy budget is computed, and no reconstruction or membership-inference attack is evaluated. Because the released values are means of class feature vectors and are not clipped, the sensitivity of each coordinate to a single sample is not bounded by the stated mechanism. With three prototypes per class (Section V.A.6), the effective noise is further reduced by averaging, so the asserted privacy property is not established. This is load-bearing because the title and abstract claim 'privacy-preserving'; either a formal DP guarantee with per-coordinate sensitivity analysis or an empirical attack evaluation is needed.","section":"IV.D, Eq. (2)"},{"comment":"The comparison against FedAvg and FedProx is confounded by the extra training signal given to FedP3E. In Algorithm 1 (lines 20-23), clients receive global prototypes and generate synthetic samples with SMOTE for classes missing locally, while baselines receive no such information. In the severe non-IID case (Table IX), FedP3E reaches 95.11% while all FedAvg/FedProx variants stay near 49.39% or lower, but part of this gap is attributable to the fact that FedP3E's local training set is augmented with information about classes it never observed. To support the claim that prototype exchange is the cause of the improvement, an ablation is needed—for example, FedP3E without prototype exchange, or baselines augmented with the same synthetic prototypes—so that the measured advantage is not built into the protocol.","section":"V.C.4, Algorithm 1"},{"comment":"The results contain internal inconsistencies and are single-run point estimates. Section V.C.3 states that FedProx (µ=0.3) 'plateaus near 96.1% accuracy' in the moderate non-IID scenario, but Table IX lists 94.02% for that cell. The abstract states accuracy ranges from 95.11% to 99.57%, omitting the 99.71% IID and 99.40% moderate values listed in Table IX. In addition, no seeds, confidence intervals, or repeated runs are reported anywhere, so it is impossible to assess whether the differences between methods are significant. The FedProx (µ=1.0) results (12.67% in IID, 33.28% light, 59.11% moderate, 4.85% severe) are surprisingly poor and suggest a possible baseline misconfiguration; this should be checked and documented.","section":"Table IX, V.C.3"},{"comment":"It is not stated whether the GMM prototypes are fit on the 80% training split or on the full local dataset. Section V.A.1 describes an 80/20 stratified train/test split, but Algorithm 1 (lines 11-13) says only 'Fit a GMM to local features X_c' without specifying that X_c is restricted to the training split. If the full local data are used, the prototypes encode test-set information and the reported accuracies are inflated. The algorithm and experimental setup must state the split used for prototype fitting.","section":"Algorithm 1, V.A.1"},{"comment":"The number of GMM components is handled inconsistently. Section IV.D says K_c is selected via BIC, while Section V.A.6 and Section V.C.6 assume m_k=3 prototypes per class and use that in the communication-cost calculation. If BIC is used, the number of prototypes varies by class and client, and the advertised '4.37%' upload overhead is not an accurate bound; if m_k=3 is fixed, the text should say so and the BIC statement should be removed. This needs to be clarified for reproducibility.","section":"IV.D, V.A.6, V.C.6"}],"minor_comments":[{"comment":"The table header 'P3E Federated-Learning Hyper-parameters' should read 'FedP3E Federated-Learning Hyper-parameters'.","section":"Table VIII"},{"comment":"The Training time column has spacing anomalies (e.g., '8 663.3', '5 788', '5 785.5') and inconsistent decimal places; these should be cleaned up.","section":"Table IX"},{"comment":"Algorithm 1 uses an unspecified evaluation round r*, while the text says the exchange is triggered at round 6 if mean accuracy over rounds 1-5 is below 97%; the algorithm should define r* and state which split is used to compute Accuracy(M_t^G).","section":"Algorithm 1"},{"comment":"The Acknowledgments section contains placeholder text ('This should be a simple paragraph before the References...') that should be removed before submission.","section":"Acknowledgments"},{"comment":"The opening sentence of Section II contains a subject-verb agreement error: 'examine advanced strategies' should be 'examines advanced strategies'.","section":"II"},{"comment":"Table I lists IoT-23 with reference [37] while the text in Section II.C refers to [29]; please unify the citation.","section":"Table I"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is not ready in its current form. The privacy claim, which is central to the paper's title, is asserted rather than demonstrated; the evaluation lacks error bars and controlled ablations; and there are internal numerical inconsistencies. I would not reject outright because the proposed mechanism is clearly described and the communication-overhead analysis is useful, and the missing privacy analysis and ablations are, in principle, addable. However, if the authors cannot provide a rigorous privacy argument or an attack evaluation, the paper should be rejected, since 'privacy-preserving' is a title-level claim."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: FedP3E is not as novel as it claims, but it targets a real failure mode—disjoint classes across silos—and its reported 95.11% on the severe split is the kind of result that makes you stop. The mechanism is a composition of known pieces: GMM prototypes, additive noise, MiniBatch K-Means aggregation, SMOTE. The paper does not cite the FedProto line, so the novelty framing is overstated. Still, the evaluation on N-BaIoT with a three-class disjoint partition is new in the cited literature, and the communication overhead (~9.6% of one model round) is honestly quantified.\n\nWhat the paper does well: the severe non-IID setup is well constructed. Each client gets one class, and FedAvg/FedProx collapse to majority-class prediction (49.39% accuracy, exactly the Mirai share). FedP3E's one-shot prototype exchange plus 10% SMOTE samples lifts that to 95.11%. That's a large, mechanistically plausible effect, and the communication cost section is clear.\n\nSoft spots: the privacy-preserving claim is the load-bearing weakness. Section IV.D asserts that sigma=0.01 Gaussian noise on GMM means 'thwarts sample reconstruction' with no threat model, no sensitivity bound, no DP accounting, and no attack evaluation. The means are not clipped, features are min-max scaled to [0,1], and sigma=0.01 is about 1% of the feature range—averaging three prototypes per class makes the effective noise even smaller. An honest-but-curious server could estimate class centroids accurately. The title-level claim collapses unless this is fixed.\n\nThe experimental reporting is also thin: all results are single-run point estimates with no error bars or seeds. There's an internal inconsistency: Section V.C.3 says FedProx (mu=0.3) plateaus near 96.1% in moderate non-IID, but Table IX lists 94.02% for that cell. Algorithm 1 never states whether GMMs are fit on the training split only; if they're fit on full local data, the headline result could be leakage-inflated. No code is provided.\n\nOne minor point: the novelty claim would be easier to take if the paper cited and compared against existing federated prototype-sharing methods (FedProto and follow-ups), since the mechanism reduces to known components.\n\nOverall: a serious referee could push this into a solid conditional—add a real privacy analysis or drop the privacy claim, report multiple seeds, clarify the split handling, and benchmark against prototype-sharing baselines. As it stands, the accuracy result is plausible but unverified, and the privacy property is asserted, not demonstrated.\n\nRecommendation: I'd send it to review rather than desk reject. The severe non-IID experiment is worth refereeing, and the flaws are fixable in revision. But I would not rely on the numbers until the split ambiguity and single-run issue are resolved.","headline":"The severe non-IID result is the real contribution, but the privacy claim is asserted not demonstrated, and the numbers need seeds and error bars.","tokens_in":21987,"tokens_out":3001,"would_cite":false,"duration_ms":29325,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"FedP3E claims one round of noisy class-prototype exchange lets federated clients learn disjoint IoT malware classes, beating FedAvg and FedProx with accuracy from 95.11% to 99.57%.","keywords":["Federated Learning","IoT Malware Detection","Cross-Silo","Non-IID","Data Imbalance","Prototype Learning","Gaussian Mixture Models","Privacy-Preserving"],"falsifier":"A decisive experiment is to run the severe non-IID scenario with the GMMs fit strictly on each client's 80% training split, holding the 20% test partition out of prototype construction, and then attempt a reconstruction attack on the transmitted noisy means; if accuracy collapses toward baseline or the attacker recovers the true class means with small error, the central claim fails.","tokens_in":20724,"feed_emoji":"🛡️","tokens_out":13766,"duration_ms":136597,"temperature":0.7,"pith_summary":"FedP3E is an attempt to solve a known failure of federated learning: when clients hold different, partially or fully disjoint sets of classes, global models trained by averaging local updates collapse on the classes that are rare or absent locally. The paper's claim is that a single exchange of class-wise prototypes—Gaussian mixture component means, perturbed with Gaussian noise at $\\sigma=0.01$—gives every client enough statistical information about unseen classes to keep the global model accurate. On the N-BaIoT IoT traffic dataset, the authors report that this mechanism lifts accuracy from roughly 49% (where FedAvg and FedProx stall) to 95.11% in the most severe disjoint setting, and to between 99.40% and 99.57% under moderate and light non-IID conditions, with communication overhead below 10% of one full model round. If true, this gives cross-silo federated learning a cheap, one-shot way to train accurate IoT malware detectors without sharing raw data or gradients.","feed_headline":"Prototype swap lifts federated malware detection from 49% to 95%","feed_subtitle":"A one-time exchange of noisy class summaries lets silos learn missing malware families with under 10% overhead.","key_machinery":"The load-bearing object is the class-wise Gaussian Mixture prototype: the component means $\\mu_j^{(c)}$ of a GMM fit to local feature vectors of class $c$, with component count selected by the Bayesian Information Criterion and then perturbed as $\\tilde{\\mu}_j^{(c)} = \\mu_j^{(c)} + \\epsilon$, $\\epsilon \\sim \\mathcal{N}(0, \\sigma^2 I)$ with $\\sigma = 0.01$. This object's job is to compress one client's knowledge of a class into a few vectors, let the server merge all clients' views into global prototypes $\\hat{\\mu}_l^{(c)}$ via Mini-Batch K-Means, and give each client a seed set for SMOTE interpolation $x_{\\mathrm{syn}} = \\hat{\\mu}_a^{(c)} + \\lambda (\\hat{\\mu}_b^{(c)} - \\hat{\\mu}_a^{(c)})$, $\\lambda \\sim U(0,1)$, that produces synthetic training samples for classes the client has never seen. The whole argument that one round of prototype exchange closes the non-IID gap at under 10% of a model round's communication cost rests on this mechanism.","core_discovery":"The core discovery is that indirect representation sharing through perturbed class prototypes can stand in for the missing class signal in non-IID federated learning. Each client fits a Gaussian Mixture Model to the 115-dimensional feature vectors of each class it holds, chooses the component count by Bayesian Information Criterion, and uploads only the component means after adding zero-mean Gaussian noise with standard deviation 0.01. The server clusters these noisy prototypes by class with Mini-Batch K-Means and sends the merged prototypes back to all clients, which then use SMOTE-style linear interpolation between prototype pairs to synthesize roughly 10% extra training samples for rare or absent classes. On the paper's own evaluation, this one-time, accuracy-gated exchange lets a three-client federation trained with FedAvg-style aggregation reach 99.71% accuracy in the IID case, 99.57% under light non-IID, 99.40% under moderate non-IID, and 95.11% under severe non-IID, while the baselines stay near random or collapse entirely in the worst setting. The authors present this as the reason cross-silo FL can handle statistical heterogeneity without exchanging raw data or gradients.","pith_inferences":["The same one-shot prototype recipe should transfer to other federated tasks with disjoint labels, such as medical imaging or financial fraud, because it only assumes that class-conditional feature vectors form clusters that a GMM can summarize.","A simpler summary than full GMM components—for example, per-class means and variances—might deliver most of the reported accuracy at lower computational cost, and comparing the two would isolate how much of the gain comes from multi-modality versus from sharing class statistics at all.","Because features are min-max scaled to [0,1], a noise scale of 0.01 is small relative to typical inter-class distances, so the natural next test is formal sensitivity analysis or a reconstruction attack on the transmitted prototypes; this would determine whether a provable privacy guarantee can be attached to the same accuracy numbers."],"forward_implications":["A system with fully disjoint client labels can still learn a global multi-class malware detector: in the severe non-IID setting, the reported accuracy is 95.11% where FedAvg and FedProx fall to roughly 49% or lower.","A single accuracy-triggered exchange is sufficient: the mechanism activates only when early global accuracy drops below 97%, so balanced settings pay almost no extra communication, and the one-time exchange itself costs less than 10% of a full model update.","The largest gains are on minority malware families: the paper reports minority-class recall improvements of about 6 percentage points over FedAvg in light non-IID and about 7 points in moderate non-IID.","The mechanism layers onto standard FedAvg aggregation and leaves the model architecture unchanged, so existing cross-silo deployments could adopt it without altering their training objective."],"supporting_citations":[{"why":"Supplies the N-BaIoT dataset and per-device structure that the client partitions and 115-feature representations are built from.","marker":"[36]"},{"why":"Defines FedAvg, the aggregation strategy FedP3E inherits and the primary baseline it is compared against.","marker":"[42]"},{"why":"Defines FedProx and its proximal term, whose varying regularization strength is tested and shown to collapse in severe non-IID settings.","marker":"[43]"},{"why":"Provides earlier federated malware-detection results on N-BaIoT that frame the cross-silo setting and serve as a comparison row.","marker":"[1]"},{"why":"Contributes the horizontal-FL N-BaIoT baseline (90.00% accuracy) listed in the literature comparison.","marker":"[10]"}],"fun_headline_variants":["Federated malware detection: noisy prototypes lift accuracy to 95%","Prototype exchange beats data sharing in non-IID federated IoT","From 49% to 95%: prototype exchange tames non-IID federated learning","Privacy-preserving prototype swap boosts federated malware detection","Siloed IoT clients share prototypes, not data, to catch malware"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that Gaussian noise with standard deviation 0.01 added to the 115-dimensional class prototypes makes those prototypes safe to share; if that noise does not actually prevent reconstruction of sensitive class statistics, the framework's privacy guarantee collapses even if the accuracy mechanism still works.","fun_headline_variants_meta":{"raw":{"variants":["Federated malware detection: noisy prototypes lift accuracy to 95%","Prototype exchange beats data sharing in non-IID federated IoT","From 49% to 95%: prototype exchange tames non-IID federated learning","Privacy-preserving prototype swap boosts federated malware detection","Siloed IoT clients share prototypes, not data, to catch malware"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000288,"raw_usage":{"total_tokens":1746,"prompt_tokens":1061,"completion_tokens":685,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":677,"completion_tokens_details":{"reasoning_tokens":589}},"tokens_in":677,"tokens_out":685,"duration_ms":6421,"temperature":1.0,"reasoning_tokens":589,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T18:47:59.936133+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A decisive experiment is to run the severe non-IID scenario with the GMMs fit strictly on each client's 80% training split, holding the 20% test partition out of prototype construction, and then attempt a reconstruction attack on the transmitted noisy means; if accuracy collapses toward baseline or the attacker recovers the true class means with small error, the central claim fails.","supporting_citations":[{"cited_title":"N-baiot—network-based detection of iot botnet attacks using deep autoencoders,","cited_arxiv_id":null,"evidence_quote":"Supplies the N-BaIoT dataset and per-device structure that the client partitions and 115-feature representations are built from."},{"cited_title":"Federated learning for malware detection in IoT devices,","cited_arxiv_id":null,"evidence_quote":"Provides earlier federated malware-detection results on N-BaIoT that frame the cross-silo setting and serve as a comparison row."},{"cited_title":"A horizontal federated learning approach to iot malware traffic detection: An empirical evaluation with n-baiot dataset,","cited_arxiv_id":null,"evidence_quote":"Contributes the horizontal-FL N-BaIoT baseline (90.00% accuracy) listed in the literature comparison."}],"review_version":1}