{"id":"9040e0a3-ad0e-4814-baa6-dc34f7fe3a07","arxiv_id":"2507.14212","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"A timing side channel in goal-oriented communication lets an eavesdropper infer the state of a Markov process, and two simple scheduling heuristics reduce that leakage by about half with only a small loss of task reward.","lead":"Goal-oriented communication schedules updates only when they help the receiver, but the timing of those updates leaks information about the monitored system. This paper models that leak, shows a naive scheduler lets an eavesdropper guess the state about 60% of the time, and proposes two heuristics that cut leakage roughly in half with small performance loss.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Eq. (8) reverses the forward transition kernel, and since the transition law in Eq. (17) is asymmetric, every leakage and accuracy result depends on an unstated correction.","rationale":"I read the paper as making two central claims: a timing side channel can leak substantial information about the state in goal-oriented communication, and the ADE and PDE heuristics reduce that leakage with only modest reward loss. Both claims are quantitatively supported by Eve's HMM filter, so the correctness of that filter is load-bearing. The reader's suspicion of Eq. (8) is well founded: comparing Eq. (8) with the definition of ζ in Eq. (3) shows that the printed recursion sums the wrong transition kernel. The transition matrix in Eq. (17) is not symmetric, so the direction of the kernel matters numerically, not just notationally. The proof of Theorem 2 already uses the corrected orientation, which indicates an internal inconsistency rather than a deliberate alternative definition. The qualitative conclusions may survive the fix, but the reported magnitudes, including the 60% accuracy and the halved leakage, would need to be re-derived. I therefore keep the CONDITIONAL verdict rather than strengthening or weakening it.","tokens_in":19992,"tokens_out":4362,"duration_ms":56986,"concrete_test":"Independently re-derive Eq. (8) and reimplement the forward-backward filter for the MPI policy in the estimation scenario with β=1, θ=32, and D=5. Run the same episode set twice: once with the printed kernel ζ_{τ(k),s}(s') and once with the corrected kernel ζ_{τ(k),s'}(s). If the mean leakage E[L_E] differs by more than 0.05 between the two runs, the reported figures cannot be taken to validate the printed attack model. Also verify that Theorem 2's derivation already uses the corrected orientation (P^T)_{s',s}; if it does, the typo is confirmed, but the simulation code still needs to be checked against the corrected recursion.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Eq. (8) as printed computes f_k(s) = Σ_{s'} ζ_{τ(k),s}(s') δ(τ(k),σ(s')) f_{k-1}(s'). By the definition in Eq. (3), ζ_{τ(k),s}(s') is the probability of being in state s' after τ(k) steps starting from state s. For a forward recursion from predecessor state s' to current state s, the correct kernel is ζ_{τ(k),s'}(s), i.e., the indices must be swapped. This is not a cosmetic issue: the transition law in Eq. (17) is not symmetric, so the printed and corrected recursions yield different beliefs. Theorem 2's proof implicitly uses the corrected orientation (P^T)_{s',s}, confirming the inconsistency. Since Eve's posterior ϕ_k(s;n) in Eq. (10), the leakage L_E(n;D) in Eq. (5), Eve's accuracy η in Eq. (7), and the ADE switching rule in Algorithm 1 all consume this recursion, the numbers in Figs. 4–9 and 12–19 rest on an unstated correction. If the printed recursion was used in the simulations, the reported leakage values are not trustworthy; if the corrected one was used, the manuscript must state it explicitly. Either way, the central quantitative claims are not reproducible from the text as written.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper studies timing side-channel attacks against pull-based goal-oriented communication (GoC) for remote estimation and control of a finite Markov process. Alice observes the state, Bob requests updates according to a GoC scheduling policy, and Eve observes only the timing of requests while knowing the transition matrix and the policy. The paper defines an opacity-gap leakage metric L_E(n;D), models Eve's inference as an HMM with forward-backward recursions, claims computational hardness of finding a Nash equilibrium for the resulting game, and proposes two heuristics, ADE and PDE, to trade off secrecy against task reward. The claims are supported by Monte Carlo simulations in both estimation and control scenarios comparing the MPI GoC policy, a periodic policy, and the two heuristics in terms of leakage, reward, and Eve's accuracy.","tokens_in":20219,"tokens_out":6922,"duration_ms":92254,"significance":"If correct, the paper is a timely and useful contribution: it identifies a side channel that is specific to GoC, quantifies it with an opacity-based leakage metric, and offers two practical defenses with plausible trade-offs. The qualitative claim that naive GoC scheduling leaks substantial state information through transmission timing, and that heuristic defenses can reduce leakage with limited reward loss, is plausible and worth publishing. However, several load-bearing issues remain: Eq. (8) contains a likely index error in the forward recursion that all quantitative results depend on, the simulation settings are inconsistent and statistically weak, and the hardness proof of Theorem 1 does not establish the stated lower bound. The paper does not provide code or detailed per-configuration statistics, which amplifies reproducibility concerns. With these issues fixed, the contribution would be suitable for a journal publication.","major_comments":[{"comment":"The forward recursion as printed is f_k(s) = Σ_{s'} ζ_{τ(k),s}(s') δ(τ(k), σ(s')) f_{k-1}(s'). By Eq. (3), ζ_{τ,s}(s') is the probability of being in state s' after τ steps starting from state s, so the printed kernel propagates information backward from the current state s to the previous state s', rather than forward from s' to s. Because the transition law in Eq. (17) is asymmetric, the correct recursion must use ζ_{τ(k),s'}(s). The inconsistency is confirmed by the proof of Theorem 2, which uses (P^T)_{s',s}, i.e., the corrected orientation. Since L_E(n;D), η, ϕ_k, and Algorithm 1 all consume this recursion, the quantitative results in Figs. 4–9 and 12–19 rest on an unstated correction. The authors must state which recursion was implemented and, if the printed one was used, recompute all affected results.","section":"Eq. (8), Sec. IV-B"},{"comment":"The proof that finding a Nash equilibrium is computationally hard does not establish the claim. From the fact that Bob's policy space has exponentially many elements, it only follows that the explicit Dantzig LP written down in Eq. (13) has exponential size; it does not rule out polynomial-time algorithms for the structured one-sided zero-sum POMDP, nor does it show that the LP cannot be solved in time polynomial in the natural parameters of the problem. The authors should either provide a proper hardness reduction from a known hard problem, or restate the claim as a complexity statement about the explicit matrix-game formulation rather than about the original game-theoretic problem.","section":"Theorem 1, Sec. V"},{"comment":"The simulation settings are not reproducible as written and the statistics are too weak for the quantitative claims. The text states θ ∈ [1, 27], but the heatmaps use log2(θ) up to 7 (θ = 128) and the single-episode and D-sweep experiments use θ = 32; this discrepancy must be resolved. In addition, the heatmaps use only Nep = 10 episodes per configuration with no error bars, which is insufficient for a 30-state Markov chain over 200 steps to support comparisons such as 'ADE halves leakage' or 'PDE is better than ADE in control.' The authors should report the exact parameter grid, increase the number of episodes, and provide confidence intervals or error bars for all averaged quantities.","section":"Sec. VI-A and Figs. 5–8, 13–16"},{"comment":"The ADE pseudocode is not fully specified. The calls LE(σ(s)) and LE(T) in lines 3 and 8 are not defined: the leakage L_E in Eq. (5) depends on the current time n, the observation history, and the opacity gap D, and it is not clear how these are combined with the planned next transmission interval. The function inputs f, b, τ are also unused in the pseudocode. Without a precise definition of the leakage computation used inside the scheduler, a reader cannot reproduce the ADE results.","section":"Algorithm 1, Sec. V-A"}],"minor_comments":[{"comment":"The statement that leakage can never be less than Lmin = 1 − H(µ)/H0 should be qualified: it holds when the delay d can reach the stationary regime within the window {0,...,D}, i.e., when D is at least on the order of the mixing time of the chain.","section":"Eq. (5)-(6), Sec. IV-A"},{"comment":"Equation (11) appears to factor the posterior probability of the two transmitted states s′ and s″ as ϕ_k(s′)ϕ_{k+1}(s″), which is an approximation unless the posterior marginals are independent; this should be stated explicitly.","section":"Eq. (11), Sec. IV-B"},{"comment":"The heatmap color bars and axis ranges are not accompanied by the number of runs or standard deviations; please add this information either in the captions or in the text.","section":"Figs. 2-3 and 10-11"},{"comment":"The text says that for PP 'the performance does not change in the different scenarios,' but Fig. 13a shows that PP leakage in the control scenario is non-negligible and varies with θ and β; please reconcile this wording with the displayed results.","section":"Sec. VI-C, Fig. 13"},{"comment":"The paper refers to θ ∈ [1, 27] but also uses θ = 32 in Figs. 4, 9, 12, 17, 18, and 19; please correct the stated range or the experimental values.","section":"Sec. VI-A"}],"recommendation":"major_revision","confidential_remarks":"The paper extends the authors' previous conference paper [12], and the overlap should be checked carefully during revision. The absence of released code makes the Eq. (8) ambiguity more serious; if the authors cannot confirm which recursion was used in the simulations, the quantitative results may need to be regenerated. I do not see grounds for outright rejection, as the qualitative phenomenon is plausible and the corrections appear feasible within the manuscript's scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. First, the paper identifies a genuine and under-explored vulnerability: in pull-based goal-oriented communication, the timing of Bob's requests leaks the state of a Markov process even when message content is perfectly encrypted. That claim is plausible and well-motivated. Second, the printed attack model is wrong: Eq. (8) has the indices of the transition kernel reversed. The forward recursion should use ζ_{τ(k),s'}(s), not ζ_{τ(k),s}(s'). As written, Eve's belief conditions on the future state, not the past. The kernel in Eq. (17) is asymmetric, so this is not a typo with no effect: the corrected and printed recursions give different beliefs. Since the leakage metric, Eve's accuracy, and the ADE switching rule all consume these beliefs, every quantitative result in Figs. 4–19 rests on an unstated correction. That is a load-bearing flaw, but it is fixable.\n\nWhat the paper does well: the overall framework is sensible. The leak metric based on opacity time gap is reasonable; the two defenses (ADE and PDE) are intuitive and the experiments span estimation and control. The qualitative lesson — GoC schedules reveal state via timing, and periodic/packed schedules trade secrecy for efficiency — is likely correct and useful. I agree with the reader that this is not a circularity problem; the self-citation to the authors' MPI algorithm is legitimate.\n\nThe smaller soft spots: Theorem 1 claims exponential hardness of finding a Nash equilibrium, but the proof only shows the explicit LP has exponential size, not that the problem is inherently hard. The simulations use 10 episodes per configuration without error bars, the θ range in the text ([1,27]) disagrees with the figures (log2(θ) up to 7), and no code or data are provided. Theorem 2's statement about perfect privacy for periodic policies is also overbroad for control scenarios, which the authors partly acknowledge.\n\nBottom line: this paper deserves a serious referee, but only after major revision. A referee should demand a corrected Eq. (8), rerun or verify the simulations, and ask for the artifacts. The core idea is worth engaging with; the numbers as printed are not trustworthy.","headline":"GoC timing side channel is a real problem, and the two defenses are sensible, but the index error in Eq. (8) undermines the printed numbers until corrected.","tokens_in":20799,"tokens_out":5224,"would_cite":false,"duration_ms":59087,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Goal-oriented schedulers leak the monitored state through transmission timing, and two heuristics cut the leakage roughly in half.","keywords":["goal-oriented communication","timing side channel","eavesdropping","hidden Markov model","information leakage","opacity","remote estimation","remote control"],"falsifier":"Re-implement the attack on a small chain ($|\\mathcal{S}|=2$) with Eq. (8) exactly as printed and compare Eve's posterior against a brute-force HMM filter; if the printed indices are used literally, the posterior diverges and the leakage curves cannot reproduce, whereas the paper's claims require the corrected recurrence $\\zeta_{\\tau(k),s'}(s)\\,f_{k-1}(s')$ in place of the printed product.","tokens_in":19731,"feed_emoji":"🕵️","tokens_out":7882,"duration_ms":76508,"temperature":0.7,"pith_summary":"Goal-oriented communication (GoC) schedules transmissions only when an update serves the receiver's task, yet this paper argues that the very timing of those transmissions is a side channel: an eavesdropper who knows the Markov process and the scheduling rule can infer the remote state even when message content is perfectly encrypted. The authors formalize the attack as a hidden Markov model with a leakage metric based on an opacity time gap, and show that a naive GoC scheduler lets Eve guess the state about 60% of the time. They then propose two heuristics—Alternating Defense from Eavesdropping (ADE), which switches to periodic updates when estimated leakage crosses thresholds, and Packing Defense from Eavesdropping (PDE), which maps several states to the same transmission interval to reduce scheduling entropy—and report that these can halve the leakage with only a marginal loss of GoC advantage. If correct, the work establishes timing-based leakage as a first-order security concern for GoC systems and provides practical countermeasures that do not require changing message content.","feed_headline":"Eavesdroppers read encrypted system states via transmission timing","feed_subtitle":"A scheduler's timing reveals the monitored state; two heuristics cut the leak in half at low cost.","key_machinery":"The central object is the timing signal $\\tau(k)$ — the number of steps between consecutive update requests — which turns the goal-oriented scheduler into a hidden Markov model whose observations are transmission times. Eve's inference is carried by the forward-backward recursion: Eq. (8) updates the forward probability $f_k(s)$ by propagating the previous state through the $\\tau$-step transition distribution and enforcing consistency with the observed interval through the scheduling map $\\sigma(\\cdot)$, and Eq. (9) runs the same update backward; the product $f_k(s)b_k(s;n)$ gives the smoothed posterior $\\varphi_k(s;n)$ used for maximum a posteriori state estimates. The secrecy metric is the information leakage $L_E(n;D)$, the maximum normalized entropy drop of Eve's belief over the last $D$ steps (with steady-state floor $L_{\\min}$). On the defense side, ADE is driven by an online estimate of $L_E$ with hysteresis thresholds $(L_{\\mathrm{low}}, L_{\\mathrm{high}})$, while PDE is driven by the scheduling entropy $H(\\sigma)$ defined in Eq. (14): it repeatedly applies the single-state deviation $\\xi_{\\sigma}^{(s^*,\\tau)}$ that maximizes expected reward among policies with lower entropy, until a target entropy $H^*$ is reached. The theorem that any periodic policy is perfectly private (Theorem 2) is what licenses ADE's fallback mode.","core_discovery":"The paper's central claim is that in pull-based goal-oriented remote monitoring and control of a Markov process, the inter-transmission intervals chosen by the scheduler are themselves a hidden-state observation channel. Even if Alice's updates are encrypted with information-theoretic security, Eve—knowing the transition matrix $P$, the initial distribution, and the scheduling policy $\\sigma(s)$—can run a forward-backward algorithm on the observed timing signal $\\tau(k)$ to compute a posterior belief over the process state and beat steady-state guessing by a wide margin. The paper defines information leakage $L_E(n; D)$ as the normalized entropy drop of Eve's belief over the last $D$ steps, proves that any periodic policy is perfectly private in the estimation setting (leakage falls to the steady-state floor $L_{\\min}$), and proves that computing the Nash equilibrium of the zero-sum game between Bob and Eve is exponentially hard in the state-space size. The constructive contributions are the ADE heuristic, which tracks Eve's leakage online and alternates between goal-oriented and periodic scheduling, and the PDE heuristic, which greedily packs scheduling intervals so that different states share transmission periods, lowering the entropy $H(\\sigma)$ of the timing signal. Simulations over 30-state chains show that naive GoC lets Eve guess correctly about 60% of the time, while ADE and PDE roughly halve the leakage with a small reward penalty; the preferred heuristic flips by scenario, with ADE winning in estimation and PDE in control.","pith_inferences":["The same timing side channel likely extends to push-based GoC, where Alice decides autonomously when to transmit; the paper's HMM framing should transfer if Alice's policy is known to Eve, and testing PDE-style interval packing there is a natural next step.","The leakage metric $L_E(n;D)$ with a finite opacity window suggests a stronger definition: a scheduler that keeps $L_E$ below a threshold for all $n$ is guaranteeing a form of finite-time opacity, which could be verified by model checking on the product of the Markov chain and the belief-state automaton.","PDE's entropy-packing objective is a promising template for cheap defenses on constrained IoT hardware: because it is computed offline as a lookup table, it avoids the online belief-tracking cost that ADE requires, which may matter more at scale than the estimation-scenario reward gap."],"forward_implications":["In pull-based GoC monitoring, an eavesdropper with knowledge of the process statistics and scheduling rule can estimate the state from transmission timing alone, so content encryption (even one-time pad) does not protect the system state.","Periodic scheduling is perfectly private in estimation tasks: as $n$ grows, leakage falls to the process's steady-state floor $L_{\\min}$, because timing carries no state information.","Finding the jointly optimal defense under rational eavesdropping (the Nash equilibrium of the zero-sum one-sided partially observable stochastic game) is computationally intractable for nontrivial state spaces, so practical defenses must be heuristic.","The ADE heuristic caps leakage at a chosen threshold $L_{\\mathrm{high}}$ while preserving roughly 10% reward gain over periodic scheduling in estimation tasks.","The PDE heuristic halves the entropy of the scheduling policy and, in control tasks, can reduce leakage from about 0.5 to below 0.2 while keeping reward close to the unsecured optimum."],"supporting_citations":[{"why":"Supplies the goal-oriented POMDP model and the Modified Policy Iteration algorithm that generates the scheduling policy $\\sigma(s)$ under attack.","marker":"[11]"},{"why":"The preliminary conference version that introduced the timing attack model and the ADE heuristic, which this manuscript extends with PDE and control scenarios.","marker":"[12]"},{"why":"Formulation of zero-sum one-sided partially observable stochastic games whose complexity underpins the claim that finding a Nash equilibrium is exponentially hard.","marker":"[33]"},{"why":"The linear-programming/game equivalence result used in the proof of Theorem 1 on the exponential complexity of equilibrium computation.","marker":"[35]"},{"why":"The entropy definition used to construct the normalized leakage metric $L_E$.","marker":"[1]"}],"fun_headline_variants":["Timing leaks state in goal-oriented comms","Eavesdroppers exploit GoC timing; heuristics halve leak","Scheduler timing exposes state; two defenses cut leak","Naive GoC leaks 60% state; defenses halve it","GoC timing side-channel: attack and countermeasures"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The quantitative results depend on Eve's belief-update recursion in Eq. (8), printed with swapped state indices; the reported leakage and defense numbers rest on an unstated corrected version of that recursion.","fun_headline_variants_meta":{"raw":{"variants":["Timing leaks state in goal-oriented comms","Eavesdroppers exploit GoC timing; heuristics halve leak","Scheduler timing exposes state; two defenses cut leak","Naive GoC leaks 60% state; defenses halve it","GoC timing side-channel: attack and countermeasures"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000212,"raw_usage":{"total_tokens":1468,"prompt_tokens":1043,"completion_tokens":425,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":659,"completion_tokens_details":{"reasoning_tokens":342}},"tokens_in":659,"tokens_out":425,"duration_ms":5800,"temperature":1.0,"reasoning_tokens":342,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T17:15:11.449599+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-implement the attack on a small chain ($|\\mathcal{S}|=2$) with Eq. (8) exactly as printed and compare Eve's posterior against a brute-force HMM filter; if the printed indices are used literally, the posterior diverges and the leakage curves cannot reproduce, whereas the paper's claims require the corrected recurrence $\\zeta_{\\tau(k),s'}(s)\\,f_{k-1}(s')$ in place of the printed product.","supporting_citations":[{"cited_title":"Eavesdropping on goal-oriented communication: Timing attacks and countermeasures,","cited_arxiv_id":null,"evidence_quote":"The preliminary conference version that introduced the timing attack model and the ADE heuristic, which this manuscript extends with PDE and control scenarios."},{"cited_title":"Solving zero-sum one-sided partially observable stochastic games,","cited_arxiv_id":null,"evidence_quote":"Formulation of zero-sum one-sided partially observable stochastic games whose complexity underpins the claim that finding a Nash equilibrium is exponentially hard."},{"cited_title":"A proof of the equivalence of the programming problem and the game problem,","cited_arxiv_id":null,"evidence_quote":"The linear-programming/game equivalence result used in the proof of Theorem 1 on the exponential complexity of equilibrium computation."}],"review_version":1}