{"id":"082d5140-40c3-485c-932d-7c9e761cfb17","arxiv_id":"2509.00992","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"An algorithm that filters neighbor updates by cumulative trust scores, aiming for sublinear regret in online decentralized federated multi-task learning with a Byzantine majority.","lead":"This paper proposes an online decentralized federated learning algorithm that uses physical-layer trust scores to stay accurate even when a majority of clients are Byzantine (malicious). It claims sublinear regret and constraint violation, but the proof is omitted and the simulation covers a single setting.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Unvalidated trust-separation assumption and an omitted proof leave the O(√T) regret guarantee unsupported.","rationale":"The reader's weakest assumption correctly identifies Assumption 1(ii) as the linchpin of the Byzantine-resilience argument. The algorithm's filtering step (Step 9) relies entirely on the sign of βvu(t), and the theorem's proof (omitted) must show that misclassification errors before the eventual correct classification contribute only sublinearly to regret. If the trust separation does not hold—either because the physical-layer observations are noisy in practice or because Byzantine clients actively spoof them—the trusted neighbor set includes Byzantine clients, and the algorithm's updates (17) incorporate malicious gradients, leading to linear regret. The simulation in §V does not test this: it generates trust values from distributions with means 0.55 and 0.45, which is essentially a direct instantiation of the assumption, and compares only to a Byzantine-free baseline, not to alternative robust methods or to a scenario with contaminated trust observations. In addition, the proof of the central theorem is deferred entirely to a citation, and the expressed bound in (22) appears malformed, further obscuring whether the claimed O(√T) holds. These issues compound: even if Assumption 1(ii) were granted, the lack of a proof leaves the theoretical result unverified. The reader's REJECT verdict is appropriate and my analysis does not alter it. I agree that Assumption 1(ii) is the most load-bearing assumption; my proposed simulation directly tests whether the algorithm's resilience is contingent on it.","tokens_in":10610,"tokens_out":8468,"duration_ms":104176,"concrete_test":"Run Algorithm 1 on the Section V setup exactly as described, but modify the Byzantine clients' trust distribution so that E[αvu(t)] = 0.55 (same as honest clients, violating Assumption 1(ii)). Keep all other parameters identical and average over 50 realizations. If the time-average regret does not converge to zero (e.g., remains bounded away from 0 as T grows), the algorithm fails when trust scores do not separate, confirming that the assumption is load-bearing and that the resilient guarantee does not hold under a spoofing-capable Byzantine adversary.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The Theorem in Section IV guarantees O(√T) regret and O(T^(3/4)) constraint violation under Assumption 1(ii), which requires E[αvu(t)]−0.5 ≥ 0 for honest neighbors and E[αvu(t)]−0.5 < 0 for Byzantine neighbors. Algorithm 1 filters neighbors using βvu(t) ≥ 0. If a Byzantine client can manipulate its trust signal (e.g., adjust transmit power or spoof the physical layer) so that E[αvu]−0.5 ≥ 0, then Byzantine neighbors are never excluded. Equation (17) then incorporates their updates, and the regret bound becomes linear. The paper provides no evidence that physical-layer trust mechanisms achieve this separation under an adaptive Byzantine adversary; the simulation §V simply draws trust values from distributions with means 0.55/0.45, which is the assumption itself, not a validation of it. Moreover, the proof is omitted entirely, stated only as a modification of [32, Thm. 1], so the derivation cannot be checked. The bound in (22) contains an ill-defined term involving βvu in the denominator, suggesting the proof is not carefully worked out. Thus the paper's central claim—sublinear regret despite a Byzantine majority—rests on an unvalidated assumption and an absent proof.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes an online decentralized federated multi-task learning algorithm (Algorithm 1) that combines regularized Lagrangian optimization with a trust-score filter based on cyber-physical observations. The trust score α_vu(t) is used to build a time-varying trusted-neighbor set N_v^h(t) by thresholding β_vu(t), the cumulative excess of α_vu(t) over 0.5. The central claim is Theorem 1 in Section IV: under Assumption 1, honest clients running Algorithm 1 achieve static regret O(√T) and constraint violation O(T^{3/4}) even when Byzantine clients form a majority. The paper supports this with a simulation of 15 honest and 30 Byzantine clients on a fully connected graph, using online logistic regression and trust values drawn with means 0.55 (honest) and 0.45 (Byzantine). The empirical claim is that performance is close to the Byzantine-free baseline.","tokens_in":10918,"tokens_out":3957,"duration_ms":51765,"significance":"If the theorem and the trust-separation premise held, the paper would address an important open gap: Byzantine-resilient federated learning under a Byzantine majority. Combining online decentralized multi-task learning with physical-layer trust is an appealing direction, and the authors correctly note that standard statistical-robustness filters fail when more than half of the clients are Byzantine. However, the current manuscript does not provide enough evidence for the central claim. The proof of the main theorem is omitted entirely, the stated regret bound contains an ill-defined term, and the trust-separation assumption is used as a simulation input rather than validated or even stress-tested. The paper is best viewed as a promising extended abstract whose core technical contribution remains unverified.","major_comments":[{"comment":"The proof of Theorem 1 is stated as 'omitted due to space constraints' and described only as a modification of Theorem 1 in [32]. For a journal submission, the central regret and constraint-violation guarantees cannot be accepted on a citation alone. The proof must be supplied, either in full or in an appendix, with clear derivations of Eqs. (22) and (23). Without this, the main contribution is unverifiable.","section":"Section IV, Theorem"},{"comment":"The regret bound is syntactically ill-defined. The term β_vu appears in the denominator inside the expression `(1 + 1/(ζ β_vu))/(1 - (1+ζ)β_vu)` with no lower bound on β_vu, no definition of the aggregate `β` used in the interval `ζ ∈ (0, 1/β - 1)`, and no handling of β_vu = 0. As written, the claimed O(√T) bound is not a mathematically valid upper bound. This suggests the proof (or its transcription) is not carefully worked out.","section":"Section IV, Eq. (22)"},{"comment":"Assumption 1(ii) is load-bearing: the trusted-neighbor filter β_vu(t) ≥ 0 separates honest from Byzantine neighbors only if E[α_vu] - 0.5 is nonnegative for honest neighbors and negative for Byzantine neighbors. The manuscript assumes α_vu(t) is 'known from the physicality' and cites [23], [24], but the simulation in Section V samples α directly from distributions with means 0.55 and 0.45, which is exactly the assumed separation, not a test of it. The paper gives no evidence that physical-layer trust mechanisms remain well-separated under an adaptive Byzantine adversary that can manipulate its transmitted signal. If the adversary can shift E[α_vu] - 0.5 to be nonnegative, the trusted set includes Byzantine clients and Eq. (17) no longer excludes their updates, breaking the regret bound. This needs either a formal argument for Assumption 1, a sensitivity analysis, or a clear statement tha","section":"Assumption 1(ii) and Algorithm 1, Step 9"},{"comment":"The simulation study is too narrow to substantiate the paper's claims. It considers exactly one graph topology (fully connected), one learning task (online logistic regression), one trust configuration (means 0.55/0.45, l=0.8), and one Byzantine fraction (30 of 45). No confidence intervals or error bars are shown, and the comparison to the Byzantine-free baseline is qualitative ('close') rather than quantitative. The paper should report numeric regret/violation values, standard deviations across the 50 realizations, and ideally vary the topology, the trust-separation gap, and the Byzantine fraction to show when the algorithm degrades.","section":"Section V, Figures 1 and 2"}],"minor_comments":[{"comment":"The definition of β_vu(k) uses the index k both as the left-side argument and as the summation variable; the right-hand side depends on t, not k. Please rewrite as β_vu(t) = Σ_{k=0}^{t-1} (α_vu(k) - 0.5).","section":"Eq. (12)"},{"comment":"The indicator term in (14) is written `I_{Em≥0}`; this appears to be a typo for `I_{Eb≥0}`. Similar notation issues occur around Ev and Eb in Eq. (11).","section":"Lemma 1, Eq. (14)"},{"comment":"The logistic regression objective is missing a closing parenthesis: `log(1 + exp(-lv,t ψ^T_{v,t} x_{v,t}))`. Also κ_vu is used in the constraint but never defined.","section":"Eq. (24)"},{"comment":"There is a typo in Eq. (5): the second term writes `fv.t` instead of `fv,t`. In Eq. (6), the notation `E/K` is not standard for edge-set difference; please use `E \\ K` or define it explicitly.","section":"Eqs. (5) and (6)"},{"comment":"The interval for the uniform distribution is written as `[E[α_vu(t)] - l/2, E[α_vu(t) + l/2]`; the second endpoint should be `E[α_vu(t)] + l/2`.","section":"Section V, paragraph on trust generation"}],"recommendation":"major_revision","confidential_remarks":"The manuscript has an interesting and timely research question, but in its current form it is closer to a workshop extended abstract than a complete journal paper. The omitted proof alone is a gatekeeping issue: the central theorem cannot be assessed. The ill-defined expression in Eq. (22) and the circular simulation of Assumption 1 strengthen the concern that the theoretical result is not yet in verifiable form. I would be willing to review a revised version that includes a full proof, a corrected and meaningful regret bound, and a more thorough experimental evaluation that does not assume the very separation the algorithm needs."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper goes after a real gap: online decentralized federated multi-task learning where Byzantine clients outnumber honest ones. As far as I can tell, the combination of trust-based neighbor filtering with online saddle-point methods is new, and Algorithm 1 is clearly written. If the trust signal actually separates honest from malicious clients, the approach is plausible and the simulation suggests it behaves close to the Byzantine-free baseline. Credit where due: the problem selection is good, and the authors are transparent about where the trust values come from.\n\nThe soft spots are serious, though. The main theorem (Section IV) is stated with explicit O(sqrt(T)) regret and O(T^(3/4)) violation, but the proof is one sentence saying it is a modification of Yan and Cao [32, Thm 1]. For a theory-driven paper, that is a load-bearing omission. On top of that, the bound in (22) contains a term with beta_vu in the denominator that looks ill-defined—beta_vu is a random sum, not a constant, and the expression as written doesn't make sense. That makes me wonder whether the derivation was fully carried out.\n\nThe bigger conceptual issue is Assumption 1(ii): the guarantee only kicks in when expected trust scores separate honest from Byzantine behavior. That is exactly the property that makes the Byzantine majority tractable, and the simulation does not validate it—it just draws trust values with means 0.55 and 0.45, which is the assumption itself. So the experiments are a proof-of-concept under friendly conditions, not evidence that physical-layer trust mechanisms achieve this separation under an adaptive adversary. The simulation is also narrow: one graph, one task, one trust configuration, no error bars, no code.\n\nIs the central argument wrong? I can't tell, because the proof is absent. The pieces are all standard, so the result may well be true. But as written, the paper asks the reader to take the core guarantee on faith. That is not enough for acceptance.\n\nFor whom is this useful? Researchers working on robust decentralized FL and trust-based resilience. It would be a reasonable reading-group paper to discuss what counts as evidence in this subfield. I would not cite it until the proof appears. But I'd send it to reviewers rather than desk reject: the problem is worth solving and the authors show enough understanding that a revision could fill the gap. My recommendation: request the full proof and a more serious experimental section, then reconsider.","headline":"Real problem, plausible approach, but the main theorem has no proof and the experiments assume the key assumption.","tokens_in":11397,"tokens_out":2789,"would_cite":false,"duration_ms":34442,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"An online decentralized multi-task federated learner proves O(√T) regret for honest clients even when Byzantine attackers outnumber them, given physical-layer trust probabilities that separate honest from malicious signals.","keywords":["online federated learning","decentralized federated learning","multi-task learning","Byzantine resilience","trust probability","cyber-physical systems","regret bound","constraint violation"],"falsifier":"Run Algorithm 1 with trust probabilities whose means are reversed or equal for honest and Byzantine neighbors (e.g., both E[α]=0.5), so Assumption 1(ii) fails; measure the honest clients' time-average regret over a long horizon. If regret becomes linear, the separation is load-bearing; if it stays sublinear, the bound does not depend on the claimed trust margin. A complementary test: mount a signal-strength spoofing attack that makes Byzantine transmissions mimic honest ones and check whether the trusted-neighbor filter allows malicious updates through.","tokens_in":10534,"feed_emoji":"🛡️","tokens_out":5815,"duration_ms":67873,"temperature":0.7,"pith_summary":"This paper claims that federated learning can stay resilient even when Byzantine attackers outnumber honest clients—a regime where standard Byzantine-robust methods fail—if clients exploit cyber-physical side information. The authors design an online decentralized multi-task learning algorithm in which each honest client computes a running trust score for every neighbor from a probability derived from physical signals (e.g., received signal strength), then updates its personalized model using only neighbors whose trust score is nonnegative. They prove that under a mean-separation assumption on those trust probabilities, the honest clients' cumulative regret is O(√T) and their constraint violation is O(T^(3/4)), matching the best-known rates for the Byzantine-free case. Simulations with 30 Byzantine and 15 honest clients show performance close to a Byzantine-free benchmark. If correct, this is the first algorithm with sublinear-regret guarantees for a Byzantine majority in online decentralized federated multi-task learning.","feed_headline":"Trust scores let federated learning survive a Byzantine majority","feed_subtitle":"With cyber-physical trust signals, honest clients keep regret √T even when attackers outnumber them.","key_machinery":"The running trust score βvu(t)=Σ_{k=0}^{t-1}(αvu(k)−0.5), whose sign selects the trusted neighbor set Nh_v(t)={u∈Nv | βvu(t)≥0} at each round. This sign-threshold filter is the mechanism that lets the algorithm discard Byzantine updates; the regret analysis rests on the Hoeffding-style decay of misclassification probability from Lemma 1, applied to the trusted-set gradients in the regularized Lagrangian primal-dual update (Algorithm 1).","core_discovery":"The central claim is that malicious clients can be outvoted, not by robust statistics on the model updates, but by physical evidence about the sender. Each honest client v maintains βvu(t), the accumulated difference between the observed trust probability αvu(t) and 0.5 for each neighbor u. By a concentration argument, βvu(t) is eventually positive for honest neighbors and negative for Byzantine neighbors, so the sign of βvu(t) defines the trusted set Nh_v(t) that enters the saddle-point update. The algorithm then runs projected primal-descent (on the local loss plus similarity constraints to trusted neighbors) and dual-ascent (on the constraint violations) restricted to that trusted set. Th","pith_inferences":["The paper leaves the breakdown threshold unquantified: its own future-work section says it will seek a bound on how far the Byzantine majority can grow before the algorithm fails, implying the O(√T) guarantee may hold only up to some majority size not characterized here.","Because the Theorem's proof is omitted from this text, the exact conditions under which the modification of the existing proof goes through cannot be checked from the paper alone; a reader cannot verify whether additional assumptions beyond Assumption 1 are needed.","The trust model is generic: any side information satisfying the same mean separation (reputation scores, protocol compliance, spatial fingerprints) would plug into the same algorithm, since only the scalar αvu(t) enters the update.","The early-round behavior is not covered by the regret bound: Lemma 1 guarantees misclassification decays exponentially but provides no finite time Tf, so the trusted set in the first rounds can still admit Byzantine updates before the filter stabilizes."],"forward_implications":["Honest clients with a weak but nonnegative trust margin still enjoy sublinear regret; the bound contains O(√T) terms and O(T^(3/4)) constraint violation.","The algorithm needs no central server and no consensus; each client builds its own trusted neighbor set from its own physical observations.","Time-varying data distributions are handled directly, so the method applies to autonomous and wireless settings where data drift is the norm.","The long-run average constraint satisfaction means model-similarity (personalization) constraints are met even under a Byzantine majority.","Simulation with 30 Byzantine and 15 honest clients tracks the Byzantine-free benchmark, suggesting the filter removes nearly all malicious influence after a short burn-in."],"supporting_citations":[{"why":"Supplies Assumption 1 (trust-homogeneity and separation) and the Byzantine-dominant simulation configuration (30 Byzantine, 15 honest) used to evaluate Algorithm 1.","marker":"[24]"},{"why":"Provides the decentralized multi-task online convex optimization proof template (Theorem 1) that the paper's Theorem modifies for the trust-filtered updates.","marker":"[32]"},{"why":"Yields the concentration result (Proposition 1) that Lemma 1 uses to bound the decay of misclassification probability in the trust scores.","marker":"[31]"},{"why":"Demonstrates that physical-layer signals such as received signal strength can be converted into trust probabilities, grounding the availability of αvu(t).","marker":"[25]"},{"why":"Used to justify treating trust values as observable cyber-physical side information while designing the resilient algorithm.","marker":"[23]"}],"fun_headline_variants":["Physical signals outvote Byzantine clients in federated learning","Federated learning survives Byzantine majority via trust scores","Trust signals beat Byzantine clients in online federated learning","Cyber-physical trust tames Byzantine-dominated federated learning","Trust from physics makes federated learning Byzantine-proof"],"cache_read_input_tokens":2688,"weakest_assumption_plain":"For every honest client, the expected trust score minus 0.5 must be nonnegative for honest neighbors and negative for Byzantine neighbors; if an attacker can spoof the physical signal so that this separation fails, the trusted set admits Byzantine updates and the regret bound collapses.","fun_headline_variants_meta":{"raw":{"variants":["Physical signals outvote Byzantine clients in federated learning","Federated learning survives Byzantine majority via trust scores","Trust signals beat Byzantine clients in online federated learning","Cyber-physical trust tames Byzantine-dominated federated learning","Trust from physics makes federated learning Byzantine-proof"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000166,"raw_usage":{"total_tokens":1115,"prompt_tokens":796,"completion_tokens":319,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":540,"completion_tokens_details":{"reasoning_tokens":243}},"tokens_in":540,"tokens_out":319,"duration_ms":4358,"temperature":1.0,"reasoning_tokens":243,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T12:58:52.746978+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run Algorithm 1 with trust probabilities whose means are reversed or equal for honest and Byzantine neighbors (e.g., both E[α]=0.5), so Assumption 1(ii) fails; measure the honest clients' time-average regret over a long horizon. If regret becomes linear, the separation is load-bearing; if it stays sublinear, the bound does not depend on the claimed trust margin. A complementary test: mount a signal-strength spoofing attack that makes Byzantine transmissions mimic honest ones and check whether the trusted-neighbor filter allows malicious updates through.","supporting_citations":[{"cited_title":"Resilient distributed optimization for multi-agent cyberphysical systems,","cited_arxiv_id":null,"evidence_quote":"Supplies Assumption 1 (trust-homogeneity and separation) and the Byzantine-dominant simulation configuration (30 Byzantine, 15 honest) used to evaluate Algorithm 1."},{"cited_title":"Decentralized multitask online convex optimization under random link failures,","cited_arxiv_id":null,"evidence_quote":"Provides the decentralized multi-task online convex optimization proof template (Theorem 1) that the paper's Theorem modifies for the trust-filtered updates."},{"cited_title":"Characterizing trust and resilience in distributed consensus for cyberphysical systems,","cited_arxiv_id":null,"evidence_quote":"Yields the concentration result (Proposition 1) that Lemma 1 uses to bound the decay of misclassification probability in the trust scores."},{"cited_title":"Guaranteeing spoof-resilient multi-robot networks,","cited_arxiv_id":null,"evidence_quote":"Demonstrates that physical-layer signals such as received signal strength can be converted into trust probabilities, grounding the availability of αvu(t)."},{"cited_title":"Resilience to malicious activity in distributed optimization for cyberphysical systems,","cited_arxiv_id":null,"evidence_quote":"Used to justify treating trust values as observable cyber-physical side information while designing the resilient algorithm."}],"review_version":1}