{"id":"8a12d471-ebea-4702-9d1f-14c5151df361","arxiv_id":"2509.08449","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"DSFL claims a lightweight dual-server federated learning protocol that hides updates with additive noise and filters Byzantine clients using group deviation scores.","lead":"This paper proposes DSFL, a federated learning scheme with two servers that hides client updates by splitting them into noisy shares and filters suspicious clients using group-based scores. A generalist might read it because it claims robust, privacy-preserving training without encryption, a major practical goal for edge devices.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"DSFL's central claim of removing the non-colluding-server dependency is contradicted by its own protocol: Algorithm 1 splits each update into additive shares sent to SP and TP, so any server-server collusion trivially recovers every local update, and Section V.G explicitly assumes the servers do…","rationale":"The reader's weakest assumption identifies exactly the load-bearing issue: the paper claims to remove the non-colluding-server dependency, but the protocol assumes it at every level. The protocol is additive secret sharing between two servers; if the servers collude, the shares sum to the plaintext update with no cryptographic protection. The paper's own Theorem 2 explicitly conditions security on non-collusion. This contradiction undermines the central contribution, not just a peripheral detail. The empirical contradiction in Table III further weakens the performance claim, but the trust-model failure alone is sufficient to reject. The paper has no machine-checked proofs, no released code, and the security arguments are proof sketches that rely on the very assumption being advertised as removed. My recommendation matches the reader's REJECT verdict.","tokens_in":24447,"tokens_out":5247,"duration_ms":47235,"concrete_test":"Implement Algorithm 1 exactly as specified for N=10 participants, with each participant generating local update w_i and noise zeta_i, sending w1_i = w_i - zeta_i to TP and w2_i = w_i + zeta_i to SP. Then simulate server-server collusion by having TP and SP exchange all received shares and compute w_i' = (w1_i + w2_i)/2 for every i. Verify whether w_i' equals the true local update w_i. If equality holds for all participants, the protocol provides zero privacy against the colluding-server scenario that the abstract claims to eliminate.","verdict_should_be":"REJECT","load_bearing_attack":"The paper's headline contribution, stated in the Abstract and Conclusion, is that DSFL 'eliminates' LSFL's dependency on non-colluding semi-honest servers. The protocol does not do this. Algorithm 1 and Section IV have each client split its update as w_i = (w1_i + w2_i)/2, sending one share to SP and one to TP. If SP and TP collude, they pool both shares and compute the exact update for every participant; the additive noise zeta cancels, and no grouping or PCM structure prevents this. The security analysis confirms the dependency: Section V.G, Theorem 2, states the protocol is 'secure as long as SP and TP do not collude,' and Section III.A adopts an honest-but-curious model for both servers. Thus the protocol's privacy guarantee rests on precisely the non-colluding-server assumption the abstract claims to remove. This is not a presentation issue; it invalidates the stated central contribution. A secondary issue is that Table III shows LSFL outperforms DSFL in four of six settings (MNIST non-IID, CIFAR-10 IID/non-IID, CIFAR-100 IID), contradicting the claim that DSFL 'consistently outperforms' LSFL, but the trust-model failure is the more fundamental problem.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes DSFL, a dual-server federated learning framework in which each client splits its model update into two additive shares sent to a Service Provider and a Trusted Authority, and the servers jointly perform group-based Byzantine filtering (PCM/CPG matrices), top-k selection, a credit-based reward-penalty mechanism, and secure aggregation. The authors evaluate DSFL on MNIST, CIFAR-10, and CIFAR-100 under IID and non-IID data with up to 30% Byzantine participants, and report runtime and communication overhead. The abstract and conclusion claim that DSFL eliminates the non-colluding-server dependency of LSFL, achieves strong privacy through additive noise sharing, and consistently outperforms state-of-the-art baselines.","tokens_in":24739,"tokens_out":7692,"duration_ms":65931,"significance":"If the security and empirical claims were sound, DSFL would be a useful lightweight dual-server protocol for privacy-preserving Byzantine-robust federated learning on edge devices. The paper contains useful overhead measurements and a broad baseline comparison, and the group-based deviation-scoring idea is potentially interesting. However, the central contribution as stated is not delivered: the protocol explicitly retains the honest-but-curious, non-colluding-server assumption that the abstract claims to remove, and the security analysis is presented only as proof sketches with no formal adversary model. The empirical results also contradict the claim that DSFL consistently outperforms LSFL. The manuscript does not provide machine-checked proofs or reproducible code, so the remaining claims rest on informal arguments and selected experiments.","major_comments":[{"comment":"The claim that DSFL eliminates LSFL's dependency on non-colluding semi-honest servers is contradicted by the protocol itself. Algorithm 1 sends w(1)_i to TP and w(2)_i to SP, Section IV states that the design is secure under \"a semi-honest, non-colluding assumption between TP and SP\", and Section V.G Theorem 2 states that the protocol is \"secure as long as SP and TP do not collude\". If SP and TP collude, they can pool their shares and recover each client's update exactly via Eq. (10) as w_i = (w(1)_i + w(2)_i)/2. The paper does not provide any mechanism that prevents this, so the headline contribution in the Abstract is not supported.","section":"Abstract; Section III.A; Section IV; Section V.G; Algorithm 1"},{"comment":"The security analysis consists of one-paragraph proof sketches and does not define a formal adversary model, a security game, or a simulation argument. In Theorem 2, the claimed views are internally inconsistent: SP's view is said to include w = w(1)+w(2) and w(2)_i, yet the proof simply asserts that SP cannot infer w(1) without explaining how these quantities can be combined. Since privacy preservation is the paper's central claim, a proof sketch is not sufficient; a formal reduction or an explicit indistinguishability argument is needed.","section":"Section V.G, Theorems 1-3"},{"comment":"Table III does not support the assertion that DSFL \"consistently outperforms\" LSFL. Under 20% Byzantine participants, DSFL is worse than LSFL in four of the six reported settings: MNIST non-IID (90.12 vs. 90.31), CIFAR-10 IID (97.15 vs. 97.53), CIFAR-10 non-IID (95.05 vs. 95.25), and CIFAR-100 IID (68.60 vs. 69.08). DSFL only outperforms LSFL on MNIST IID and CIFAR-100 non-IID. The Abstract and Conclusion should be corrected, or the evaluation should be revised to support the claimed superiority.","section":"Table III; Abstract; Section VI"},{"comment":"The Byzantine-robustness evaluation is partly forced by construction. The selection threshold is set to k = floor((1-beta)N), where beta is the estimated Byzantine fraction, and the experiments set beta equal to the actual attack fraction used in the same scenario (e.g., beta in {0.0, 0.1, 0.2, 0.3} in Section V.B). This assumes the defender knows the exact attack rate, which is unrealistic, and no experiments vary k under a fixed attack fraction or study mismatch between the assumed and actual beta. The reported robustness numbers are therefore optimistic.","section":"Section IV (Collaborative Filtering Method); Section V.B"}],"minor_comments":[{"comment":"Equation (8) states wi = w(1)_i + w(2)_i, which is inconsistent with Eq. (2) and Eq. (10), where wi = (w(1)_i + w(2)_i)/2. The reconstruction attack still works with the correct factor, but the equation should be fixed.","section":"Section III.C, Eq. (8)"},{"comment":"The displayed formula for m is typeset ambiguously and appears to depend on P rather than P^*; please clarify the intended expression and its relationship to the number of malicious participants.","section":"Section IV (Secure Byzantine Robustness)"},{"comment":"The line \"TP computes d''_i = |P dP1 - M|\" appears to contain a typo; it should presumably be |P dPi - M| for each participant Pi.","section":"Algorithm 2, Step 12"},{"comment":"The caption states 5%, 10%, and 20% Byzantine ratios, but the individual panels are labeled 5%, 15%, and 20%; the labels and caption should be reconciled.","section":"Figure 2 caption and panel labels"},{"comment":"The entry in the Server column reads \"sual\", which appears to be a typo for \"dual\".","section":"Table I, DSFL row"},{"comment":"The text says \"DSFL consistently outperforms all baselines across datasets and data partitions,\" but this is contradicted by Table III even when comparing only with LSFL. The wording should be aligned with the data.","section":"Section V.D"}],"recommendation":"reject","confidential_remarks":"The paper's central security contribution is internally contradicted by its own trust assumptions, and the empirical claim of consistently outperforming LSFL is not supported by Table III. Fixing these issues would require redesigning the protocol or substantially reframing the contribution as an incremental improvement under the same non-collusion assumption, so rejection is appropriate rather than major revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know two things up front. First, the advertised headline contribution—removing LSFL's reliance on non-colluding semi-honest servers—does not hold. Algorithm 1 splits each update into additive shares sent to SP and TP, and if those two servers collude they trivially recover every participant's update; the additive noise cancels. Section III.A adopts an honest-but-curious model for both servers, and Section V.G explicitly says the protocol is secure only as long as SP and TP do not collude. The abstract and conclusion claim to eliminate this dependency, but the protocol itself retains it. Second, the claim that DSFL 'consistently outperforms' LSFL is contradicted by Table III: DSFL is worse on MNIST non-IID, CIFAR-10 IID, CIFAR-10 non-IID, and CIFAR-100 IID, with several gaps exceeding the combined standard deviations.\n\nWhat is genuinely new and worth credit: the paper identifies a real vulnerability in LSFL—a single malicious client colluding with one server lets that server reconstruct all other clients' updates—and proposes a group-based PCM/CPG mechanism that plausibly mitigates this specific attack by only revealing group-level distances. The empirical study is broad (three datasets, IID and non-IID, up to 30% Byzantine) and reports means with standard deviations. The runtime and communication measurements are also useful.\n\nWhere the soft spots are, in proportion: the trust-model contradiction is load-bearing, not cosmetic, because it invalidates the central privacy claim as stated. The 'consistently outperforms' language is also load-bearing for the empirical contribution, though the underlying protocol may still be competitive if the claims are corrected. Theorems 1–3 are one-paragraph sketches with no formal indistinguishability or simulation argument; Theorem 2's security is explicitly conditional on non-collusion, so it cannot support the abstract's claim of removing that assumption. I also note that k is set as floor((1−β)N) with β equal to the actual attack fraction used in the same experiments; that is tuning the defense to the attack, which weakens the robustness evaluation. These are real issues, not presentation quibbles.\n\nWho this is for: readers working on Byzantine-robust secure aggregation for edge FL will find the LSFL attack description and the group-filtering idea worth a look, but the paper's current form is not something I would build on or cite. The authors should reframe the contribution as 'fixing client-server collusion in LSFL under the standard non-colluding-server assumption' and correct the performance comparisons. If that reframing is done honestly, the underlying mechanism may be worth a follow-up.\n\nRecommendation: desk reject in current form. The central advertised contribution is contradicted by the paper's own assumptions, and the performance claim is not supported by the reported tables. This is not a case where referee time is needed to adjudicate a subtle technical point; the contradictions are on the page.","headline":"A promising fix for LSFL's client-server collusion attack, but the paper's central claim of eliminating non-colluding-server assumptions is contradicted by its own protocol, and the performance claims are overstated.","tokens_in":25283,"tokens_out":4445,"would_cite":false,"duration_ms":39756,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"DSFL claims that a dual-server federated learning scheme using additive secret sharing and group-based deviation filtering can keep models accurate and private under up to 30% Byzantine clients, without encryption.","keywords":["federated learning","secure aggregation","Byzantine robustness","dual-server architecture","additive secret sharing","non-IID data","edge computing","privacy-preserving machine learning"],"falsifier":"Run the DSFL protocol with the two servers colluding: have them exchange their received shares $w_i^{(1)}$ and $w_i^{(2)}$ and check whether each client's update $w_i$ is recovered exactly; if yes, the privacy guarantee collapses under collusion. Separately, to test the Byzantine filter, launch a coordinated label-flipping attack where malicious clients submit updates that are deliberately close to the median; if the attacker success rate no longer drops to near zero, the top-k median selection fails.","tokens_in":24242,"feed_emoji":"🔐","tokens_out":5731,"duration_ms":48910,"temperature":0.7,"pith_summary":"This paper tries to establish that federated learning can simultaneously resist Byzantine participants, protect individual updates from curious servers, and stay cheap enough for edge devices. It proposes DSFL, a dual-server protocol in which each client splits its update into two noisy shares sent to two separate servers, which then compare group-level aggregates to score and filter clients. The paper argues this design avoids encryption and pairwise key exchange, and reports that it outperforms baselines including LSFL, homomorphic encryption, and differential privacy on MNIST, CIFAR-10, and CIFAR-100 with up to 30% attackers. A sympathetic reader would care because the result points to a practical edge-deployable balance between privacy and robustness, provided the trust assumptions hold.","feed_headline":"Two servers keep federated learning private and poison-resistant","feed_subtitle":"A lightweight scheme holds CIFAR-10 accuracy above 97 percent even when a fifth of clients attack.","key_machinery":"The load-bearing mechanism is additive secret sharing across two non-colluding honest-but-curious servers, combined with group-wise deviation scoring. Each client sends $w_i^{(1)}=w_i+\\zeta_i$ to one server and $w_i^{(2)}=w_i-\\zeta_i$ to the other; the servers exchange only group sums and per-group distances encoded in the PCM and CPG matrices. Because the group membership equations are deliberately overlapping and underdetermined ($m<N$ or $\\mathrm{rank}(PCM)<N$), neither server alone can solve for individual $w_i$, while the median of per-client deviation scores $d_i''=|Pd_{P_i}-M|$ provides a Byzantine filter that selects the top-$k$ consistent updates. The credit system then rewards selected clients and penalizes unselected ones, gradually excluding persistent free-riders or attackers.","core_discovery":"The central discovery is that a dual-server aggregation protocol can be hardened against both privacy leakage and Byzantine poisoning by making each server's view of client updates linearly underdetermined. DSFL builds on LSFL's additive-noise sharing but replaces simple aggregate exchange with a participant combination matrix (PCM) and a contributed participant group matrix (CPG): the third-party server sends groupwise sums to the service provider, which computes each group's distance from the global average; deviation scores are assembled per client, the median is taken as the trusted reference, and the top-k closest updates are aggregated. The authors claim that no single server can invert the group equations to recover individual updates, and that top-k median filtering plus a reward-penalty credit system suppresses label-flipping attackers while preserving convergence at $O(1/T)$. They also report exposing a critical flaw in LSFL: one malicious client sharing its share with a server lets that server reconstruct every other client's update from the transmitted distance values. On CIFAR-10, DSFL holds 97.15% accuracy under 20% Byzantine clients, and on CIFAR-100 non-IID it reaches 61.18%, compared with 9.39% for FedAvg under comparable threat.","pith_inferences":["If the paper is right, the non-collusion assumption is doing the essential privacy work: the moment the two servers pool their received shares, every client update is recoverable exactly, so the privacy claim should be read as privacy against each server individually, not against colluding servers.","The top-k median filtering follows a standard robust-aggregation template; a natural testable extension is to evaluate DSFL against adaptive attackers that mimic benign update distributions, or against model-replacement and backdoor attacks, which the current label-flipping evaluation does not cover.","The credit and reward-penalty mechanism turns participation into an economic game; an extension would study whether strategic clients can earn credits while still harming the model, and whether the scheme behaves fairly under client churn and dropout.","The underdetermined-system privacy argument is information-theoretic in spirit, but it depends on servers never sharing their views; a concrete extension would compute the minimum number of colluding clients or malicious servers needed to make the PCM equations uniquely solvable."],"forward_implications":["With 20% Byzantine clients, DSFL holds 96.12% accuracy on MNIST IID, 97.15% on CIFAR-10 IID, and 68.60% on CIFAR-100 IID, where FedAvg collapses to 9.39% on CIFAR-100 non-IID under similar threat.","Attacker success rate under label-flipping falls to near zero within the first 5–10 communication rounds, suggesting the deviation filter neutralizes poisoned updates early in training.","Per-round runtime of 55.9 ms and 1088 KB communication for 10 clients on MNIST place DSFL close to FedAvg and far below homomorphic-encryption aggregation, which the paper reports at 1020.3 ms and 13.2 MB.","The security theorems state that privacy holds only while the two servers do not collude; otherwise the stated guarantees do not apply.","The convergence analysis claims an optimal $O(1/T)$ rate under L-smoothness, strong convexity, and bounded variance, with the Byzantine filter preserving this rate."],"supporting_citations":[{"why":"Supplies the LSFL dual-server architecture and the collusion vulnerability (single-client server collusion) that DSFL claims to fix; also serves as the main baseline.","marker":"[35]"},{"why":"Defines the SecAgg secure aggregation baseline with pairwise masks and quadratic overhead that DSFL aims to avoid.","marker":"[31]"},{"why":"Provides the Trimmed Mean and Median Byzantine-robust aggregation baselines and the statistical robustness framework DSFL builds on.","marker":"[29]"},{"why":"Establishes Byzantine-tolerant gradient descent principles and the theoretical justification for top-k and median-based selection used in DSFL.","marker":"[27]"},{"why":"Represents homomorphic-encryption-based federated learning, the cryptographic privacy baseline DSFL compares against in accuracy and overhead.","marker":"[32]"},{"why":"Provides ELSA, a malicious-secure dual-server aggregation baseline with range proofs, which DSFL claims to outperform in efficiency.","marker":"[38]"},{"why":"Defines FedAvg, the standard federated averaging baseline whose collapse under Byzantine clients DSFL contrasts with its own stability.","marker":"[4]"},{"why":"Provides DPBFL, a differentially private Byzantine-robust baseline that DSFL compares against on accuracy and utility.","marker":"[37]"},{"why":"Used as the reference scheme in the runtime and communication overhead comparison where DSFL reports lower cost.","marker":"[53]"}],"fun_headline_variants":["Dual-server FL shrugs off Byzantine attacks without encryption","Two servers, zero key exchange: Byzantine-safe federated learning","Poison-resistant federated learning: 97% CIFAR-10 without encryption","Two-server aggregation filters bad clients, keeps updates private"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the two servers, the Service Provider and the Trusted Authority, are honest-but-curious and never collude; the paper's abstract says it removes this dependency, but the protocol and security proofs explicitly assume it, and if the servers collude, pooling their shares reconstructs every client update.","fun_headline_variants_meta":{"raw":{"variants":["Dual-server FL shrugs off Byzantine attacks without encryption","Two servers, zero key exchange: Byzantine-safe federated learning","Poison-resistant federated learning: 97% CIFAR-10 without encryption","Two-server aggregation filters bad clients, keeps updates private"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000542,"raw_usage":{"total_tokens":2673,"prompt_tokens":1097,"completion_tokens":1576,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":713,"completion_tokens_details":{"reasoning_tokens":1503}},"tokens_in":713,"tokens_out":1576,"duration_ms":9962,"temperature":1.0,"reasoning_tokens":1503,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T16:08:28.876407+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the DSFL protocol with the two servers colluding: have them exchange their received shares $w_i^{(1)}$ and $w_i^{(2)}$ and check whether each client's update $w_i$ is recovered exactly; if yes, the privacy guarantee collapses under collusion. Separately, to test the Byzantine filter, launch a coordinated label-flipping attack where malicious clients submit updates that are deliberately close to the median; if the attacker success rate no longer drops to near zero, the top-k median selection fails.","supporting_citations":[{"cited_title":"Lsfl: A lightweight and secure federated learning scheme for edge computing,","cited_arxiv_id":null,"evidence_quote":"Supplies the LSFL dual-server architecture and the collusion vulnerability (single-client server collusion) that DSFL claims to fix; also serves as the main baseline."},{"cited_title":"Machine learning with adversaries: Byzantine tolerant gradient descent,","cited_arxiv_id":null,"evidence_quote":"Establishes Byzantine-tolerant gradient descent principles and the theoretical justification for top-k and median-based selection used in DSFL."},{"cited_title":"ELSA: secure aggregation for federated learning with malicious actors,","cited_arxiv_id":null,"evidence_quote":"Provides ELSA, a malicious-secure dual-server aggregation baseline with range proofs, which DSFL claims to outperform in efficiency."}],"review_version":1}