{"id":"bd6aaf76-8beb-49fa-b5ce-823112781940","arxiv_id":"2601.04930","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"A new protocol enables differentially private federated averaging in asynchronous networks with fully Byzantine aggregators, using replicated servers, LWE masking, and verifiable cluster shuffling.","lead":"This paper designs a secure aggregation protocol for federated learning that works in asynchronous networks and tolerates aggregators that lie, stall, or fail. It claims to be the first protocol combining privacy, verifiable aggregation, and fairness to slow clients without client-to-client communication.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Byzantine coordinator equivocation: the SS-threshold argument in §5.2 does not prevent a coordinator from reconstructing two overlapping subset sums; privacy break not foreclosed.","rationale":"The reader's weakest_assumption (inclusion-uniformity) is real but addressable: one could specify the Blaming thresholds and prove the inclusion distribution. The equivocation issue is more load-bearing because it attacks the core privacy guarantee without relying on statistical assumptions. If the protocol as written allows a Byzantine coordinator to collect multiple subset sums, the DP guarantee (which applies only to aggregates of ≥rho clients) is void: the adversary obtains client-level noisy gradients. The paper's one-paragraph argument that threshold SS prevents equivocation is not supported by the pseudocode, which lacks any single-request enforcement. This warrants the same CONDITIONAL verdict: the paper should not be accepted until the equivocation gap is closed (either by adding a protocol rule and proving it, or by a full security proof). I disagree with the reader's choice of weakest assumption because the equivocation gap is a direct protocol-level flaw, not an unproven statistical property.","tokens_in":20470,"tokens_out":17081,"duration_ms":188014,"concrete_test":"Implement a minimal instance (n_a=4, t_a=1, rho=2, k=5, dummy gradients/noise) following Algorithms 1–2 exactly, with one Byzantine coordinator. In one round, have it send two SUM-SHARES messages for subsets {c1,c2} and {c1,c3} to all three correct aggregators. Record whether the coordinator obtains valid INTRA-CLUSTER-RECONSTRUCTION responses for both subsets, reconstructs both unmasked sums, and computes (g_2+e_2)−(g_3+e_3). If yes, equivocation is possible and privacy is compromised. As a control, add the hypothesized missing guard (respond only to the first SUM-SHARES per coordinator per round) and re-run; the attack should fail.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim requires that a Byzantine coordinator cannot exploit overlapping aggregation sets to isolate individual updates. §5.2 argues that threshold SS with n_a≥3t_a+1 prevents equivocation. But Algorithm 2 (lines 12–19) makes every correct aggregator respond to every SUM-SHARES request by decrypting, summing, and returning sumShares for the requested subset; there is no check that the coordinator has not already requested a different subset this round. A Byzantine coordinator can therefore send SUM-SHARES for two rho-subsets S' and S'' that differ in one client, collect n_a−t_a sumShares for each from correct aggregators, reconstruct both unmasked cluster sums, and compute G_S'−G_S'' = (g_x+e_x)−(g_y+e_y). Repeating over many overlapping subsets yields a linear system from which individual noisy updates can be recovered. The threshold n_a−t_a only ensures at least one correct aggregator participates per reconstruction; it does not bound the number of reconstructions. Thus the stated security argument is incomplete, and the 'fully Byzantine aggregator' privacy guarantee is not established. This is more fundamental than the inclusion-uniformity gap: even with perfect inclusion, equivocation breaks DP/privacy.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a federated averaging protocol for asynchronous networks with replicated aggregators, claiming to tolerate fully Byzantine aggregators while preserving client privacy through LWE-based masking, secret sharing, differential privacy, deterministic client shuffling, a fair inclusion mechanism, and threshold-signature certification. The protocol removes client-to-client communication and avoids BFT consensus. The authors argue that their construction is the first secure aggregation primitive that is both privacy-preserving and robust to fully Byzantine behavior in asynchronous settings, and they provide MNIST experiments comparing convergence speed against FLDP.","tokens_in":20774,"tokens_out":7179,"duration_ms":83073,"significance":"The problem is well motivated: existing secure aggregation schemes assume synchrony, require inter-client coordination, and do not model Byzantine aggregators that halt or equivocate. If the construction were correct, it would close a genuine gap in the literature. The proposed architecture — replicated aggregators, verifiable shuffling, and an inclusion mechanism to reduce DP noise — contains interesting ideas, and the experimental evaluation suggests that the inclusion mechanism can mitigate delay-induced bias. However, the manuscript does not provide a formal security proof, and the core equivocation argument is flawed as written. The central privacy claim is therefore not established, and the stated strengths (first fully Byzantine-tolerant secure aggregation, no client-to-client communication, certified outputs) cannot be accepted on the basis of the current text.","major_comments":[{"comment":"The claim that threshold SS with n_a ≥ 3t_a+1 prevents equivocation is not supported by the protocol. In Algorithm 2, every correct aggregator responds to every SUM-SHARES request for any valid rho-subset S'_j, with no check that coordinator a_j has not already requested another subset in the same round. A Byzantine coordinator can request two rho-subsets S' and S'' differing in exactly one client, collect n_a−t_a sumShares from correct aggregators for each, reconstruct both cluster sums, and subtract to isolate a single noisy update. The threshold n_a−t_a only guarantees that at least one correct aggregator participates per reconstruction; it does not bound the number of reconstructions. The same gap affects §5.4: threshold signatures certify each aggregate independently, not the uniqueness of the subset. A non-equivocation mechanism (e.g., serving at most one SUM-SHARES request per coo","section":"§5.2 and Algorithm 2 (lines 12–19)"},{"comment":"The uniform-inclusion claim is load-bearing for both fairness and DP accounting, but it is not established. The text states 'We prove experimentally' that inclusion is uniform, yet no formal theorem and no inclusion-frequency data are shown. Algorithm 7's Blaming function depends on ExpectedVar, secParam, and Δmax, none of which are specified. The noise budget T = τmax·ρ/k + Δmax depends on the inclusion mechanism's uniformity; without a proof or empirical distribution of inclusion counts, the RDP accounting is not justified. A Byzantine aggregator that biases inclusion can invalidate the privacy budget. The authors need to provide a formal analysis of the inclusion distribution or, failing that, concrete histograms and explicit parameter values.","section":"§5.3 (Inclusion and 'Impact of inclusion on budget')"},{"comment":"The paper lacks any formal security statement or end-to-end proof for the Byzantine aggregator model. The pivotal assertions — equivocation prevention, inclusion uniformity, and DP accounting under Byzantine coordinators — are argued informally ('equivocation is prevented without impacting the liveness'). Given the attack above, a rigorous threat model, a precise statement of the privacy guarantee, and a proof that the protocol satisfies it are necessary. The current text does not support the abstract's claim of 'the first secure aggregation primitive that is both privacy-preserving and robust to fully Byzantine behavior in asynchronous networks.'","section":"§5.2–§5.4 (general)"}],"minor_comments":[{"comment":"'We prove experimentally' is a category error: experiments can provide evidence, not proof. Please rephrase and present the corresponding measurements.","section":"§5.3"},{"comment":"The condition 'Wait until SUM-SHARES<τ, ⋆, ⋆, ⋆> is received from a_j' is underspecified. It is unclear whether this is a typo or a missing condition on the set identity.","section":"Algorithm 2, line 14"},{"comment":"There are formatting artifacts in the line numbers ('9 9', '12 12') and in several other places (e.g., 'whenTRAIN< τ,cW τ proposed >is received') that should be cleaned.","section":"Algorithm 1"},{"comment":"The text says clients are 'one-shot' and communication is client-to-aggregator only, but Algorithm 4 has clients send a separate PING message after their UPDATE. Clarify whether PING is considered part of the same round and how this is compatible with the one-shot description.","section":"§4 and Algorithm 4"},{"comment":"The evaluation is limited to MNIST and a single baseline (FLDP). While informative, it does not compare against other secure-aggregation protocols or report inclusion-distribution statistics, which are needed to support the fairness and DP-budget claims.","section":"§6"}],"recommendation":"major_revision","confidential_remarks":"The equivocation attack is the decisive issue. If the authors cannot add a sound non-equivocation mechanism and a formal proof of privacy under Byzantine coordinators, the paper should be rejected. The inclusion-uniformity and DP-accounting gaps also need to be closed with formal analysis and concrete parameters. The topic is relevant and the architecture is promising, but the current version does not substantiate the advertised guarantees."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First, the honest bottom line: this is a genuinely interesting protocol paper with a real gap in the security argument. The combination it targets—asynchronous delivery, fully Byzantine aggregators, DP-secured aggregation, one-shot clients, and no client-to-client links—is not something the cited prior work covers, and the high-level design is clever. The deterministic reshuffling and the fair-inclusion mechanism are worth studying even if the paper's full claims don't hold.\n\nThe main problem is the equivocation argument in §5.2. The paper claims that threshold secret sharing with n_a ≥ 3t_a+1 prevents a Byzantine coordinator from reconstructing two overlapping subset sums. It does not. In Algorithm 2, every correct aggregator responds to every SUM-SHARES request for any subset of size ρ. A corrupted coordinator can issue requests for two subsets that differ in one client, collect n_a−t_a responses for each, reconstruct both mask sums, and therefore compute the difference of the two noisy updates. That is a direct violation of the privacy guarantee. The threshold only ensures at least one correct aggregator participates in each reconstruction; it does not limit the number of reconstructions. This is a load-bearing flaw, and it is not fixed elsewhere in the paper. The certification mechanism does not help because it starts after the reconstruction.\n\nThere are secondary issues. §5.3 says inclusion uniformity is proved experimentally, but no inclusion-distribution data appears and the Blaming thresholds (ExpectedVar, Δmax, secParam) are never specified. The DP noise budget T = τmax·ρ/k + Δmax depends on that uniformity, so the privacy accounting is not yet grounded. The evaluation never runs a Byzantine aggregator, and the convergence analysis assumes strong convexity while the experiments use a CNN. Source code is promised but not provided.\n\nNone of these are necessarily fatal—they are addressable—but the equivocation hole is. It breaks the paper's central privacy claim. The pieces are there for something good: I would want to see a revised version that either proves a non-equivocation bound or modifies the protocol so correct aggregators only serve one reconstruction request per round, plus real adversarial experiments and a formal DP accounting that accounts for manipulative inclusion.\n\nThe paper is worth sending to serious referees. It would be unfair to desk-reject it, because the question it attacks is important and the design ideas are genuinely novel. But as it stands I wouldn't rely on it or cite it as a secure construction.","headline":"The paper has a genuinely novel combination and a real, load-bearing flaw: threshold SS does not prevent a Byzantine coordinator from requesting overlapping subsets and isolating individual updates, so the central privacy claim is not yet established.","tokens_in":21263,"tokens_out":4531,"would_cite":false,"duration_ms":49122,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims the first secure aggregation protocol for federated averaging that is both privacy-preserving and robust to fully Byzantine aggregators in asynchronous networks, using replicated coordinators, verifiable shuffling, fair in","keywords":["federated learning","secure aggregation","Byzantine aggregators","asynchronous networks","differential privacy","verifiable shuffling","client inclusion fairness","threshold signatures"],"falsifier":"Run the Section 5.3 scenario with a Byzantine coordinator that drops PING messages from the slowest clients in its cluster before broadcasting UNIFICATION. If the coordinator can keep the variance of inclusion counts and the max gap Δ(λ) below the unspecified ExpectedVar and Δ_max thresholds while excluding a targeted client for many rounds, then the privacy budget T = τ_max·ρ/k + Δ_max is undercounted and the claimed (ε,δ)-DP guarantee fails. A simpler non-adversarial check: measure inclusion frequencies with honest aggregators under the stated gamma delay distributions; if any correct aggreg","tokens_in":20349,"feed_emoji":"🔒","tokens_out":6974,"duration_ms":67977,"temperature":0.7,"pith_summary":"Federated learning needs secure aggregation so a server can average private model updates without seeing them, but prior protocols assume bounded message delays, require heavy client-to-client coordination, and fail if an aggregator crashes or misbehaves. This paper tries to remove all three restrictions at once. It proposes a protocol in which clients are divided into clusters coordinated by replicated aggregators; each client masks its update with lightweight lattice-based secret-shared masking and adds differential-privacy noise, and the aggregators collectively unmask only cluster-level sums. A deterministic verifiable shuffling reassigns clients to coordinators every round, and a fair-inclusion mechanism compensates slow clients, so no participant is systematically excluded and fast clients do not burn through their privacy budget. If the construction holds, privacy-preserving federated averaging can run in fully asynchronous, unreliable networks with per-client communication that scales only with the number of aggregators, and clients can verify the integrity of the global model through threshold signatures.","feed_headline":"Byzantine servers no longer block private federated learning","feed_subtitle":"Keeps updates masked even when coordinators crash, cheat, or stall; no client-to-client messages.","key_machinery":"The key machinery is a combination of a publicly verifiable, deterministic shuffling function Assign(τ) and a fair inclusion function Include(λ, S). Assign(τ) partitions clients into equal, disjoint clusters from a public hash of the round number, guaranteeing in expectation that every client is assigned to every aggregator equally often and preventing Byzantine coordinators from systematically excluding clients or intersecting aggregates to isolate individual updates. Include(λ, S) sorts a coordinator's responding clients by their historical inclusion count and returns the ρ least-included ones, which both equalizes participation and controls the DP noise via T = τ_max·ρ/k + Δ_max. Around t","core_discovery":"The central claim is that secure aggregation for federated averaging can tolerate fully Byzantine aggregators in asynchronous networks without sacrificing privacy or liveness. The construction combines four elements: replicated aggregators (n_a ≥ 3t_a + 1) with clients partitioned into disjoint clusters; lightweight LWE-based masking, where each client secret-shares its mask among all aggregators so masks are removed only on sums of at least ρ updates; a deterministic shuffling that re-partitions clients each round using the round number as a public seed; and a fair inclusion mechanism that picks the ρ least-included clients, plus PING and UNIFICATION messages to decide when to stop waiting.","pith_inferences":["The fairness and DP guarantees hinge on the inclusion distribution being uniform in expectation; the paper only demonstrates this experimentally at Section 5.3 and never specifies ExpectedVar, Δ_max, or secParam (Algorithm 7). An adversarial aggregator that can bias inclusion counts without tripping the blaming mechanism would violate the privacy budget T = τ_max·ρ/k + Δ_max, so the protocol needs","The certification mechanism produces a threshold-signature proof that at least one correct aggregator was involved at every aggregation step; the same certificate could serve as a public audit record for the provenance of a global model, which the paper does not discuss.","The 'wasted cluster' mechanism introduces a subtle incentive: a Byzantine aggregator can voluntarily declare itself wasted and skip its own intra-cluster aggregate, shifting the inter-cluster average toward the other coordinators' clusters. The random reshuffling bounds the damage in expectation, but the paper does not analyze this strategic dimension.","A natural next experiment is to measure inclusion-frequency variance under adversarial message-delay distributions, such as a coordinator that withholds PINGs from the slowest clients, to test whether the Blaming function can actually detect the manipulation it is designed to catch."],"forward_implications":["Federated averaging can keep its privacy guarantee even when aggregation servers halt, omit messages, or try to manipulate the model, as long as fewer than one third of the aggregators are Byzantine (n_a ≥ 3t_a + 1).","Clients need only one round of communication with a single coordinator per training round, eliminating the mutual dependencies and high message complexity of pairwise-mask secure aggregation.","Because each client is included in expectation only ρ/k of the time, privacy noise can be set by T = τ_max·ρ/k + Δ_max instead of τ_max, giving better model utility at the same differential-privacy budget; the experiments show convergence on MNIST where the baseline does not converge.","Verifiable shuffling plus threshold-signature certification provides an integrity check on the global model without running Byzantine consensus, so the protocol remains live under arbitrarily delayed messages.","Fair inclusion prevents fast clients from dominating the aggregate, which avoids both model bias under non-i.i.d. data and unequal privacy risk among clients."],"fun_headline_variants":["Byzantine-proof privacy for async federated learning","Federated learning keeps secrets from cheating servers","Async FL: private even when coordinators go rogue","No client links, no leaks: Byzantine-resilient FL","Private aggregation that survives halting or lying servers"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is that the inclusion mechanism yields a uniform (in expectation) client-participation distribution even when Byzantine aggregators choose which messages to forward; the paper offers only an experimental argument for this at Section 5.3, and the thresholds ExpectedVar, Δ_max, and secParam used by the Blaming function are never specified—if inclusion can be skewed, the privacy budget and the fairness guarantee collapse.","fun_headline_variants_meta":{"raw":{"variants":["Byzantine-proof privacy for async federated learning","Federated learning keeps secrets from cheating servers","Async FL: private even when coordinators go rogue","No client links, no leaks: Byzantine-resilient FL","Private aggregation that survives halting or lying servers"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000151,"raw_usage":{"total_tokens":1047,"prompt_tokens":764,"completion_tokens":283,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":508,"completion_tokens_details":{"reasoning_tokens":207}},"tokens_in":508,"tokens_out":283,"duration_ms":4318,"temperature":1.0,"reasoning_tokens":207,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-03T11:49:51.892769+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the Section 5.3 scenario with a Byzantine coordinator that drops PING messages from the slowest clients in its cluster before broadcasting UNIFICATION. If the coordinator can keep the variance of inclusion counts and the max gap Δ(λ) below the unspecified ExpectedVar and Δ_max thresholds while excluding a targeted client for many rounds, then the privacy budget T = τ_max·ρ/k + Δ_max is undercounted and the claimed (ε,δ)-DP guarantee fails. A simpler non-adversarial check: measure inclusion frequencies with honest aggregators under the stated gamma delay distributions; if any correct aggreg","supporting_citations":[],"review_version":1}