{"id":"413cf47a-c4fb-485b-8eea-e6822e05a77e","arxiv_id":"2601.17360","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":6,"one_line_summary":"Certified output invariance is reframed as inference-stage privacy, expanding the range of sensitive attribute values compatible with a prediction and disrupting label-only model inversion attacks.","lead":"The paper recasts a known security property—a model giving the same answer for all small input changes—as a privacy guarantee, and tests it on health and face data. It reports that this narrows how precisely an attacker can infer private attributes and cuts a face-reconstruction attack's success rate from 73% to 4%.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central (R,α)-Robust Privacy guarantee — 'adversary advantage ≤ α/2' — is asserted in the abstract but is never defined or proved in Section 4; the paper's formal core is unsupported.","rationale":"The reader's weakest assumption — that output invariance on a ball is sufficient to bound inference advantage, with no proof appearing in Section 4 — is the same load-bearing concern I identify. The abstract explicitly promises a proof of the α/2 advantage bound, but the full text contains only informal remarks and an APE definition that is essentially a restatement of invariance. This is not a minor omission: the formal privacy guarantee is the central claimed contribution of the paper. If the proof were supplied and the necessary assumptions (e.g., pairwise distinguisher, prior over candidates, probabilistic smoothing model) made explicit, the paper could potentially be rehabilitated; as submitted, the core theorem is absent. The empirical results on model inversion are interesting and may be reproducible, but they do not substitute for the missing formal derivation. I therefore agree with the reader's REJECT verdict, with the emphasis on the missing (R,α) theorem rather than on the MIA abstention issue, though that second concern also deserves attention in revision.","tokens_in":12708,"tokens_out":7434,"duration_ms":88159,"concrete_test":"Insert in Section 4 a formal definition of (R,α)-Robust Privacy and a complete proof of the α/2 advantage bound: specify the probability space of smoothing noise, the adversary's prior over a candidate pair (x,x') with ||x-x'||≤R, the released output, and compute the total variation distance between the output distributions under the two hypotheses; show TV ≤ α and advantage ≤ α/2. If the proof requires assumptions not stated (uniform prior, single query, pairwise comparison), those assumptions must be added; if the correct bound is α rather than α/2, the abstract overclaims by a factor of 2.","verdict_should_be":"REJECT","load_bearing_attack":"The paper's central formal promise is that observing a released prediction gives any adversary at most α/2 advantage in distinguishing x from any input within distance R. Yet Section 4 defines only deterministic R-Robust Privacy (Definition 1) and APE (Definition 2); no (R,α)-Robust Privacy is defined, no adversary advantage is formalized, and no theorem or proof appears anywhere in the text. Definition 1 has no α and no probabilistic output mechanism, so the α/2 claim cannot be derived from it without additional assumptions (e.g., a prior over candidate inputs, a pairwise hypothesis test, and a probabilistic smoothing model). The informal 'interpretation' paragraph simply restates invariance. The abstract's other quantitative claims — RP 'dominates DP-SGD and randomized response' with 98.4% accuracy at 21% ASR, and the distillation boundary — likewise have no corresponding experiments or proofs in the manuscript. Since the formal guarantee is the paper's advertised contribution, the central claim is claim-without-derivation. The empirical sections may show that smoothed classifiers resist label-only inversion, but they do not establish the advertised (R,α) privacy bound.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces Robust Privacy (RP), an inference-stage privacy notion that reinterprets certified robustness: if a model's prediction is invariant on a radius-R ball around input x, then observing the prediction supposedly cannot distinguish x from other inputs in that ball. It also defines Attribute Privacy Enhancement (APE) to translate input-level invariance into an expanded set of sensitive-attribute values compatible with a released label. Experiments cover (i) a BMI-based recommendation task where randomized smoothing expands the range of BMI values that receive a positive recommendation, and (ii) label-only model inversion attacks (Kahla et al., 2022) where randomized smoothing reduces attack success rate from 73% to 44% at 100% accuracy or to 4% at 59% accuracy. The abstract makes substantially stronger claims — an (R,α)-Robust Privacy theorem bounding adversary advantage by α/2, a median APE interval growth from 23.50 to 29.96, 98.4% accuracy at 21% ASR, dominance over DP-SGD and randomized response, and a distillation scope boundary — but none of these appears in the body of the paper.","tokens_in":13054,"tokens_out":5703,"duration_ms":66125,"significance":"If the advertised (R,α) guarantee were actually proved, repurposing certified robustness as an inference-time privacy notion would be a genuinely useful conceptual bridge between two active research areas. The empirical observation that randomized smoothing can disrupt label-only model inversion is interesting and could be of practical value, and the paper is honest in acknowledging the abstention issue in Section 7.2. However, as submitted, the formal core of the paper is missing: the central theorem is stated only in the abstract, the APE expansion is a definitional consequence of the smoothing certificate rather than an independent predictive result, and the MIA experiments use a protocol that invalidates the certified-invariance interpretation. The current manuscript therefore does not establish the contribution it advertises.","major_comments":[{"comment":"The paper's advertised formal guarantee — '(R,α)-Robust Privacy, under which any adversary observing the released prediction has at most α/2 advantage in distinguishing x from any input within distance R' — is never defined or proved. Definition 1 is a deterministic invariance condition with no α and no probabilistic output model; Definition 2 concerns attribute-level inference sets. No adversary-advantage formalization, no hypothesis-testing setup, and no theorem statement appear anywhere in Section 4 or the rest of the paper. The 'Interpretation' paragraph merely restates f(x')=f(x) as 'cannot distinguish.' That is not a derivation: without a prior over candidate inputs, a query model (single label vs. multiple queries), and a probabilistic smoothing model, invariance alone does not imply a numeric advantage bound. The abstract's quantitative claim is therefore unsupported by the manus","section":"Section 4 (Definitions 1–2); abstract"},{"comment":"The MIA experiment adopts an 'always-return-a-label protocol ... without abstention.' Under randomized smoothing, the certified radius (Eq. 1) and hence Definition 1's R-Robust Privacy are only valid for predictions returned with the certified confidence procedure. Once abstention is removed, the majority-vote label that the attacker observes is not certified. Consequently, the observed ASR reduction in Figure 3 cannot be attributed to the certified invariance mechanism that defines RP; it may be an effect of randomized smoothing more broadly (e.g., label noise or boundary flattening). The paper's central causal claim — that RP mitigates MIAs specifically by enforcing output invariance within a certified radius — is not established by the experiments as designed.","section":"Section 6 and Section 7.2"},{"comment":"The APE-expanded inference set I_y^(R) is defined as the union of intervals [z−R_z, z+R_z] over z∈I_y. Since R_z is, by definition, a radius such that all inputs within that interval produce the same output y, the expansion is a definitional consequence of the certificate. The experiment in Section 5 therefore verifies that the smoothing certificate holds on the sampled BMI grid, not that RP provides an independently derived privacy effect. This is not fatal to the concept, but it should be presented as a soundness/consistency check of the definition, not as empirical evidence of a new privacy mechanism beyond what randomized smoothing already provides.","section":"Section 5, Definition 2"},{"comment":"Several quantitative claims in the abstract have no counterpart in the body: (i) the median APE interval growing from 23.50 to 29.96; (ii) RP 'dominating' DP-SGD and randomized response, with 98.4% accuracy at 21% ASR; (iii) a distillation scope boundary. Table 1 reports accuracy 96.36% at σ=1, 92.76% at σ=2, and 89.04% at σ=3, with no ASR; Figure 3 reports 59% accuracy at 4% ASR and 100% accuracy at 44% ASR. No DP-SGD or randomized-response comparison and no distillation experiment is described anywhere. The manuscript must either include these results and analyses or remove the claims from the abstract; as is, the abstract describes a different or more complete paper than the one under review.","section":"Abstract vs. Sections 4–8"}],"minor_comments":[{"comment":"The notation f_{x_{-1}}(x_1) is difficult to read because x_{-1} is both a vector and a subscript. Suggest writing f_{x_{-1}} with parentheses or using a clearer functional notation.","section":"Definition 2, notation"},{"comment":"The robustness radius formula is referenced as 'Equation 1' in Section 5, but the equation is not numbered in the text. Please number it or adjust the cross-reference.","section":"Equation (1)"},{"comment":"The statement that 'the observed expansion increasing from 0.4 to 1.0' should specify how these numbers are measured and include the underlying counts or confidence intervals; otherwise the reader cannot assess the stability of the reported expansion.","section":"Section 5, results"},{"comment":"Several references contain LaTeX artifacts, e.g., 'A¨ıvodji' in the in-text citation; please clean up special characters. Also, the Kaggle dataset citation would benefit from an explicit access date beyond the existing note.","section":"References/formatting"}],"recommendation":"reject","confidential_remarks":"The gap between the abstract and the body is severe: the abstract promises formal guarantees, state-of-the-art comparisons, and quantitative results that are absent from Sections 4–8. This is not a routine presentation issue; the central technical contribution is missing. I would not consider this a near-miss; the paper needs a major rewrite and a complete reconciliation between its claims and its evidence before it could be suitable for review at this journal."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague — quick take on arXiv:2601.17360. The headline promise—an (R,α)-Robust Privacy guarantee giving an adversary at most α/2 advantage—is simply not in the manuscript. Section 4 defines deterministic R-Robust Privacy (Definition 1) and the APE expansion (Definition 2), but there is no (R,α) formalization, no advantage definition, no theorem, no proof. So the central advertised contribution is a claim without derivation. The body's abstract is more modest than the arXiv abstract; the latter adds 'RAP,' α/2, DP-SGD/randomized-response dominance, and distillation boundaries, none of which appear in the text. That's a serious integrity problem.\n\nThat said, the paper does contain real work. The observation that certified robustness output invariance can be read as local indistinguishability is a fair and useful re-framing; it won't surprise anyone who knows Cohen et al., but it's cleanly stated. The APE construction—unioning the robust intervals over the baseline inference set—is a reasonable operationalization of attribute-level privacy, and the recommendation experiment shows convincingly that smoothing broadens the set of BMI values consistent with a positive label. The model-inversion experiments are also honest: they adopt an always-return-a-label protocol, explicitly discuss the abstention issue in Section 7.2, and the ASR drop (73% to 4% at σ=0.1, and 44% at σ=0.03 with full accuracy) is reported with appropriate caveats.\n\nSoft spots beyond the missing theorem: novelty is modest, since Definition 1 is literally the standard ℓp robustness condition and the APE expansion is definitional. The claim that RP 'dominates DP-SGD and randomized response' appears only in the abstract and is unsupported. The MIA mitigation is empirically plausible, but the causal link to certified invariance is not established because the no-abstention protocol voids the certificate; they acknowledge this, but it weakens the 'privacy' interpretation. The α parametrization is also odd: Definition 1 has no α, and the α/2 claim would need a prior and a hypothesis-testing setting that never appears.\n\nOn balance: the formal core is not delivered, and the empirical scope is narrow. But the paper is not incoherent; the ideas are clearly presented and the limitations are candid. If the authors can actually prove the α/2 bound under explicit assumptions, or reframe this as an empirical study of smoothing-induced inference-set expansion, there's a useful paper. As submitted, I'd not desk-reject—send it to review, but with a clear note to align the abstract with what the body actually establishes.","headline":"Worth one look: the empirical story is plausible, but the advertised α/2 guarantee is absent from the actual paper—so treat the abstract as aspiration.","tokens_in":13518,"tokens_out":4592,"would_cite":false,"duration_ms":47499,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper introduces Robust Privacy: if a model's output is invariant within radius R of an input at confidence 1−α, then a label-only adversary gains at most α/2 advantage in distinguishing the input from others within that radius.","keywords":["Robust Privacy","certified robustness","inference-time privacy","attribute inference","model inversion attacks","randomized smoothing","label-only adversary"],"falsifier":"Run the label-only inversion attack against the certified classifier with abstention enabled, and compare ASR with the always-return-a-label protocol used in Section 6; if ASR rises sharply, the reported 4% is an artifact of query refusal, not invariance. Separately, compute the exact Bayesian advantage for a two-point prior inside the ball; if it exceeds α/2, the paper's headline bound is false. Both are directly checkable.","tokens_in":12611,"feed_emoji":"🔒","tokens_out":6986,"duration_ms":65964,"temperature":0.7,"pith_summary":"Robust Privacy is the claim that a model's local output invariance can be turned into a privacy guarantee at inference time. The paper defines an input x as (R,α)-Robust Private if the model's prediction is invariant on the radius-R ball around x at confidence 1−α, and asserts that any adversary seeing only that label has at most α/2 advantage in telling x apart from any point inside the ball. From this it derives Attribute Privacy Enhancement, widening the set of sensitive-attribute values consistent with a released prediction, and it tests the idea on a recommendation task and a label-only model-inversion attack, reporting that invariance reduces inversion success from 73% to 4% while largely preserving accuracy. If correct, the notion gives model deployers a practical inference-stage countermeasure against attribute inference and training-data reconstruction, complementing training-stage protections such as differential privacy.","feed_headline":"One robustness trick shrinks model-inversion attacks from 73% to 4%","feed_subtitle":"Certified output invariance hides fine-grained input details from label-only adversaries, weakening attribute inference.","key_machinery":"The load-bearing object is robust radius R from randomized smoothing, defined by R=(σ/2)(Φ^{-1}(p_A)−Φ^{-1}(p_B)) with confidence 1−α. Definition 1 (Robust Privacy) says that B_p(x,R) ⊆ f^{-1}(f(x)); Definition 2 (APE) expands the baseline inference set to I_y^(R)=∪_{z∈I_y}[z−R_z,z+R_z]. The mechanism carries the argument because the invariance ball is what makes the released label compatible with all nearby inputs, and the smoothing noise scale σ and Monte Carlo sampling size N control the radius.","core_discovery":"On its own terms, the paper's central discovery is that certified robustness—usually built for adversarial defense—is already a privacy mechanism: a robust radius R at x is exactly the radius within which observing f(x) leaves x indistinguishable from its neighbors B_p(x,R) ⊆ f^{-1}(f(x)). The paper then defines Attribute Privacy Enhancement as the union expansion of the baseline inference set I_y by the robust radii at each compatible attribute value, and demonstrates on a BMI-threshold recommendation task that this widens the inference interval (median length from 23.50 to 29.96 in the abstract) and, on a face-recognition inversion task with label-only access, that Gaussian smoothing's inv","pith_inferences":["The α/2 bound is proved nowhere in Section 4; it holds only under the certified interface (possibly abstaining) with a single label query and a uniform prior over the ball. The paper's own Section 7.2 removes abstention for the inversion experiments, so the 4% ASR result is not covered by the formal guarantee—the attacker sees labels outside the certified region.","A natural extension is an adaptive adversary who issues multiple queries inside the ball; the paper's single-query formulation does not address how advantage compounds across queries, which would likely exceed α/2.","The APE interval expansion is demonstrated on a one-dimensional slice (fixing x_{−1}), but real adversaries may vary other attributes; testing whether the expansion survives with partial knowledge of x_{−1} would clarify the practical reach.","Since larger N improves both privacy and utility, the authors implicitly propose a Pareto-improving knob: any deployment that can afford more Monte Carlo samples gets both stronger certificates and better accuracy—worth testing at larger N and higher dimensions."],"forward_implications":["Observation of a prediction cannot single out x among the points inside its certified ball, so the sensitive-attribute inference interval widens; the paper reports median RAP-compatible interval length growing from 23.50 to 29.96.","Label-only model-inversion attacks lose their directional update signal: ASR falls from 73% to 4% at σ=0.1 with N=100 and to 44% at σ=0.03 with N=100 while accuracy remains 100%.","Strengthening the certificate (larger N) can improve both utility and privacy; the paper reports accuracy increasing and ASR decreasing together when N goes from 10 to 100.","Because it targets the inference interface rather than training, RP dominates DP-SGD and randomized response on the reported privacy-utility trade-off, retaining 98.4% accuracy at 21% ASR where DP-SGD needs to drop to 61.7%.","RP mitigates attribute- and instance-level leakage but not function-level extraction: distillation can still remove the model's functionality."],"fun_headline_variants":["Robust Privacy: certified robustness cuts inversion ASR from 73% to 4%","Certified output invariance hides attributes, reducing inversion ASR to 4%","Inference-stage privacy shield: model inversion ASR drops from 73% to 4%","RP: provable robustness at inference lowers attack success from 73% to 4%"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The central claim rests on the unproven premise that output invariance on a ball is itself enough to cap an adversary's inference advantage at α/2—an assumption that silently presumes a uniform prior over the ball, a single label query, and in the model-inversion experiments the removal of abstention, none of which the paper proves to hold.","fun_headline_variants_meta":{"raw":{"variants":["Robust Privacy: certified robustness cuts inversion ASR from 73% to 4%","Certified output invariance hides attributes, reducing inversion ASR to 4%","Inference-stage privacy shield: model inversion ASR drops from 73% to 4%","RP: provable robustness at inference lowers attack success from 73% to 4%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001036,"raw_usage":{"total_tokens":4260,"prompt_tokens":871,"completion_tokens":3389,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":615,"completion_tokens_details":{"reasoning_tokens":3308}},"tokens_in":615,"tokens_out":3389,"duration_ms":22593,"temperature":1.0,"reasoning_tokens":3308,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-03T08:18:28.281323+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the label-only inversion attack against the certified classifier with abstention enabled, and compare ASR with the always-return-a-label protocol used in Section 6; if ASR rises sharply, the reported 4% is an artifact of query refusal, not invariance. Separately, compute the exact Bayesian advantage for a two-point prior inside the ball; if it exceeds α/2, the paper's headline bound is false. Both are directly checkable.","supporting_citations":[],"review_version":1}