Robust-PCA and Marchenko–Pastur denoising lower bound

Prove a formal lower bound showing whether AEGIS’s Gaussian uniformisation remains resistant to adversaries applying Robust PCA or Marchenko–Pastur denoising to the masked gradients.

Background

The MLP-gradient defence is motivated by the prediction that calibrated noise pushes the signal singular values below the Marchenko–Pastur noise bulk. The paper treats this as a design criterion and empirical prediction rather than a theorem.

A sufficiently capable adversary might denoise the uniformised gradients and recover the submerged low-rank signal. The paper explicitly leaves a formal robust-PCA lower bound unresolved, making this a theoretical limitation of the current security argument.

References

This is a design criterion and empirical prediction rather than a theorem in this paper; a formal robust-PCA lower bound is left to future work (Limitation~\ref{lim:adaptive}).

— AEGIS: Attention-Embedding Gradient Isolation Shield - Triple-Channel Gradient Masking for Privacy-Preserving Federated LLM Fine-Tuning  (2608.19534 - Tao et al., 20 Aug 2026) in Section 3.3, subsection “Random-matrix rationale for Eq. (\ref{eq:flood_fc})”; Section 5.1, Limitations