A Verifiable Accountable Anonymous Authentication Interface for Cross-Silo Federated Learning

Abstract

Cross-silo federated learning must reconcile update authentication, routine identity privacy, and auditable accountability across independently operated institutions. Ordinary digital signatures provide direct attribution but expose the signer of every benign update. Secure aggregation and robust learning address complementary confidentiality and robustness goals, yet they typically do not provide a publicly verifiable interface for post-incident attribution and revocation. We present A3FL, a verifiable accountable anonymous authentication interface for cross-silo federated learning, motivated by regulated institutional collaboration. The interface defines canonical transcripts that bind the payload hash, the complete round context (including the transparency-log digest), registry state, nullifier, auditor-committee key, opening policy, trace ciphertext, and opening evidence. A client proves that an update comes from an authorized, active member without disclosing its identity. An atomic per-round registry-version pin, combined with a round-local nullifier, detects duplicate submissions. A policy-valid incident request and verifiable shares from a threshold quorum of auditors enable publicly verifiable opening and registry-based revocation with respect to the historical state. We instantiate the interface with a Groth16/Edwards backend and implement a prototype that covers registry freshness, duplicate filtering, authorized public opening, revocation, and adversarial transcript validation. Experiments across institutional-scale registry sizes quantify the control-plane costs of anonymous admission, authorized opening, revocation, and the proof backend. A multi-scenario poisoning case study demonstrates how the policy-gated accountability path responds to different incident-evidence conditions.