2026· IEEE Transactions on Information Forensics and Security· Vol 21, pp. 6958-6972· 0 citations· 34 references
TL;DR
This paper analyzes client-side vulnerabilities in three chained stages of local training: local dataset pollution, model selective inputs, and training process tampering and proposes AMBER, a robust FL framework with a novel three-layer verification mechanism for client trust assessment.
Abstract
Federated Learning (FL) preserves data privacy by avoiding direct access to local data, but this limits server verification of client model updates. Unreliable participants can inject malformed updates to poison the global model without detection. In this paper, we analyze client-side vulnerabilities in three chained stages of local training: local dataset pollution, model selective inputs, and training process tampering. We refer to this class of threats as Local Chained Attacks (LCAs), which severely degrade global model robustness. To address these challenges, we propose AMBER, a robust FL framework with a novel three-layer verification mechanism for client trust assessment. The first layer ensures dataset integrity via vector commitments for content and distribution of client-held data. The second layer detects selective input attacks through a local consistency-based verification mechanism. The third layer enforces computational integrity by verifying the correlation between model inputs and outputs using secure primitives in a Trusted Execution Environment (TEE). AMBER establishes verifiable integrity links across data, input, and computation stages under an explicit trust boundary. Experimental evaluations covering multiple datasets, models, and attack scenarios show AMBER outperforms existing approaches in defense effectiveness with low overhead, adapting well to Non-IID environments.
A block chain-based Privacy-preserving and Secure Federated Learning (BPS-FL) system that uses threshold homomorphic encryption to safeguard the local gradients of clients in order to successfully solve such privacy and security assault challenges is suggested.
Umema Samreen, Dr. I. Samuel, Peter James· American Journal of AI Cyber...· 0 citations
This SoK model federated learning as an append-only transcript of submissions, admissions, aggregation, and finalization events, and formalize verifiability as a collection of integrity claims issued by clients and the aggregator, and checked by different verifier classes.
Andrea Rizzini, Marco Esposito, Tommaso Gagliardoni et al.· Proceedings on Privacy Enhan...· 0 citations
This work proposes PRoVeFL-a novel, modular FL framework that is Privacy-preserving, Byzantine-Robust, and ensures Verifiable aggregation, and improves runtime over the prior works, Prio and ELSA, based on distributed trust with comparable security guarantees, up to 100x and 10x, respectively.
Harsh Kasyap, Anil Kumar Pradhan, U. Atmaca et al.· 0 citations
Federated Learning (FL) enables collaborative model training without centralizing client data, making it well-suited for privacy-sensitive domains. Existing approaches use techniques such as homomorphic encryption, differential privacy, and secure multi-party computation to mitigate attacks including model inversion, membership inference, and gradient leakage. However, these methods often incur high computational and memory overheads and frequently overlook confidentiality of the global model itself, which may be proprietary and sensitive. These limitations reduce the practicality of secure FL in large-scale and compliance-sensitive environments.We present NETFL, a Fully Secure and scalable FL framework that decentralizes training across client pairs using lightweight MPC, while restricting servers to secure aggregation, client pairing, and routing. NETFL eliminates server-side bottlenecks, avoids full data offloading, and preserves confidentiality of data, model parameters, and updates throughout training. Our evaluation shows that NETFL protects against unauthorized observation, reconstruction, gradient leakage, membership inference, and inversion attacks, while achieving up to 13× faster training time and 50% lower server memory usage compared to prior work.
Sahar Ghoflsaz Ghinani, Elaheh Sadredini· International Conference on...· 0 citations
It is proved that TriVer satisfies client data privacy, aggregation correctness, and aggregation-result non-forgeability in the Random Oracle Model under ECDLP hardness, HPRF pseudorandomness, and hash collision resistance, against a fully malicious server that may collude with a subset of aggregators and clients.
Guangye Zhu, Liqiang Wu, Weidong Du· Journal of King Saud Univers...· 0 citations
Federated learning (FL) is a machine learning technique where multiple clients with local data collaborate in training a machine learning model. However, this centralization of sensitive model updates incurs security and privacy issues. A malicious aggregator can launch inference attacks to violate the privacy of clients' private data from local models and explore sensitive knowledge from global model. Trusted Execution Environment (TEE) based schemes offer secure enclaves to protect models privacy during the aggregation procedure. However, TEE technologies incur new functional and security assumptions, where a single vulnerability could undermine the trusted system. Cryptographic schemes such as homomorphic encryption (HE), differential privacy (DP) and secret sharing (SS) cannot achieve the simultaneous requirements of efficiency, accuracy and privacy currently. In this paper, we present DoshFL that avoids expensive cryptographic operations and enables tunable trade-off between privacy and efficiency in federated learning for model asset protection.
Jia-Ming Fang· 2026 3rd World Conference on...· 0 citations