This work proposes PRoVeFL-a novel, modular FL framework that is Privacy-preserving, Byzantine-Robust, and ensures Verifiable aggregation, and improves runtime over the prior works, Prio and ELSA, based on distributed trust with comparable security guarantees, up to 100x and 10x, respectively.
Abstract
Federated Learning (FL) enables multiple clients to collaboratively train machine learning models while retaining data locality, thereby enhancing user privacy. However, traditional FL frameworks rely on a centralized aggregation server and assume honest-but-curious clients, making them susceptible to both server-side inference and client-side poisoning attacks. Although recent work has explored secure and Byzantine-resilient FL protocols, they face a fundamental trade-off among privacy, integrity, and verifiability, and incur substantial computational and communication overhead due to the heavy use of cryptographic primitives. In this work, we propose PRoVeFL-a novel, modular FL framework that is Privacy-preserving, Byzantine-Robust, and ensures Verifiable aggregation. PRoVeFL employs multiple servers leveraging multi-key fully homomorphic encryption. Each client encrypts its local model updates and distributes encrypted shares to all servers. This design enables a hybrid computation model in which ciphertext operations are carefully offloaded to the plaintext domain under strict privacy constraints to efficiently evaluate complex statistical aggregation rules. PRoVeFL is compatible with a wide range of state-of-the-art Byzantine-robust aggregation algorithms (e.g., Krum, Trimmed Mean, FLTrust, norm clipping, MESAS, and more) and further enhances them with verifiability mechanisms that require minimal trust in at least one honest server. We evaluate it across different settings and demonstrate its scalability with varying numbers of parameters and participants. PRoVeFL improves runtime over the prior works, Prio and ELSA, based on distributed trust with comparable security guarantees, up to 100x and 10x, respectively.
Federated Learning (FL) enables collaborative model training without centralizing client data, making it well-suited for privacy-sensitive domains. Existing approaches use techniques such as homomorphic encryption, differential privacy, and secure multi-party computation to mitigate attacks including model inversion, membership inference, and gradient leakage. However, these methods often incur high computational and memory overheads and frequently overlook confidentiality of the global model itself, which may be proprietary and sensitive. These limitations reduce the practicality of secure FL in large-scale and compliance-sensitive environments.We present NETFL, a Fully Secure and scalable FL framework that decentralizes training across client pairs using lightweight MPC, while restricting servers to secure aggregation, client pairing, and routing. NETFL eliminates server-side bottlenecks, avoids full data offloading, and preserves confidentiality of data, model parameters, and updates throughout training. Our evaluation shows that NETFL protects against unauthorized observation, reconstruction, gradient leakage, membership inference, and inversion attacks, while achieving up to 13× faster training time and 50% lower server memory usage compared to prior work.
Sahar Ghoflsaz Ghinani, Elaheh Sadredini· International Conference on...· 0 citations
Federated learning alleviates data silos through a “data-local, model-global” paradigm, but transmitting plaintext gradients exposes clients to reconstruction attacks from malicious servers. Existing secure aggregation methods face trade-offs among privacy, accuracy, and efficiency: homomorphic encryption incurs high overhead, differential privacy sacrifices accuracy, and lightweight secret-sharing schemes often lack weighted aggregation support and suffer accuracy degradation as client numbers grow. To address these limitations, we propose SecAGG, a lossless secure weighted aggregation scheme based on additive secret sharing. SecAGG adopts a three-tier architecture consisting of client clusters, cooperative servers, and a super server. Clients split weighted model parameters into random shares and distribute them to cooperative servers, which perform encrypted partial aggregation before the super server securely reconstructs the global model. Experimental results demonstrate that SecAGG achieves strict security against up to M-1 colluding servers under the semi-honest model while preserving FedAvg-equivalent accuracy with minimal computation and communication overhead, effectively balancing privacy, accuracy, and efficiency.
Xiaomei Tian· 2026 3rd World Conference on...· 0 citations
It is proved that TriVer satisfies client data privacy, aggregation correctness, and aggregation-result non-forgeability in the Random Oracle Model under ECDLP hardness, HPRF pseudorandomness, and hash collision resistance, against a fully malicious server that may collude with a subset of aggregators and clients.
Guangye Zhu, Liqiang Wu, Weidong Du· Journal of King Saud Univers...· 0 citations
This work proposes a lightweight and information-theoretically secure aggregation framework that securely computes the majority vote (MV) polynomial through single-round secure multiplication, ensuring end-to-end information-theoretic security under the honest-majority assumption while revealing only the final aggregated sign to the server.
Secure Federated Learning protects user privacy by keeping local gradients within the ciphertext space, thereby preventing direct exposure of raw gradients during aggregation. Paradoxically, this very protection introduces a fundamental vulnerability: the opacity of encrypted gradients blinds the server, rendering honest and malicious gradients indistinguishable. An attacker can exploit this opacity to inject manipulated gradients directly into the secure aggregation process, compromising the integrity of the global model. To address this issue, we propose SFLBR, a novel Byzantine-robust Secure Federated Learning framework. Specifically, we adopt the gradient median as a robust benchmark and introduce a layer-wise cosine similarity metric to differentiate malicious gradients. Furthermore, considering the complexity of non-independent and identically distributed (Non-IID) scenarios, we further design a proactive defense strategy that constrains the divergence among honest gradients, and augment it with a trust score function to improve robustness against potential misjudgments. Finally, we construct a series of secure communication protocols based on a lightweight dual-masking encryption mechanism, which enable efficient robust aggregation directly within the ciphertext space. Extensive experiments validate the effectiveness of SFLBR, demonstrating state-of-the-art (SOTA) defense performance across diverse attack scenarios.
Jinbo Wang, Ruijin Wang, Zengpeng Li et al.· IEEE Transactions on Informa...· 0 citations
Privacy preserving federated learning (FL) faces a crucial trade-off between privacy and efficiency. Specifically, traditional multi-party homomorphic encryption incurs high computational and communication costs, while schemes relying on a single mask are susceptible to selective aggregation attacks. To address these limitations, this paper proposes DMSA-FL as a practical and robust FL framework leveraging double-masked secure aggregation integrated with multiparty homomorphic encryption. We mitigate efficiency bottlenecks by designing a strategy that encrypts only low-dimensional mask seeds rather than high-dimensional gradients. This method utilizes a homomorphic pseudorandom generator for mask expansion. Furthermore, a robustness protocol based on threshold secret sharing over sparse sketches is implemented to ensure aggregation continuity during user dropouts. Theoretical analysis demonstrates that DMSA-FL is secure against collusion attacks and selective aggregation attacks. Extensive experiments on multiple datasets indicate that DMSA-FL maintains model accuracy comparable to plaintext baselines. Compared with representative federated learning schemes based on CKKS multiparty homomorphic encryption, our approach achieves improved computational efficiency and significantly reduces communication overhead. Moreover, the computational advantage becomes increasingly evident as the number of model parameters grows.
Wenhao Liu, Xu-An Wang, Weiwei Jiang et al.· Journal of King Saud Univers...· 0 citations