2026· IEEE Transactions on Information Forensics and Security· Vol 21, pp. 6958-6972· 0 citations· 34 references
TL;DR
This paper analyzes client-side vulnerabilities in three chained stages of local training: local dataset pollution, model selective inputs, and training process tampering and proposes AMBER, a robust FL framework with a novel three-layer verification mechanism for client trust assessment.
Abstract
Federated Learning (FL) preserves data privacy by avoiding direct access to local data, but this limits server verification of client model updates. Unreliable participants can inject malformed updates to poison the global model without detection. In this paper, we analyze client-side vulnerabilities in three chained stages of local training: local dataset pollution, model selective inputs, and training process tampering. We refer to this class of threats as Local Chained Attacks (LCAs), which severely degrade global model robustness. To address these challenges, we propose AMBER, a robust FL framework with a novel three-layer verification mechanism for client trust assessment. The first layer ensures dataset integrity via vector commitments for content and distribution of client-held data. The second layer detects selective input attacks through a local consistency-based verification mechanism. The third layer enforces computational integrity by verifying the correlation between model inputs and outputs using secure primitives in a Trusted Execution Environment (TEE). AMBER establishes verifiable integrity links across data, input, and computation stages under an explicit trust boundary. Experimental evaluations covering multiple datasets, models, and attack scenarios show AMBER outperforms existing approaches in defense effectiveness with low overhead, adapting well to Non-IID environments.
A block chain-based Privacy-preserving and Secure Federated Learning (BPS-FL) system that uses threshold homomorphic encryption to safeguard the local gradients of clients in order to successfully solve such privacy and security assault challenges is suggested.
Umema Samreen, Dr. I. Samuel, Peter James· American Journal of AI Cyber...· 0 citations
This SoK model federated learning as an append-only transcript of submissions, admissions, aggregation, and finalization events, and formalize verifiability as a collection of integrity claims issued by clients and the aggregator, and checked by different verifier classes.
Andrea Rizzini, Marco Esposito, Tommaso Gagliardoni et al.· Proceedings on Privacy Enhan...· 0 citations
This work proposes PRoVeFL-a novel, modular FL framework that is Privacy-preserving, Byzantine-Robust, and ensures Verifiable aggregation, and improves runtime over the prior works, Prio and ELSA, based on distributed trust with comparable security guarantees, up to 100x and 10x, respectively.
Harsh Kasyap, Anil Kumar Pradhan, U. Atmaca et al.· 0 citations
Federated learning relies on a central server to aggregate client updates, making secure aggregation (SA) essential for privacy protection. Masking-based SA schemes dominate large-scale deployments due to their low overhead, yet they face a fundamental tension: efficient schemes assume a semi-honest server and provide no client-side cryptographic verification, while existing verifiable schemes admit algebraic degrees of freedom that allow a malicious server to forge results that pass all client-side checks. We present TriVer, a lightweight SA protocol that resolves this tension by augmenting a single-mask HPRF-based framework with a triple-binding verification mechanism grounded in elliptic curve cryptography. Each client independently verifies the aggregated result through three non-interactive checks: threshold signature verification, commitment aggregation consistency, and model-hash binding. Passing all three checks simultaneously is computationally equivalent to solving the elliptic curve discrete logarithm problem (ECDLP). We prove that TriVer satisfies client data privacy, aggregation correctness, and aggregation-result non-forgeability in the Random Oracle Model under ECDLP hardness, HPRF pseudorandomness, and hash collision resistance, against a fully malicious server that may collude with a subset of aggregators and clients. Experimentally, TriVer achieves a per-round latency of 1.96 s, approximately six times lower than LightVeriFL (11.68 s) and roughly twice the cost of Aion (0.97 s), with no forged result accepted across all evaluated attack types in our simulations, including the algebraic bypass attack; under the same attack, LightVeriFL’s single-constraint verification equation did not prevent forgery in our evaluated scenario. TriVer tolerates client dropout rates up to 40% with negligible recovery overhead, whereas LightVeriFL fails to complete aggregation at a 20% dropout rate.
Guangye Zhu, Liqiang Wu, Weidong Du· Journal of King Saud Univers...· 0 citations
Federated learning (FL) is a machine learning technique where multiple clients with local data collaborate in training a machine learning model. However, this centralization of sensitive model updates incurs security and privacy issues. A malicious aggregator can launch inference attacks to violate the privacy of clients' private data from local models and explore sensitive knowledge from global model. Trusted Execution Environment (TEE) based schemes offer secure enclaves to protect models privacy during the aggregation procedure. However, TEE technologies incur new functional and security assumptions, where a single vulnerability could undermine the trusted system. Cryptographic schemes such as homomorphic encryption (HE), differential privacy (DP) and secret sharing (SS) cannot achieve the simultaneous requirements of efficiency, accuracy and privacy currently. In this paper, we present DoshFL that avoids expensive cryptographic operations and enables tunable trade-off between privacy and efficiency in federated learning for model asset protection.
Jia-Ming Fang· 2026 3rd World Conference on...· 0 citations