TGSFL: Trustworthy group-signature-based federated learning for LLMs in healthcare

TeleZK-FL: enabling trustless and verifiable remote patient monitoring via quantized zero-knowledge federated learning

TeleZK-FL establishes the feasibility of verifiable, trustless federated learning on commodity telehealth hardware by eliminating the computational bottlenecks of server-side proof generation while incurring only 0.1%–0.3% AUC degradation.

Trustworthy and privacy-preserving decentralized federated learning with multi-layer defense for secure collaborative AI

Decentralized Federated Learning (DFL) enables collaborative artificial intelligence model training without centralizing sensitive data, making it suitable for privacy-critical and distributed intelligent systems such as healthcare, Industrial IoT, and smart digital infrastructure. Despite its advantages, DFL remains vulnerable to privacy leakage through shared model updates and to model poisoning and backdoor attacks that compromise system reliability, robustness, and trustworthiness. Existing defense mechanisms primarily address either privacy preservation or poisoning robustness independently and often exhibit limited effectiveness under adaptive or high-ratio adversarial settings. This work proposes a trustworthy and privacy-preserving decentralized federated learning framework that jointly addresses these challenges through two integrated components: (i) a hybrid privacy mechanism based on public dataset pretraining followed by differentially private fine-tuning, and (ii) a multi-layer model defense architecture designed to mitigate poisoning and backdoor attacks across decentralized peer-to-peer environments. The framework integrates local data sanitization, peer-side model verification, robust trimmed-mean aggregation, and runtime inference protection to provide defense-in-depth across both training-time and inference-time attack surfaces. An adversary model and operational assumptions are formally defined, and the framework is evaluated under strong adversarial conditions, including a 20% poisoning ratio. Experimental results demonstrate consistent robustness improvements over a vanilla DFL baseline. While the baseline model achieves a clean accuracy of 83.10%, the proposed framework improves clean performance to 86.12%. Under adversarial conditions, accuracy improves from 37.71% to 53.88% for Fast Gradient Sign Method (FGSM) attacks, from 21.75% to 46.40% for Projected Gradient Descent (PGD) attacks, and from 40.62% to 67.35% for Carlini–Wagner (CW) attacks. For backdoor-based poisoning attacks such as BadNets and Blended attacks, the defense pipeline restores model accuracy to above 86% while maintaining stable benign performance. These findings demonstrate that the proposed framework provides an effective balance between privacy preservation, adversarial robustness, and trustworthy decentralized collaborative learning for secure AI-driven systems.

MAD-Based Update Filtering for Non-IID Federated Learning: Robustness Analysis Under Poisoning Attacks

A ablation indicates that removing MAD filtering substantially reduces class-balanced performance on HAM10000 under noise injection, and a diagnostic analysis shows that the cosine-distance signal separates benign and malicious updates strongly under noise injection but weakly under sign flipping.

Poison-Resilient and Privacy-Preserving Federated Learning Scheme in Mobile Systems

NETFL: Network Efficient Fully Secure Federated Learning at Scale

Federated Learning (FL) enables collaborative model training without centralizing client data, making it well-suited for privacy-sensitive domains. Existing approaches use techniques such as homomorphic encryption, differential privacy, and secure multi-party computation to mitigate attacks including model inversion, membership inference, and gradient leakage. However, these methods often incur high computational and memory overheads and frequently overlook confidentiality of the global model itself, which may be proprietary and sensitive. These limitations reduce the practicality of secure FL in large-scale and compliance-sensitive environments.We present NETFL, a Fully Secure and scalable FL framework that decentralizes training across client pairs using lightweight MPC, while restricting servers to secure aggregation, client pairing, and routing. NETFL eliminates server-side bottlenecks, avoids full data offloading, and preserves confidentiality of data, model parameters, and updates throughout training. Our evaluation shows that NETFL protects against unauthorized observation, reconstruction, gradient leakage, membership inference, and inversion attacks, while achieving up to 13× faster training time and 50% lower server memory usage compared to prior work.

Differentially private federated learning with Byzantine-robust aggregation: A cross-domain framework for secure model training in banking and healthcare systems

Federated learning allows banks, hospitals, and other regulated organizations to train a shared model without moving raw records off their own servers, which is attractive wherever data protection law or competitive sensitivity rules out pooling data centrally. Two problems limit how far this promise can be trusted in practice. First, the parameter updates that clients exchange still leak information about local records through gradient inversion and membership inference attacks. Second, an honest averaging rule such as FedAvg has no defense against a subset of clients that submit corrupted or adversarial updates, so a small number of malicious or compromised participants can quietly steer the shared model off course. This paper presents a federated learning framework, DP-BR-FedAvg, that combines a Gaussian-mechanism differential privacy layer with a coordinate-wise trimmed-mean Byzantine-robust aggregation rule, evaluated on a simulated cross-institutional classification task resembling fraud and clinical-risk scoring. Across sixty communication rounds with twenty clients, a quarter of them Byzantine, plain FedAvg collapses on the minority class (F1-score 0.030) while the proposed framework recovers substantially more of the signal (F1-score 0.119) while bounding the privacy loss of any single client's contribution. A Byzantine-robust aggregator with no privacy layer performs best in raw accuracy, quantifying the cost privacy imposes on robustness. The results show that privacy and robustness mechanisms interact rather than simply add, and that system design for regulated, adversarial, cross-institutional settings needs to budget for that interaction.