Aug 2026· Al-Noor Journal of Engineering Management and Computer Science· 0 citations· 9 references
TL;DR
These findings expose time as a first class security primitive in FL systems and recommend integrating timing randomization, lightweight monitoring, and scheduler level defenses into frameworks such as Tensor Flow Federated.
Abstract
Federated learning (FL) protects client data by sharing only model updates, yet current defences ignore timing metadata. We show that a single malicious client can embed a 128 bit cryptographic key into the final global model by modulating update latency alone, bypassing gradient-value inspections, differential privacy (DP), and secure aggregation (SecAgg). We model the latency-to-weight channel as an additive white Gaussian noise (AWGN) process with CPU jitter and derive its information-theoretic capacity, demonstrating that 134 rounds suffice to transmit 128 bits at ε=500 μs. We design Jitter Deconv, a spread-spectrum encoder/decoder that maps Gold-code delays to weight-space imprints and recovers keys with bit-error rate (BER) 1.02×10⁻³ under DP-SGD (σ=10⁻²) and SecAgg. To detect the covert channel, we introduce Latency Print, a lightweight autocovariance-based statistic achieving AUC=0.98 and ≤0.7 % false-positive rate with <0.1 % CPU overhead. Experiments on CIFAR-10, FEMNIST, and Stack Overflow under realistic FL hyperparameters and hardware time-stamping (PTP, ±1 μs) confirm that our attack incurs ≤0.18 % accuracy degradation and survives network congestion. We further compare Latency Print to an SVM-based arrival-pattern classifier, demonstrating superior detection speed and reliability. Our findings expose time as a first class security primitive in FL systems and recommend integrating timing randomization, lightweight monitoring, and scheduler level defenses into frameworks such as Tensor Flow Federated.
Federated Learning (FL) enables privacy-aware distributed training, yet gradient updates remain exploitable: Man-in-the-Middle (MitM) interception exposes updates in transit, while model poisoning corrupts global convergence. We first introduce GASHE (Gradient-Aware Selective Homomorphic Encryption), a novel selective encryption strategy that dynamically identifies and encrypts only the gradient components exceeding a DP-calibrated sensitivity threshold, rather than encrypting all parameters uniformly as in static layer-based or full-parameter CKKS schemes. Building on GASHE, we introduce SecureDrive-FL, a federated driver monitoring framework that couples DP-SGD with GASHE to create the first closed-loop DP+HE privacy pipeline: DP-SGD calibration parameters directly derive the GASHE encryption mask, unifying training-time privacy and communication-time confidentiality. Evaluated on a ten-class distracted driver classification task under non-IID federated splits, SecureDrive-FL matches DP-SGD alone's poisoning resistance (73.6% vs. 74.0% accuracy, 3.9% Attack Success Rate for both) while additionally withstanding MitM interception, where DP-SGD alone collapses to near-random accuracy (78.2% vs. 10.4%), all under only approx. 8--10% additional runtime overhead relative to DP-SGD alone---under DP-SGD noise injection with per-round privacy parameter epsilon_0=4.
Baran Can Gül, Hanuma Siddhartha Tunuguntla, Anjana Arvind Naik et al.· 0 citations
Model updates in federated learning can expose sensitive information, while existing defenses often trade off privacy protection, communication efficiency, and training stability. This paper presents SURGE, which stands for Sparse Updates with Randomized Guarding and Selective Encryption. SURGE targets empirical attack resistance under the honest-but-curious server model, rather than a formal privacy guarantee. SURGE builds a unified sparse coordinate set from Top-k accumulated updates and uses Layered Risk-guided Mask Selection (LRMS) to allocate a limited homomorphic-encryption budget according to leakage risk, plaintext exposure history, and residual cost. It then applies random sign flipping to the remaining plaintext coordinates and uses residual feedback to compensate for sparsification and perturbation errors across rounds. Experiments cover IID and label-skew non-IID partitions on MNIST and CIFAR-10, as well as a natural-split FEMNIST benchmark. On MNIST and CIFAR-10, SURGE reduces communication overhead by 87% to 88% relative to FedPHE and MaskCrypt, averaged over the two datasets and the two selective-encryption baselines, and reaches high accuracy sooner under the same simulated wall-clock budget. SURGE also drives membership inference performance close to random guessing and substantially degrades the quality of gradient inversion reconstructions.
Embedding-as-a-Service (EaaS) has emerged as a critical paradigm for commercializing large language models (LLMs). However, existing backdoor watermarking techniques are fundamentally limited to "zero-bit" detection, which prevents user-level traceability in multi-user EaaS scenarios. To address these limitations, we propose RShield, a multi-bit backdoor watermarking that enables reliable user-level attri-bution of LLMs for EaaS under model extraction attacks. RShield integrates Reed-Solomon error-correcting codes with orthogonal feature mapping to introduce highly-structured redundancy, constructing fault-tolerant symbol sequences for multi-bit watermark space, thereby staying recoverable even after aggressive extraction noise condition. To mitigate semantic distortion under the interference of noise channel, RShield employs a lightweight Adapter to adaptively inject multi-bit watermarks in the feature space, preserving the quality of EaaS while achieving a user-level traceability. Extensive experiments on four NLP benchmarks demonstrate that RShield efficiently achieves 100% multi-bit watermark recovery and high semantic fidelity under model extraction attacks compared to existing methods, while significantly reducing the degradation of watermarking on downstream task performance.
Lin Xiang, Yufan Zhong, Chengfu Ou et al.· Annual Meeting of the Associ...· 0 citations
Federated fine-tuning of large language models (LLMs) enables collaborative training without exposing raw data. However, a recent attack, NeuroImprint, demonstrates that a malicious parameter server can corrupt a PEFT adapter into a privacy backdoor: by assigning a dedicated memorization neuron to each training sample and ensuring each neuron updates at most once, the server can analytically reconstruct 59%--79% of client training data with high semantic fidelity. Existing defenses---including local differential privacy (LDP) and gradient clipping---either fail against this attack or impose unacceptable utility degradation. We present \textbf{TriShield}, a three-layer deterministic defense that completely prevents NeuroImprint-style reconstruction with zero model utility loss and no additional communication rounds. TriShield consists of: (1) a Parameter Artifact Detector that identifies memory-neuron signatures in distributed model parameters before local training begins; (2) a Stateful Virtual Iteration} mechanism that forces Adam/AdamW's momentum state to irreversibly entangle gradients across virtual steps, invalidating NeuroImprint's closed-form inversion; and (3) a Zero-Utility Orthogonal Projection operator that projects all local gradient updates onto the main-task semantic subspace computed via SVD, physically eliminating any gradient components that carry private memorization. We prove theoretically that after Layers 2 and 3, the mutual information between the uploaded gradient and any individual training sample is zero. Experiments on GPT-2 (117M) and Llama-Guard-3-1B verify that TriShield reduces NeuroImprint reconstruction rate to 0% across all tested attack variants, while maintaining or improving training accuracy, with less than 5% additional GPU computation overhead.
Vertical Federated Learning (VFL) enables multiple participants to collaboratively train models using vertically partitioned data. However, during the actual training process, participants must exchange intermediate model representations(e.g., embeddings), which creates a potential attack surface for privacy leakage. Recent studies have shown that the URVFL attack achieves precise and covert data reconstruction by constructing malicious gradients and training a decoder using label information, posing a serious threat to the privacy security of vertical federated learning systems.To address this issue, we propose TMI-VFL, a secure training framework based on Threshold Multi-Identity Fully Homomorphic Encryption.This method establishes a ciphertext computation mechanism that ensures embedding vectors, gradients, and intermediate activation values are all processed in encrypted form, while the threshold decryption scheme prevents any single participant from recovering sensitive information. Experimental results show that under URVFL attacks, the proposed method increases reconstruction error by more than 10-fold, significantly reducing the effectiveness of the attack. Meanwhile, model accuracy decreases by less than 1% and remains close to baseline levels. These results indicate that TMI-VFL achieves an effective trade-off between privacy protection and model utility, providing a practical solution for secure VFL.
Yuqing Song· Poster Volume 0008 The 2026...· 0 citations
Federated Learning (FL) enables collaborative model learning without the need to share raw data, but its communication links are vulnerable to interception, replay, and man-in-the-middle (MITM) attacks. The existing key exchange methods rely on computational hardness assumptions, which can be broken by post-quantum attackers. In this paper, a secure federated learning framework improved by Quantum Key Distribution (QKD) is proposed, which integrates BB84-like quantum key generation and authenticated encryption on a per-round basis, as well as Quantum Bit Error Rate (QBER)-assisted intrusion detection. A new cryptographic key is produced in each federated round, making it immune to replay attacks and allowing for detection of tampering. Theoretical calculations show that intercept-resend attacks lead to a minimum expected QBER of 25%, making it easier to detect statistically. Experimental results on the MNIST dataset show near-perfect detection rates for MITM and replay attacks, with QBER values increasing from about 1% (serving as a benign scenario) to about 26% in an attack scenario. Communication overhead is kept below 10%, with negligible computational latency compared to local training. The experiments show that the use of QKD-based key refresh improves FL communication security while still ensuring model convergence.
M. Kumari, Charvi Suri, Isha Suri· 2026 International Conferenc...· 0 citations