{"id":"5a38db98-b7a8-4ed6-8104-85023a33f4a0","arxiv_id":"2501.04319","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"VerifBFL uses Nova recursive zk-SNARKs to generate verifiable proofs of local model accuracy and aggregation in blockchain-based federated learning, with on-chain verification via a decentralized oracle network and differential privacy for data protection.","lead":"VerifBFL is a proposed blockchain-based federated learning system that uses recursive zero-knowledge proofs to check that trainers and aggregators did their jobs, plus differential privacy to protect local data. The paper contributes a new way to get end-to-end verifiability in crowdsourced federated learning, with a proof-of-concept benchmark showing proof generation times below 82 seconds and on-chain verification below 0.6 seconds.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Section V.B's IVC state is a binary correctness flag and explicitly cannot carry the addition result, so the aggregation proof verifies step-circuit executions but never binds the submitted global model to the local updates; the advertised end-to-end aggregation verifiability is therefore…","rationale":"The reader's REJECT verdict is correct, and the strongest objection is even more direct than the one the reader highlighted. The accuracy-proof issue in Section V.A is real: proving accuracy on a trainer-selected test set reduces the claim to a self-reported metric and does not attest to training integrity. However, the aggregation proof in Section V.B is the more load-bearing failure because the paper explicitly states that the IVC running state cannot hold the addition result and is instead a one-bit flag. In an IVC scheme, the proof is tied to the evolution of the carried state z_i; if z_i is only a correctness flag, the final proof cannot certify that w_glob equals the weighted sum of local models. This is not an external disagreement about threat models or consensus; it is an internal inconsistency between the stated aggregation claim and the described construction. Because the central advertised guarantee is end-to-end verifiability of both training and aggregation, and the aggregation proof does not bind the aggregate to the local updates, the main contribution is not delivered. No code or data artifacts are provided, so the empirical benchmark does not independently substantiate the construction. The recommended verdict remains REJECT, matching the reader's verdict; the change is only that the aggregation binding failure, rather than the accuracy proof, is the decisive point.","tokens_in":12592,"tokens_out":2347,"duration_ms":24580,"concrete_test":"Set up the actual or reconstructed AggregationCircuit used in the PoC and instantiate the Nova IVC exactly as in Section V.B with z_i a one-bit flag. Then run the verifier on a correctly computed transcript but with an arbitrary fake w_glob in the IPFS submission (e.g., all zeros or a replay of round r−1). If the proof verifies, the aggregation proof is not binding; if it does not verify, identify which constraint forced w_glob to equal Σ w_k. A second check: re-derive the R1CS for z_{i+1}=F(z_i,w_i) and confirm whether z_{i+1} contains any component equal to the accumulated sum; given the paper's explicit statement, it should not.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that VerifBFL ensures verifiability of both local training and aggregation. The aggregation construction fails on its own terms. Section V.B defines F as the incremental addition of local models and states the prover's claim as w_glob ← Σ (n_k/n) w_k, then says: 'Due to implementation specifications, in this setup, the running input to F: z_i will be set to 1 if invocation i is performed correctly. z_i cannot hold the addition result of local models because of its high dimension.' This is not a minor implementation detail: in an IVC, the final proof certifies a transcript z_{k+1}=F(z_k,w_k). If the carried state z_i is only a flag, then F is not the weighted addition of model vectors, and the proof does not assert anything about w_glob. A malicious aggregator can execute the step circuits honestly, receive a valid proof, and submit any w_glob, including a replay or garbage model, because no constraint links the proof to the stored IPFS hash. The unweighted 'for simplicity' removal of n_k/n is likewise incompatible with the FedAvg statement claimed. The formal completeness/soundness properties in Section V are generic Nova properties applied to a relation R that is never defined for aggregation; they cannot repair the missing binding. Consequently the central guarantee of trustless aggregation verification is unsupported.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"VerifBFL proposes a blockchain-based federated learning framework that uses zk-SNARKs (specifically Nova's incrementally verifiable computation) to generate proofs of local training accuracy and of global model aggregation, with proofs verified on-chain through a decentralized oracle network. The paper claims trustless verifiability of both local training and aggregation, privacy protection via differential privacy, and reports a proof-of-concept implementation with benchmarks for proof generation and blockchain throughput.","tokens_in":12840,"tokens_out":3012,"duration_ms":28724,"significance":"If the central claims were sound, VerifBFL would be a useful step toward accountable, trustless federated learning in crowdsourced settings. The paper also has tangible strengths: it implements a working prototype using the Nova crate, measures proof-generation and verification times, and evaluates on-chain performance with Hyperledger Caliper. However, the core cryptographic constructions, as described, do not prove the statements that the system claims to prove. The accuracy proof only attests to self-reported accuracy on a trainer-chosen test set, and the aggregation proof deliberately drops the FedAvg weights and carries a binary flag instead of the accumulated model sum. These issues are load-bearing and undermine the paper's central contribution.","major_comments":[{"comment":"The IVC state z_i is described as being \"set to 1 if invocation i is performed correctly\" and explicitly \"cannot hold the addition result of local models because of its high dimension.\" In Nova, a proof certifies a transcript z_{k+1}=F(z_k,w_k); if the carried state is only a binary flag, then F is not the weighted addition of model vectors, and the proof does not assert anything about the final global model w_glob. A malicious aggregator can run the step circuits honestly, obtain a valid proof, and submit an arbitrary w_glob, including a replay or a garbage model, because no constraint in the proof statement links the proof to the IPFS hash of the submitted global model.","section":"Section V.B"},{"comment":"The proof construction removes the FedAvg weight factors n_k/n \"for the sake of simplicity.\" This means the step circuit F does not compute the weighted aggregation that the protocol's claimed statement w_glob ← Σ (n_k/n) w_k requires. At best, the proof attests to an unweighted sum of local model vectors, which is a different aggregation rule from the one defined in the FL protocol, so the proof does not establish the integrity of the FedAvg aggregation process.","section":"Section V.B"},{"comment":"The accuracy proof computes Acc = z_n/n, where z_n is the number of correct predictions on a test dataset {w_0,...,w_{n-1}} chosen by the trainer. This attests only to the model's performance on self-selected inputs; it does not attest to any property of the local training process. A lazy or malicious trainer can select an easy test set, or even report any desired accuracy, and then produce a valid proof that the reported accuracy matches the chosen test set. Consequently, the claimed \"verifiability of local training\" is not established by this construction.","section":"Section V.A, Eq. (1)"},{"comment":"The security analysis claims that free-riding is prevented because the knowledge soundness of Nova ensures that \"proofs cannot be forged unless the trainers have conducted the training with integrity.\" This is a non sequitur: the accuracy proof covers only a sequence of inference operations on trainer-selected inputs, not the training computation. Knowledge soundness of the zk-SNARK does not imply that any training was performed or that it followed the protocol. The analysis therefore does not support the paper's central guarantee that local training integrity is verifiable.","section":"Section VI"}],"minor_comments":[{"comment":"The phrase \"T the FL actors\" appears to be a typo and should read \"The FL actors.\"","section":"Section IV.B"},{"comment":"The subsection header \"VerifBFL Arichitecture\" contains a typo; it should be \"Architecture.\"","section":"Section IV.C"},{"comment":"The text says \"aggregate n local models {w0,w1,...,wn}\" which lists n+1 models; the indexing should be made consistent throughout the description.","section":"Section V.B"},{"comment":"The formal completeness and knowledge-soundness properties are stated for a generic relation R that is never instantiated for the accuracy or aggregation statements. The paper should specify what (u,w) and F are in each application; as written, the formal properties are vacuous.","section":"Section V"},{"comment":"The performance evaluation is limited to a single dataset (MNIST) with 100 test images and five local models. The reported proof-generation time of about 81 seconds for training is for a small CNN, and the paper should discuss generalization to larger models and datasets.","section":"Section VII"}],"recommendation":"reject","confidential_remarks":"This paper has serious soundness issues that go beyond presentation: the central IVC constructions do not prove the statements they are claimed to prove, and the security analysis relies on circular reasoning. The prototype implementation and benchmarking are useful, but they cannot compensate for the unsupported core claims. I recommend rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the paper is a solid architecture proposal with a real gap between the claims and the constructions. The application of Nova's recursive proofs to both local training and aggregation in BFL is new as far as I know, and the system model — IPFS storage, Chainlink DON verification, PBFT blockchain — is clearly presented and reasonable for a crowdsourced FL setting. The performance numbers (81s prove, 0.6s verify) would be useful if the proofs were sound.\n\nThe problem is that they aren't. The proof of accuracy reduces to inference on a trainer-chosen test set: the IVC counts correct predictions on inputs w_i, so the trainer can pick easy data to satisfy the accuracy claim. That doesn't attest to the integrity of local training. The paper itself says the proof attests to 'accuracy and integrity,' but it only attests to the former on self-selected data.\n\nThe aggregation proof is worse. The stated statement is FedAvg: w_glob = Σ (n_k/n) w_k. But then the authors say, 'Due to implementation specifications, the running input z_i will be set to 1 if invocation i is performed correctly. z_i cannot hold the addition result.' So the IVC verifies that each step circuit executed, but the carried state is only a flag, not the accumulated sum. A valid proof therefore does not bind the submitted global model to the local updates at all. Dropping the n_k/n weights for 'simplicity' is likewise incompatible with the claimed FedAvg statement. The completeness and knowledge-soundness properties quoted from Nova apply to a relation R that is never defined for aggregation, so they don't repair this.\n\nThere are smaller issues: the privacy analysis gives Pr[correctGuess] = e^ε/(e^ε+1) with no derivation, and there's no code or data shipped. The setup time of 785s for the training circuit is also not negligible in a multi-task crowdsourcing scenario, though the authors wave it away.\n\nWho is this for? Researchers working on zk-SNARKs for FL will find the architecture a useful template, but they should read the proof sections carefully. The paper deserves a serious referee because the core idea — applying Nova to FL verifiability — is legitimate and the authors are onto a real problem. I'd send it back for major revision, not reject out of hand: fix the binding in the aggregation proof, or change the claim to 'proof of step execution,' and replace the accuracy proof with something that attests to training (or explicitly scope the claim). As written, the central guarantee is unsupported.","headline":"A genuinely novel application of Nova IVC to federated learning, but both central proof constructions fail to bind the statements they claim to verify, so the advertised end-to-end verifiability is not delivered.","tokens_in":13428,"tokens_out":2693,"would_cite":false,"duration_ms":26554,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Zero-knowledge proofs verify every federated learning step.","keywords":["blockchain","federated learning","zk-SNARK","incrementally verifiable computation","Nova","differential privacy","verifiable computation","crowdsourcing"],"falsifier":"A single concrete experiment would settle the core claim: ask a trainer to submit a model known to be useless, such as one that always outputs the majority class, together with a proof of accuracy computed over a self-selected set of trivially classifiable inputs. If the system accepts the proof and pays the reward, then the claim that VerifBFL prevents free-riding and lazy training is refuted; if the task publisher instead supplies a fixed, signed test set and the proof still verifies, the claim is supported.","tokens_in":12337,"feed_emoji":"🔐","tokens_out":7587,"duration_ms":69485,"temperature":0.7,"pith_summary":"VerifBFL is a proposed blockchain-based federated learning framework for crowdsourcing in which no participant is trusted by default. Its central claim is that recursive zk-SNARK proofs, built with the Nova folding scheme, let each trainer prove the accuracy of its local update and let each aggregator prove correct FedAvg aggregation, with the proofs checked in the blockchain layer through a decentralized oracle network. If this holds, a crowdsourced learning task can detect lazy trainers, replay attacks, and faulty aggregation without a central authority, while differential privacy noise protects local updates from inference attacks. The paper positions this as the first use of recursive zk-SNARKs for end-to-end verifiability of the federated learning workflow, and reports proof-of-concept timings of about 81 seconds for a training proof, about 2 seconds for an aggregation proof, and under 0.6 seconds for verification.","feed_headline":"Zero-knowledge proofs verify every federated learning step","feed_subtitle":"VerifBFL wraps local training and aggregation in recursive zk-SNARKs, verified on-chain in under 0.6s.","key_machinery":"The central object is Nova, a recursive zero-knowledge SNARK that implements incrementally verifiable computation: each step of a computation is folded into a running proof instance, so one compressed proof covers arbitrarily many steps. VerifBFL defines one inference of the model as the step function F for training proofs, with the IVC state z_i being the running count of correct predictions; at step n the predicate Acc = z_n/n is itself part of the attested computation. For aggregation, the step function is one FedAvg addition of a local model; the paper notes that in the implementation the IVC state only carries a correctness flag because the full model vector is too large to fold, so the aggregation proof attests to faithful execution of each addition circuit rather than to the summed vector directly. The compressed Nova SNARK is what makes verifying the entire chain constant-time for the verifier.","core_discovery":"The paper claims that end-to-end verifiability in blockchain-based federated learning can be achieved by expressing the two operations that matter—local training quality and global model aggregation—as incrementally verifiable computations and attesting to them with Nova recursive zk-SNARKs. For local training, the prover runs n inference operations, counts correct predictions in the IVC state z_i, and proves that the reported accuracy equals z_n/n. For aggregation, the prover folds each FedAvg addition step into a recursive proof, and the compressed SNARK makes the whole chain checkable in constant time. Because invalid or missing proofs cause loss of stake and blacklisting, the framework converts honest participation from a trust assumption into an economically enforced, publicly auditable obligation. The proof-of-concept reports training-proof generation around 81 seconds, aggregation-proof generation around 2 seconds, and verification under 0.6 seconds.","pith_inferences":["Beyond the paper, the accuracy proof is better read as a proof of a self-reported metric than a proof of learning: because the trainer selects the test inputs, a lazy trainer can satisfy the proof without improving the model; a direct fix would be publisher-signed test data or a circuit that proves gradient-descent updates.","Beyond the paper, the described aggregation proof keeps only a boolean flag in the IVC running state, so it attests to execution of addition steps rather than to the final sum; folding the model vector into the state would turn it into a full equality proof of the FedAvg result.","Beyond the paper, the 81-second training-proof time suggests the practical bottleneck is on the prover side; since verification is under a second, the framework scales to many trainers more easily than to very deep or large models."],"forward_implications":["Local updates are auditable: a trainer must produce a proof tying the submitted model to a computed accuracy, and invalid submissions lead to forfeited stake and blacklisting.","Aggregation is auditable: the aggregator's proof ties the global model to FedAvg over the accepted local models, so skipping or faking aggregation is detectable.","On-chain overhead stays small: because Nova verification is constant-time in the number of training steps, the blockchain layer performs a cheap check per round.","Privacy and verifiability are combined: differential privacy noise is added to local updates before proof generation, while the zero-knowledge property prevents the proof itself from leaking training data.","The framework's security depends on at least two-thirds of blockchain and oracle nodes behaving honestly, so it avoids trusting FL participants but not the infrastructure."],"supporting_citations":[{"why":"Supplies the Nova folding scheme and recursive zk-SNARK construction used to build incremental proofs of training and aggregation.","marker":"[16]"},{"why":"Defines incrementally verifiable computation, the formal model VerifBFL uses to chain n inference or addition steps into one proof.","marker":"[17]"},{"why":"Defines FedAvg, the aggregation algorithm whose correct execution the aggregation proof attests to.","marker":"[1]"},{"why":"Provides the epsilon-differential privacy definition and mechanism used to protect local updates from inference attacks.","marker":"[9]"},{"why":"Earlier zk-SNARK-based BFL framework that only proves one inference; VerifBFL positions itself as extending this to full accuracy computation.","marker":"[14]"},{"why":"Earlier zk-SNARK FL work that proves inference but not the whole training process; comparison baseline for the paper's end-to-end claim.","marker":"[15]"},{"why":"PBFT consensus assumed for the permissioned blockchain, giving the two-thirds honest-node guarantee the system relies on.","marker":"[30]"},{"why":"Chainlink decentralized oracle network protocol used to verify proofs off-chain while maintaining blockchain-level trust assumptions.","marker":"[31]"}],"fun_headline_variants":["zk-SNARKs make federated learning verifiable on-chain","Recursive zero-knowledge proofs verify FL training and aggregation","Trustless federated learning: every step proven on-chain","Recursive zk-SNARKs verify federated learning in under 0.6s","zk-SNARKs prove federated training and aggregation on-chain"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole verifiability guarantee rests on treating the accuracy of a local model as the metric a trainer must prove, but the test dataset used for that accuracy is chosen by the trainer itself, so a lazy or malicious trainer can pass the proof by evaluating on easy, self-selected inputs.","fun_headline_variants_meta":{"raw":{"variants":["zk-SNARKs make federated learning verifiable on-chain","Recursive zero-knowledge proofs verify FL training and aggregation","Trustless federated learning: every step proven on-chain","Recursive zk-SNARKs verify federated learning in under 0.6s","zk-SNARKs prove federated training and aggregation on-chain"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000626,"raw_usage":{"total_tokens":2910,"prompt_tokens":974,"completion_tokens":1936,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":590,"completion_tokens_details":{"reasoning_tokens":1843}},"tokens_in":590,"tokens_out":1936,"duration_ms":13828,"temperature":1.0,"reasoning_tokens":1843,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T21:35:43.557605+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A single concrete experiment would settle the core claim: ask a trainer to submit a model known to be useless, such as one that always outputs the majority class, together with a proof of accuracy computed over a self-selected set of trivially classifiable inputs. If the system accepts the proof and pays the reward, then the claim that VerifBFL prevents free-riding and lazy training is refuted; if the task publisher instead supplies a fixed, signed test set and the proof still verifies, the claim is supported.","supporting_citations":[{"cited_title":"Nova: Recursive zero-knowledge arguments from folding schemes,","cited_arxiv_id":null,"evidence_quote":"Supplies the Nova folding scheme and recursive zk-SNARK construction used to build incremental proofs of training and aggregation."},{"cited_title":"Incrementally verifiable computation or proofs of knowledge imply time/space efficiency,","cited_arxiv_id":null,"evidence_quote":"Defines incrementally verifiable computation, the formal model VerifBFL uses to chain n inference or addition steps into one proof."},{"cited_title":"BV- ICVs: A privacy-preserving and verifiable federated learning framework for V2X environments using blockchain and zkSNARKs,","cited_arxiv_id":null,"evidence_quote":"Earlier zk-SNARK-based BFL framework that only proves one inference; VerifBFL positions itself as extending this to full accuracy computation."},{"cited_title":"Practical byzantine fault tolerance,","cited_arxiv_id":null,"evidence_quote":"PBFT consensus assumed for the permissioned blockchain, giving the two-thirds honest-node guarantee the system relies on."}],"review_version":1}