Pith. sign in

REVIEW 4 major objections 6 minor 50 references

TAPFed: Threshold Secure Aggregation for Privacy-Preserving Federated Learning

T0 review · 4 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper proposes TAPFed, a threshold functional encryption scheme for inner products that lets federated learning aggregate encrypted model updates across independent aggregators with no peer-to-peer communication, tolerating up to t−1…

desk verdict A real construction undermined by a security proof that simulates in the wrong group and a missing discrete-log feasibility condition. read the letter →

arxiv 2501.05053 v1 pith:LITMYWSP submitted 2025-01-09 cs.CR cs.AI

Runhua Xu , Bo Li , Chao Li , James B.D. Joshi , Shuai Ma , Jianxin Li This is my paper · ORCID
classification cs.CRcs.AI MSC 94A6068P25
keywords thresholdfunctionalencryptionsecureaggregationprivacy-preservingfederatedlearninginnerproductDDHassumptionmaliciousaggregatorsdisaggregationattackmulti-client
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

TAPFed aims to close a gap in privacy-preserving federated learning: existing secure aggregation schemes either rely on a single honest-but-curious aggregator and leak intermediate aggregated models to inference attacks, or they require multiple aggregators to communicate peer-to-peer, creating scalability and single-point-of-failure problems. The paper's central claim is that a threshold variant of multi-client functional encryption can give each aggregator only a partial decryption capability, so no single aggregator or colluding group below a threshold can recover the intermediate global model. A party that collects enough partial results can reconstruct the exact aggregated inner product, making the scheme practical for cross-silo FL. If correct, TAPFed provides a communication-light, hardware-free secure aggregation primitive that resists gradient inference, disaggregation, isolation, replay, and collusion attacks while offering comparable accuracy and training time to existing crypto-based baselines.

What carries the argument

The load-bearing object is the threshold multi-client functional encryption (tMCFE) scheme for the inner-product functionality fMCIP. It works by having each party encrypt its model update under a round label, having each independent aggregator apply its Shamir-shared functional decryption key to produce a partially decrypted ciphertext, and having a party combine any t partial results to obtain a value $D = g^{2 f_{\text{MCIP}}(\{x_i\}, y)}$, from which the inner product is recovered as $\frac{1}{2}\log_g(D)$. The DDH instantiation keeps the ciphertexts compact, the label mechanism prevents cross-round replay, and the threshold property guarantees that no group of fewer than t aggregators can reconstruct an intermediate aggregated model.

What would settle it

Run a single TAPFed aggregation round with the paper's own CNN-MNIST setting (1,199,882 parameters, five parties, encoding precision 4) and measure the time CombineDecrypt takes to recover the inner product from $D$; if recovery requires searching a range comparable to the 256-bit group order rather than a small polynomial-time range, the claimed correctness and practicality of TAPFed collapse. Concretely, an implementation that only applies the stated $\frac{1}{2}\log_g(D)$ formula without an additional small-range discrete-log algorithm would fail to complete on realistic model magnitudes.

Watch

Extended reading notes

Core claim

TAPFed introduces a t-of-s threshold multi-client functional encryption (tMCFE) scheme, built on the Decisional Diffie-Hellman assumption, that securely computes an inner product over encrypted model updates. The scheme distributes functional decryption keys via Shamir secret sharing: each of s independent aggregators receives a key share and performs a partial decryption on the set of encrypted updates, outputting an encrypted aggregated fragment without ever seeing it in plaintext. A party combines the fragments from any t aggregators using Lagrange interpolation and recovers the global model update as an inner product of the encoded updates with a fusion weight vector. Because ciphertexts carry a per-round cryptographic label and the combined output remains hidden from aggregators below the threshold, TAPFed blocks the intermediate-model disclosure that enables recent inference attacks. The paper reports equivalent model quality to state-of-the-art baselines while reducing per-party transmission payload by 29%–45% across MNIST and CIFAR10 experiments, and argues formally that the scheme achieves selective simulation-based security under DDH.

Load-bearing premise

The correctness of TAPFed depends on the final step, computing $\frac{1}{2}\log_g(D)$, being computationally feasible, which holds only when the encoded inner-product sum stays in a small, enumerable range; the paper never bounds how large this sum grows as model sizes and client counts increase.

Editorial extensions

If this is right

  • No single aggregator can ever see an intermediate aggregated model in plaintext, so gradient inference, disaggregation, isolation, and replay attacks launched by a curious or malicious aggregator are blocked by design.
  • Any coalition of fewer than t colluding aggregators still cannot recover the aggregated model, giving a tunable trust threshold rather than assuming honest-but-curious behavior.
  • Both average and weighted fusion (including FedAvg-style sample-size weighting) are supported, and personalized federated learning can be realized by using per-party labels and fusion weight vectors.
  • The scheme naturally handles party dropout and aggregator dropout (up to t stragglers), without requiring aggregator-to-aggregator communication, removing a single point of failure.
  • The reduced ciphertext payload size, combined with DP integration for final-model privacy, makes the approach suitable for cross-silo deployments where communication is the bottleneck.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same tMCFE inner-product primitive could be reused outside federated learning, for example for privacy-preserving similarity search, statistical analysis, or secure evaluation of linear functions over data held by multiple parties, with the label serving as a query or session identifier.
  • The practicality of the scheme hinges on the discrete-logarithm step in CombineDecrypt: the paper does not specify an algorithm such as Pollard's lambda or baby-step giant-step, nor does it bound how large the encoded inner product can grow; for very large models or many clients, this step could become computationally infeasible.
  • The threat model explicitly covers malicious aggregators, but not collusion between parties and aggregators; since parties legitimately learn the global model, a party that colludes with t−1 aggregators could combine its own knowledge with partial results to bypass the threshold guarantee, an edge case the paper leaves unexamined.
  • TAPFed's 29–45% overhead reduction is measured against single-aggregator FE/HE baselines; in a distributed deployment the communication topology change (no P2P links between aggregators) may yield additional latency improvements that the simulation-based experiments do not fully capture.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes TAPFed, a privacy-preserving federated learning framework that uses a threshold multi-client functional encryption (tMCFE) scheme to allow multiple independent aggregators to perform secure aggregation without any aggregator learning the intermediate aggregated model. The authors claim DDH-based selective simulation security for the cryptographic scheme, defense against gradient, disaggregation, isolation, replay, and collusion attacks, and experimental results showing model quality comparable to baselines with 29%-45% lower transmission overhead. The presentation includes the scheme construction, a security proof in Section 5.1, and an evaluation with several baselines in simulated and cloud settings.

Significance. If the central security claim were valid, TAPFed would be a notable step: it removes the need for peer-to-peer aggregator communication, tolerates up to t-1 malicious aggregators, and directly addresses disaggregation attacks that affect single-aggregator secure aggregation. The experimental evaluation is broad, covering multiple baselines and two deployment settings, and the paper is explicit about its scope (cross-silo FL, excluding poisoning and backdoor attacks). However, the core cryptographic proof does not establish security for the scheme as constructed, and the decryption procedure is not shown to be efficient for the intended model-update magnitudes. The contribution is therefore not established as presented.

major comments (4)
  1. [Section 5.1, Theorem 1] The proof for encrypted data simulates ciphertexts as uuui selected uniformly from Z_L and concludes Adv=0, an information-theoretic statement. The actual scheme in Section 3.4 encrypts in a group G of prime order p, with ciphertexts cti,0 = g^{xxxi+H(l)UUU_i} ∘ (g^{ααα^⊺WWW_i})^{r_i} and cti,1 = ∏(g^{ααα})^{r_i}. The proof never constructs a simulator for these group elements, never invokes DDH, and gives no reduction from the real ciphertext distribution to the simulated one. Consequently, the claimed SEL-SIM security of the tMCFE scheme is unproven, and the attack-resistance claims in Section 5.2 rest on an unproven theorem.
  2. [Section 3.4, CombineDecrypt] The algorithm recovers fMCIP({xxxi}, yyy) by computing 1/2 log(D), where D is an element of G. No bound is given on the magnitude of the inner product ⟨{xxxi}, yyy⟩, and no discrete-log algorithm (e.g., Pollard's lambda or baby-step giant-step) is specified. For a group of order p with λ=256, recovering the exponent is computationally infeasible unless the exponent is known to lie in a small, enumerable range. The paper's encoding precision pr and the dimension of the model updates are not used to justify such a bound, so the protocol's ability to recover the global model in practice is not established.
  3. [Section 5.1, Security for Functionality Result] The argument that threshold security follows from Shamir's secret sharing is a bare assertion. The DKGenerate algorithm defines polynomials f^(0)(x) = Σ a_k x^k and f^(i)(x) = Σ b_{i,k} x^k, and the key shares are evaluations of these polynomials at the aggregator indices. The proof does not show that the joint distribution of any t-1 shares is independent of the master secret, nor does it account for the additional terms H(l)Σ⟨yyy_i,UUU_i⟩ and ⟨yyy_i,WWW_i⟩. No formal reduction to the security of Shamir's scheme is provided, so the claim that no set of fewer than t aggregators can learn the intermediate aggregated model is unsupported.
  4. [Section 5.1] The proof conflates 'corrupted participants' with 'sharing decryptors' and 'combining decryptors', while the TAPFed threat model in Section 4.1 allows up to t-1 malicious aggregators. The mapping between these roles and the aggregators/parties in the FL framework is not made explicit, and the proof never analyzes the actual adversary in TAPFed (an aggregator with a functional decryption key share who observes ciphertexts from parties). This disconnect further weakens the relevance of the proof to the framework's privacy claims.
minor comments (6)
  1. [Section 3.4] The notation g^{xxxi+H(l)UUU_i} applies exponentiation to a vector, and the operation ∘ is described as 'element-wise multiplication'. Please clarify that the group is G^η with component-wise operations, and define H as a hash function with values in Z_p (or G) explicitly; the current description says H is 'onto G' but then uses H(l) in the exponent.
  2. [Section 3.4.1] The correctness derivation shows D = g^{2 fMCFE(...)}; the final step '1/2 log(D)' should state explicitly that the logarithm is taken to base g, and the fact that g^2 is the effective generator should be noted.
  3. [Abstract and Section 6.2.1] The abstract reports 'reducing transmission overhead by 29%-45%', but Section 6.2.1 also reports a 70.8% reduction against HybridOne. Please reconcile the claimed range with the reported numbers.
  4. [Algorithm 1] The input description contains a typo: 'traingin' should be 'training'.
  5. [Section 6.1] The paper does not state the concrete security parameter λ used in the experiments, only that the group size is 256 bits. For reproducibility, please report λ and the concrete group generation algorithm.
  6. [Figure 7] The y-axis label 'payload/party(one attempt)' is unclear; please specify whether this is cumulative over training rounds or per round, and define 'one attempt'.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: TAPFed's derivation is self-contained; the main risks are proof gaps, not circular reasoning.

full rationale

No circularity is present in the claimed derivation chain. The correctness of the threshold MCFE scheme in Section 3.4.1 is verified by direct substitution of the scheme's own encryption and share-decryption equations, and the threshold property is imported from Shamir's secret sharing [49] as an external theorem; neither step reduces to the conclusion being proved. The central security claim, Theorem 1 in Section 5.1, does contain a serious proof gap: the simulator operates over Z_L uniform values and never constructs a simulator for the actual group ciphertexts, and DDH is never invoked. That is an unsupported proof step, not a circular one, because the paper does not show that its real and ideal experiments are identical by definition; it simply omits the required reduction. Similarly, the CombineDecrypt recovery of 1/2 log_g(D) in Section 3.4 assumes a small plaintext range so that the discrete logarithm is feasible, but this is an implementation-feasibility assumption rather than a fitted parameter renamed as a prediction. The paper's self-citations, including [10], [18], [46], and [47], are used for motivation, DP compatibility, and implementation methodology; they are not load-bearing evidence for the tMCFE security theorem, and the threshold construction itself is shown from the scheme's own equations plus an external Shamir result. The experimental evaluation compares against published baselines and reports measured training time, accuracy, and payload size rather than deriving those numbers from fitted inputs. Therefore, no load-bearing claim reduces by construction to its own input, and the appropriate circularity score is 0, with the proof-validity concerns noted separately as correctness risk.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The protocol introduces no physical or conceptual entities beyond the tMCFE construction itself. The most consequential unstated objects are the trusted crypto infrastructure and the implicit small-plaintext assumption in decryption.

free parameters (3)
  • encoding precision pr = 4 (default; 3-6 tested)
    Scales floating-point model parameters to integers before encryption. Chosen by hand; affects plaintext magnitude and therefore the feasibility of the discrete logarithm in decryption.
  • aggregator threshold t = 2 in default MNIST/CIFAR10 runs; 3-5 in scaling tests
    Determines how many malicious aggregators can be tolerated. Set as a configuration choice, not derived from a security model.
  • security parameter lambda = 256
    Standard cryptographic group size used in the experiments. Not fitted to data, but it affects both security and the practical cost of decryption.
assumptions (5)
  • domain assumption Decisional Diffie-Hellman (DDH) assumption in the integer group
    Theorem 1 claims security under DDH, but the proof in Section 5.1 never invokes DDH, leaving the assumption formally unused.
  • standard math Shamir secret sharing provides a secure t-of-s threshold scheme
    The threshold functionality relies on Shamir splitting of functional key shares, referenced to [49].
  • domain assumption Trusted crypto infrastructure C for key distribution and DK compliance
    The threat model assumes C is trusted; if C is malicious, the privacy guarantees of TAPFed collapse. Stated in Section 4.1.
  • domain assumption Full-domain hash function H onto G
    Setup defines H onto G and uses it in ciphertexts and key shares. The paper does not model H as a random oracle or justify its realizability.
  • ad hoc to paper Plaintext inner products are small enough for discrete-log recovery
    CombineDecrypt computes 1/2 log_g(D); this is only feasible for a bounded plaintext range, which is never stated or analyzed in the paper.

how reviews work

0 comments
Cite this review

Pith. "Pith review of TAPFed: Threshold Secure Aggregation for Privacy-Preserving Federated Learning." pith.science (2026). https://pith.science/paper/LITMYWSP

@misc{pith2026250105053,
  author       = {Pith},
  title        = {Pith review of: TAPFed: Threshold Secure Aggregation for Privacy-Preserving Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LITMYWSP}},
  note         = {Machine review of arXiv:2501.05053}
}
read the original abstract

Federated learning is a computing paradigm that enhances privacy by enabling multiple parties to collaboratively train a machine learning model without revealing personal data. However, current research indicates that traditional federated learning platforms are unable to ensure privacy due to privacy leaks caused by the interchange of gradients. To achieve privacy-preserving federated learning, integrating secure aggregation mechanisms is essential. Unfortunately, existing solutions are vulnerable to recently demonstrated inference attacks such as the disaggregation attack. This paper proposes TAPFed, an approach for achieving privacy-preserving federated learning in the context of multiple decentralized aggregators with malicious actors. TAPFed uses a proposed threshold functional encryption scheme and allows for a certain number of malicious aggregators while maintaining security and privacy. We provide formal security and privacy analyses of TAPFed and compare it to various baselines through experimental evaluation. Our results show that TAPFed offers equivalent performance in terms of model quality compared to state-of-the-art approaches while reducing transmission overhead by 29%-45% across different model training scenarios. Most importantly, TAPFed can defend against recently demonstrated inference attacks caused by curious aggregators, which the majority of existing approaches are susceptible to.

Figures

Figures reproduced from arXiv: 2501.05053 by the authors.

Figure 1
Figure 1. An illustration of TAPFed system with three independent aggre￾gators including one malicious aggregator. [18]. From the viewpoint of the parties involved, this could lead to a model that doesn’t effectively interpret its data or is biased. A straightforward approach involves spreading trust among multiple decentralized aggregators instead of one centralized aggregator. This results in each aggregator’s inability to … view at source ↗
Figure 2
Figure 2. An overview of threshold secure aggregation in [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Comparison of various baseline approaches in model training loss, model test accuracy, total training time and transmission payload on [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Comparison of various baseline approaches in model training loss, model test accuracy, total training time and transmission payload on [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 5
Figure 5. Figure 5: Comparison of various baseline approaches in model training loss, model test accuracy, total training time and transmission payload on [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 6
Figure 6. Figure 6: Impact of encoding precision of floating-point parameters in [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: Impact of a number of aggregators in TAPFed training and evaluation on MNIST dataset with setting of 5 parties and 10 local training epochs per global FL training round in real distributed setting. 1 5 10 15 20 FL training round 0.96 0.97 0.98 0.99 test accuracy test a…
Figure 8
Figure 8. Figure 8: Impact of number of parties in TAPFed training on MNIST dataset with settings of precision = 5 and 5 local training epochs per training round. by 45.8% and 29%, respectively. Besides, we believe that the reason why TAPFed achieved the smallest transmission payload volu…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

50 extracted references · 48 canonical work pages

  1. [1]

    Federated learning: Strategies for improving com- munication efficiency,

    J. Kone ˇcn`y, H. B. McMahan, F. X. Yu, P . Richt ´arik, A. T. Suresh, and D. Bacon, “Federated learning: Strategies for improving com- munication efficiency,” in NIPS’16, 2016

    work page 2016

  2. [2]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Ar- cas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics . PMLR, 2017, pp. 1273–1282

    2017

  3. [3]

    Member- ship inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Member- ship inference attacks against machine learning models,” in S&P. IEEE, 2017, pp. 3–18

    work page 2017

  4. [4]

    Comprehensive privacy analysis of deep learning: Stand-alone and federated learning under passive and active white-box inference attacks,

    M. Nasr, R. Shokri, and A. Houmansadr, “Comprehensive privacy analysis of deep learning: Stand-alone and federated learning under passive and active white-box inference attacks,” in S&P. IEEE, 2019

    work page 2019

  5. [5]

    The secret sharer: Evaluating and testing unintended memorization in neural networks,

    N. Carlini, C. Liu, ´U. Erlingsson, J. Kos, and D. Song, “The secret sharer: Evaluating and testing unintended memorization in neural networks,” in USENIX Sec’19, 2019, pp. 267–284

    work page 2019

  6. [6]

    Property inference attacks on fully connected neural networks using permutation invariant representations,

    K. Ganju, Q. Wang, W. Yang, C. A. Gunter, and N. Borisov, “Property inference attacks on fully connected neural networks using permutation invariant representations,” in CCS’18. ACM, 2018, pp. 619–633

    work page 2018

  7. [7]

    Inverting gradients-how easy is it to break privacy in federated learning?

    J. Geiping, H. Bauermeister, H. Dr ¨oge, and M. Moeller, “Inverting gradients-how easy is it to break privacy in federated learning?” in NeurIPS’20, 2020, pp. 16 937–16 947

    work page 2020

  8. [8]

    Deep leakage from gradients,

    L. Zhu and S. Han, “Deep leakage from gradients,” in Federated Learning. Springer, 2020, pp. 17–31

    work page 2020

Show all 50 references
  1. [9]

    Cafe: Catastrophic data leakage in federated learning,

    X. Jin, R. Du, P .-Y. Chen, and T. Chen, “Cafe: Catastrophic data leakage in federated learning,” in NeurIPS’21, 2021

    2021

  2. [10]

    Hy- bridalpha: An efficient approach for privacy-preserving federated learning,

    R. Xu, N. Baracaldo, Y. Zhou, A. Anwar, and H. Ludwig, “Hy- bridalpha: An efficient approach for privacy-preserving federated learning,” in ACM AISec, 2019, pp. 13–23

    2019

  3. [11]

    A hybrid approach to privacy-preserving federated learning,

    S. Truex, N. Baracaldo, A. Anwar, T. Steinke, H. Ludwig, R. Zhang, and Y. Zhou, “A hybrid approach to privacy-preserving federated learning,” in ACM AISec, 2019, pp. 1–11

    2019

  4. [12]

    Fedv: Privacy-preserving federated learning over vertically par- titioned data,

    R. Xu, N. Baracaldo, Y. Zhou, A. Anwar, J. Joshi, and H. Ludwig, “Fedv: Privacy-preserving federated learning over vertically par- titioned data,” in ACM AISec, 2021, pp. 181–192

    2021

  5. [13]

    Practical secure aggregation for privacy-preserving machine learning,

    K. Bonawitz, V . Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, “Practical secure aggregation for privacy-preserving machine learning,” in CCS’17. ACM, 2017, pp. 1175–1191

    2017

  6. [14]

    Fastsecagg: Scalable secure aggregation for privacy-preserving federated learning,

    S. Kadhe, N. Rajaraman, O. O. Koyluoglu, and K. Ramchandran, “Fastsecagg: Scalable secure aggregation for privacy-preserving federated learning,” FL-ICML’20, 2020

    2020

  7. [15]

    Turbo-aggregate: Breaking the quadratic aggregation barrier in secure federated learning,

    J. So, B. G ¨uler, and A. S. Avestimehr, “Turbo-aggregate: Breaking the quadratic aggregation barrier in secure federated learning,” IEEE Journal on Selected Areas in Information Theory , 2021

    2021

  8. [16]

    Differentially private federated learn- ing: An information-theoretic perspective,

    S. Asoodeh and F. Calmon, “Differentially private federated learn- ing: An information-theoretic perspective,” in ICML-FL, 2020

    2020

  9. [17]

    Batchcrypt: Ef- ficient homomorphic encryption for cross-silo federated learning,

    C. Zhang, S. Li, J. Xia, W. Wang, F. Yan, and Y. Liu, “Batchcrypt: Ef- ficient homomorphic encryption for cross-silo federated learning,” in USENIX ATC, 2020, pp. 493–506

    2020

  10. [18]

    Detrust-fl: Privacy-preserving federated learning in decentral- ized trust setting,

    R. Xu, N. Baracaldo, Y. Zhou, A. Anwar, S. Kadhe, and H. Ludwig, “Detrust-fl: Privacy-preserving federated learning in decentral- ized trust setting,” in IEEE CLOUD. IEEE, 2022, pp. 417–426

    2022

  11. [19]

    Protecting against data leakage in fed- erated learning: What approach should you choose?

    N. Baracaldo and R. Xu, “Protecting against data leakage in fed- erated learning: What approach should you choose?” in Federated Learning. Springer, 2022, pp. 281–312

    2022

  12. [20]

    Differentially private feder- ated learning: A client level perspective,

    R. C. Geyer, T. Klein, and M. Nabi, “Differentially private feder- ated learning: A client level perspective,” arXiv:1712.07557, 2017

    2017 arXiv

  13. [21]

    Elsa: Secure aggregation for federated learning with malicious actors,

    M. Rathee, C. Shen, S. Wagh, and R. A. Popa, “Elsa: Secure aggregation for federated learning with malicious actors,” in S&P. IEEE, 2023, pp. 1961–1979

    2023

  14. [22]

    Federated learning with homomorphic encryption,

    H. Roth, M. Zephyr, and A. Harouni, “Federated learning with homomorphic encryption,” NVIDIA™ Developer Blog, Jun

  15. [23]

    Secure single-server aggregation with (poly) logarithmic over- head,

    J. H. Bell, K. A. Bonawitz, A. Gasc ´on, T. Lepoint, and M. Raykova, “Secure single-server aggregation with (poly) logarithmic over- head,” in CCS’20. ACM, 2020, pp. 1253–1269

    2020

  16. [24]

    Eiffel: Ensuring integrity for federated learning,

    A. Roy Chowdhury, C. Guo, S. Jha, and L. van der Maaten, “Eiffel: Ensuring integrity for federated learning,” inCCS’22. ACM, 2022, pp. 2535–2549

    2022

  17. [25]

    Flamingo: Multi-round single-server secure aggregation with applications to private federated learning,

    Y. Ma, J. Woods, S. Angel, A. Polychroniadou, and T. Rabin, “Flamingo: Multi-round single-server secure aggregation with applications to private federated learning,” in S&P. IEEE, 2023, pp. 477–496

    2023

  18. [26]

    {ACORN}: Input validation for secure aggregation,

    J. Bell, A. Gasc ´on, T. Lepoint, B. Li, S. Meiklejohn, M. Raykova, and C. Yun, “ {ACORN}: Input validation for secure aggregation,” in USENIX Sec’23, 2023, pp. 4805–4822. 14

    2023

  19. [27]

    Rofl: Robustness of secure federated learning,

    H. Lycklama, L. Burkhalter, A. Viand, N. K ¨uchler, and A. Hith- nawi, “Rofl: Robustness of secure federated learning,” in S&P. IEEE, 2023, pp. 453–476

    2023

  20. [28]

    Aggregation service for federated learning: An efficient, secure, and more resilient realization,

    Y. Zheng, S. Lai, Y. Liu, X. Yuan, X. Yi, and C. Wang, “Aggregation service for federated learning: An efficient, secure, and more resilient realization,” IEEE TDSC, vol. 20, no. 2, pp. 988–1001, 2022

    2022

  21. [29]

    Efficient dropout-resilient aggregation for privacy-preserving machine learning,

    Z. Liu, J. Guo, K.-Y. Lam, and J. Zhao, “Efficient dropout-resilient aggregation for privacy-preserving machine learning,” IEEE TIFS, vol. 18, pp. 1839–1854, 2022

    2022

  22. [30]

    Ef- ficient verifiable protocol for privacy-preserving aggregation in federated learning,

    T. Eltaras, F. Sabry, W. Labda, K. Alzoubi, and Q. Malluhi, “Ef- ficient verifiable protocol for privacy-preserving aggregation in federated learning,” IEEE TIFS, 2023

    2023

  23. [31]

    Separation of powers in federated learning (poster paper),

    P .-C. Cheng, K. Eykholt, Z. Gu, H. Jamjoom, K. Jayaram, E. Valdez, and A. Verma, “Separation of powers in federated learning (poster paper),” in ACM SOSP-ResilientFL’21, 2021, pp. 16–18

    2021

  24. [32]

    Shufflefl: gradient-preserving federated learning using trusted execution environment,

    Y. Zhang, Z. Wang, J. Cao, R. Hou, and D. Meng, “Shufflefl: gradient-preserving federated learning using trusted execution environment,” in ACM CF, 2021, pp. 161–168

    2021

  25. [33]

    Secure collaborative learning in mining pool via robust and efficient verification,

    X. Zhang, Z. Xu, H. Cheng, T. Che, K. Xu, W. Wang, W. Zhao, C. Wang, and Q. Li, “Secure collaborative learning in mining pool via robust and efficient verification,” in ICDCS. IEEE, 2023, pp. 794–805

    2023

  26. [34]

    A taxonomy of attacks on federated learning,

    M. S. Jere, T. Farnan, and F. Koushanfar, “A taxonomy of attacks on federated learning,” IEEE Security & Privacy , vol. 19, no. 2, pp. 20–28, 2020

    2020

  27. [35]

    Secure two-party computation is practical,

    B. Pinkas, T. Schneider, N. P . Smart, and S. C. Williams, “Secure two-party computation is practical,” in Asiacrypt’09. Springer, 2009, pp. 250–267

    2009

  28. [36]

    Fast and secure three- party computation: The garbled circuit approach,

    P . Mohassel, M. Rosulek, and Y. Zhang, “Fast and secure three- party computation: The garbled circuit approach,” in CCS’15. ACM, 2015, pp. 591–602

    2015

  29. [37]

    Global-scale secure multi- party computation,

    X. Wang, S. Ranellucci, and J. Katz, “Global-scale secure multi- party computation,” in CCS’17, 2017, pp. 39–56

    2017

  30. [38]

    Untraceable electronic mail, return addresses, and digital pseudonyms,

    D. L. Chaum, “Untraceable electronic mail, return addresses, and digital pseudonyms,” Comm. of the ACM , vol. 24, no. 2, pp. 84–90, 1981

    1981

  31. [39]

    The dining cryptographers problem: Unconditional sender and recipient untraceability,

    D. Chaum, “The dining cryptographers problem: Unconditional sender and recipient untraceability,” J. Cryptology, vol. 1, no. 1, pp. 65–75, 1988

    1988

  32. [40]

    Partially encrypted deep learning using functional encryption,

    T. Ryffel, D. Pointcheval, F. Bach, E. Dufour-Sans, and R. Gay, “Partially encrypted deep learning using functional encryption,” NeurIPS, vol. 32, 2019

    2019

  33. [41]

    Federated learning with differential pri- vacy: Algorithms and performance analysis,

    K. Wei, J. Li, M. Ding, C. Ma, H. H. Yang, F. Farokhi, S. Jin, T. Q. Quek, and H. V . Poor, “Federated learning with differential pri- vacy: Algorithms and performance analysis,” IEEE TIFS, vol. 15, pp. 3454–3469, 2020

    2020

  34. [42]

    Revisiting secure computation using functional encryption: Opportunities and research directions,

    R. Xu and J. Joshi, “Revisiting secure computation using functional encryption: Opportunities and research directions,” inTPS-ISA’20. IEEE, 2020, pp. 226–235

    2020

  35. [43]

    Multi- input functional encryption for inner products: function-hiding realizations and constructions without pairings,

    M. Abdalla, D. Catalano, D. Fiore, R. Gay, and B. Ursu, “Multi- input functional encryption for inner products: function-hiding realizations and constructions without pairings,” in CRYPTO’18. Springer, 2018, pp. 597–627

    2018

  36. [44]

    Decentralized multi-client functional encryption for inner prod- uct,

    J. Chotard, E. Dufour Sans, R. Gay, D. H. Phan, and D. Pointcheval, “Decentralized multi-client functional encryption for inner prod- uct,” in Asiacrypt’18. Springer, 2018, pp. 703–732

    2018

  37. [45]

    From single-input to multi-client inner-product functional encryption,

    M. Abdalla, F. Benhamouda, and R. Gay, “From single-input to multi-client inner-product functional encryption,” in Asiacrypt’19. Springer, 2019, pp. 552–582

    2019

  38. [46]

    Cryptonn:training neural networks over encrypted data,

    R. Xu, J. Joshi, and C. Li, “Cryptonn:training neural networks over encrypted data,” in ICDCS. IEEE, 2019, pp. 1199–1209

    2019

  39. [47]

    Nn-emd: Efficiently training neural networks using en- crypted multi-sourced datasets,

    ——, “Nn-emd: Efficiently training neural networks using en- crypted multi-sourced datasets,” IEEE TDSC, 2021

    2021

  40. [48]

    Functional encryption: Defini- tions and challenges,

    D. Boneh, A. Sahai, and B. Waters, “Functional encryption: Defini- tions and challenges,” in TCC’11. Springer, 2011, pp. 253–273

    2011

  41. [49]

    How to share a secret,

    A. Shamir, “How to share a secret,” Comm. of the ACM , vol. 22, no. 11, pp. 612–613, 1979

    1979

  42. [2021]

    Available: https://developer.nvidia.com/blog/ federated-learning-with-homomorphic-encryption/

    [Online]. Available: https://developer.nvidia.com/blog/ federated-learning-with-homomorphic-encryption/

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.