ByzSFL: Achieving Byzantine-Robust Secure Federated Learning with Zero-Knowledge Proofs

Chenghong Wang; Haixu Tang; Hyunghoon Cho; Lucila Ohno-Machado; Rui Zhu; Ye Dong; Yongming Fan; Zihao Wang

REVIEW 4 major objections 5 minor 60 references

ByzSFL: Achieving Byzantine-Robust Secure Federated Learning with Zero-Knowledge Proofs

T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper presents ByzSFL as the first system to make Byzantine-robust secure aggregation practical in secure federated learning, by moving trust-score computation to clients and proving it with zero-knowledge proofs.

desk verdict The core FLTrust-equivalence claim does not hold up because g* is pinned at setup and never refreshed; the architecture is plausible but this flaw is load-bearing. read the letter →

arxiv 2501.06953 v1 pith:IAXM2VHW submitted 2025-01-12 cs.CR

Yongming Fan , Rui Zhu , Zihao Wang , Chenghong Wang , Haixu Tang , Ye Dong , Hyunghoon Cho , Lucila Ohno-Machado This is my paper · ORCID

classification cs.CR

keywords securefederatedlearningByzantinerobustnesszero-knowledgeproofszk-SNARKspartiallyhomomorphicencryptionFLTrustaggregationinputvalidation

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to close a gap in secure federated learning: encrypted aggregation protects privacy but has no practical way to defend against malicious clients. ByzSFL is designed as the first system to combine Byzantine-robust aggregation with encrypted model updates, by having each client compute its own FLTrust aggregation weight and prove with a zero-knowledge proof that the weight follows from its encrypted update. The claimed payoff is that an otherwise expensive secure-aggregation pipeline becomes about 100 times faster than the fully homomorphic alternative, while inheriting FLTrust's tolerance for a large fraction of malicious clients. The paper also introduces DuoAgg, a two-server setup that lets the aggregation server work only on encrypted additions.

What carries the argument

The machinery that carries the argument is the combination of DuoAgg, a two-server secure aggregation framework, and a Circom-based zk-SNARK gadget library for the operators FLTrust needs. DuoAgg assigns the aggregation server SC only Paillier addition on ciphertexts, while the encryption server SE handles key generation, decryption, and the reference update g*. The gadget library—cosine similarity, L2 norms, min/max, vector arithmetic, and additive homomorphic encryption—lets each client prove in zero knowledge that its TSi, \tilde{TS}_i, and H_i were computed correctly without revealing g_i. That replaces the expensive FHE evaluation of trust scores with verifiable plaintext computation on the client side, which is what yields the speedup.

What would settle it

Evaluate both sides of the asserted equivalence on a concrete vector pair: take g* = (1,0) and g_i = (2,2), compute the paper's H/TS update using Equations (4)–(5), and compute FLTrust's original update on the same inputs; if the two vectors differ, the Section 5.3 equivalence—and with it the inherited robustness guarantee—is false.

Watch

Extended reading notes

Core claim

The central claim, stated by the authors, is that ByzSFL is the first system to achieve highly efficient Byzantine-robust secure aggregation in secure federated learning. The protocol keeps FLTrust's robustness while encrypting intermediate updates: each client i computes its trust score TSi = max(0, g*·gi/(||g*|| ||gi||)), the normalized score \tilde{TS}_i = TSi ||g*||/||gi||, and H_i = \tilde{TS}_i g_i, encrypts H_i and TSi with Paillier encryption, and attaches a zk-SNARK proving these values come from its local update. The server SC verifies each proof, adds the encrypted H_i and TSi over all accepted clients, and SE decrypts and sets \beta_{new} = \beta_{new} + \$\alpha$ H/TS. The authors assert that this reorganized computation is mathematically equivalent to FLTrust's original aggregation, so FLTrust's resilience—reported to survive over 90% malicious clients—is inherited; they report a per-round runtime of 38s versus 3224s for an FHE baseline on 19K parameters.

Load-bearing premise

The whole robustness guarantee stands on the claim that dividing the sum of normalized trust-score-weighted updates by the sum of raw trust scores reproduces FLTrust's aggregation rule exactly; if that equality is false, the Byzantine-robustness guarantee may not transfer.

Editorial extensions

If this is right

If the mathematical equivalence holds, FLTrust's Byzantine-robustness guarantee—including its reported tolerance for more than 90% malicious clients—becomes available inside encrypted aggregation.
The protocol's proof size stays at 803 bytes regardless of model size, so verification time on the aggregation server stays roughly constant as the model grows.
A two-server setup with no SC–SE collusion means no single server ever sees both individual ciphertexts and the decryption key, reducing the trust needed compared to single-server masking or FHE designs.
On the MNIST benchmark with 19K parameters, ByzSFL is about 85 times faster than the CKKS-based FHE protocol (38s vs 3224s per round) and faster than RoFL with L2 or L∞ norm regularization.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: the asserted equivalence between the paper's H/TS update and FLTrust's original rule is independently checkable; computing both sides on a toy gradient pair would settle whether the inherited robustness guarantee actually follows.
Editorial inference: because the gadget library already covers median, mean, Krum-style distances, and range constraints, the same DuoAgg architecture could likely wrap other plaintext robust-aggregation rules, not just FLTrust.
Editorial inference: the practical viability hinges on the no-collusion two-server assumption; in deployment, SC and SE would need to be operated by separate organizations or audited to deter collusion.
Editorial inference: a natural next benchmark would run ByzSFL under model-poisoning attacks on a larger model and compare final accuracy to plaintext FLTrust, checking how much fixed-point quantization and the trust-score aggregation form erode the robustness.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Dear colleague,

The headline: ByzSFL is a real engineering attempt to add Byzantine robustness to secure FL, but as written its central claim—that it implements FLTrust securely—fails because the reference update g* is computed once in Setup and never refreshed. That is the issue to focus on, not the normalization algebra, which the reader's report misread.

What's genuinely there: the dual-server SC/SE split is sensible, and the idea of having clients compute their own FLTrust weights and prove them with Groth16 zk-SNARKs over Paillier ciphertexts is a plausible way to avoid FHE. The Circom gadget library is a useful practical contribution, and the timing experiments, however rough, do suggest the PHE+zk-SNARK route can beat an FHE baseline by a large margin. The threat model is stated carefully, and the limitation section is honest about the privacy leak when there are few clients.

The soft spots, in order of severity. First, the stale g*. In Figure 4, g* is sent to clients once at setup. FLTrust recomputes the server reference gradient against the current model each round; here after a few rounds honest clients' updates are scored against a gradient from beta_0, so their trust scores become arbitrary, and an adversary who knows the stale direction can keep a high weight. The paper's own Section 4 description says SE 'derives the reference update' each round, so Figure 4 seems to be a mistake—but as written, the protocol is not FLTrust, and the robustness guarantee does not follow. This is load-bearing. A corrected version that recomputes and redistributes g* per round could plausibly work, with added communication cost.

Second, the evaluation never demonstrates robustness. There are no attack experiments, no accuracy/learning curves under Byzantine clients, and no comparison with the one directly relevant prior work, reference [31] (low-cost ZKP for robust secure FL). That omission hurts the novelty claim. Third, there are several data-quality problems: the abstract says 100x speedup while the conclusion says 85x; Table 1's 38k total is inconsistent with its row entries; and the 38s/round vs 3224s/round FHE numbers appear only in a figure with no cost model in the text.

Overall: the paper is not ready to accept, but the idea is not wrong-headed and the flaw is identifiable and fixable. Send it to review, and push the authors toward a per-round g*, a real robustness evaluation, and a discussion of [31]. A serious referee will find this worth the time.

Referee Report

4 major / 5 minor

Summary. The paper proposes ByzSFL, a two-server secure federated learning system that combines Paillier partially homomorphic encryption with zk-SNARKs to verify client-computed FLTrust aggregation weights. Clients encrypt local updates and trust scores, the aggregation server SC homomorphically sums them, and the encryption server SE decrypts and applies the update beta_new = beta_new + alpha * H/TS. The paper claims this is mathematically equivalent to FLTrust, reports an approximately 85x to 100x speedup over an FHE baseline and RoFL, and presents timing and bandwidth experiments on MNIST. The evaluation contains only runtime and communication measurements; no accuracy or Byzantine-attack experiments are reported.

Significance. If the protocol worked as claimed, it would be a useful engineering contribution: outsourcing trust-score computation to clients while using PHE plus zk-SNARKs to verify it addresses a real gap in secure federated learning. The dual-server DuoAgg architecture and the proposed Circom gadget library are concrete steps toward practical Byzantine-robust secure aggregation, and the reported benchmarks, if corrected and reproduced, would be valuable. However, as written, the protocol is not FLTrust-equivalent because the server's reference update is never refreshed, and the evaluation does not demonstrate Byzantine robustness at all. The significance is therefore conditional on substantial revision.

major comments (4)

[Section 5.3, Figure 4] The claimed mathematical equivalence with FLTrust fails because the reference update g* is computed once during Setup (Figure 4, Setup step 2) and is never recomputed in the per-round loop. In FLTrust (Cao et al., Algorithm 1), the server's reference update is the validation gradient at the current global model and must be refreshed every round. With a fixed g*, client trust scores in later rounds are cosine similarities against the gradient at beta_0, not at the current beta_t, so the protocol is not equivalent to FLTrust and the inherited Byzantine-robustness guarantee does not follow. This is load-bearing for the paper's central claim. I note that the specific H/TS normalization algebra in Equations (4) and (5) is consistent with the FLTrust weighted average; the problem is the stale anchor, not the normalization. The authors should either recompute and redistribute g* each round and state this explicitly, or prove that a fixed g* preserves FLTrust's guarantees, which seems unlikely.
[Section 6] The paper claims that ByzSFL "ensures robust model training even in the presence of malicious participants," but Section 6 reports no experiments with malicious clients and no accuracy or model-utility measurements. The only experimental results are timing and bandwidth numbers in Tables 1-3 and Figure 6. There is no end-to-end training accuracy curve, no comparison of ByzSFL versus FLTrust under the same attack model, and no demonstration that the proposed protocol preserves model performance under Byzantine clients. This missing evaluation leaves the central robustness claim untested.
[Section 6.3, Table 1] The reported "38 seconds per round" for ByzSFL is inconsistent with Table 1: the 19K-parameter row shows a total of 13.08 seconds, and no row in the table reports 38 seconds. Furthermore, several totals in Table 1 do not match the sum of the listed components (e.g., for 9K parameters the components sum to 8.30 seconds, not 8.51; for 38K parameters they sum to 25.24 seconds, not 15.89). These numerical inconsistencies undermine the quantitative speedup claim and must be corrected before the efficiency comparison can be assessed.
[Section 3.3, Figure 4, Section 5.5] The security analysis is informal and does not state or prove the properties required for the central claim. The composed protocol needs a precise argument for ZKP soundness (a client cannot produce a valid proof for a trust score not derived from its encrypted update), zero-knowledge for the Paillier encryption and the trust-score computation, and privacy for honest clients under the stated no-collusion assumptions. Section 5.5 gives narrative discussion but no theorems. In addition, Setup step 1 of Figure 4 sends the validation dataset D* to every client. This is unnecessary for the protocol and leaks the server's trusted dataset; if D* is meant to be public, the authors should say so explicitly and explain why this does not weaken the FLTrust trust anchor.

minor comments (5)

[Figure 4] Setup step 1 says "Server SC sends initial model beta_0..." but according to Section 3.2 and Figure 2 this should be Server SE; the figure caption also contains the typo "Protocal."
[Abstract, Section 1, Section 8] The speedup is described as "approximately 100 times faster" in the abstract and contributions, while Section 6.3 says "approximately 85 times" and the conclusion says "85x." These numbers should be reconciled.
[Section 5.4] The sentence "In Section 5.4, we demonstrate how to use our newly developed gadget library..." refers to the current section; it should be rephrased, and the actual circuit construction described there should be explicitly tied to the gadget library.
[Section 5.4] The fixed-point arithmetic conversion is mentioned but the scaling factor and its status as a public parameter are not specified; this matters because it affects the precision of cosine similarity and L2-norm computations inside the R1CS circuit.
[Equations (4)-(6), Figure 4] Equation (6) writes E(TS_i * g_i), while the protocol and Figure 4 use H_i = tilde_TS_i * g_i and C(H_i). The notation should be aligned so that the encrypted quantity is unambiguous.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: ByzSFL's aggregation rule is an algebraic restatement of the external FLTrust benchmark, and the self-cited SNARKProbe reference is not load-bearing.

full rationale

The paper's central update, beta_new = beta_new + alpha * H/TS with H_i = TS_i * ||g*||/||g_i|| * g_i and TS = sum TS_i, is exactly FLTrust's trust-score-weighted normalized average, so the claim of equivalence to FLTrust is a direct algebraic identity rather than a fitted parameter being renamed as a prediction. The ZKP circuits verify that TS_i, ~TS_i, and H_i are computed from the client's local update and the server's reference update; this is a proof obligation, not an input that forces the claimed robustness result. The self-citation to SNARKProbe [32] appears only in a background remark that tools exist to assess zk-SNARK correctness and security; it is not used to justify ByzSFL's efficiency, soundness, or robustness claims, and the cited tool is independent code-based evidence. The main scientific weakness is a correctness gap rather than circularity: Figure 4 computes g* once during Setup and never refreshes it, whereas FLTrust's reference update must be recomputed at the current global model each round; if that is so, the asserted 'mathematical equivalence with original formulation of FLTrust' does not follow. That is a soundness problem with an external benchmark, not a circular derivation.

Assumptions & free parameters 2 free parameters · 6 assumptions · 0 invented entities

The central claim rests on domain assumptions about honest clients, non-colluding servers, and a representative validation dataset, plus an unproved equivalence to FLTrust and an unverified new gadget library. No numeric parameters are fit to data, but the fixed-point scaling and key sizes are unspecified implementation parameters. There are no new physical entities; the novel architectural components are captured in the axioms and threat model.

free parameters (2)

Fixed-point scaling factor for gradient and trust-score encoding = not specified
The zk-SNARK circuit works over a finite field, so real-value gradients and cosine terms must be scaled to integers; the chosen scale affects proof correctness and model accuracy but is not reported.
Paillier key modulus size = not specified
Timing and security depend on the Paillier modulus bit length; without it the reported encryption and decryption times cannot be reproduced or compared across schemes.

assumptions (6)

domain assumption The majority of clients are honest (only a bounded subset is Byzantine).
Stated in the threat model, Section 3.2; this is the standard FL Byzantine assumption and is required for any FLTrust-style guarantee.
domain assumption The two servers SC and SE do not collude with each other or with clients in ways that break privacy or validation.
Section 3.2 and Section 5.5 rely on non-collusion; if SC and SE collude, SC can pass encrypted client updates to SE for decryption.
domain assumption Server SE has access to a small, low-sensitivity validation dataset D* representative of the target distribution.
Equation 2 computes the reference update g* from D*; trust scores inherit FLTrust's dependence on this representative dataset.
ad hoc to paper The implemented aggregation formula (normalized scores in H, raw scores in the denominator TS) is equivalent to FLTrust.
Section 5.3 claims equivalence, but Figure 4 and Equations 4 and 5 do not cancel the ||g*||/||gi|| factors; this unproved equivalence is the basis for the Byzantine-robustness claim.
ad hoc to paper The new Circom gadget library correctly implements fixed-point cosine similarity, L2 norm, vector arithmetic, and Paillier encryption in R1CS.
Section 5.4 introduces the gadgets, but no code, tests, or formal verification are provided, so circuit correctness is assumed.
standard math Groth16 is sound and the trusted setup performed by SE is executed correctly and without leakage.
Section 5.4 selects Groth16 over BLS12-381; the security analysis relies on its standard soundness and on SE performing a trusted setup.

how reviews work

0 comments

Cite this review

Pith. "Pith review of ByzSFL: Achieving Byzantine-Robust Secure Federated Learning with Zero-Knowledge Proofs." pith.science (2026). https://pith.science/paper/IAXM2VHW

@misc{pith2026250106953,
  author       = {Pith},
  title        = {Pith review of: ByzSFL: Achieving Byzantine-Robust Secure Federated Learning with Zero-Knowledge Proofs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IAXM2VHW}},
  note         = {Machine review of arXiv:2501.06953}
}

read the original abstract

The advancement of AI models, especially those powered by deep learning, faces significant challenges in data-sensitive industries like healthcare and finance due to the distributed and private nature of data. Federated Learning (FL) and Secure Federated Learning (SFL) enable collaborative model training without data sharing, enhancing privacy by encrypting shared intermediate results. However, SFL currently lacks effective Byzantine robustness, a critical property that ensures model performance remains intact even when some participants act maliciously. Existing Byzantine-robust methods in FL are incompatible with SFL due to the inefficiency and limitations of encryption operations in handling complex aggregation calculations. This creates a significant gap in secure and robust model training. To address this gap, we propose ByzSFL, a novel SFL system that achieves Byzantine-robust secure aggregation with high efficiency. Our approach offloads aggregation weight calculations to individual parties and introduces a practical zero-knowledge proof (ZKP) protocol toolkit. This toolkit supports widely used operators for calculating aggregation weights, ensuring correct computations without compromising data privacy. Not only does this method maintain aggregation integrity, but it also significantly boosts computational efficiency, making ByzSFL approximately 100 times faster than existing solutions. Furthermore, our method aligns with open-source AI trends, enabling plaintext publication of the final model without additional information leakage, thereby enhancing the practicality and robustness of SFL in real-world applications.

Figures

Figures reproduced from arXiv: 2501.06953 by the authors.

**Figure 1.** Framework of DuoAgg a sophisticated operator (cosine similarity) to enhance model reliability. The Trust Score (TS) from FLTrust [1], which serves as the unnormalized aggregation weight for the i th client, is defined as: TSi = max(0, g ∗ · gi ∥g ∗∥∥gi∥ ) (4) The normalized trust score denoted as TS˜ i : TS˜ i = TSi · ∥g ∗∥ ∥gi∥ (5) The i th client computes its encrypted weighted local model, and denote as: E(TS˜ i … view at source ↗

**Figure 2.** Framework of ByzSFL encrypted data, leveraging the homomorphic properties of the encryption scheme. The encrypted final model is then computed as: C(g) = Xm i=1 C(gi) SC subsequently transmits this encrypted output, C(βˆ), to the encryption server SE. Encryption Server SE. Upon receiving C(βˆ) from SC , SE decrypts the aggregated vector to obtain the final computed model. The decryption process is expressed as: g = … view at source ↗

**Figure 3.** Protocol details of DuoAgg For the encryption, We selected the Paillier cryptosystem, a partial homomorphic encryption scheme that supports homomorphic addition over encrypted integers, allowing for computations on ciphertexts without decrypting the data. We also integrate zk-SNARKs to ensure the integrity and correctness of the client’s computations. The detailed ZKP protocol will be discussed in Section 5.4. 5.4.… view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: Protocal of ByzSFL for federated learning models, we developed a new gadget library based on Circom. This library modularizes complex operations frequently used in Byzantine-robust technique, making circuit construction more manageable. The library includes the followi…

**Figure 5.** Figure 5: Detailed protocol of zk-SNARKs for each party [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]

**Figure 6.** Figure 6: Runtime and Bandwidth Comparison Between [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]

**Figure 7.** Figure 7: Protocol with fully homomorphic encryption [PITH_FULL_IMAGE:figures/full_fig_p016_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

60 extracted references · 53 canonical work pages

[31]

Robust and secure federated learning with low-cost zero-knowledge proof,

Y . Zhu, Y . Wu, Z. Luo, B. C. Ooi, and X. Xiao, “Robust and secure federated learning with low-cost zero-knowledge proof,” 2023. 15

work page 2023
[1]

Fltrust: Byzantine- robust federated learning via trust bootstrapping,

X. Cao, M. Fang, J. Liu, and N. Z. Gong, “Fltrust: Byzantine- robust federated learning via trust bootstrapping,” arXiv preprint arXiv:2012.13995, 2020

arXiv 2012
[2]

Fedatm: Adap- tive trimmed mean based federated learning against model poison- ing attacks,

K. Nishimoto, Y .-H. Chiang, H. Lin, and Y . Ji, “Fedatm: Adap- tive trimmed mean based federated learning against model poison- ing attacks,” in 2023 IEEE 97th Vehicular Technology Conference (VTC2023-Spring). IEEE, 2023, pp. 1–5

work page 2023
[3]

Median-krum: A joint distance- statistical based byzantine-robust algorithm in federated learning,

F. Colosimo and F. De Rango, “Median-krum: A joint distance- statistical based byzantine-robust algorithm in federated learning,” in Proceedings of the Int’l ACM Symposium on Mobility Management and Wireless Access, 2023, pp. 61–68

work page 2023
[4]

Communication-efficient learning of deep networks from decentral- ized data,

B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentral- ized data,” in Artificial intelligence and statistics . PMLR, 2017, pp. 1273–1282

2017
[5]

Byzantine-robust feder- ated learning through collaborative malicious gradient filtering,

J. Xu, S.-L. Huang, L. Song, and T. Lan, “Byzantine-robust feder- ated learning through collaborative malicious gradient filtering,” in 2022 IEEE 42nd International Conference on Distributed Computing Systems (ICDCS). IEEE, 2022, pp. 1223–1235

work page 2022
[6]

Fast and scalable private genotype imputation us- ing machine learning and partially homomorphic encryption,

E. Sarkar, E. Chielle, G. G ¨ursoy, O. Mazonka, M. Gerstein, and M. Maniatakos, “Fast and scalable private genotype imputation us- ing machine learning and partially homomorphic encryption,” IEEE access, vol. 9, pp. 93 097–93 110, 2021

work page 2021
[7]

Fast additive partially homo- morphic encryption from the approximate common divisor problem,

E. L. Cominetti and M. A. Simplicio, “Fast additive partially homo- morphic encryption from the approximate common divisor problem,” IEEE Transactions on Information Forensics and Security , vol. 15, pp. 2988–2998, 2020

work page 2020

Show all 60 references

[8]

ACORN: input validation for secure aggregation,

J. Bell, A. Gasc ´on, T. Lepoint, B. Li, S. Meiklejohn, M. Raykova, and C. Yun, “ACORN: input validation for secure aggregation,” in 32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9-11, 2023 , J. A. Calandrino and C. Troncoso, Eds. USENIX Associ...

2023
[9]

Efficient, private and robust federated learning,

M. Hao, H. Li, G. Xu, H. Chen, and T. Zhang, “Efficient, private and robust federated learning,” in Proceedings of the 37th Annual Computer Security Applications Conference , 2021, pp. 45–60

2021
[10]

Rofl: Attestable robustness for secure federated learning,

L. Burkhalter, H. Lycklama, A. Viand, N. K ¨uchler, and A. Hithnawi, “Rofl: Attestable robustness for secure federated learning,” arXiv preprint arXiv:2107.03311, vol. 21, 2021

2021 arXiv
[11]

Privacy-preserving construction of generalized linear mixed model for biomedical computation,

R. Zhu, C. Jiang, X. Wang, S. Wang, H. Zheng, and H. Tang, “Privacy-preserving construction of generalized linear mixed model for biomedical computation,” Bioinformatics, vol. 36, no. Supple- ment 1, pp. i128–i135, 2020

2020
[12]

A survey on federated learning,

C. Zhang, Y . Xie, H. Bai, B. Yu, W. Li, and Y . Gao, “A survey on federated learning,” Knowledge-Based Systems, vol. 216, p. 106775, 2021

2021
[13]

Federated learning for healthcare informatics,

J. Xu, B. S. Glicksberg, C. Su, P. Walker, J. Bian, and F. Wang, “Federated learning for healthcare informatics,” Journal of healthcare informatics research, vol. 5, pp. 1–19, 2021

2021
[14]

Machine learning with adversaries: Byzantine tolerant gradient descent,

P. Blanchard, E. M. E. Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” in Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, December 4-9, 2017, ...

2017
[15]

Distributed statistical machine learning in adversarial settings: Byzantine gradient descent,

Y . Chen, L. Su, and J. Xu, “Distributed statistical machine learning in adversarial settings: Byzantine gradient descent,” in Abstracts of the 2018 ACM International Conference on Measurement and Modeling of Computer Systems, SIGMETRICS 2018, Irvine, CA, USA, June 18- 22, 201...

2018
[16]

Byzantine- robust distributed learning: Towards optimal statistical rates,

D. Yin, Y . Chen, K. Ramchandran, and P. L. Bartlett, “Byzantine- robust distributed learning: Towards optimal statistical rates,” in Proceedings of the 35th International Conference on Machine Learning, ICML 2018, Stockholmsm ¨assan, Stockholm, Sweden, July 10-15, 2018 , ser....

2018
[17]

zprobe: Zero peek robustness checks for federated learning,

Z. Ghodsi, M. Javaheripi, N. Sheybani, X. Zhang, K. Huang, and F. Koushanfar, “zprobe: Zero peek robustness checks for federated learning,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2023, pp. 4860–4870

2023
[18]

Secure aggregation against malicious users,

F. Karakoc ¸, M. ¨Onen, and Z. Bilgin, “Secure aggregation against malicious users,” in Proceedings of the 26th ACM Symposium on Access Control Models and Technologies , 2021, pp. 115–124

2021
[19]

Eiffel: Ensuring integrity for federated learning,

A. Roy Chowdhury, C. Guo, S. Jha, and L. van der Maaten, “Eiffel: Ensuring integrity for federated learning,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, 2022, pp. 2535–2549

2022
[20]

A survey on ho- momorphic encryption schemes: Theory and implementation,

A. Acar, H. Aksu, A. S. Uluagac, and M. Conti, “A survey on ho- momorphic encryption schemes: Theory and implementation,” ACM Computing Surveys (Csur) , vol. 51, no. 4, pp. 1–35, 2018

2018
[21]

Homomorphic encryption application on financialcloud framework,

H.-T. Peng, W. W. Hsu, J.-M. Ho, and M.-R. Yu, “Homomorphic encryption application on financialcloud framework,” in 2016 IEEE Symposium Series on Computational Intelligence (SSCI) . IEEE, 2016, pp. 1–5

2016
[22]

A systematic review of homomorphic encryption and its contributions in healthcare industry,

K. Munjal and R. Bhatia, “A systematic review of homomorphic encryption and its contributions in healthcare industry,” Complex & Intelligent Systems, vol. 9, no. 4, pp. 3759–3786, 2023

2023
[23]

Homomorphic encryption for security of cloud data,

M. M. P. Mr, C. A. Dhote, and D. H. S. Mr, “Homomorphic encryption for security of cloud data,” Procedia Computer Science , vol. 79, pp. 175–181, 2016

2016
[24]

A review of homomorphic encryption and its applications,

L. Zhang, Y . Zheng, and R. Kantoa, “A review of homomorphic encryption and its applications,” in Proceedings of the 9th EAI Inter- national Conference on Mobile Multimedia Communications , 2016, pp. 97–106

2016
[25]

Homomorphic en- cryption for arithmetic of approximate numbers,

J. H. Cheon, A. Kim, M. Kim, and Y . Song, “Homomorphic en- cryption for arithmetic of approximate numbers,” in Advances in Cryptology–ASIACRYPT 2017: 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, Decembe...

2017
[26]

Proofs that yield nothing but their validity and a methodology of cryptographic protocol design,

O. Goldreich, S. Micali, and A. Wigderson, “Proofs that yield nothing but their validity and a methodology of cryptographic protocol design,” in Providing Sound Foundations for Cryptography: On the Work of Shafi Goldwasser and Silvio Micali , O. Goldreich, Ed. ACM, 2019, pp. 2...

2019
[27]

Snarks for c: Verifying program executions succinctly and in zero knowledge,

E. Ben-Sasson, A. Chiesa, D. Genkin, E. Tromer, and M. Virza, “Snarks for c: Verifying program executions succinctly and in zero knowledge,” in Annual cryptology conference . Springer, 2013, pp. 90–108

2013
[28]

Pinocchio: Nearly practical verifiable computation,

B. Parno, J. Howell, C. Gentry, and M. Raykova, “Pinocchio: Nearly practical verifiable computation,” Communications of the ACM, vol. 59, no. 2, pp. 103–112, 2016

2016
[29]

On the size of pairing-based non-interactive arguments,

J. Groth, “On the size of pairing-based non-interactive arguments,” in Advances in Cryptology–EUROCRYPT 2016: 35th Annual Interna- tional Conference on the Theory and Applications of Cryptographic Techniques, Vienna, Austria, May 8-12, 2016, Proceedings, Part II

2016
[30]

Kick bad guys out! zero-knowledge-proof- based anomaly detection in federated learning,

S. Han, W. Wu, B. Buyukates, W. Jin, Y . Yao, Q. Zhang, S. Aves- timehr, and C. He, “Kick bad guys out! zero-knowledge-proof- based anomaly detection in federated learning,” arXiv preprint arXiv:2310.04055, 2023

2023 arXiv
[32]

Snarkprobe: An automated secu- rity analysis framework for zksnark implementations,

Y . Fan, Y . Xu, and C. Garman, “Snarkprobe: An automated secu- rity analysis framework for zksnark implementations,” in Interna- tional Conference on Applied Cryptography and Network Security . Springer, 2024, pp. 340–372

2024
[33]

Automated detection of under- constrained circuits in zero-knowledge proofs,

S. Pailoor, Y . Chen, F. Wang, C. Rodr´ıguez, J. Van Geffen, J. Morton, M. Chu, B. Gu, Y . Feng, and I. Dillig, “Automated detection of under- constrained circuits in zero-knowledge proofs,” Proceedings of the ACM on Programming Languages, vol. 7, no. PLDI, pp. 1510–1532, 2023

2023
[34]

Practical secure aggre- gation for privacy-preserving machine learning,

K. Bonawitz, V . Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, “Practical secure aggre- gation for privacy-preserving machine learning,” in proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, 201...

2017
[35]

Springer, 2016, pp. 305–326

2016
[36]

Secure single-server aggregation with (poly) logarithmic overhead,

J. H. Bell, K. A. Bonawitz, A. Gasc ´on, T. Lepoint, and M. Raykova, “Secure single-server aggregation with (poly) logarithmic overhead,” in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security , 2020, pp. 1253–1269

2020
[37]

Privacy-preserving deep learning via additively homomorphic encryption,

Y . Aono, T. Hayashi, L. Wang, S. Moriai et al., “Privacy-preserving deep learning via additively homomorphic encryption,” IEEE trans- actions on information forensics and security , vol. 13, no. 5, pp. 1333–1345, 2017

2017
[38]

{BatchCrypt}: Efficient homomorphic encryption for {Cross-Silo} federated learn- ing,

C. Zhang, S. Li, J. Xia, W. Wang, F. Yan, and Y . Liu, “{BatchCrypt}: Efficient homomorphic encryption for {Cross-Silo} federated learn- ing,” in 2020 USENIX annual technical conference (USENIX ATC 20), 2020, pp. 493–506

2020
[39]

{ACORN}: input validation for secure aggregation,

J. Bell, A. Gasc ´on, T. Lepoint, B. Li, S. Meiklejohn, M. Raykova, and C. Yun, “{ACORN}: input validation for secure aggregation,” in 32nd USENIX Security Symposium (USENIX Security 23) , 2023, pp. 4805–4822

2023
[40]

Bulletproofs: Short proofs for confidential transactions and more,

B. B ¨unz, J. Bootle, D. Boneh, A. Poelstra, P. Wuille, and G. Maxwell, “Bulletproofs: Short proofs for confidential transactions and more,” in 2018 IEEE symposium on security and privacy (SP) . IEEE, 2018, pp. 315–334

2018
[41]

Circom: A circuit description language for building zero-knowledge applications,

M. Bell ´es-Mu˜noz, M. Isabel, J. L. Mu ˜noz-Tapia, A. Rubio, and J. Baylina, “Circom: A circuit description language for building zero-knowledge applications,” IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 6, pp. 4733–4751, 2022

2022
[42]

Crypten: Secure multi-party computation meets machine learning,

B. Knott, S. Venkataraman, A. Hannun, S. Sengupta, M. Ibrahim, and L. van der Maaten, “Crypten: Secure multi-party computation meets machine learning,” Advances in Neural Information Processing Systems, vol. 34, pp. 4961–4973, 2021

2021
[43]

Training differentially pri- vate models with secure multiparty computation,

S. Pentyala, D. Railsback, R. Maia, R. Dowsley, D. Melanson, A. Nascimento, and M. De Cock, “Training differentially pri- vate models with secure multiparty computation,” arXiv preprint arXiv:2202.02625, 2022

2022 arXiv
[44]

Byzantine-resilient decentralized stochastic optimization with robust aggregation rules,

Z. Wu, T. Chen, and Q. Ling, “Byzantine-resilient decentralized stochastic optimization with robust aggregation rules,” IEEE trans- actions on signal processing , 2023

2023
[45]

Byzantine-resilient sgd in high dimensions on heterogeneous data,

D. Data and S. Diggavi, “Byzantine-resilient sgd in high dimensions on heterogeneous data,” in 2021 IEEE International Symposium on Information Theory (ISIT) . IEEE, 2021, pp. 2310–2315

2021
[46]

Sok: Understand- ing the prevailing security vulnerabilities in trustzone-assisted tee systems,

D. Cerdeira, N. Santos, P. Fonseca, and S. Pinto, “Sok: Understand- ing the prevailing security vulnerabilities in trustzone-assisted tee systems,” in 2020 IEEE Symposium on Security and Privacy (SP) . IEEE, 2020, pp. 1416–1432

2020
[47]

Federated dropout—a simple approach for enabling federated learning on resource constrained devices,

D. Wen, K.-J. Jeon, and K. Huang, “Federated dropout—a simple approach for enabling federated learning on resource constrained devices,” IEEE wireless communications letters , vol. 11, no. 5, pp. 923–927, 2022

2022
[48]

Minimax approximation of sign function by composite polynomial for homomorphic com- parison,

E. Lee, J.-W. Lee, J.-S. No, and Y .-S. Kim, “Minimax approximation of sign function by composite polynomial for homomorphic com- parison,” IEEE Transactions on Dependable and Secure Computing , vol. 19, no. 6, pp. 3711–3727, 2021. Appendix

2021
[49]

Notation Notation Definition m Number of parties (clients) β0 Initial model parameters g∗ Reference update computed by SC using its validation data gi Local update of the ith client αi Aggregation weight of the ith client C( ˆgi) Encrypted local gradient uploaded by the ith cl...
[50]

Baseline Protocol with FHE The detailed protocol design with fully homomorphic encryption is presented in Figure 7. The CKKS scheme is configured with the following parameters: • Polynomial modulus degree as 216, corresponding to a polynomial ring of degree 32768, which balanc...
[51]

Server SC sends initial model β0, loss function ℓ, opti- mizer O and learning rate η to each client
[52]

Server SE sends ek to each client ith Client:
[53]

Compute gi by Equation 3
[54]

Encrypt C(gi) =E(gi, ek)
[55]

Send C(gi) to server SC Server SC
[56]

Compute C(TSi) and C( ˜TSi) for each client by Equa- tion 5 with encrypted C(gi)
[57]

Compute C(H) =P i∈All clients C( ˜TSi) · C(gi)
[58]

Compute new global model C(βnew) = C(H) C(TS)
[59]

Send C(βnew) to clients ith Client:
[60]

Send the updated global model βnew to each client for next round Figure 7: Protocol with fully homomorphic encryption 16

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.

[1] [31]

Robust and secure federated learning with low-cost zero-knowledge proof,

Y . Zhu, Y . Wu, Z. Luo, B. C. Ooi, and X. Xiao, “Robust and secure federated learning with low-cost zero-knowledge proof,” 2023. 15

work page 2023

[2] [1]

Fltrust: Byzantine- robust federated learning via trust bootstrapping,

X. Cao, M. Fang, J. Liu, and N. Z. Gong, “Fltrust: Byzantine- robust federated learning via trust bootstrapping,” arXiv preprint arXiv:2012.13995, 2020

arXiv 2012

[3] [2]

Fedatm: Adap- tive trimmed mean based federated learning against model poison- ing attacks,

K. Nishimoto, Y .-H. Chiang, H. Lin, and Y . Ji, “Fedatm: Adap- tive trimmed mean based federated learning against model poison- ing attacks,” in 2023 IEEE 97th Vehicular Technology Conference (VTC2023-Spring). IEEE, 2023, pp. 1–5

work page 2023

[4] [3]

Median-krum: A joint distance- statistical based byzantine-robust algorithm in federated learning,

F. Colosimo and F. De Rango, “Median-krum: A joint distance- statistical based byzantine-robust algorithm in federated learning,” in Proceedings of the Int’l ACM Symposium on Mobility Management and Wireless Access, 2023, pp. 61–68

work page 2023

[5] [4]

Communication-efficient learning of deep networks from decentral- ized data,

B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentral- ized data,” in Artificial intelligence and statistics . PMLR, 2017, pp. 1273–1282

2017

[6] [5]

Byzantine-robust feder- ated learning through collaborative malicious gradient filtering,

J. Xu, S.-L. Huang, L. Song, and T. Lan, “Byzantine-robust feder- ated learning through collaborative malicious gradient filtering,” in 2022 IEEE 42nd International Conference on Distributed Computing Systems (ICDCS). IEEE, 2022, pp. 1223–1235

work page 2022

[7] [6]

Fast and scalable private genotype imputation us- ing machine learning and partially homomorphic encryption,

E. Sarkar, E. Chielle, G. G ¨ursoy, O. Mazonka, M. Gerstein, and M. Maniatakos, “Fast and scalable private genotype imputation us- ing machine learning and partially homomorphic encryption,” IEEE access, vol. 9, pp. 93 097–93 110, 2021

work page 2021

[8] [7]

Fast additive partially homo- morphic encryption from the approximate common divisor problem,

E. L. Cominetti and M. A. Simplicio, “Fast additive partially homo- morphic encryption from the approximate common divisor problem,” IEEE Transactions on Information Forensics and Security , vol. 15, pp. 2988–2998, 2020

work page 2020