REVIEW 4 major objections 3 minor 27 references
EBS-CFL: Efficient and Byzantine-robust Secure Clustered Federated Learning
T0 review · 4 major / 3 minor · reviewed 2026-08-15 · deepseek-v4-flash
Pith's one-line read EBS-CFL lets a single server run Byzantine-robust clustered federated aggregation while clients' gradients and cluster identities stay confidential.
desk verdict Novel combination of secure aggregation, cluster-identity hiding, and Byzantine robustness, but the secure ReLU primitive has a concrete algebraic flaw that breaks the core aggregation claim. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing machinery is VOMCA (Verifiable Orthogonal Matrix Confusion for Aggregation), combined with the Secure ReLU Function Computation Mechanism (SRFC). VOMCA encodes secrets by multiplying them with mutually orthogonal matrices and adding random masks whose sums vanish, so single-client values are hidden while the aggregate decodes correctly; a verification key lets the server confirm that a client did not tamper with its ciphertext. SRFC lets the server compute the sum of ReLU of the cosine-similarity scores, effectively dropping negatively correlated gradients, while the underlying scores remain encrypted. Around these sit the RFCA algorithm and the compression scheme, gradient segmentation and layered aggregation, which keep per-client communication and computation independent of the total number of clients.
What would settle it
Run EBS-CFL with a deliberately poisoned or single-class root dataset $D_0$ while honest clients hold diverse data; if benign gradients receive negative cosine similarity to $g_0$ and are filtered out, while an adversary who trains on the poisoned $D_0$ passes the filter and raises attack success rate, then the robustness claim collapses. A second check would test cluster-identity privacy by having the server perform repeated aggregation queries with altered weights and measuring whether any cluster assignment information leaks through the decoded sums.
Extended reading notes
Core claim
The central claim is that a single honest-but-curious server can run Byzantine-robust clustered federated learning without ever seeing a client's plaintext gradient or its cluster assignment. Each client sends an encoded gradient of the form $$\delta_i = \frac{g_i}{\|g_i\|} A_j M'_i + \sum_{j=1}^m R''_{ij} A_j M'_{i+n} + \mu_i M'_{i+2n},$$ where $A_j$ picks the client's cluster, the $M'$ matrices are mutually orthogonal secret masks, and the random terms $R''_{ij},\mu_i$ sum to zero across clients. The server then uses a decoding key $dk'$ and the secure ReLU mechanism to compute, in Eq. (16), the cluster-wise weighted aggregate $$g = \left(\sum_i \delta_i\right) dk'^T,$$ with weights determined by cosine similarity to server-computed reference gradients $g_0$. Negative-correlation updates are discarded, and a norm check $\|\delta_i\|^2 = 3$ plus a verification key authenticates that the client encoded a normalized gradient. The paper claims this keeps gradients and cluster identities confidential, detects poisoned updates, authenticates correct encoding, and does so with client communication $O(ml + m^2)$ and computation $O(m^2l)$, independent of client count $n$.
Load-bearing premise
The load-bearing premise is that the server has a small, clean, representative public root dataset $D_0$ from which it can train trustworthy reference gradients $g_0$; if $D_0$ is unrepresentative, noisy, or poisoned, the cosine-similarity filter can misclassify honest gradients as malicious and let aligned attackers through.
Editorial extensions
If this is right
- Clients never reveal their cluster identity to the server, because the one-hot selector is buried inside the encoded gradient and only survives aggregation in decoded form.
- Updates that are negatively correlated with the server reference gradient are discarded by the secure ReLU computation, and positively correlated updates are weighted by similarity, which weakens label-flipping and scaling attacks.
- Per-client communication and computation stay flat as the client population grows, so the scheme scales to settings where earlier secure-aggregation protocols charged each client a cost that grew with $n$.
- The same secure-aggregation core is compatible with both FedAvg and IFCA-style clustered training, so adopting it does not force a switch of federated learning algorithm.
- Under strong-convexity and bounded-variance assumptions, the RFCA iterate contracts toward the optimum with high probability, matching the style of guarantee IFCA provides.
Reading between the lines
- The scheme's usefulness in practice depends on the server holding a trustworthy reference dataset; where no such clean public set exists, one could derive $g_0$ from a small trusted client subset, at the price of weakening the single-server trust model.
- Because the filter rewards alignment with $g_0$, a natural next attack is reference-aware poisoning that trains malicious updates to have high cosine similarity with the server's reference gradient; the paper does not evaluate this specific adversary.
- The secure ReLU primitive could generalize to other piecewise-linear functions of encrypted similarities, such as clipped ReLU or top-$k$ selection, which would let the same matrix-masking machinery implement other robust aggregation rules.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes EBS-CFL, a secure aggregation protocol for clustered federated learning that combines a Byzantine-robust clustering algorithm (RFCA), a matrix-based encoding scheme (VOMCA), a secure ReLU computation mechanism (SRFC), a key-transformation mechanism (SKT), and a compression scheme. The central claim is that a single server can compute a weighted robust cluster-wise aggregation from encoded client updates without learning client gradients or cluster identities, with per-client communication O(ml + m^2) and computation O(m^2 l). The manuscript includes convergence analysis, security theorems, and experiments on MNIST, CIFAR-10, and CIFAR-100.
Significance. If the algebraic and security claims were correct, this would be a valuable contribution: single-server secure aggregation for clustered federated learning with cluster-identity privacy and per-client complexity independent of the number of clients is an attractive combination, and the experimental evaluation is reasonably extensive, covering multiple Byzantine attacks and data-heterogeneity settings. The authors also include an honest discussion of the root-dataset dependency in the appendix. However, the central secure-ReLU primitive is algebraically incorrect, and the security proofs are informal; these issues are load-bearing and not fixable by local revision.
major comments (4)
- [Appendix, Proof of Theorem 2, Eq. (25)] Equation (25) is algebraically false under the paper's own definitions of F and F^{-1}. The claimed identity F^{-1}(x_i^2(M_i∘M_i) - R_i^{(1)}∘R_i^{(1)} + 2x_i M_i∘R_i^{(1)}) = |x_i|M_i + R_i^{(1)} does not hold. For a scalar instantiation satisfying Eq. (7), take x_i = -1, M_i = -1, R_i^{(1)} = 0.5, R_i^{(2)} = 0. The argument of the outer F^{-1} is 1 - 0.25 + 1 = 1.75, so F^{-1}(1.75) = sqrt(1.75) ≈ 1.323, while the claimed right-hand side is -1 + 0.5 = -0.5. The two sides are not equal. This is not a degenerate corner case: it is precisely the negative-input regime that the ReLU computation is designed to handle, and Eq. (7) explicitly permits negative M_i with nonzero R_i^{(1)}. Since Eq. (9) and Eq. (10) inherit this step, the server cannot compute Σ_i ReLU(w_i) or Σ_i E(ReLU(w_i)) as claimed, and the secure aggregation formula in Eq. (16) is unsupported. This is a load-bearing error in the central primitive.
- [Proof of Theorem 1] The proof of Theorem 1 equates Pr[V_i R^T = 0] with 1/λ^l, where λ is described as 'the probability of correctly predicting pseudo-random numbers without additional information.' This conflates a probability over the random matrix V_i with a probability over an adversary's guess R; no distribution over R or V_i is specified, and no reduction to a computational assumption is given. The claimed bound ε = 1/λ^l in Eq. (5) is therefore not established. Because Theorem 1 is the basis for the server's verification that clients cannot tamper with ciphertexts, the authentication guarantee is not proven.
- [SRFC and VOMCA definitions, Eqs. (2) and (6)] The dimensions in the orthogonality condition are inconsistent. Definition 1 requires M_i^T M_j = I for i = j, but in SRFC and the secure aggregation scheme the matrices M_i are stated as elements of R^{lm × 2lmn}; for M_i^T M_i = I_{2lmn} to hold, the rank of M_i would have to be 2lmn, which is impossible when lm < 2lmn. The same issue appears in VOMCA, where M_i ∈ R^{l × lm}. As written, the matrix products in Eqs. (6), (9), (12), and (16) are not all well-defined under the stated dimensions, so the algebraic claims cannot be checked without a corrected dimension specification.
- [Algorithm 2 and Eq. (1)] The Byzantine-robustness claim depends on the server's root dataset D_0 producing trusted updates g_0^j. Eq. (1) weights every client by alignment with these server updates, and Algorithm 2 initializes g_0^j from D_0 before any federated training. If D_0 is unrepresentative, noisy, or poisoned, the filter itself becomes the attack vector. The supplementary discussion explicitly concedes that a poorly chosen initialization makes benign gradients look poisonous and that convergence is tied to the selection of g_0. The security analysis does not formalize this trust assumption in any theorem, so the robustness guarantee is conditional on an assumption that is not modeled.
minor comments (3)
- [Security Analysis, Theorems 4-9] Several security theorems are informal narrative arguments rather than formal proofs; for example, Theorem 4 argues via 'countless rotations' in the real number field without an indistinguishability-based argument. The paper should either provide formal proofs or explicitly label these as heuristic security analyses.
- [SRFC definitions, F and F^{-1}] The notation for F and F^{-1} in the text is typeset in a confusing way (e.g., '((A)3ij/(|(A)ij|)'), which obscures the intended elementwise formulas; the definitions should be written cleanly with explicit subscripts.
- [Algorithm 2, steps 12-13] Algorithm 2 sends the one-hot vector and the plaintext gradient to the server, which conflicts with the privacy claims of the secure aggregation scheme; the relationship between this plaintext baseline and the secure protocol should be clarified so readers can see where privacy enforcement begins.
Circularity Check
No circular derivation found: EBS-CFL's claims are constructive, and its admitted g0 dependence is a limitation rather than a circularity.
full rationale
The claimed derivation chain is not circular in any of the enumerated senses. The central aggregation formula (Eq. 1) is a weighted average defined by cosine similarity with server-root updates; it is a design choice taken from FLTrust (Cao et al. 2021), an external cited work, and the clustering loop is IFCA (Ghosh et al. 2022), also external. The secure protocol encodes client gradients and cluster identities via orthogonal-matrix masks and claims (Eqs. 9, 16) that the server can compute the same weighted sum without seeing plaintexts; this is a homomorphic computation claim, not a definition of the output. The admitted dependence on the root dataset D0 (Supplementary Experiments: 'model convergence performance intrinsically tied to the selection of the server update g0') is a real limitation, but it is not a fitted parameter renamed as a prediction: D0 is an input to the algorithm, and robustness is measured by accuracy and attack-impact metrics rather than by the filter's own labels. The convergence theorem imports IFCA's assumptions and proof skeleton; no load-bearing self-citation appears, and no uniqueness theorem from the authors' prior work is invoked. The algebraic doubts about SRFC Eq. (25) are a correctness issue (possible sign inconsistency for negative inputs), not a circularity: a failed identity is not an identity assumed as its own conclusion. Accordingly, no circular step meets the evidentiary bar.
Assumptions & free parameters
free parameters (4)
- m (number of clusters) =
2 in most experiments, 1/4 in complexity analysis
- scaling factor ||g0|| in Eq. (1) =
multiplied by ||g0|| and later described as optionally absorbed into the learning rate
- segmentation size t (and number of segments s = l/t) =
not specified in experiments
- learning rate η =
dynamic in experiments
assumptions (4)
- domain assumption The server holds a clean public dataset D0 and can train trustworthy reference updates g0 from it.
- domain assumption Mutually orthogonal matrices of dimension R^{lm x 2lmn} exist and can be efficiently generated and kept secret.
- domain assumption Assumptions 1-5 from the convergence analysis (strong convexity, smoothness, bounded variance, and Gaussian weight distribution).
- domain assumption The random masks R_i, R''_ij, µ_i, and ζ_i are generated and distributed by a trusted KDC that does not collude with the server or clients.
invented entities (2)
-
Mutually orthogonal matrix families {M_i}, {M'_i}, {A_i}
-
SRFC secure ReLU computation
Cite this review
Pith. "Pith review of EBS-CFL: Efficient and Byzantine-robust Secure Clustered Federated Learning." pith.science (2026). https://pith.science/paper/JPRXDRTN
@misc{pith2026250613612,
author = {Pith},
title = {Pith review of: EBS-CFL: Efficient and Byzantine-robust Secure Clustered Federated Learning},
year = {2026},
howpublished = {\url{https://pith.science/paper/JPRXDRTN}},
note = {Machine review of arXiv:2506.13612}
}
read the original abstract
Despite federated learning (FL)'s potential in collaborative learning, its performance has deteriorated due to the data heterogeneity of distributed users. Recently, clustered federated learning (CFL) has emerged to address this challenge by partitioning users into clusters according to their similarity. However, CFL faces difficulties in training when users are unwilling to share their cluster identities due to privacy concerns. To address these issues, we present an innovative Efficient and Robust Secure Aggregation scheme for CFL, dubbed EBS-CFL. The proposed EBS-CFL supports effectively training CFL while maintaining users' cluster identity confidentially. Moreover, it detects potential poisonous attacks without compromising individual client gradients by discarding negatively correlated gradients and aggregating positively correlated ones using a weighted approach. The server also authenticates correct gradient encoding by clients. EBS-CFL has high efficiency with client-side overhead O(ml + m^2) for communication and O(m^2l) for computation, where m is the number of cluster identities, and l is the gradient size. When m = 1, EBS-CFL's computational efficiency of client is at least O(log n) times better than comparison schemes, where n is the number of clients.In addition, we validate the scheme through extensive experiments. Finally, we theoretically prove the scheme's security.
Figures
Figures from the paper (4 more)
Reference graph
Works this paper leans on
-
[1]
Biggio, B.; Nelson, B.; and Laskov, P. 2012. Poisoning Attacks against Support Vector Machines. In Proceedings of the 29th International Coference on International Conference on Machine Learning, ICML'12, 1467–1474. Madison, WI, USA: Omnipress. ISBN 9781450312851
work page 2012
-
[2]
M.; Guerraoui, R.; and Stainer, J
Blanchard, P.; El Mhamdi, E. M.; Guerraoui, R.; and Stainer, J. 2017. Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent. In Proceedings of the 31st International Conference on Neural Information Processing Systems, NIPS'17, 118–128. Red Hook, NY, USA: Curran Associates Inc. ISBN 9781510860964
work page 2017
-
[3]
A.; Ivanov, V.; Kreuter, B.; Marcedone, A.; McMahan, H
Bonawitz, K. A.; Ivanov, V.; Kreuter, B.; Marcedone, A.; McMahan, H. B.; Patel, S.; Ramage, D.; Segal, A.; and Seth, K. 2016. Practical Secure Aggregation for Federated Learning on User-Held Data. CoRR, abs/1611.04482
arXiv 2016
-
[4]
Cao, X.; Fang, M.; Liu, J.; and Gong, N. Z. 2021. FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping. In 28th Annual Network and Distributed System Security Symposium, NDSS 2021, virtually, February 21-25, 2021 . The Internet Society
work page 2021
-
[5]
Chen, W.-N.; Choo, C. A. C.; Kairouz, P.; and Suresh, A. T. 2022. The Fundamental Price of Secure Aggregation in Differentially Private Federated Learning. In Chaudhuri, K.; Jegelka, S.; Song, L.; Szepesvari, C.; Niu, G.; and Sabato, S., eds., Proceedings of the 39th International Conference on Machine Learning, volume 162 of Proceedings of Machine Learni...
work page 2022
-
[6]
Chen, W.-N.; Ozgur, A.; and Kairouz, P. 2022. The Poisson Binomial Mechanism for Unbiased Federated Learning with Secure Aggregation. In Chaudhuri, K.; Jegelka, S.; Song, L.; Szepesvari, C.; Niu, G.; and Sabato, S., eds., Proceedings of the 39th International Conference on Machine Learning, volume 162 of Proceedings of Machine Learning Research, 3490--3506. PMLR
work page 2022
-
[7]
Choi, B.; Sohn, J.; Han, D.; and Moon, J. 2020. Communication-Computation Efficient Secure Aggregation for Federated Learning. CoRR, abs/2012.05433
arXiv 2020
-
[8]
Deng, L. 2012. The mnist database of handwritten digit images for machine learning research. IEEE Signal Processing Magazine, 29(6): 141--142
2012
Show all 27 references
-
[9]
Fang, M.; Cao, X.; Jia, J.; and Gong, N. Z. 2020. Local Model Poisoning Attacks to Byzantine-Robust Federated Learning. In Capkun, S.; and Roesner, F., eds., 29th USENIX Security Symposium, USENIX Security 2020, August 12-14, 2020 , 1605--1622. USENIX Association
2020
-
[10]
Ghosh, A.; Chung, J.; Yin, D.; and Ramchandran, K. 2022. An Efficient Framework for Clustered Federated Learning. IEEE Trans. Inf. Theory , 68(12): 8076--8091
2022
-
[11]
H.; Qi, H.; and Brown, M
Hsu, T. H.; Qi, H.; and Brown, M. 2019. Measuring the Effects of Non-Identical Data Distribution for Federated Visual Classification. CoRR, abs/1909.06335
2019 arXiv
-
[12]
A.; Li, S.; and Caire, G
Jahani-Nezhad, T.; Maddah-Ali, M. A.; Li, S.; and Caire, G. 2023. SwiftAgg+: Achieving Asymptotically Optimal Communication Loads in Secure Aggregation for Federated Learning. IEEE Journal on Selected Areas in Communications, 41(4): 977--989
2023
-
[13]
O.; and Ramchandran, K
Kadhe, S.; Rajaraman, N.; Koyluoglu, O. O.; and Ramchandran, K. 2020. FastSecAgg: Scalable Secure Aggregation for Privacy-Preserving Federated Learning. CoRR, abs/2009.11248
2020 arXiv
-
[14]
Kasyap, H.; and Tripathy, S. 2024. Sine: Similarity is Not Enough for Mitigating Local Model Poisoning Attacks in Federated Learning. IEEE Transactions on Dependable and Secure Computing, 21(5): 4481--4494
2024
-
[15]
Krizhevsky, A.; and Hinton, G. 2009. Learning multiple layers of features from tiny images. Handbook of Systemic Autoimmune Diseases, 1(4)
2009
-
[16]
Liu, X.; Li, H.; Xu, G.; Chen, Z.; Huang, X.; and Lu, R. 2021. Privacy-Enhanced Federated Learning Against Poisoning Adversaries. IEEE Trans. Inf. Forensics Secur. , 16: 4574--4588
2021
-
[17]
McMahan, H.; Moore, E.; Ramage, D.; Hampson, S.; and Arcas, B. 2016. Communication-Efficient Learning of Deep Networks from Decentralized Data. arXiv: Learning,arXiv: Learning
2016
-
[18]
Sattler, F.; Müller, K.-R.; and Samek, W. 2021. Clustered Federated Learning: Model-Agnostic Distributed Multitask Optimization Under Privacy Constraints. IEEE Transactions on Neural Networks and Learning Systems, 32(8): 3710--3722
2021
-
[19]
Vahidian, S.; Morafah, M.; Wang, W.; Kungurtsev, V.; Chen, C.; Shah, M.; and Lin, B. 2023. Efficient Distribution Similarity Identification in Clustered Federated Learning via Principal Angles between Client Data Subspaces. In Williams, B.; Chen, Y.; and Neville, J., eds., Thi...
2023
-
[20]
Y.; Jin, H.; and He, Y
Wan, W.; Hu, S.; Lu, J.; Zhang, L. Y.; Jin, H.; and He, Y. 2022. Shielding Federated Learning: Robust Aggregation with Adaptive Client Selection. In Raedt, L. D., ed., Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, IJCAI 2022, Vienna...
2022
-
[21]
Yin, D.; Chen, Y.; Kannan, R.; and Bartlett, P. 2018. B yzantine-Robust Distributed Learning: Towards Optimal Statistical Rates. In Dy, J.; and Krause, A., eds., Proceedings of the 35th International Conference on Machine Learning, volume 80 of Proceedings of Machine Learning ...
2018
-
[22]
Zhang, Y.; Liu, D.; Duan, M.; Li, L.; Chen, X.; Ren, A.; Tan, Y.; and Wang, C. 2023 a . FedMDS: An Efficient Model Discrepancy-Aware Semi-Asynchronous Clustered Federated Learning Framework. IEEE Transactions on Parallel and Distributed Systems, 34(3): 1007--1019
2023
-
[23]
Zhang, Z.; Li, J.; Yu, S.; and Makaya, C. 2023 b . SAFELearning: Secure Aggregation in Federated Learning With Backdoor Detectability. IEEE Trans. Inf. Forensics Secur. , 18: 3289--3304
2023
-
[24]
Zheng, Y.; Lu, R.; Zhang, S.; Guan, Y.; Shao, J.; and Zhu, H. 2022. Toward Privacy-Preserving Healthcare Monitoring Based on Time-Series Activities Over Cloud. IEEE Internet of Things Journal, 9(2): 1276--1288
2022
-
[25]
Zhu, L.; Liu, Z.; and Han, S. 2019. Deep Leakage from Gradients. In Wallach, H.; Larochelle, H.; Beygelzimer, A.; d Alch\' e -Buc, F.; Fox, E.; and Garnett, R., eds., Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc
2019
-
[26]
, " * write output.state after.block = add.period write newline
ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all...
-
[27]
write newline
" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...
Reviewed August 15, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.