Pith. sign in

REVIEW 3 major objections 5 minor 43 references

This paper claims the first secure aggregation protocol for federated averaging that is both privacy-preserving and robust to fully Byzantine aggregators in asynchronous networks, using replicated coordinators, verifiable shuffling, fair in

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

A new protocol enables differentially private federated averaging in asynchronous networks with fully Byzantine aggregators, using replicated servers, LWE masking, and verifiable cluster shuffling.

T0 review reviewed 2026-08-03 challenge →

load-bearing objection The paper has a genuinely novel combination and a real, load-bearing flaw: threshold SS does not prevent a Byzantine coordinator from requesting overlapping subsets and isolating individual updates, so the central privacy claim is not yet established. the 3 major comments →

arxiv 2601.04930 v2 pith:OAMJEI2E submitted 2026-01-08 cs.DC

Privacy-Preserving Federated Averaging with Byzantine Aggregators in Asynchronous Networks

Antonella Del Pozzo , Achille Desreumaux , Mathieu Gestin , Alexandre Rapetti , Sara Tucci-Piergiovanni This is my paper
classification cs.DC
keywords federated learningsecure aggregationByzantine aggregatorsasynchronous networksdifferential privacyverifiable shufflingclient inclusion fairnessthreshold signatures
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated learning needs secure aggregation so a server can average private model updates without seeing them, but prior protocols assume bounded message delays, require heavy client-to-client coordination, and fail if an aggregator crashes or misbehaves. This paper tries to remove all three restrictions at once. It proposes a protocol in which clients are divided into clusters coordinated by replicated aggregators; each client masks its update with lightweight lattice-based secret-shared masking and adds differential-privacy noise, and the aggregators collectively unmask only cluster-level sums. A deterministic verifiable shuffling reassigns clients to coordinators every round, and a fair-inclusion mechanism compensates slow clients, so no participant is systematically excluded and fast clients do not burn through their privacy budget. If the construction holds, privacy-preserving federated averaging can run in fully asynchronous, unreliable networks with per-client communication that scales only with the number of aggregators, and clients can verify the integrity of the global model through threshold signatures.

Core claim

The central claim is that secure aggregation for federated averaging can tolerate fully Byzantine aggregators in asynchronous networks without sacrificing privacy or liveness. The construction combines four elements: replicated aggregators (n_a ≥ 3t_a + 1) with clients partitioned into disjoint clusters; lightweight LWE-based masking, where each client secret-shares its mask among all aggregators so masks are removed only on sums of at least ρ updates; a deterministic shuffling that re-partitions clients each round using the round number as a public seed; and a fair inclusion mechanism that picks the ρ least-included clients, plus PING and UNIFICATION messages to decide when to stop waiting.

What carries the argument

The key machinery is a combination of a publicly verifiable, deterministic shuffling function Assign(τ) and a fair inclusion function Include(λ, S). Assign(τ) partitions clients into equal, disjoint clusters from a public hash of the round number, guaranteeing in expectation that every client is assigned to every aggregator equally often and preventing Byzantine coordinators from systematically excluding clients or intersecting aggregates to isolate individual updates. Include(λ, S) sorts a coordinator's responding clients by their historical inclusion count and returns the ρ least-included ones, which both equalizes participation and controls the DP noise via T = τ_max·ρ/k + Δ_max. Around t

Load-bearing premise

The load-bearing premise is that the inclusion mechanism yields a uniform (in expectation) client-participation distribution even when Byzantine aggregators choose which messages to forward; the paper offers only an experimental argument for this at Section 5.3, and the thresholds ExpectedVar, Δ_max, and secParam used by the Blaming function are never specified—if inclusion can be skewed, the privacy budget and the fairness guarantee collapse.

What would settle it

Run the Section 5.3 scenario with a Byzantine coordinator that drops PING messages from the slowest clients in its cluster before broadcasting UNIFICATION. If the coordinator can keep the variance of inclusion counts and the max gap Δ(λ) below the unspecified ExpectedVar and Δ_max thresholds while excluding a targeted client for many rounds, then the privacy budget T = τ_max·ρ/k + Δ_max is undercounted and the claimed (ε,δ)-DP guarantee fails. A simpler non-adversarial check: measure inclusion frequencies with honest aggregators under the stated gamma delay distributions; if any correct aggreg

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Federated averaging can keep its privacy guarantee even when aggregation servers halt, omit messages, or try to manipulate the model, as long as fewer than one third of the aggregators are Byzantine (n_a ≥ 3t_a + 1).
  • Clients need only one round of communication with a single coordinator per training round, eliminating the mutual dependencies and high message complexity of pairwise-mask secure aggregation.
  • Because each client is included in expectation only ρ/k of the time, privacy noise can be set by T = τ_max·ρ/k + Δ_max instead of τ_max, giving better model utility at the same differential-privacy budget; the experiments show convergence on MNIST where the baseline does not converge.
  • Verifiable shuffling plus threshold-signature certification provides an integrity check on the global model without running Byzantine consensus, so the protocol remains live under arbitrarily delayed messages.
  • Fair inclusion prevents fast clients from dominating the aggregate, which avoids both model bias under non-i.i.d. data and unequal privacy risk among clients.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The fairness and DP guarantees hinge on the inclusion distribution being uniform in expectation; the paper only demonstrates this experimentally at Section 5.3 and never specifies ExpectedVar, Δ_max, or secParam (Algorithm 7). An adversarial aggregator that can bias inclusion counts without tripping the blaming mechanism would violate the privacy budget T = τ_max·ρ/k + Δ_max, so the protocol needs
  • The certification mechanism produces a threshold-signature proof that at least one correct aggregator was involved at every aggregation step; the same certificate could serve as a public audit record for the provenance of a global model, which the paper does not discuss.
  • The 'wasted cluster' mechanism introduces a subtle incentive: a Byzantine aggregator can voluntarily declare itself wasted and skip its own intra-cluster aggregate, shifting the inter-cluster average toward the other coordinators' clusters. The random reshuffling bounds the damage in expectation, but the paper does not analyze this strategic dimension.
  • A natural next experiment is to measure inclusion-frequency variance under adversarial message-delay distributions, such as a coordinator that withholds PINGs from the slowest clients, to test whether the Blaming function can actually detect the manipulation it is designed to catch.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes a federated averaging protocol for asynchronous networks with replicated aggregators, claiming to tolerate fully Byzantine aggregators while preserving client privacy through LWE-based masking, secret sharing, differential privacy, deterministic client shuffling, a fair inclusion mechanism, and threshold-signature certification. The protocol removes client-to-client communication and avoids BFT consensus. The authors argue that their construction is the first secure aggregation primitive that is both privacy-preserving and robust to fully Byzantine behavior in asynchronous settings, and they provide MNIST experiments comparing convergence speed against FLDP.

Significance. The problem is well motivated: existing secure aggregation schemes assume synchrony, require inter-client coordination, and do not model Byzantine aggregators that halt or equivocate. If the construction were correct, it would close a genuine gap in the literature. The proposed architecture — replicated aggregators, verifiable shuffling, and an inclusion mechanism to reduce DP noise — contains interesting ideas, and the experimental evaluation suggests that the inclusion mechanism can mitigate delay-induced bias. However, the manuscript does not provide a formal security proof, and the core equivocation argument is flawed as written. The central privacy claim is therefore not established, and the stated strengths (first fully Byzantine-tolerant secure aggregation, no client-to-client communication, certified outputs) cannot be accepted on the basis of the current text.

major comments (3)
  1. [§5.2 and Algorithm 2 (lines 12–19)] The claim that threshold SS with n_a ≥ 3t_a+1 prevents equivocation is not supported by the protocol. In Algorithm 2, every correct aggregator responds to every SUM-SHARES request for any valid rho-subset S'_j, with no check that coordinator a_j has not already requested another subset in the same round. A Byzantine coordinator can request two rho-subsets S' and S'' differing in exactly one client, collect n_a−t_a sumShares from correct aggregators for each, reconstruct both cluster sums, and subtract to isolate a single noisy update. The threshold n_a−t_a only guarantees that at least one correct aggregator participates per reconstruction; it does not bound the number of reconstructions. The same gap affects §5.4: threshold signatures certify each aggregate independently, not the uniqueness of the subset. A non-equivocation mechanism (e.g., serving at most one SUM-SHARES request per coo
  2. [§5.3 (Inclusion and 'Impact of inclusion on budget')] The uniform-inclusion claim is load-bearing for both fairness and DP accounting, but it is not established. The text states 'We prove experimentally' that inclusion is uniform, yet no formal theorem and no inclusion-frequency data are shown. Algorithm 7's Blaming function depends on ExpectedVar, secParam, and Δmax, none of which are specified. The noise budget T = τmax·ρ/k + Δmax depends on the inclusion mechanism's uniformity; without a proof or empirical distribution of inclusion counts, the RDP accounting is not justified. A Byzantine aggregator that biases inclusion can invalidate the privacy budget. The authors need to provide a formal analysis of the inclusion distribution or, failing that, concrete histograms and explicit parameter values.
  3. [§5.2–§5.4 (general)] The paper lacks any formal security statement or end-to-end proof for the Byzantine aggregator model. The pivotal assertions — equivocation prevention, inclusion uniformity, and DP accounting under Byzantine coordinators — are argued informally ('equivocation is prevented without impacting the liveness'). Given the attack above, a rigorous threat model, a precise statement of the privacy guarantee, and a proof that the protocol satisfies it are necessary. The current text does not support the abstract's claim of 'the first secure aggregation primitive that is both privacy-preserving and robust to fully Byzantine behavior in asynchronous networks.'
minor comments (5)
  1. [§5.3] 'We prove experimentally' is a category error: experiments can provide evidence, not proof. Please rephrase and present the corresponding measurements.
  2. [Algorithm 2, line 14] The condition 'Wait until SUM-SHARES<τ, ⋆, ⋆, ⋆> is received from a_j' is underspecified. It is unclear whether this is a typo or a missing condition on the set identity.
  3. [Algorithm 1] There are formatting artifacts in the line numbers ('9 9', '12 12') and in several other places (e.g., 'whenTRAIN< τ,cW τ proposed >is received') that should be cleaned.
  4. [§4 and Algorithm 4] The text says clients are 'one-shot' and communication is client-to-aggregator only, but Algorithm 4 has clients send a separate PING message after their UPDATE. Clarify whether PING is considered part of the same round and how this is compatible with the one-shot description.
  5. [§6] The evaluation is limited to MNIST and a single baseline (FLDP). While informative, it does not compare against other secure-aggregation protocols or report inclusion-distribution statistics, which are needed to support the fairness and DP-budget claims.

Circularity Check

0 steps flagged

No significant circularity: the masking/SS/DP derivation is built on external primitives; the flagged gaps are correctness risks, not reductions of predictions to inputs.

full rationale

The paper's derivation chain is not circular. Client privacy is built from (i) LWE masking h_i = g̅_i + A·s_i + e_i, (ii) (n_a, n_a−t_a)-SS of s_i, and (iii) aggregator-side reconstruction of only the cluster-level mask sum; the cluster sum is unmasked once and the DP guarantee is the standard RDP Gaussian bound ε_max(α)=T·C²·α/(2σ²) with T=τ_max·ρ/k+Δ_max. No equation defines the predicted quantity in terms of itself: the DP budget is a parameter imported from the RDP mechanism (and cited to [37]), not fitted to the output it is used to predict. The only self-citation ([6], co-authored by Del Pozzo) appears in a list of blockchain-FL examples and is not load-bearing. Two rigour gaps are present but are correctness risks, not circularity: §5.3 asserts 'We prove experimentally that... the frequency at which clients are included is uniform' without a formal proof or specified thresholds (ExpectedVar, Δmax, secParam in Algorithm 7), and §5.2's equivocation argument ('Hence, as n_a ≥ 3t_a+1, equivocation is prevented') is incomplete because a Byzantine coordinator can request multiple ρ-subsets; neither statement reduces a claimed result to its own input by construction.

Axiom & Free-Parameter Ledger

3 free parameters · 6 axioms · 1 invented entities

The protocol's central claims (privacy, Byzantine tolerance, fairness, less noise) rest on a small set of stated distributed-system assumptions plus several under-specified parameters and one sketched cryptographic primitive. The most fragile entries are the unspecified Blaming thresholds (Δmax, ExpectedVar, secParam), which directly determine whether Byzantine aggregators can bias inclusion without detection, and the smooth/strong-convexity assumption that is inconsistent with the paper's own CNN experiments.

free parameters (3)
  • ρ (minimum aggregation size) = 64 or 128 in experiments
    Chosen by hand; sets the number of updates aggregated together and directly controls DP noise magnitude and cluster-size constraints (k > 2ρ). No closed-form selection rule is given.
  • Δmax (max allowed inclusion-count difference) = not specified
    Appears in Blaming (Algorithm 7) and in the noise budget T = τmax·ρ/k + Δmax (§5.3); the claimed privacy/utility trade-off depends on its value, but no value or derivation is provided.
  • ExpectedVar and secParam (blaming thresholds) = not specified
    Used in Blaming() to decide whether an aggregator is biasing inclusion; with no concrete formulas, correct aggregators may be blamed or Byzantine bias may evade detection.
axioms (6)
  • ad hoc to paper Each local objective F_ci is smooth and strongly convex
    Assumed in §4 to justify convergence without consensus ('The smoothness and strong convexity of the F functions allows all aggregators to converge...'), but the evaluation uses a non-convex CNN on MNIST, so the theoretical support does not cover the experiments.
  • domain assumption Reliable asynchronous network: messages sent by correct participants are eventually delivered and never lost
    Stated in §4; needed for the PING/UNIFICATION and SUM-SHARES phases to terminate. If messages can be lost, the protocol has no liveness guarantee.
  • domain assumption At most t_a of n_a aggregators are Byzantine with n_a ≥ 3t_a + 1; correct aggregators are honest-but-curious; at most t_c clients crash
    Stated in §4 and §5.1; used for equivocation prevention, threshold-signature certification, and the quorum-based reconstruction.
  • domain assumption Existence/instantiation of PVAHSS with homomorphic verification (Pedersen VSS + signed commitments)
    §5.4 sketches the construction ('we rather propose to use the Pedersen homomorphic verifiable SS scheme... and additionally homomorphic commitment schemes... signed by the actors'); no formal definition or security proof is provided.
  • domain assumption Intersecting quorums yield an n_c - t_c common core of participating clients when n_a > 3t_a
    Invoked in §5.3 with citation [25]; underpins the UNIFICATION phase that lets aggregators agree on which clients participated.
  • standard math Hardness of Learning With Errors for the public masking matrix A
    Inherited from FLDP [37] and stated in §2/§5.1; standard crypto hardness assumption, not introduced by this paper.
invented entities (1)
  • PVAHSS-based certification (threshold signature over homomorphic sums of PVAHSS proofs) no independent evidence
    purpose: Lets clients verify that the global model was computed according to protocol and that at least one correct aggregator certified each step, replacing consensus-based verification.
    Described only as a sketch in §5.4; no concrete instantiation, proof-of-security, or implementation is given.

reviewed 2026-08-03 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Privacy-Preserving Federated Averaging with Byzantine Aggregators in Asynchronous Networks." pith.science (2026). https://pith.science/paper/OAMJEI2E

@misc{pith2026260104930,
  author       = {Pith},
  title        = {Pith review of: Privacy-Preserving Federated Averaging with Byzantine Aggregators in Asynchronous Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OAMJEI2E}},
  note         = {Machine review of arXiv:2601.04930}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Federated Learning requires secure aggregation to prevent gradient leakage, yet existing protocols suffer from key limitations: they assume synchrony, require heavy peer-to-peer coordination, and do not tolerate aggregators that halt or omit messages. These constraints make current secure aggregation schemes impractical in large-scale, unreliable distributed settings.To overcome these limitations, we introduce a new secure aggregation protocol that operates in fully asynchronous networks, where messages may be arbitrarily delayed, and tolerates fully Byzantine aggregators that are capable of arbitrary deviations including premature halting. Our design combines several key mechanisms: clustering clients under verifiable coordinators, lightweight LWE-based masking (with masking components distributed across aggregators), and differential privacy applied to both intermediary and final aggregated models. We further propose verifiable shuffling of clients across clusters, which prevents any client from being systematically excluded by a Byzantine coordinator, and a fair inclusion mechanism that ensures the inclusion of straggling clients whose messages are late. The protocol eliminates all client-to-client communication, and its communication overhead scales only with the number of aggregators. It also ensures equal representation of clients across rounds, avoiding bias and preventing unbalanced privacy risks among clients. Overall, our protocol provides the first secure aggregation primitive that is both privacy-preserving and robust to fully Byzantine behavior in asynchronous networks, closing the gap between prior secure aggregation assumptions and real-world distributed systems.

Figures

Figures reproduced from arXiv: 2601.04930 by Achille Desreumaux, Alexandre Rapetti, Antonella Del Pozzo, Mathieu Gestin, Sara Tucci-Piergiovanni.

Figure 1
Figure 1. Figure 1: Overview of one training round in the proposed federated learning protocol. (1) Each [PITH_FULL_IMAGE:figures/full_fig_p009_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Communication flow for aggregator a1. The aggregator a1 waits for enough updates, then includes ρ out of k updates (1). It sends each share of the ρ updates to the concerned aggregators which aggregate the shares and produce a proof of non-tampering (2). Each aggregator sends back the aggregated shares and proofs to a1, which can verify the proof, reconstruct the mask, unmask the cluster-level aggregated u… view at source ↗
Figure 3
Figure 3. Figure 3: Privacy preserving update sharing: Aggregator shares its model with a client (1). The client first trains the received model on local data (2), then adds noise e τ i to the resulting update and masks it with s τ i (3). Shares are then produced using a (na, na − ta)-SS scheme (4). Those shares are then encrypted and sent to their recipient, using a1 as a proxy (5). Finally, aggregators receive their shares,… view at source ↗
Figure 4
Figure 4. Figure 4: (a) Accuracy progression over 300 rounds of aggregation with skewed datasets, where fast [PITH_FULL_IMAGE:figures/full_fig_p021_4.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

43 extracted references · 4 linked inside Pith

  1. [1]

    Deep Learning with Differential Privacy

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang. “Deep Learning with Differential Privacy”. In:CCS. 2016

    2016

  2. [2]

    Prio+: Privacy pre- serving aggregate statistics via boolean shares

    S. Addanki, K. Garbe, E. Jaffe, R. Ostrovsky, and A. Polychroniadou. “Prio+: Privacy pre- serving aggregate statistics via boolean shares”. In:International Conference on Security and Cryptography for Networks. Springer. 2022, pp. 516–539

    2022

  3. [3]

    Flchain: A blockchain for auditable federated learning with trust and incentive

    X. Bao, C. Su, Y. Xiong, W. Huang, and Y. Hu. “Flchain: A blockchain for auditable federated learning with trust and incentive”. In:BIGCOM. 2019

    2019

  4. [4]

    Secure single-server aggregation with (poly) logarithmic overhead

    J. H. Bell, K. A. Bonawitz, A. Gasc´ on, T. Lepoint, and M. Raykova. “Secure single-server aggregation with (poly) logarithmic overhead”. In:CCS. 2020

    2020

  5. [5]

    Asynchronous secure computation

    M. Ben-Or, R. Canetti, and O. Goldreich. “Asynchronous secure computation”. In:STOC. 1993

    1993

  6. [6]

    Fantastyc: Blockchain-based federated learning made secure and practical

    W. Boitier, A. Del Pozzo, ´A. Garc ´ ıa-P´ erez, S. Gazut, P. Jobic, A. Lemaire, E. Mahe, A. Mayoue, M. Perion, T. F. Rezende, et al. “Fantastyc: Blockchain-based federated learning made secure and practical”. In:SRDS. 2024

    2024

  7. [7]

    Practical Secure Aggregation for Privacy-Preserving Machine Learning

    K. Bonawitz, V. Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth. “Practical Secure Aggregation for Privacy-Preserving Machine Learning”. In: CCS. 2017

    2017

  8. [8]

    Lightweight, Maliciously Secure Verifiable Function Secret Sharing

    L. de Castro and A. Polychroniadou. “Lightweight, Maliciously Secure Verifiable Function Secret Sharing”. In:EUROCRYPT. 2022

    2022

  9. [9]

    Practical byzantine fault tolerance

    M. Castro, B. Liskov, et al. “Practical byzantine fault tolerance”. In:OsDI. 1999

    1999

  10. [10]

    Homomorphic Secret Sharing with Veri- fiable Evaluation

    A. R. Choudhuri, A. Goel, A. Hegde, and A. Jain. “Homomorphic Secret Sharing with Veri- fiable Evaluation”. In:Theory of Cryptography Conference. 2025

    2025

  11. [11]

    Prio: Private, robust, and scalable computation of aggre- gate statistics

    H. Corrigan-Gibbs and D. Boneh. “Prio: Private, robust, and scalable computation of aggre- gate statistics”. In:14th USENIX symposium on networked systems design and implementa- tion (NSDI 17). 2017, pp. 259–282

    2017

  12. [12]

    Cryp- toNets: applying neural networks to encrypted data with high throughput and accuracy

    N. Dowlin, R. Gilad-Bachrach, K. Laine, K. Lauter, M. Naehrig, and J. Wernsing. “Cryp- toNets: applying neural networks to encrypted data with high throughput and accuracy”. In: ICML’16. 2016

    2016

  13. [13]

    BEAT: Asynchronous BFT Made Practical

    S. Duan, M. K. Reiter, and H. Zhang. “BEAT: Asynchronous BFT Made Practical”. In:CCS ’18. 2018

    2018

  14. [14]

    Differential Privacy

    C. Dwork. “Differential Privacy”. In:Automata, Languages and Programming. 2006

    2006

  15. [15]

    van Elsloo, G

    T. van Elsloo, G. Patrini, and H. Ivey-Law.SEALion: a Framework for Neural Network Inference on Encrypted Data. 2019. arXiv:1904.12840

    Pith/arXiv arXiv 2019

  16. [16]

    Impossibility of Distributed Consensus with One Faulty Process

    M. J. Fischer, N. A. Lynch, and M. S. Paterson. “Impossibility of Distributed Consensus with One Faulty Process”. In:J. ACM(1985)

    1985

  17. [17]

    D. M. J. G., D. Solans, M. Heikkila, A. Vitaletti, N. Kourtellis, A. Anagnostopoulos, and I. Chatzigiannakis.Non-IID data in Federated Learning: A Survey with Taxonomy, Metrics, Methods, Frameworks and Future Directions. 2024. arXiv:2411.12377. 24

    Pith/arXiv arXiv 2024

  18. [18]

    Differential privacy and byzantine resilience in sgd: Do they add up?

    R. Guerraoui, N. Gupta, R. Pinot, S. Rouault, and J. Stephan. “Differential privacy and byzantine resilience in sgd: Do they add up?” In:Proceedings of the 2021 ACM Symposium on Principles of Distributed Computing. 2021, pp. 391–401

    2021

  19. [19]

    V eri fl: Communication- efficient and fast verifiable aggregation for federated learning

    X. Guo, Z. Liu, J. Li, J. Gao, B. Hou, C. Dong, and T. Baker. “V eri fl: Communication- efficient and fast verifiable aggregation for federated learning”. In:IEEE Transactions on Information Forensics and Security(2020)

    2020

  20. [20]

    G¨ urcan.Multi-Agent eXperimenter (MAX)

    ¨O. G¨ urcan.Multi-Agent eXperimenter (MAX). 2024. arXiv:2404.08398

    Pith/arXiv arXiv 2024

  21. [21]

    Cheater-identifiable homomorphic secret sharing for outsourcing computations

    Y. He and L. F. Zhang. “Cheater-identifiable homomorphic secret sharing for outsourcing computations”. In:Journal of Ambient Intelligence and Humanized Computing(2020)

    2020

  22. [22]

    An Enciphering Scheme Based on a Card Shuffle

    V. T. Hoang, B. Morris, and P. Rogaway. “An Enciphering Scheme Based on a Card Shuffle”. In:Advances in Cryptology. 2012

    2012

  23. [23]

    Constant-Size Commitments to Polynomials and Their Applications

    A. Kate, G. M. Zaverucha, and I. Goldberg. “Constant-Size Commitments to Polynomials and Their Applications”. In:ASIACRYPT. 2010

    2010

  24. [24]

    Blockchained on-device federated learning

    H. Kim, J. Park, M. Bennis, and S.-L. Kim. “Blockchained on-device federated learning”. In: IEEE Communications Letters(2019)

    2019

  25. [25]

    Byzantine quorum systems

    D. Malkhi and M. Reiter. “Byzantine quorum systems”. In:STOC. 1997

    1997

  26. [26]

    Communication- Efficient Learning of Deep Networks from Decentralized Data

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y. Arcas. “Communication- Efficient Learning of Deep Networks from Decentralized Data”. In:International Conference on Artificial Intelligence and Statistics

  27. [27]

    Collaborative learning as an agreement problem

    E.-M. El-Mhamdi, R. Guerraoui, A. Guirguis, L. N. Hoang, and S. Rouault. “Collaborative learning as an agreement problem”. In:arXiv preprint arXiv:2008.00742(2020)

    Pith/arXiv arXiv 2008

  28. [28]

    Genuinely distributed byzantine machine learning

    E.-M. El-Mhamdi, R. Guerraoui, A. Guirguis, L. N. Hoang, and S. Rouault. “Genuinely distributed byzantine machine learning”. In:PoDC. 2020

    2020

  29. [29]

    R´ enyi Differential Privacy

    I. Mironov. “R´ enyi Differential Privacy”. In:CSF. 2017

    2017

  30. [30]

    Non-Interactive and Information-Theoretic Secure Verifiable Secret Sharing

    T. P. Pedersen. “Non-Interactive and Information-Theoretic Secure Verifiable Secret Sharing”. In:Advances in Cryptology. 1992

    1992

  31. [31]

    Elsa: Secure aggregation for federated learning with malicious actors

    M. Rathee, C. Shen, S. Wagh, and R. A. Popa. “Elsa: Secure aggregation for federated learning with malicious actors”. In:2023 IEEE Symposium on Security and Privacy (SP). IEEE. 2023, pp. 1961–1979

    2023

  32. [32]

    On lattices, learning with errors, random linear codes, and cryptography

    O. Regev. “On lattices, learning with errors, random linear codes, and cryptography”. In: JACM(2009)

    2009

  33. [33]

    An accurate, scalable and verifiable protocol for fed- erated differentially private averaging

    C. Sabater, A. Bellet, and J. Ramon. “An accurate, scalable and verifiable protocol for fed- erated differentially private averaging”. In:Machine Learning(2022)

    2022

  34. [34]

    How to share a secret

    A. Shamir. “How to share a secret”. In:Commun. ACM(1979)

    1979

  35. [35]

    Biscotti: A blockchain system for private and secure federated learning

    M. Shayan, C. Fung, C. J. Yoon, and I. Beschastnikh. “Biscotti: A blockchain system for private and secure federated learning”. In:IEEE Transactions on Parallel and Distributed Systems(2020)

    2020

  36. [36]

    Practical threshold signatures

    V. Shoup. “Practical threshold signatures”. In:International conference on the theory and applications of cryptographic techniques. 2000. 25

    2000

  37. [37]

    Efficient Differentially Private Secure Aggregation for Federated Learning via Hardness of Learning with Errors

    T. Stevens, C. Skalka, C. Vincent, J. Ring, S. Clark, and J. Near. “Efficient Differentially Private Secure Aggregation for Federated Learning via Hardness of Learning with Errors”. In:USENIX Security. 2022

    2022

  38. [38]

    A flexible and scalable malicious secure aggregation protocol for federated learning

    J. Tang, H. Xu, M. Wang, T. Tang, C. Peng, and H. Liao. “A flexible and scalable malicious secure aggregation protocol for federated learning”. In:IEEE Transactions on Information Forensics and Security(2024)

    2024

  39. [39]

    Sum It Up: Verifiable Additive Homomorphic Secret Sharing

    G. Tsaloli and A. Mitrokotsa. “Sum It Up: Verifiable Additive Homomorphic Secret Sharing”. In:ICISC. 2020

    2020

  40. [40]

    VerifyNet: Secure and verifiable federated learn- ing

    G. Xu, H. Li, S. Liu, K. Yang, and X. Lin. “VerifyNet: Secure and verifiable federated learn- ing”. In:IEEE Transactions on Information Forensics and Security(2019)

    2019

  41. [41]

    Privacy risk in machine learning: Ana- lyzing the connection to overfitting

    S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha. “Privacy risk in machine learning: Ana- lyzing the connection to overfitting”. In:CSF. 2018

    2018

  42. [42]

    See through gradients: Image batch recovery via gradinversion

    H. Yin, A. Mallya, A. Vahdat, J. M. Alvarez, J. Kautz, and P. Molchanov. “See through gradients: Image batch recovery via gradinversion”. In:Conference on computer vision and pattern recognition. 2021

    2021

  43. [43]

    Deep leakage from gradients

    L. Zhu, Z. Liu, and S. Han. “Deep leakage from gradients”. In:Advances in neural information processing systems(2019). 26

    2019

This paper was first reviewed by deepseek-v4-flash on August 3, 2026.