Pith. sign in

REVIEW 3 major objections 5 minor 33 references

Masking-based secure aggregation can hide individual hospital EEG model updates from the server while still supporting federated training, at a measurable cost that grows with stronger consistency checks.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-31 15:06 UTC pith:TN3EFCNA

load-bearing objection Solid Flower integration and honest overhead comparison of known SecAgg variants on EEG silos; security strength is mostly design-level because dropout and server-equivocation paths were never exercised. the 3 major comments →

arxiv 2607.28191 v1 pith:TN3EFCNA submitted 2026-07-30 cs.CR cs.DCcs.LG

Secure Aggregation for Privacy-Preserving Federated Learning on Clinical EEG Data

Pouya Rajabi , Mohsen Toorani This is my paper
classification cs.CR cs.DCcs.LG
keywords secure aggregationfederated learningclinical EEGprivacy-preserving machine learningmasking protocolsdropout resilienceverifiable aggregationcross-silo healthcare
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Hospitals want to train shared EEG models together without shipping raw clinical recordings, but ordinary federated learning still exposes each site’s model update to the central server. This paper builds a practical secure-aggregation pipeline for that setting: clients clip and quantize their updates, hide them with self-masks and pairwise masks over a sparse neighbor graph, and recover from dropouts with threshold secret sharing so the server only learns the sum. It offers four variants—semi-honest, malicious, and each with an auxiliary-notary consistency check—plus an optional Bloom-filter record-linkage step for pre-training duplicate handling. On TUH EEG-derived data with 10, 40, and 70 simulated institutional clients, the secure variants stay compatible with learning; the semi-honest path is the cheapest secure option, while malicious safeguards and notary tags buy stronger consistency and integrity at higher compute, communication, and round time. A sympathetic reader cares because cross-silo clinical collaboration often stalls on update leakage and protocol trust, and the paper shows a concrete, implementable trade-off ladder rather than a single all-or-nothing crypto claim.

Core claim

Under the paper’s stated assumptions, graph-based masking secure aggregation hides individual client updates from the aggregation server in a Flower-based cross-silo EEG federated-learning pipeline, remains compatible with iterative training on TUH-derived data across 10–70 clients, and incurs overhead that rises from the semi-honest variant to malicious and auxiliary-notary variants as consistency and lightweight aggregate verification are added.

What carries the argument

Masking-based secure aggregation (graph-sparse SecAgg-style): each client uploads a clipped, quantized update plus a self-mask and pairwise neighbor masks that cancel in the sum; Shamir shares let the server strip masks after bounded dropout without learning any surviving client’s plaintext update. Malicious variants add Merkle key commitments, inclusion/ack signatures, and consistency checks; AN variants add public-randomness linear verification tags checked against the released aggregate.

Load-bearing premise

Privacy and integrity hold only if enough clients stay active for threshold recovery, the notary does not collude with the server, and the adversary is limited to server-side protocol inconsistency rather than malicious clients or full adaptive aggregate forgery.

What would settle it

Run the same EEG FL workload with intentional dropouts below the survival threshold, a colluding notary and server, or active server equivocation and forged active-set views, and check whether individual updates become recoverable or inconsistent aggregates still pass AN checks while accuracy and overhead claims break.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Cross-silo EEG consortia can choose a protection ladder: semi-honest SecAgg for lowest secure overhead, malicious plus notary when server consistency matters more than cost.
  • Individual institutional updates need not be visible to the aggregator for useful normal/abnormal EEG federated training in the reported regimes.
  • Sparse graph neighbor masking keeps secure aggregation communication bounded as client count grows to at least 70 simulated silos, unlike dense all-to-all masking.
  • Lightweight linear notary tags give clients a reject-the-round signal when the released aggregate disagrees with submitted tags, without changing accepted updates.
  • Record-linkage can be separated from training-time update protection via local Bloom filters when linkage attributes exist.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The accuracy drop as client count rises is driven mainly by thinner local partitions, so real multi-hospital deployments may need more data per silo or heterogeneity-aware training before secure aggregation is the binding constraint.
  • Because AN randomness is public before the server releases the aggregate, stronger verifiable aggregation (commit-then-challenge or commitment-based proofs) is a natural next hardening step the paper already flags as out of full scope.
  • Pairing this stack with differential privacy or robust aggregation would address the residual leakage from the final global model and poisoning risks the authors explicitly leave open.
  • The optional Bloom-filter linkage module’s real privacy/utility cost remains an empirical gap until a dataset with usable identifiers is used.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper presents a Flower-based privacy-preserving federated learning framework for clinical EEG data whose core mechanism is masking-based secure aggregation. It adapts graph-based SecAgg+ style neighbor masking with threshold secret sharing and dropout recovery, and extends it with local update clipping, malicious-setting consistency mechanisms (Merkle public-key commitments, inclusion/ack signatures), optional auxiliary-notary (AN) linear tag checks inspired by LVSA, and an optional Bloom-filter PPRL initialization module. Four protocol variants (semi-honest, malicious, and each with AN) plus baseline FL and classical SecAgg are evaluated in simulation on TUH EEG-derived normal/abnormal classification under 10/40/70-client configurations. The central claims are that, under stated non-collusion and threshold assumptions, the secure variants hide individual updates from the server; that they remain compatible with iterative FL training; and that semi-honest SecAgg has the lowest secure overhead while malicious and AN variants buy stronger consistency/integrity at higher computation, communication, and round-duration cost (Abstract; §3–§5; Table 5).

Significance. If the claims hold at the stated scope, the contribution is a solid systems integration rather than a new cryptographic primitive: a concrete cross-silo EEG FL pipeline that packages graph-based SecAgg, malicious-server consistency checks, and lightweight AN verification in Flower, with measured overhead up to 70 simulated clients. That is useful for applied healthcare FL and for workshop-level reproducibility of SecAgg+/LVSA-style designs on a real physiological modality. Strengths include detailed protocol tables (Tables 2–3), explicit threat-model scoping (§2, §5, Table 6), and a multi-variant overhead comparison (Table 5). The work does not claim new security proofs; privacy rests on standard masking/secret-sharing assumptions. Significance is therefore engineering and empirical, contingent on honest reporting of what was and was not stress-tested.

major comments (3)
  1. [§4 Table 4; Abstract; §5] §4 Table 4 and the Abstract/§5 integrity claims are misaligned with the evaluation. Table 4 states that no intentional client dropouts, active server equivocation, forged active-set views, or malicious-client behavior were injected. Yet the distinguishing machinery of Π1–Π4—Shamir recovery of bi vs sk1_i (§3.1, Eqs. 9–11; Tables 2–3 recovery steps), acknowledgment threshold p=t before share release (§3.2), Merkle commitments and inclusion/ack signatures (§3.2), and AN checks (§3.3, Eqs. 14–18)—exists precisely for dropout and inconsistent-server cases. Under full honest participation, pairwise masks cancel and recovery paths that must not reconstruct both bi and sk1_i for a surviving client are unexercised. Table 5 therefore supports ordered benign-run overhead, not that “malicious and auxiliary-notary variants offer stronger consistency, integrity, and lightweight verification” under th
  2. [§4 Table 5; Figure 5] Table 5 omits accuracy for Baseline and basic SecAgg (“—”), and §4 acknowledges that fixed file-to-client partitions and identical seeds were not enforced across variants. The claim that secure variants “remain compatible with federated model training” is only weakly supported for the proposed variants’ own accuracies (e.g., ~79% at 10 clients, declining at 40/70 as data per client shrinks; Figure 5). Without retained baseline/SecAgg accuracy under matched partitions, one cannot separate protocol effects from partition/run randomness, nor show that masking, quantization (sQ=2^22, M=2^32), or clipping (τ=0.75) did not materially harm learning relative to unprotected FedAvg. Please re-run or recover matched-partition accuracies for all protocols, or qualify the compatibility claim to “proposed secure variants alone trained to non-trivial accuracy under this pipeline,” and report variabilit
  3. [§3.3; Abstract; Table 1] §3.3 and Eq. (18): the paper correctly notes that public ρr before aggregate release yields only lightweight consistency checking, not full adaptive malicious-output protection, and that AN tags may leak limited linear information. This limitation should be reflected more consistently in the Abstract and contribution bullets, which currently group AN with “stronger consistency, integrity, and lightweight verification support” alongside malicious-setting safeguards. Clarify in the front matter that AN is a non-colluding auxiliary consistency layer with public randomness (not a substitute for commit-then-challenge verifiable aggregation), and that Π2’s malicious mechanisms address server equivocation/recovery abuse after honest setup—not end-to-end malicious-output security.
minor comments (5)
  1. [§3.4] The optional Bloom-filter PPRL module is described in §3.4 and Figures 2–4 but explicitly not evaluated (no linkage attributes in TUH). Consider moving most of §3.4 to an appendix or marking it more clearly as future/optional so the main narrative matches the experiments.
  2. [§4; Table 5; Figure 6] §4 notes cases where logged semi-honest server time exceeds malicious server time and attributes this to “implementation-level logging effects.” That undermines interpretability of the Server column in Table 5; either fix instrumentation or de-emphasize per-component server times in favor of Round and Comm., which are more robust.
  3. [§3.1–§3.2] Notation: A1, A′2, etc. are introduced carefully, but the jump between undirected NG(i) in Π1 and directed Nout/Nin in Π2 could use a short clarifying sentence when Table 1 is first referenced.
  4. [§6 Table 7] Related work Table 7 is helpful; a one-line row note on whether each prior system was evaluated on medical/EEG data would sharpen the positioning versus healthcare FL papers cited in §6.
  5. [Abstract; §4] Minor prose: “auxiliary-notary-based verifiability” is used interchangeably with “lightweight consistency checking”—prefer the latter in results text to match §3.3’s own caveat.

Circularity Check

0 steps flagged

No circularity: engineering evaluation of known SecAgg constructions; measured overhead/accuracy are not forced by inputs.

full rationale

This paper is a systems/engineering integration and empirical evaluation, not a first-principles derivation that could collapse into its inputs. The core mechanisms (pairwise/self masks, graph-based SecAgg+, Shamir recovery, Merkle commitments, AN linear tags) are explicitly adapted from external prior work (Bonawitz et al., Bell et al. SecAgg+, Li et al. LVSA) and implemented in Flower; the paper does not claim to derive those constructions from EEG data or from fitted parameters. Empirical claims in §4/Table 5 (runtime, communication, accuracy under 10/40/70 clients) are logged measurements under stated protocol parameters, not quantities defined to equal fitted inputs. Privacy/integrity statements are scoped as holding under explicit non-collusion and threshold assumptions (§2, §5, Table 6), not as predictions forced by construction. There is no self-definitional loop, no fitted-parameter-as-prediction, no load-bearing self-citation uniqueness theorem, and no renaming of a known empirical law. Unexercised adversarial paths (no injected dropouts/equivocation) are an evaluation-scope limitation, not circularity. Score 0 is appropriate.

Axiom & Free-Parameter Ledger

5 free parameters · 5 axioms · 2 invented entities

Load-bearing content is mostly standard FL/crypto assumptions plus engineering parameter choices. Central privacy claims inherit classical masking correctness and non-collusion; empirical claims inherit simulation and logging choices. No new physical entities; the auxiliary notary is an architectural role borrowed from prior verifiable aggregation.

free parameters (5)
  • graph degree k and reconstruction threshold t = k∈{5,9,11}, t∈{3,5,6}
    Chosen per client scale (k=5/9/11, t=3/5/6) to bound communication while enabling recovery; directly affects overhead and dropout tolerance.
  • clipping bound τ = 0.75
    Hand-set L2 clip before quantization/masking; affects update scale and modular wraparound margin.
  • quantization scale sQ and modulus M = sQ=2^22, M=2^32
    Implementation domain choices for integer masking; must keep aggregate magnitude below M/2.
  • AN verification vector count v = v=5
    Controls number of linear consistency checks and tag communication cost.
  • dropout tolerance δ and max aggregation weight = δ=0.1; weight 256 (10 clients) / 64 (40/70)
    Abort thresholds and weighting caps chosen for experiments; shape when rounds succeed.
axioms (5)
  • domain assumption Masking-based secure aggregation reveals only the sum over surviving clients when pairwise/self masks cancel or are correctly reconstructed and the server (and AN, when used) follow non-collusion assumptions.
    Inherited from Bonawitz/Bell-style SecAgg; stated in §2–§3 and Table 6 as the basis for individual-update privacy.
  • domain assumption Enough clients remain active and enough neighbor shares are available to meet threshold t; otherwise the protocol aborts.
    Explicit in protocol abort conditions and dropout-resilience limits (§3.1, Table 6).
  • domain assumption Auxiliary notary is independent of the server and public verification randomness yields only lightweight aggregate-consistency evidence, not full adaptive malicious-output security.
    Stated in §3.3; tags may leak limited linear information.
  • ad hoc to paper Malicious setting is limited to server equivocation/active-set/recovery abuse after honest setup registration; malicious clients, poisoning, and Byzantine learning are out of scope.
    Threat model §2 and §5 narrow 'malicious' relative to full FL adversarial models.
  • standard math Standard cryptographic primitives (KA, PRG, Shamir, AEAD, signatures, Merkle commitments) behave correctly.
    Used throughout protocol construction without re-proof.
invented entities (2)
  • Auxiliary notary (AN) role in this Flower EEG pipeline no independent evidence
    purpose: Aggregate linear verification tags and enable clients to check consistency of the server-released sum.
    Adapted from LVSA-style auxiliary verification rather than a new cryptographic object; no independent evidence beyond the paper’s design choice.
  • Optional Bloom-filter PPRL initialization module in the same framework no independent evidence
    purpose: Privacy-preserving duplicate/record linkage before training.
    Standard PPRL technique wired as pre-training step; not empirically evaluated on TUH because linkage attributes are absent.

pith-pipeline@v1.2.0-daily-grok45 · 27802 in / 3546 out tokens · 69707 ms · 2026-07-31T15:06:55.901528+00:00 · methodology

0 comments
read the original abstract

Federated learning enables multiple institutions to train shared models without exchanging raw clinical EEG data, but it does not fully prevent privacy leakage from individual model updates. This paper presents a privacy-preserving federated learning framework for clinical EEG data using masking-based secure aggregation as the core protection mechanism. The framework combines graph-based communication, threshold secret sharing, dropout-resilient aggregation, local update clipping, an optional Bloom filter-based privacy-preserving record-linkage initialization module, and auxiliary-notary-based verifiability. It supports both semi-honest and malicious aggregation settings and is implemented using the Flower federated learning framework. The secure-aggregation variants are evaluated in a simulated cross-silo healthcare setting using TUH EEG-derived data under different client configurations. Under the stated assumptions, the secure variants hide individual updates from the aggregation server. The results show that these variants remain compatible with federated model training, although malicious-setting safeguards and lightweight consistency-checking mechanisms introduce additional computation, communication, and round-duration overhead. The semi-honest variant provides the lowest overhead among the secure configurations, while malicious and auxiliary-notary variants offer stronger consistency, integrity, and lightweight verification support at higher cost.

Figures

Figures reproduced from arXiv: 2607.28191 by Mohsen Toorani, Pouya Rajabi.

Figure 1
Figure 1. Figure 1: Cross-silo federated learning system model. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: High-level architecture of the proposed framework. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Protocol flow for the semi-honest secure aggregation variants ( [PITH_FULL_IMAGE:figures/full_fig_p014_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Protocol flow for the malicious-setting aggregation variants ( [PITH_FULL_IMAGE:figures/full_fig_p015_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Distributed evaluation accuracy across 10-client, 40-client, and 70-client configurations for the [PITH_FULL_IMAGE:figures/full_fig_p019_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Secure-aggregation runtime overhead for the proposed protocols [PITH_FULL_IMAGE:figures/full_fig_p019_6.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

33 extracted references · 2 linked inside Pith

  1. [1]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” inProceedings of the 20th International Conference on Artificial Intelligence and Statistics, AISTATS 2017, 20-22 April 2017, Fort Lauderdale, FL, USA (A. Singh and X. J. Zhu, eds.), vol. 54 ofProceedings of Machine ...

    2017

  2. [2]

    Efficient federated learning for distributed neuroimaging data,

    B. Thapaliya, R. Ohib, E. Geenjaar, J. Liu, V . D. Calhoun, and S. M. Plis, “Efficient federated learning for distributed neuroimaging data,”Frontiers in Neuroinformatics, vol. 18, 2024

    2024

  3. [3]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” inAdvances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 24 2019, December 8-14, 2019, Vancouver, BC, Canada(H. M. Wallach, H. Larochelle, A. Beygelzimer, F. d’Alché-Buc, E. B. Fox, and R. Garnett, eds.), pp. 14747–14756, 2019

    2019

  4. [4]

    Fed-esd: Federated learning for efficient epileptic seizure detection in the fog-assisted internet of medical things,

    W. Ding, M. Abdel-Basset, H. Hawash, S. Abdel-Razek, and C. Liu, “Fed-esd: Federated learning for efficient epileptic seizure detection in the fog-assisted internet of medical things,”Inf. Sci., vol. 630, pp. 403–419, 2023

    2023

  5. [5]

    Practical secure aggregation for privacy-preserving machine learning,

    K. A. Bonawitz, V . Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, “Practical secure aggregation for privacy-preserving machine learning,” inProceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, October 30 - November 03, 2017(B. Thuraisingham, D. Evan...

    2017

  6. [6]

    Lightsecagg: a lightweight and versatile design for secure aggregation in federated learning,

    J. So, C. J. Nolet, C. Yang, S. Li, Q. Yu, R. E. Ali, B. Guler, and S. Avestimehr, “Lightsecagg: a lightweight and versatile design for secure aggregation in federated learning,” inProceedings of the Fifth Conference on Machine Learning and Systems, MLSys 2022, Santa Clara, CA, USA, August 29 - September 1, 2022(D. Marculescu, Y . Chi, and C. Wu, eds.), m...

    2022

  7. [7]

    Secure single-server aggregation with (poly)logarithmic overhead,

    J. H. Bell, K. A. Bonawitz, A. Gascón, T. Lepoint, and M. Raykova, “Secure single-server aggregation with (poly)logarithmic overhead,” inCCS ’20: 2020 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event, USA, November 9-13, 2020(J. Ligatti, X. Ou, J. Katz, and G. Vigna, eds.), pp. 1253–1269, ACM, 2020

    2020

  8. [8]

    Privacy-preserving record linkage using bloom filters,

    R. Schnell, T. Bachteler, and J. Reiher, “Privacy-preserving record linkage using bloom filters,”BMC Medical Informatics Decis. Mak., vol. 9, p. 41, 2009

    2009

  9. [9]

    Privacy-preserving record linkage for big data: Current approaches and research challenges,

    D. Vatsalan, Z. Sehili, P. Christen, and E. Rahm, “Privacy-preserving record linkage for big data: Current approaches and research challenges,” inHandbook of Big Data Technologies(A. Y . Zomaya and S. Sakr, eds.), pp. 851–895, Springer, 2017

    2017

  10. [10]

    Flower: A friendly federated learning research framework,

    D. J. Beutel, T. Topal, A. Mathur, X. Qiu, T. Parcollet, and N. D. Lane, “Flower: A friendly federated learning research framework,”CoRR, vol. abs/2007.14390, 2020

    Pith/arXiv arXiv 2007

  11. [11]

    Temple University Hospital EEG Corpus (TUH EEG),

    I. Obeid and J. Picone, “Temple University Hospital EEG Corpus (TUH EEG),” 2016. Accessed: 2025-09-09

    2016

  12. [12]

    The temple university hospital eeg data corpus,

    I. Obeid and J. Picone, “The temple university hospital eeg data corpus,”Frontiers in neuroscience, vol. 10, p. 196, 2016

    2016

  13. [13]

    LVSA: lightweight and verifiable secure aggregation for federated learning,

    G. Li, Z. Zhang, and R. Du, “LVSA: lightweight and verifiable secure aggregation for federated learning,” Neurocomputing, vol. 648, p. 130712, 2025

    2025

  14. [14]

    The future of digital health with federated learning,

    N. Rieke, J. Hancox, W. Li, F. Milletarì, H. R. Roth, S. Albarqouni, S. Bakas, M. N. Galtier, B. A. Landman, K. H. Maier-Hein, S. Ourselin, M. J. Sheller, R. M. Summers, A. Trask, D. Xu, M. Baust, and M. J. Cardoso, “The future of digital health with federated learning,”npj Digit. Medicine, vol. 3, 2020. 25

    2020

  15. [15]

    Federated optimization in heterogeneous networks,

    T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V . Smith, “Federated optimization in heterogeneous networks,” inProceedings of the Third Conference on Machine Learning and Systems, MLSys 2020, Austin, TX, USA, March 2-4, 2020(I. S. Dhillon, D. S. Papailiopoulos, and V . Sze, eds.), mlsys.org, 2020

    2020

  16. [16]

    Fastsecagg: Scalable secure aggregation for privacy-preserving federated learning,

    S. Kadhe, N. Rajaraman, O. O. Koyluoglu, and K. Ramchandran, “Fastsecagg: Scalable secure aggregation for privacy-preserving federated learning,”CoRR, vol. abs/2009.11248, 2020

    Pith/arXiv arXiv 2009

  17. [17]

    SASH: efficient secure aggregation based on SHPRG for federated learning,

    Z. Liu, S. Chen, J. Ye, J. Fan, H. Li, and X. Li, “SASH: efficient secure aggregation based on SHPRG for federated learning,” inUncertainty in Artificial Intelligence, Proceedings of the Thirty-Eighth Conference on Uncertainty in Artificial Intelligence, UAI 2022, 1-5 August 2022, Eindhoven, The Netherlands(J. Cussens and K. Zhang, eds.), vol. 180 ofProce...

    2022

  18. [18]

    Codedpaddedfl and codedsecagg: Straggler mitigation and secure aggregation in federated learning,

    R. Schlegel, S. Kumar, E. Rosnes, and A. G. i Amat, “Codedpaddedfl and codedsecagg: Straggler mitigation and secure aggregation in federated learning,”IEEE Trans. Commun., vol. 71, no. 4, pp. 2013–2027, 2023

    2013

  19. [19]

    Flamingo: Multi-round single-server secure aggregation with applications to private federated learning,

    Y . Ma, J. Woods, S. Angel, A. Polychroniadou, and T. Rabin, “Flamingo: Multi-round single-server secure aggregation with applications to private federated learning,” in44th IEEE Symposium on Security and Privacy, SP 2023, San Francisco, CA, USA, May 21-25, 2023, pp. 477–496, IEEE, 2023

    2023

  20. [20]

    Dealsecagg: Efficient dealer-assisted secure aggregation for federated learning,

    J. Stock, H. Heitmann, J. N. Schug, and D. Demmler, “Dealsecagg: Efficient dealer-assisted secure aggregation for federated learning,” inProceedings of the 19th International Conference on Availability, Reliability and Security, ARES 2024, Vienna, Austria, 30 July 2024 - 2 August 2024, pp. 183:1–183:11, ACM, 2024

    2024

  21. [21]

    Eluding secure aggregation in federated learning via model inconsistency,

    D. Pasquini, D. Francati, and G. Ateniese, “Eluding secure aggregation in federated learning via model inconsistency,” inProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, CCS 2022, Los Angeles, CA, USA, November 7-11, 2022(H. Yin, A. Stavrou, C. Cremers, and E. Shi, eds.), pp. 2429–2443, ACM, 2022

    2022

  22. [22]

    ACORN: input validation for secure aggregation,

    J. Bell, A. Gascón, T. Lepoint, B. Li, S. Meiklejohn, M. Raykova, and C. Yun, “ACORN: input validation for secure aggregation,” in32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9-11, 2023(J. A. Calandrino and C. Troncoso, eds.), pp. 4805–4822, USENIX Association, 2023

    2023

  23. [23]

    Group verifiable secure aggregate federated learning based on secret sharing,

    S. Zhou, L. Wang, L. Chen, Y . Wang, and K. Yuan, “Group verifiable secure aggregate federated learning based on secret sharing,”Scientific Reports, vol. 15, no. 1, p. 9712, 2025

    2025

  24. [24]

    Efficient verifiable secure aggregation protocols for federated learning,

    B. Xu, S. Wang, and Y . Tian, “Efficient verifiable secure aggregation protocols for federated learning,” J. Inf. Secur. Appl., vol. 93, p. 104161, 2025

    2025

  25. [25]

    Efficient secure aggregation for privacy-preserving federated machine learning,

    R. Behnia, A. Riasi, R. Ebrahimi, S. S. M. Chow, B. Padmanabhan, and T. Hoang, “Efficient secure aggregation for privacy-preserving federated machine learning,” inAnnual Computer Security 26 Applications Conference, ACSAC 2024, Honolulu, HI, USA, December 9-13, 2024, pp. 778–793, IEEE, 2024

    2024

  26. [26]

    Encrypted federated learning for secure decentralized collaboration in cancer image analysis,

    D. Truhn, S. T. Arasteh, O. L. Saldanha, G. Müller-Franzes, F. Khader, P. Quirke, N. P. West, R. Gray, G. G. A. Hutchins, J. A. James, M. B. Loughrey, M. Salto-Tellez, H. Brenner, A. Brobeil, T. Yuan, J. Chang-Claude, M. Hoffmeister, S. Foersch, T. Han, S. Keil, M. Schulze-Hagen, P. Isfort, P. Bruners, G. Kaissis, C. Kuhl, S. Nebelung, and J. N. Kather, “...

    2024

  27. [27]

    A federated learning architecture for secure and private neuroimaging analysis,

    D. Stripelis, U. Gupta, H. Saleem, N. J. Dhinagar, T. Ghai, C. Anastasiou, R. Sanchez, G. V . Steeg, S. Ravi, M. Naveed, P. M. Thompson, and J. L. Ambite, “A federated learning architecture for secure and private neuroimaging analysis,”Patterns, vol. 5, no. 8, p. 101031, 2024

    2024

  28. [28]

    Uldp-fl: Federated learning with across silo user-level differential privacy,

    F. Kato, L. Xiong, S. Takagi, Y . Cao, and M. Yoshikawa, “Uldp-fl: Federated learning with across silo user-level differential privacy,”Proc. VLDB Endow., vol. 17, no. 11, pp. 2826–2839, 2024

    2024

  29. [29]

    Secure federated learning for alzheimer’s disease detection,

    A. Mitrovska, P. Safari, K. Ritter, B. Shariati, and J. K. Fischer, “Secure federated learning for alzheimer’s disease detection,”Frontiers in aging neuroscience, vol. 16, p. 1324032, 2024

    2024

  30. [30]

    Robust and secure aggregation scheme for federated learning,

    W. Tang, J. Li, C. Dong, Y . Miao, Q. Li, N. Li, S. Deng, and S. Ji, “Robust and secure aggregation scheme for federated learning,”IEEE Internet Things J., vol. 12, no. 8, pp. 9701–9715, 2025

    2025

  31. [31]

    Robust privacy-preserving aggregation against poisoning attacks for secure distributed data fusion,

    C. Huang, Y . Yao, and X. Zhang, “Robust privacy-preserving aggregation against poisoning attacks for secure distributed data fusion,”Inf. Fusion, vol. 122, p. 103223, 2025

    2025

  32. [32]

    Federated learning for privacy-preserving severity classification in healthcare: A secure edge-aggregated approach,

    A. Maurya, R. Haripriya, M. Pandey, J. Choudhary, D. P. Singh, S. Solanki, and D. Sharma, “Federated learning for privacy-preserving severity classification in healthcare: A secure edge-aggregated approach,” IEEE Access, vol. 13, pp. 102339–102358, 2025

    2025

  33. [33]

    Secure aggregation for federated learning in flower,

    K. H. Li, P. P. B. de Gusmão, D. J. Beutel, and N. D. Lane, “Secure aggregation for federated learning in flower,” inDistributedML ’21: Proceedings of the 2nd ACM International Workshop on Distributed Machine Learning, Virtual Event / Munich, Germany, 7 December 2021, pp. 8–14, ACM, 2021. 27

    2021