Pith. sign in

REVIEW 4 major objections 5 minor 50 references

Setup Once, Secure Always: A Single-Setup Secure Federated Learning Aggregation Protocol with Forward and Backward Secrecy for Dynamic Users

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A single setup phase is enough to run secure aggregation for every round of federated learning, the paper argues, while letting users join and leave freely and preserving forward and backward secrecy, at about 1% of the user-side cost of…

desk verdict Useful engineering advance with a plausible protocol and big measured speedups; the proofs and the 'first' claims need work before the strong statements stand. read the letter →

arxiv 2502.08989 v4 pith:2QLNB4O2 submitted 2025-02-13 cs.CR cs.AI

Nazatul Haque Sultan , Yan Bo , Yansong Gao , Seyit Camtepe , Arash Mahboubi , Hang Thanh Bui , Aufeef Chauhan , Hamed Aboutorab
show 5 more authors
Michael Bewong Dineshkumar Singh Praveen Gauravaram Rafiqul Islam Sharif Abuadbba
This is my paper · ORCID
classification cs.CRcs.AI
keywords secureaggregationfederatedlearningsingle-setupprotocolforwardsecrecybackwardmodelinconsistencyattackkeynegationdynamicuserparticipation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes a secure aggregation protocol for federated learning that needs only a one-time setup for an entire training run. Its central claim is that this single-setup design can still support users joining and leaving at any round, tolerate dropouts, and provide forward and backward secrecy — meaning that if a user's long-term signing key or one round's masks are compromised, past and future model updates stay hidden. The protocol masks each user's update with fresh random values arranged in a cycle so that the masks cancel exactly when the pieces are summed, and it adds a lightweight MAC-based check that lets users detect a malicious server that tries to send different global models to different users. Measured against e-SeaFL, the paper reports up to 99% lower user-side computation with competitive model accuracy. If the claims hold, this removes the per-round setup overhead that has made secure aggregation costly in large-scale federated learning.

What carries the argument

The load-bearing object is the key-negation cycle. Each participating user splits her update $x$ into $n$ equal shares, one for each intermediate server plus the aggregator, and masks the share for entity $j$ as $x/n + k_j - k_{j-1}$ modulo $q$, where the $k$'s are fresh random vectors chosen per user per round and indexed cyclically around the set of servers. Because every $k_j$ appears once with a plus sign and once with a minus sign across the $n$ shares, summing all shares cancels every key and yields exactly the sum of the users' updates. Dropout handling rests on the common active user list $I = A \cap \{F_j\}$, the intersection of the participant lists collected by every intermediate server and the aggregator, and model-inconsistency detection rests on forwarding the aggregator's MAC of the global model through every server so that users can compare the values they receive.

What would settle it

Compromise a user's device after some training round $T$ and inspect whether any stored long-term key or pseudo-random-function seed can regenerate the masks used in earlier or later rounds; the paper's forward- and backward-secrecy claim predicts that only per-round ephemeral randomness exists.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that single-setup secure aggregation need not sacrifice forward or backward secrecy: earlier single-setup protocols derive every round's mask deterministically from a long-term seed, so compromising the seed exposes all rounds, whereas this protocol masks every round with fresh, independent randomness and cancels the masks through a cyclic key-negation structure across intermediate servers and the aggregator. The result is a protocol that the paper claims is the first single-setup secure aggregation protocol to support dynamic user participation and the first to achieve both forward and backward secrecy, while keeping user-side computation near the e-SeaFL baseline's cost. The paper also claims a MAC-based verification layer that detects model inconsistency attacks by a malicious aggregator, with formal security proofs under semi-honest and malicious adversarial models.

Load-bearing premise

The security guarantee requires that at least two users and at least one intermediate server are honest in every round, and the protocol aborts if any intermediate server goes offline; if the aggregator and all intermediate servers collude with all but one user, that user's plaintext update can be recovered by summing her masked shares.

Editorial extensions

If this is right

  • New users can join at any round with no re-keying, because users never establish pairwise secrets with each other.
  • A dropped user's contribution is excluded by intersecting per-server participant lists, with no secret-sharing reconstruction step.
  • Compromising a user's long-term signing key or one round's masks reveals nothing about other rounds, giving forward and backward secrecy.
  • User-side cost is a few thousand modular additions per round, about 99% less than e-SeaFL's user time in the paper's prototype.
  • The MAC-and-hash check gives each user a way to detect a malicious aggregator that sends different global models or participant lists to different users.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the central claim holds, the per-round mask independence suggests the protocol can be combined with per-round differential privacy noise without disturbing the key-negation algebra; the paper does not explore this.
  • The two-honest-users threshold is a deployment constraint the paper states but does not price in: cohorts of two users or fewer, common in two-silo cross-silo settings, get no privacy from this construction.
  • The 99% figure measures user-side CPU time in a Python prototype; end-to-end comparisons that include the extra communication round and MAC forwarding, or against an optimized C implementation of e-SeaFL, could narrow the reported gap.
  • Because the key-negation cycle only requires a commutative group operation, the masking structure extends to weighted aggregation by folding per-user weights into the shares; this generalization is left implicit.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a single-setup secure aggregation protocol for federated learning that uses additive symmetric homomorphic encryption with a key-negation technique, intermediate servers for partial aggregation, a common active-user list to handle dropouts, and a MAC-based mechanism to detect model-inconsistency attacks. The authors claim the protocol is the first single-setup protocol to support dynamic user participation and to achieve both forward and backward secrecy, and they report up to 99% user-side computation reduction versus e-SeaFL, along with accuracy results on MNIST and CIFAR-10. The manuscript includes an implemented prototype, open-source links, and theorems for semi-honest and malicious models with proofs in appendices.

Significance. If the protocol and its claimed properties hold, this is a useful contribution to secure aggregation for cross-device FL: it avoids per-round setup and per-element PRF evaluations, supports dynamic user joins/leaves through fresh per-round masks, and provides a concrete mechanism for detecting model inconsistency. The empirical speedups are large and the open-source implementation is a strength. However, the significance currently rests on two things that need attention: the novelty claim with respect to prior edge-assisted protocols (notably RaSA, which is cited but not compared) and the rigor of the formal security proofs, which are presented as sketches rather than complete arguments.

major comments (4)
  1. [Section 1 and Section 2, Tables 1 and 2] The central novelty claim that this is "the first single-setup secure aggregation protocol to support dynamic user participation" and "the first single-setup secure aggregation protocol to achieve both forward and backward secrecy" is not supported against RaSA [35], which the paper itself cites in Section 1 as a "similar approach involving edge or intermediate servers." RaSA is absent from Tables 1 and 2 and from the related-work comparison, and no argument is given for why it does not already provide dynamic-user support or forward/backward secrecy. Since these claims are load-bearing for the paper's significance, the authors must either include a direct comparison with RaSA and justify the "first" statements, or revise the novelty claims accordingly.
  2. [Section 7 and Appendices C-G] The formal security proof is not complete. Theorem 7.4's proof says it is "similar to that of Theorem 7.1," and Theorem 7.5's proof is a one-paragraph sketch. Appendix G, which is the central malicious-model proof, skips Hyb3 entirely, and Hyb1/Hyb2 argue indistinguishability using PRF security even though the protocol's masks are uniform random values chosen directly from Z_q, not PRF outputs. The proof also relies on an informal Random Oracle without a precise ideal functionality or a well-defined simulator. These gaps directly affect the paper's claim of "formal security proofs under both semi-honest and malicious adversarial models," and they need to be fixed with a proper hybrid argument or a complete simulation-based proof.
  3. [Section 6.1, Eq. (6), Eq. (8), and Figure 3] The masking algebra is presented inconsistently. Eq. (6) defines c_i = x_u + k_i, but the key-negation construction in Figure 2 and Figure 3 uses c_{i,j} = x_t/n + k_j - k_{j-1} for each entity j. More seriously, Eq. (8) states that (sum_{1<=i<=n} c_i)/n equals n*x_1 + n*x_2 + ... + n*x_u plus canceling key terms, and then claims this equals sum_{1<=u<=n} x_u. The left-hand side is divided by n while the right-hand side is not, and the intermediate expression is dimensionally inconsistent with the claimed result. The correctness of the protocol is central, so the derivation from the Figure 3 masking formula to the final aggregation sum needs to be rewritten cleanly and unambiguously.
  4. [Section 6.1, 'Forward and Backward secrecy' paragraph, and Section 5.3] The forward/backward secrecy argument is informal and relies on the statement that masks are "never reused and are not derived from any long-term secret." This is a reasonable intuition, but the paper does not formalize what compromise event is being protected against, does not define forward/backward secrecy in the security model, and does not state or prove that masks are securely erased after each round. If an adversary compromises a user's device and any stored past masks are still present, the claimed protection would not hold. The manuscript should either add a precise FS/BS definition and proof, or explicitly constrain the compromise model to long-term cryptographic keys only.
minor comments (5)
  1. [Table 3] The table header says "Running Time (ms)" but the text describes the e-SeaFL total user time as "approximately 194 million microseconds" and the values in the table are on the order of 1e8, not milliseconds. Please align the units between the table and the prose.
  2. [Section 6.1] The symbol n is used both for the number of entities in N (intermediate servers plus aggregator) and for the number of participating users in the sum over u; please distinguish these quantities to avoid ambiguity.
  3. [Figure 3 and Section 6.2] The letter A is used for the aggregator's active-user list and later appears as part of the verification tuple T, I, A; using separate symbols (e.g., L_Agg and A_ver) would improve readability.
  4. [Theorem 7.6 statement] The set notation in the theorem statement, including "x_{U\(C_c Ð C_f)}", contains a garbled union symbol and is hard to parse; please rewrite the notation and the statement of the theorem.
  5. [References [35]] RaSA [35] is mentioned in the introduction but is not discussed in Section 2 or included in the comparison tables; even if it is excluded from the novelty claim after revision, the related-work section should explain how it differs.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the protocol's derivations are self-contained, and the RaSA comparison gap is a novelty-support issue, not a circular reduction.

full rationale

The paper contains no circular derivation chain of the kind this pass targets. The protocol's masking and unmasking steps are built on the Castelluccia et al. symmetric homomorphic encryption scheme and a key-negation cycle; the cancellation is shown explicitly in Equation 8, where the per-node masks telescope to zero, leaving the sum of user updates. No parameter is fitted to data, no target quantity is defined in terms of the protocol's own output, and no load-bearing result is imported solely from the authors' prior work. The forward/backward secrecy claim follows directly from the design choice that each round uses fresh, independent random masks rather than PRFs derived from long-term seeds; this is a structural property, not a restatement of the conclusion. The security proofs reduce to standard one-time-pad, PRF, UF-CMA signature, and IND-CPA assumptions, with the honest-user and honest-intermediate-server thresholds stated explicitly as assumptions rather than derived properties. The efficiency and accuracy evaluations compare against e-SeaFL and FedAvg externally, with no fitting step that would make the comparison circular. The skeptical observation that RaSA [35] is cited as a similar edge-assisted protocol but omitted from Tables 1 and 2 is a genuine completeness and novelty-verification concern; if RaSA already provides dynamic-user support or forward/backward secrecy, the paper's 'first' claims would be unsupported. That is a correctness and comparison gap, not a circularity, because the paper does not define its own contribution in terms of RaSA's absence or rely on a self-citation to rule RaSA out. The stated limitations about online intermediate servers and collusion assumptions are structural assumptions, and acknowledging them does not make the argument circular. Overall, the derivation chain is self-contained and the circularity score is 0.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The protocol introduces no new cryptographic entity; intermediate servers are inherited from e-SeaFL and Flamingo's assistant-node architecture. The central claim rests on the honesty, liveness, channel, and PKI assumptions listed above, plus the external one-time-pad encryption primitive. No parameters are fitted to data; threshold, intermediate-server count, and quantization precision are hand-set design choices that affect the reported efficiency and accuracy.

free parameters (3)
  • participation threshold t = unspecified integer between 2 and m
    Chosen by the deployment to trade availability against privacy; larger t means more users must be active for a round to proceed. Not fitted to data, but a hand-set parameter of the protocol.
  • number of intermediate servers d = 5 in the experiments
    Architectural parameter set by the deployment; user communication and computation grow as O(d times |v|), so the reported 99% speedup depends on this choice.
  • fixed-point quantization precision = not specified
    The accuracy gap versus FedAvg is attributed to integer encoding of floating-point updates, but the paper does not specify the number of bits or rounding rule used in the MNIST and CIFAR-10 experiments.
assumptions (5)
  • domain assumption At least two users and at least one intermediate server remain honest in every round
    Section 5.2. If all intermediate servers collude with the aggregator, all masked shares of a user are available to the adversary and the user's update can be recovered by summation; the protocol does not protect against this.
  • domain assumption Intermediate servers and the aggregator remain online throughout training
    Section 5.3 and the conclusion. The protocol aborts if an intermediate server drops; the paper lists dynamic intermediate servers as future work.
  • domain assumption Private, authenticated channels exist between users, intermediate servers, and the aggregator
    Section 5.3. These channels keep masked shares from non-recipient entities and support signature-based authentication in the malicious model.
  • domain assumption A PKI provides each entity with a UF-CMA-secure signature key pair and the proofs use the random oracle model
    Sections 4.2 and 7.2. The malicious-model protocol and proofs rely on UF-CMA signatures and a random oracle for the summation functionality.
  • standard math Castelluccia et al.'s additive symmetric homomorphic encryption is IND-CPA when keys are random and never reused
    Section 4.1 invokes the external result from reference [3]; the key negation construction inherits its security properties.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Setup Once, Secure Always: A Single-Setup Secure Federated Learning Aggregation Protocol with Forward and Backward Secrecy for Dynamic Users." pith.science (2026). https://pith.science/paper/2QLNB4O2

@misc{pith2026250208989,
  author       = {Pith},
  title        = {Pith review of: Setup Once, Secure Always: A Single-Setup Secure Federated Learning Aggregation Protocol with Forward and Backward Secrecy for Dynamic Users},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2QLNB4O2}},
  note         = {Machine review of arXiv:2502.08989}
}
abstract

Federated Learning (FL) enables multiple users to collaboratively train a machine learning model without sharing raw data, making it suitable for privacy-sensitive applications. However, local model or weight updates can still leak sensitive information. Secure aggregation protocols mitigate this risk by ensuring that only the aggregated updates are revealed. Among these, single-setup protocols, where key generation and exchange occur only once, are the most efficient due to reduced communication and computation overhead. However, existing single-setup protocols often lack support for dynamic user participation and do not provide strong privacy guarantees such as forward and backward secrecy. \par In this paper, we present a novel secure aggregation protocol that requires only a single setup for the entire FL training. Our protocol supports dynamic user participation, tolerates dropouts, and achieves both forward and backward secrecy. It leverages lightweight symmetric homomorphic encryption with a key negation technique to mask updates efficiently, eliminating the need for user-to-user communication. To defend against model inconsistency attacks, we introduce a low-overhead verification mechanism using message authentication codes (MACs). We provide formal security proofs under both semi-honest and malicious adversarial models and implement a full prototype. Experimental results show that our protocol reduces user-side computation by up to $99\%$ compared to state-of-the-art protocols like e-SeaFL (ACSAC'24), while maintaining competitive model accuracy. These features make our protocol highly practical for real-world FL deployments, especially on resource-constrained devices.

Figures

Figures reproduced from arXiv: 2502.08989 by the authors.

Figure 1
Figure 1. System Architecture the corresponding aggregated secret keys, as shown in Equation 4. ∑︁ 1≤𝑖≤𝑛 𝑚𝑖 =DecÍ 1≤𝑖≤𝑛 𝑘𝑖 ∑︁ 1≤𝑖≤𝑛 𝑐𝑖 ! (4) = ∑︁ 1≤𝑖≤𝑛 𝑐𝑖 − ∑︁ 1≤𝑖≤𝑛 𝑘𝑖 mod 𝑞. (5) The described symmetric homomorphic encryption scheme is se￾mantically secure (IND-CPA) if the secret keys ki, where 𝑖 ∈ {1, 2, · · · , 𝑛}, are generated randomly and no keys are reused. Please refer to [3] for detailed security proof. 4.2 Signature… view at source ↗
Figure 2
Figure 2. Sample Key Negation Mechanism 6 Our Proposed Protocol In this section, we provide a detailed explanation of our proposed protocol. We first present the technical intuition behind the protocol, followed by a description of its main construction. 6.1 Technical Intuition Our protocol has three main entities: users, intermediate servers, and the aggregator, as described in Section 5.1. Users mask their lo￾cally trained … view at source ↗
Figure 3
Figure 3. Detailed Description of Our Proposed Secure Aggregation Protocol [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (6 more)
Figure 2
Figure 2. Figure 2: Each node, labeled 𝑐𝑖 , represents a masked model for the 𝑖 𝑡ℎ entity in N, where 𝑐𝑖 = Enc(ki−ki+1 ) (𝑥𝑢) = 𝑥𝑢 + ki − ki+1 mod 𝑞. A directed arrow from node 𝑐𝑖 to node 𝑐𝑖+1 signifies the negation of key 𝑘𝑖+1 during the aggregation of masked models 𝑐𝑖 and 𝑐𝑖+1, as descr…
Figure 4
Figure 4. Figure 4: Average Running Time of Intermediate Server and Aggregator in the Semi-Honest Model per Round [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 5
Figure 5. Figure 5: Average Running Time of Intermediate Server and Aggregator in the Malicious Model per Round [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: Average Running Time of Intermediate Server and Aggregator in the Semi-Honest Model per Round [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: Average Running Time of Intermediate Server and Aggregator in the Malicious Model per Round [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]
Figure 8
Figure 8. Figure 8: Accuracy Comparison Between Our Protocol and Baseline FedAvg [28] [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

50 extracted references · 40 canonical work pages

  1. [35]

    L. Wang, M. Huang, Z. Zhang, M. Li, J. Wang, and K. Gai. 2025. RaSA: Robust and Adaptive Secure Aggregation for Edge-Assisted Hierarchical Federated Learning. IEEE Transactions on Information Forensics and Security 20 (2025), 4280–4295. doi:10.1109/TIFS.2025.3559411

    work page arXiv 2025

  2. [1]

    Behnia, A

    R. Behnia, A. Riasi, R. Ebrahimi, S. S. M. Chow, B. Padmanabhan, and T. Hoang

    work page

  3. [2]

    J. H. Bell, K. A. Bonawitz, A. Gascón, T. Lepoint, and M. Raykova. 2020. Secure Single-Server Aggregation with (Poly)Logarithmic Overhead. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security (Virtual Event, USA) (CCS ’20). Association for Computing Machinery, New York, NY, USA, 1253–1269. doi:10.1145/3372297.3417885

    arXiv 2020

  4. [3]

    Castelluccia, A

    C. Castelluccia, A. C-F. Chan, E. Mykletun, and G. Tsudik. 2009. Efficient and provably secure aggregation of encrypted data in wireless sensor networks.ACM Trans. Sen. Netw.5, 3, Article 20 (Jun 2009), 36 pages. doi:10.1145/1525856.1525858

    work page arXiv 2009

  5. [4]

    Privacy-Preserving Stream Aggregation with Fault Tolerance

    T. H. H. Chan, E. Shi, and D. Song. 2012. "Privacy-Preserving Stream Aggregation with Fault Tolerance". In Financial Cryptography and Data Security . 200–214

    work page 2012

  6. [5]

    Chen et al

    J. Chen et al. 2024. When Federated Learning Meets Privacy-Preserving Compu- tation. ACM Comput. Surv. (July 2024). doi:10.1145/3679013

    doi:10.1145/3679013 2024

  7. [6]

    Eltaras, F

    T. Eltaras, F. Sabry, W. Labda, K. Alzoubi, and Q. Ahmedeltaras. 2023. Efficient Verifiable Protocol for Privacy-Preserving Aggregation in Federated Learning. IEEE Transactions on Information Forensics and Security 18 (2023), 2977–2990. doi:10.1109/TIFS.2023.3273914

    work page arXiv 2023

  8. [7]

    Fereidooni et al

    H. Fereidooni et al. 2021. SAFELearn: Secure Aggregation for private FEderated Learning. In 2021 IEEE Security and Privacy Workshops (SPW) . 56–62. doi:10.1109/ SPW53761.2021.00017

    arXiv 2021

Show all 50 references
  1. [8]

    Bonawitz et al

    K. Bonawitz et al. 2017. Practical Secure Aggregation for Privacy-Preserving Machine Learning. InProceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (Dallas, Texas, USA) (CCS ’17). Association for Computing Machinery, New York, NY, USA, 1175–1...

    2017 doi

  2. [9]

    Sav et al

    S. Sav et al. 2021. POSEIDON: Privacy-Preserving Federated Neural Network Learning. In NDSS

    2021

  3. [10]

    Liu et al

    Z. Liu et al. 2024. Dynamic User Clustering for Efficient and Privacy-Preserving Federated Learning. IEEE Transactions on Dependable and Secure Computing 01 (Jan. 2024), 1–12

    2024

  4. [11]

    Fazli Khojir, D

    H. Fazli Khojir, D. Alhadidi, S. Rouhani, and N. Mohammed. 2023. FedShare: Secure Aggregation based on Additive Secret Sharing in Federated Learning. In Proceedings of the 27th International Database Engineered Applications Symposium (Heraklion, Crete, Greece) (IDEAS ’23). Ass...

    2023

  5. [12]

    Fu et al

    X. Fu et al. 2024. Blockchain-Based Efficiently Privacy-Preserving Federated Learning Framework Using Shamir Secret Sharing.IEEE Transactions on Consumer Electronics (2024), 1–1

    2024

  6. [13]

    Geiping, H

    J. Geiping, H. Bauermeister, H. Dröge, and M. Moeller. 2020. Inverting gradients - how easy is it to break privacy in federated learning?. In Proceedings of the 34th International Conference on Neural Information Processing Systems (NIPS ’20) . Article 1421, 11 pages

    2020

  7. [14]

    Mahoney, and Kurt Keutzer

    Amir Gholami, Sehoon Kim, Zhen Dong, Zhewei Yao, Michael W. Mahoney, and Kurt Keutzer. 2021. A survey of quantization methods for efficient neural network inference. arXiv preprint arXiv:2103.13630 (2021)

    2021 arXiv

  8. [15]

    Y. Guo, A. Polychroniadou, E. Shi, D. Byrd, and T. Balch. 2024. MicroSecAgg: Streamlined single-server secure aggregation. In Privacy Enhancing Technologies (PETS’24, Vol. 2024). 246–275

    2024

  9. [16]

    Guo et al

    X. Guo et al. 2021. VeriFL: Communication-Efficient and Fast Verifiable Aggre- gation for Federated Learning. IEEE Transactions on Information Forensics and Security 16 (2021), 1736–1751

    2021

  10. [17]

    Benoit Jacob, Skirmantas Kligys, Bo Chen, Menglong Zhu, Matthew Tang, Andrew Howard, Hartwig Adam, and Dmitry Kalenichenko. 2018. Quantization and training of neural networks for efficient integer-arithmetic-only inference. In CVPR. 2704–2713

    2018

  11. [18]

    J. Jeon, J. Kim, K. Lee, S. Oh, and J. Ok. 2024. Gradient inversion with genera- tive image prior. In Proceedings of the 35th International Conference on Neural Information Processing Systems (NIPS ’21) . Article 2288, 11 pages

    2024

  12. [19]

    Kadhe, N

    S. Kadhe, N. Rajaraman, O. O. Koyluoglu, and K. Ramchandran. 2020. Fast- SecAgg: Scalable Secure Aggregation for Privacy-Preserving Federated Learning. arXiv:2009.11248 [cs.CR] https://arxiv.org/abs/2009.11248

    2020 arXiv

  13. [20]

    Kairouz, Z

    P. Kairouz, Z. Liu, and T. Steinke. 2021. The Distributed Discrete Gaussian Mechanism for Federated Learning with Secure Aggregation. In Proceedings of the 2021 International Conference on Machine Learning (ICML’21)

    2021

  14. [21]

    Brian Knott, Mayank Varia, Sameer Wagh, and Shijie Yao. 2021. CrypTen: Secure multi-party computation meets machine learning. In NeurIPS

    2021

  15. [22]

    Krizhevsky, G

    A. Krizhevsky, G. Hinton, and V. Nair. 2009. Learning multiple layers of features from tiny images. Tech. Report. University of Toronto, Toronto, ON, Canada

    2009

  16. [23]

    Lecun, L

    Y. Lecun, L. Bottou, Y. Bengio, and P. Haffner. 1998. Gradient-based learning applied to document recognition. Proc. IEEE 86, 11 (1998), 2278–2324

    1998

  17. [24]

    Z. Liu, J. Guo, K. Y. Lam, and J. Zhao. 2023. Efficient Dropout-Resilient Aggrega- tion for Privacy-Preserving Machine Learning. IEEE Transactions on Information Forensics and Security 18 (2023), 1839–1854. doi:10.1109/TIFS.2022.3163592

    2023

  18. [25]

    Liu et al

    Z. Liu et al. 2022. Privacy-Preserving Aggregation in Federated Learning: A Survey. IEEE Transactions on Big Data (2022), 1–20

    2022

  19. [26]

    Y. Ma, J. Woods, S. Angel, A. Polychroniadou, and T. Rabin. 2023. Flamingo: Multi-Round Single-Server Secure Aggregation with Applications to Private Federated Learning. In 2023 IEEE Symposium on Security and Privacy (SP) . 477–

    2023

  20. [27]

    Ma et al

    Z. Ma et al. 2022. ShieldFL: Mitigating Model Poisoning Attacks in Privacy- Preserving Federated Learning. IEEE Transactions on Information Forensics and Security 17 (2022), 1639–1654

    2022

  21. [28]

    Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017. Communication-efficient learning of deep net- works from decentralized data. In Artificial Intelligence and Statistics (AISTATS). PMLR, 1273–1282

    2017

  22. [29]

    Payman Mohassel and Yupeng Zhang. 2017. SecureML: A system for scalable privacy-preserving machine learning. In IEEE Symposium on Security and Privacy (S&P). 19–38

    2017

  23. [30]

    Pasquini, D

    D. Pasquini, D. Francati, and G. Ateniese. 2022. Eluding Secure Aggregation in Fed- erated Learning via Model Inconsistency. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (CCS ’22) . 2429–2443

    2022

  24. [31]

    L. T. Phong et al. 2018. Privacy-Preserving Deep Learning via Additively Homo- morphic Encryption. IEEE Transactions on Information Forensics and Security 13, 5 (2018), 1333–1345

    2018

  25. [32]

    Ratnayake, L

    H. Ratnayake, L. Chen, and X. Ding. 2025. Privacy-preserving federated learning with intermediate-level model sharing. Expert Systems with Applications 291 (2025), 128483. doi:10.1016/j.eswa.2025.128483

    2025

  26. [33]

    J. So, B. Güler, and A. S. Avestimehr. 2021. Turbo-Aggregate: Breaking the Quadratic Aggregation Barrier in Secure Federated Learning. IEEE Journal on Selected Areas in Information Theory 2, 1 (2021), 479–489

    2021

  27. [34]

    So et al

    J. So et al. 2022. LightSecAgg: a Lightweight and Versatile Design for Secure Aggregation in Federated Learning. In Proceedings of Machine Learning and Systems, Vol. 4. 694–720

    2022

  28. [36]

    Y. Wang, Y. Tong, and D. Shi. 2020. Federated Latent Dirichlet Allocation: A Local Differential Privacy Based Framework. Proceedings of the AAAI Conference on Artificial Intelligence 34, 04 (Apr. 2020), 6283–6290. doi:10.1609/aaai.v34i04.6096

    2020 doi

  29. [37]

    Y. Wang, A. Zhang, S. Wu, and S. Yu. 2023. VOSA: Verifiable and Oblivious Secure Aggregation for Privacy-Preserving Federated Learning. IEEE Transactions on Dependable and Secure Computing 20, 5 (2023), 3601–3616. doi:10.1109/TDSC. 2022.3226508

    2023

  30. [38]

    S Wang et al. 2018. When Edge Meets Learning: Adaptive Control for Resource- Constrained Distributed Machine Learning. In IEEE INFOCOM 2018 - IEEE Con- ference on Computer Communications . 63–71

    2018

  31. [39]

    Wei et al

    K. Wei et al. 2020. Federated Learning With Differential Privacy: Algorithms and Performance Analysis. IEEE Transactions on Information Forensics and Security 15 (2020), 3454–3469

    2020

  32. [40]

    Wu and W

    J. Wu and W. Zhang. 2024. On the Security of Verifiable and Oblivious Secure Aggregation for Privacy-Preserving Federated Learning. IEEE Transactions on Dependable and Secure Computing 21, 5 (2024), 4324–4326. doi:10.1109/TDSC. 2024.3352170

    2024

  33. [41]

    Xu et al

    G. Xu et al. 2020. VerifyNet: Secure and Verifiable Federated Learning. IEEE Transactions on Information Forensics and Security 15 (2020), 911–926

    2020

  34. [42]

    S. Yang, Y. Chen, Z. Yang, B. Li, and H. Liu. 2023. Fast Secure Aggregation With High Dropout Resilience for Federated Learning. IEEE Transactions on Green Communications and Networking 7, 3 (2023), 1501–1514. doi:10.1109/TGCN.2023. 3277251

    2023 doi

  35. [43]

    X. Yin, Y. Zhu, and J. Hu. 2021. A Comprehensive Survey of Privacy-preserving Federated Learning: A Taxonomy, Review, and Future Directions. ACM Comput. Surv. 54, 6, Article 131 (Jul 2021), 36 pages

    2021

  36. [44]

    Zhang, R

    Y. Zhang, R. Behnia, A. A. Yavuz, R. Ebrahimi, and E. Bertino. 2024. Uncovering Attacks and Defenses in Secure Aggregation for Federated Deep Learning . In 2024 IEEE International Conference on Data Mining Workshops (ICDMW) . IEEE Computer Society, Los Alamitos, CA, USA, 650–6...

    2024

  37. [45]

    Zhang et al

    C. Zhang et al. 2020. BatchCrypt: efficient homomorphic encryption for cross- silo federated learning. In Proceedings of the 2020 USENIX Conference on Usenix Annual Technical Conference (USENIX ATC’20). Article 33, 14 pages

    2020

  38. [46]

    Chunyi Zhou, Yansong Gao, Anmin Fu, Kai Chen, Zhiyang Dai, Zhi Zhang, Minhui Xue, and Yuqing Zhang. 2023. PPA: Preference profiling attack against federated learning. In The Network and Distributed System Security Symposium (NDSS)

    2023

  39. [47]

    Zhou et al

    H. Zhou et al. 2022. PFLF: Privacy-Preserving Federated Learning Framework for Edge Computing. IEEE Transactions on Information Forensics and Security 17 (2022), 1905–1918

    2022

  40. [48]

    L. Zhu, Z. Liu, and S. Han. 2019. Deep Leakage from Gradients. In Advances in Neural Information Processing Systems , Vol. 32. Curran As- sociates, Inc. https://proceedings.neurips.cc/paper_files/paper/2019/file/ 60a6c4002cc7b29142def8871531281a-Paper.pdf A Detailed Analysis o...

    2019

  41. [496]

    doi:10.1109/SP46215.2023.10179434

    2023

  42. [2024]

    In Proceedings of the 2024 Annual Computer Security Applications Con- ference (ACSAC’24)

    Efficient Secure Aggregation for Privacy-Preserving Federated Machine Learning. In Proceedings of the 2024 Annual Computer Security Applications Con- ference (ACSAC’24)

    2024

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.