Pith. sign in

REVIEW 1 major objections 7 minor 62 references

Secure Decentralized Federated Learning via Gossip and Virtual Voting

T0 review · 1 major / 7 minor · reviewed 2026-07-10 · glm-5.2

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Gossip history itself can certify which FL updates are safe to aggregate

desk verdict Gossip-native consensus for DFL via Hashgraph-style virtual voting over model-origin tuples; convergence guarantee rests on an underrived mixing assumption. read the letter →

arxiv 2607.08651 v1 pith:AIIC5PEU submitted 2026-07-09 cs.LG cs.DC

Amirhossein Taherpour , Xiaodong Wang This is my paper
classification cs.LGcs.DC
keywords decentralizedfederatedlearninggossipprotocolByzantinefaulttolerancevirtualvotingdirectedacyclicgraphprovenancefinalityrobustaggregation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Decentralized federated learning (DFL) lets nodes train models collaboratively by exchanging updates only with direct neighbors, avoiding a central server. The problem is that without a server, no one can authoritatively say which updates are legitimate and which come from malicious or lazy participants. Prior solutions bolt on a blockchain, a shard, or a committee to provide that authority, but those mechanisms reintroduce the very coordination bottleneck that decentralization was supposed to eliminate. This paper proposes gspDAG-FL, a framework that derives consensus from the same gossip communication history that already disseminates the models. Nodes exchange model payloads purely with neighbors. In parallel, a subset of full nodes collects compact signed certificates and receiver-endorsed proofs from those gossip interactions, reconstructs a directed acyclic graph (DAG) of the communication topology, and runs Hashgraph-style virtual voting over that DAG. The consensus decision is not about whether all nodes hold identical model parameters; it is about which unique model-origin tuples (a binding of creator, epoch, genesis event, and model hash) have sufficient provenance to be eligible for aggregation. After consensus, each node privately audits certified models against a held-out validation set and aggregates only those that pass. The paper proves safety and conditional liveness of this control plane and gives a convergence guarantee for the resulting time-varying aggregation. Experiments on image classification and language modeling with up to 100 nodes show learning quality comparable to blockchain-assisted FL with better throughput and scalability.

What carries the argument

The Topology DAG reconstructed from signed event certificates and accepted gossip proofs, over which Hashgraph-style virtual voting determines locally confirmed origin tuples. Confirmation vectors are then exchanged among full nodes to achieve quorum finality. The origin tuple (creator, epoch, genesis event hash, model hash) is the unit of finality, not the model parameters themselves.

What would settle it

If certification and filtering systematically exclude nodes in poorly connected graph regions, the effective mixing matrix could become disconnected or its spectral gap could shrink toward zero, causing the disagreement factor to approach 1 and convergence to stall. This would be most likely under adversarial conditions where Byzantine nodes are concentrated in specific graph regions, causing those regions' updates to be rejected while well-connected regions' updates dominate.

Watch

Extended reading notes

Core claim

The central mechanism is the separation of the data plane from the control plane. The data plane carries model tensors on local neighbor-to-neighbor gossip paths; these tensors are never broadcast globally. The control plane carries only compact metadata: event certificates, send proofs, and receiver endorsements. Full nodes reconstruct a Topology DAG from this metadata and run virtual voting to infer which model-origin tuples are confirmed. This means the communication pattern that disseminates models is simultaneously the evidence from which consensus is derived, without requiring a separate ledger, block, shard, or committee to decide admission. The finality object is the model-origin tup

Load-bearing premise

The convergence guarantee depends on the assumption that the time-varying aggregation matrix induced by certification and filtering maintains a bounded disagreement factor below 1. This matrix changes every epoch based on which origins pass validation, which nodes observe them, and which survive semantic audit. The paper states this as an assumption but does not prove that the protocol's dynamics guarantee it; if certification and filtering systematically bias the matrix, for

Editorial extensions

If this is right

  • If the gossip-native consensus layer works as described, decentralized federated learning systems could achieve Byzantine resilience and auditability without the latency and throughput penalties of blockchain coordination, making secure DFL practical at larger scales.
  • The principle of deriving finality over provenance metadata rather than over model state could extend to other peer-to-peer learning settings where global state replication is too expensive, such as swarm learning or edge intelligence.
  • The multi-stage validation pipeline (magnitude, directional, semantic) provides a template for layered defense where no single filter is sufficient, and the separation of control-plane certification from data-plane transport could be adopted in other distributed systems that need provenance guarantees without global coordination.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The framework's scalability advantage over blockchain-assisted FL should widen as model sizes grow, since the control-plane metadata is fixed-size while blockchain systems must serialize or reference increasingly large model updates.
  • The effective mixing assumption could be tested empirically by measuring the spectral gap of the time-varying aggregation matrix under adversarial conditions and different graph topologies; if certification systematically excludes nodes in poorly connected regions, the assumption may fail in ways not captured by the paper's experiments.
  • The private semantic audit step creates a tension: it relies on each node having a clean held-out validation set, but if the reference model has already drifted due to prior aggregation of subtle attacks, the audit threshold may become unreliable. Studying the dynamics of reference poisoning under this protocol would clarify the boundary of the approach.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

1 major / 7 minor

Summary. The paper proposes gspDAG-FL, a decentralized federated learning (DFL) framework that derives consensus from gossip history rather than from a separate blockchain, shard, or committee layer. The key architectural idea is a separation of data and control planes: model tensors are exchanged only between one-hop neighbors, while full nodes collect compact event certificates and receiver-endorsed accepted gossip proofs, reconstruct a Topology DAG, and run Hashgraph-style virtual voting to certify provenance-admissible model-origin tuples. A multi-stage admission pipeline (payload validation, accepted-proof validation, private semantic audit) filters invalid updates before aggregation. The authors prove safety (quorum-intersection), virtual-voting consistency, conditional liveness, and a convergence guarantee under time-varying effective mixing. Experiments on MNIST and Penn Treebank with up to N=100 nodes compare against AD-PSGD, BLADE-FL, and ChainFL.

Significance. The paper addresses a genuine gap: existing gossip-based DFL methods lack provenance finality, while ledger-assisted FL reintroduces global coordination costs. Deriving consensus from the same gossip history used to disseminate models is a clean and well-motivated architectural contribution. The separation of finality over origin tuples (control plane) from local parameter states (data plane) is a useful design principle. The theoretical results are structurally sound: the consensus proofs follow standard BFT quorum-intersection arguments adapted to the Topology DAG, and the convergence analysis (Theorem 4) is a reasonable adaptation of standard DFL convergence theory to the time-varying aggregation setting. The experimental evaluation is fairly comprehensive, with multiple baselines, two tasks, and scaling up to N=100. The system implementation (extending the dagsim Hashgraph simulator with Ed25519 signatures, JGraphT DAG processing, and gRPC data/control channels) represents nontrivial engineering effort.

major comments (1)
  1. Theorem 4 (Sec. IV-D, Eq. 27): The convergence guarantee rests on the effective mixing condition E[||P W_eff_t||_F^2 | F_t] <= rho^2 < 1, where W_eff_t is the time-varying aggregation matrix induced by certified observed sets and post-audit weights. This assumption replaces the fixed doubly-stochastic matrix condition of standard DFL but is not derived from the protocol's own dynamics. The concern is structural: W_eff_t depends on which origin tuples pass payload validation (Sec. IV-C.1), which are certified by virtual voting (Sec. IV-A), and which survive semantic audit (Sec. IV-C.3). Each stage can systematically exclude nodes based on graph position—for instance, nodes in poorly connected regions of the Watts-Strogatz graph may have their origins observed by fewer peers, reducing certification probability. The semantic audit (Eq. 26) compares against a local reference theta^{t-1}_i, a
minor comments (7)
  1. Table IX: Latency and throughput values are normalized to each method's value at N=5. While this controls for hardware differences, absolute values (even for one method) would help readers assess practical deployability.
  2. Sec. III-A: The term 'Topology DAG' is introduced without a formal definition distinguishing it from the underlying communication graph G=(V,E). A brief sentence clarifying that the Topology DAG is a metadata-only structure reconstructed by full nodes would improve clarity.
  3. Sec. IV-A, Eqs. (21)-(22): The virtual voting definitions use M{e} and R{e} notation that is defined in the surrounding text but not in the equations themselves. Including the definitions inline or cross-referencing them more explicitly would aid readability.
  4. Sec. V-A.3: The convergence criterion (Eq. 30) uses a trimmed mean of node-local losses. The trimming percentage (10% from each end) is stated but the sensitivity of convergence declaration to this choice would be helpful.
  5. Table II: The 'Validation' column for AD-PSGD says 'none/local averaging' which is slightly ambiguous; clarifying that AD-PSGD performs no update admission control would be more precise.
  6. References [3], [14], [24], [25] are by the same authors. These are for related systems (ZK-HybridFL, SPID-Chain, HybridChain) and are contextually appropriate, but the authors should ensure each citation is necessary to the point being made.
  7. Fig. 2: The figure caption mentions 'Colors indicate moment values' but the figure appears in grayscale; clarifying the color-moment mapping or using labels for moment values would help.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity; self-citations are contextual, not load-bearing; convergence assumption is unverified but not circular

full rationale

The paper's central derivation chain is self-contained. The consensus safety proof (Theorem 1, Appendix B) uses a standard quorum-intersection argument: two termination certificates require overlapping signer sets of size ≥ ⌊2N_F/3⌋+1, whose intersection exceeds N_F/3 > B_F, forcing at least one control-correct node to have signed both—a contradiction. This is proven from first principles within the paper. Virtual voting consistency (Theorem 2) follows by induction on DAG structure (Lemma 1). Conditional liveness (Theorem 3) is explicitly conditional on delivery and readiness assumptions. The convergence guarantee (Theorem 4) assumes the effective mixing condition (Eq. 27) rather than deriving it from protocol dynamics—this is a modeling assumption that may or may not hold, but it is not circular: the assumption does not presuppose the conclusion. Proposition 2 (semantic separation) is a conditional sufficient condition: 'if the MAD threshold separates clean from Byzantine scores, then the audit separates them.' This is tautological in form but is presented as a sufficient condition, not as a derivation or prediction. The authors cite their own prior work ([3], [14], [24], [25]) for related systems context (ZK-HybridFL, SPID-Chain, HybridChain, coded blockchain), but none of these citations are invoked as load-bearing mathematical results that the present paper's proofs depend on. The proofs reference only standard assumptions (L-smoothness, bounded variance, bounded heterogeneity, doubly stochastic mixing) and the paper's own definitions. Score 2 reflects the presence of non-load-bearing self-citations and the tautological form of Proposition 2, neither of which undermines the independence of the main derivation chain.

Assumptions & free parameters 8 free parameters · 7 assumptions · 4 invented entities

The free parameters are mostly standard BFT thresholds and SGD hyperparameters. The two ad-hoc axioms (effective mixing condition and tracking error bound) are the load-bearing assumptions for the convergence theory; they are reasonable but unverified under the protocol's own dynamics. The invented entities (Topology DAG, origin tuples, accepted proofs, moment values) are protocol constructs with clear cryptographic grounding.

free parameters (8)
  • rho (disagreement factor bound)
    Assumed < 1 in Eq. 27 for the effective mixing matrix; not derived from protocol dynamics but stated as a condition for convergence.
  • Q (readiness threshold) = floor(2N/3)+1
    Set to 2/3 supermajority for termination; standard BFT threshold choice.
  • tau_N, tau_F (quorum sizes) = floor(2N/3)+1, floor(2N_F/3)+1
    Standard BFT quorum thresholds defined in Eq. 17.
  • epsilon_stale, epsilon_dir (validation thresholds)
    Used in payload validation (Eqs. 24-25) to reject stale or directionally inconsistent updates; specific values not stated.
  • lambda (proximal consensus pull) = 100
    Controls the primal-dual consensus pull in Eq. 7; set to 100 in simulations.
  • eta (learning rate) = 0.01
    Local SGD step size; set to 0.01 in simulations.
  • alpha_t_i_omega (aggregation weights) = 1 (uniform)
    Defined in Eq. 16 as general positive weights; simulations use uniform weighting.
  • R_max_t (ripple cap) = Q+2
    Maximum ripples per epoch; set to Q+2 in simulations.
assumptions (7)
  • domain assumption Authenticated communication channels with deterministic verification
    Invoked in Sec. IV-A and Theorem 1 for quorum-intersection safety; standard in BFT literature.
  • domain assumption Fewer than N_F/3 Byzantine full nodes and at most floor((N-1)/3) Byzantine nodes
    Stated in Sec. IV-A; standard BFT fault bound required for safety and liveness proofs.
  • ad hoc to paper Effective mixing condition: E[||P W_eff_t||_F^2 | F_t] <= rho^2 < 1
    Eq. 27; replaces fixed doubly-stochastic matrix condition of standard DFL with a bound on time-varying certified aggregation matrix; not derived from protocol dynamics.
  • domain assumption Learning-clean losses are L-smooth with bounded gradient variance and bounded heterogeneity
    Standard assumptions for decentralized SGD convergence; stated in Sec. II-B and invoked in Theorem 4.
  • ad hoc to paper Primal-dual tracking error bounded (Eq. 28)
    Bounds the stochastic gradient tracking error including primal-dual correction; condition for Theorem 4.
  • domain assumption Eventual delivery of valid control messages with bounded processing delay
    Invoked in Theorem 3 for conditional liveness; standard asynchronous system assumption.
  • domain assumption Connected control-correct gossip paths exist
    Invoked in Theorem 3; required for liveness under Byzantine faults.
invented entities (4)
  • Topology DAG independent evidence
    purpose: Compact directed acyclic graph reconstructed by full nodes from event certificates and accepted gossip proofs to represent communication history
    The DAG structure is verifiable from signed certificates; its construction is specified in Sec. III-A and its acyclicity follows from the ripple-index monotonicity of edges.
  • Model-origin tuple (omega) independent evidence
    purpose: Unique identifier for a model update consisting of (node, epoch, genesis event hash, model hash) over which finality is decided
    Defined in Eq. 15; finality over tuples rather than node IDs is a protocol design choice that prevents equivocation; its effectiveness is tested in simulations.
  • Accepted gossip proof (Pi) independent evidence
    purpose: Compact proof combining sender send-proof and receiver endorsement to certify that a gossip transmission occurred
    Defined in Sec. III-A; cryptographically verifiable via Ed25519 signatures; used to construct DAG edges.
  • Moment value (M{e}) independent evidence
    purpose: Integer assigned to events in the Topology DAG to determine voting eligibility and structure virtual voting rounds
    Defined in Eqs. 18-20; adapted from Hashgraph's strongly-see and famous-witness concepts; well-definedness proven in Lemma 1.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Secure Decentralized Federated Learning via Gossip and Virtual Voting." pith.science (2026). https://pith.science/paper/AIIC5PEU

@misc{pith2026260708651,
  author       = {Pith},
  title        = {Pith review of: Secure Decentralized Federated Learning via Gossip and Virtual Voting},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AIIC5PEU}},
  note         = {Machine review of arXiv:2607.08651}
}
abstract

Decentralized federated learning (DFL) removes the central server by letting nodes exchange model updates through peer-to-peer gossip, but existing gossip-based methods often lack provenance finality and resilience to Byzantine or lazy participants. Ledger-assisted federated learning (FL) improves auditability, yet blockchains, shards, or settlement committees can reintroduce global coordination costs that conflict with DFL locality. This paper proposes \emph{gspDAG-FL}, a secure DFL framework that derives consensus from the same gossip history used to disseminate models. Nodes exchange model payloads only with neighbors, while full nodes collect event certificates and receiver-endorsed accepted gossip proofs, reconstruct a compact Topology directed acyclic graph (DAG), and run Hashgraph-style virtual voting followed by compact full-node certificates. Finality is over unique model-origin tuples, not identical local parameter states. To improve resilience, gspDAG-FL combines payload validation, accepted-proof validation, and private semantic audit before aggregation. We formalize the adversarial setting, prove safety and conditional liveness of the control plane, and give a convergence guarantee for certified perturbed gossip under time-varying effective mixing. Experiments on MNIST classification and Penn Treebank language modeling, using fair held-out validation/audit data and networks up to \(N=100\), show that gspDAG-FL achieves learning quality close to validation-based ledger FL while reducing coordination bottlenecks, improving throughput, and maintaining high invalid-origin detection under mixed Byzantine and lazy participation.

Figures

Figures reproduced from arXiv: 2607.08651 by the authors.

Figure 1
Figure 1. Communication protocols for different FL approaches. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Illustration of the proposed Topology DAG with [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Training-loss dynamics of gspDAG-FL under different Byzantine and lazy-node compositions. [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Ripple dynamics of gspDAG-FL for N = 15, Q = 11, and R max t = 13. TABLE VI: End-to-end defense-pipeline summary under N = 15, target µ = 0.15, and target γ = 0.10. Counts are mean ± standard deviation over 20 runs. Task Detection rate False alarm Detected / flawed Tas…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

62 extracted references · 62 canonical work pages

  1. [1]

    Communication-efficient learning of deep networks from decentralized data,

    H. B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. Agüera y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Proc. 20th Int. Conf. Artif. Intell. Statist. (AISTATS), 2017, pp. 1273–1282

    work page 2017

  2. [2]

    Advances and open problems in federated learning,

    P. Kairouz et al., “Advances and open problems in federated learning,” Found. Trends Mach. Learn., vol. 14, no. 1–2, pp. 1– 210, 2021, doi: 10.1561/2200000083

    work page doi:10.1561/2200000083 2021

  3. [3]

    ZK-HybridFL: Zero-knowledge proof-enhanced hybrid ledger for federated learning,

    A. Taherpour and X. Wang, “ZK-HybridFL: Zero-knowledge proof-enhanced hybrid ledger for federated learning,” IEEE Trans. Neural Netw. Learn. Syst., early access, pp. 1–15, Feb. 2026, doi: 10.1109/TNNLS.2026.3658993

    work page doi:10.1109/tnnls.2026.3658993 2026

  4. [4]

    Full accounting for verifiable outsourcing,

    K. Bonawitz et al., “Practical secure aggregation for privacy- preserving machine learning,” in Proc. ACM SIGSAC Conf. Comput. Commun. Secur. (CCS), 2017, pp. 1175–1191, doi: 10.1145/3133956.3133982

    work page doi:10.1145/3133956.3133982 2017

  5. [5]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” in Proc. Adv. Neural Inf. Process. Syst. (NeurIPS), 2019, pp. 14747–14756

    work page 2019

  6. [6]

    Randomized gossip algorithms,

    S. Boyd, A. Ghosh, B. Prabhakar, and D. Shah, “Randomized gossip algorithms,” IEEE Trans. Inf. Theory, vol. 52, no. 6, pp. 2508–2530, Jun. 2006, doi: 10.1109/TIT.2006.874516

    work page doi:10.1109/tit.2006.874516 2006

  7. [7]

    Can decentralized algorithms outperform centralized algorithms? A case study for decentralized parallel stochastic gradient descent,

    X. Lian, C. Zhang, H. Zhang, C.-J. Hsieh, W. Zhang, and J. Liu, “Can decentralized algorithms outperform centralized algorithms? A case study for decentralized parallel stochastic gradient descent,” in Proc. Adv. Neural Inf. Process. Syst. (NeurIPS), 2017, pp. 5330–5340

    work page 2017

  8. [8]

    Asyn- chronous decentralized parallel stochastic gradient descent,

    X. Lian, W. Zhang, C.-J. Hsieh, C. Zhang, and J. Liu, “Asyn- chronous decentralized parallel stochastic gradient descent,” in Proc. Int. Conf. Mach. Learn. (ICML), 2018, pp. 3043–3052

    work page 2018

Show all 62 references
  1. [9]

    Stochastic gradient push for distributed deep learning,

    M. Assran, N. Loizou, N. Ballas, and M. G. Rabbat, “Stochastic gradient push for distributed deep learning,” in Proc. Int. Conf. Mach. Learn. (ICML), 2019, pp. 344–353

    2019

  2. [10]

    Decentralized stochastic optimization and gossip algorithms with compressed commu- nication,

    A. Koloskova, S. Stich, and M. Jaggi, “Decentralized stochastic optimization and gossip algorithms with compressed commu- nication,” in Proc. Int. Conf. Mach. Learn. (ICML), 2019, pp. 3478–3487

    2019

  3. [11]

    GossipFL: A decentralized federated learning framework with sparsified and adaptive com- munication,

    Z. Tang, S. Shi, B. Li, and X. Chu, “GossipFL: A decentralized federated learning framework with sparsified and adaptive com- munication,” IEEE Trans. Parallel Distrib. Syst., vol. 34, no. 3, pp. 909–922, Mar. 2023, doi: 10.1109/TPDS.2022.3230938

    2023 doi

  4. [12]

    FedDual: Pair-wise gossip helps federated learning in large decentralized networks,

    Q. Chen, Z. Wang, H. Wang, and X. Lin, “FedDual: Pair-wise gossip helps federated learning in large decentralized networks,” IEEE Trans. Inf. Forensics Security, vol. 18, pp. 335–350, 2023, doi: 10.1109/TIFS.2022.3222935

    2023 doi

  5. [13]

    Communication-efficient federated optimization over semi-decentralized networks,

    H. Wang and Y. Chi, “Communication-efficient federated optimization over semi-decentralized networks,” IEEE Trans. Signal Inf. Process. Netw., vol. 11, pp. 147–160, 2025, doi: 10.1109/TSIPN.2025.3539004. 13

    2025 doi

  6. [14]

    SPID-Chain: A smart contract-enabled, polar-coded interoperable DAG chain,

    A. Taherpour and X. Wang, “SPID-Chain: A smart contract-enabled, polar-coded interoperable DAG chain,” arXiv:2501.11794, Jan. 2025, doi: 10.48550/arXiv.2501.11794

    2025 doi arXiv

  7. [15]

    Machine learning with adversaries: Byzantine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” in Proc. Adv. Neural Inf. Process. Syst. (NeurIPS), 2017, pp. 119–129

    2017

  8. [16]

    Byzantine- robust distributed learning: Towards optimal statistical rates,

    D. Yin, Y. Chen, R. Kannan, and P. Bartlett, “Byzantine- robust distributed learning: Towards optimal statistical rates,” in Proc. Int. Conf. Mach. Learn. (ICML), 2018, pp. 5650–5659

    2018

  9. [17]

    Robust aggre- gation for federated learning,

    K. Pillutla, S. M. Kakade, and Z. Harchaoui, “Robust aggre- gation for federated learning,” IEEE Trans. Signal Process., vol. 70, pp. 1142–1154, 2022, doi: 10.1109/TSP.2022.3153135

    2022 doi

  10. [18]

    Mitigating sybils in federated learning poisoning,

    C. Fung, C. J. M. Yoon, and I. Beschastnikh, “Mitigating sybils in federated learning poisoning,” arXiv:1808.04866, 2018, doi: 10.48550/arXiv.1808.04866

    2018 doi arXiv

  11. [19]

    How to backdoor federated learning,

    E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, “How to backdoor federated learning,” in Proc. Int. Conf. Artif. Intell. Statist. (AISTATS), 2020, pp. 2938–2948

    2020

  12. [20]

    Attack of the tails: Yes, you really can backdoor federated learning,

    H. Wang et al., “Attack of the tails: Yes, you really can backdoor federated learning,” in Proc. Adv. Neural Inf. Process. Syst. (NeurIPS), 2020, pp. 16070–16084

    2020

  13. [21]

    Neural Cleanse: Identifying and mitigating back- door attacks in neural networks,

    B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao, “Neural Cleanse: Identifying and mitigating back- door attacks in neural networks,” in Proc. IEEE Symp. Secur. Privacy (S&P), 2019, pp. 707–723, doi: 10.1109/SP.2019.00031

    2019 doi

  14. [22]

    STRIP: A defence against Trojan attacks on deep neural networks,

    Y. Gao, C. Xu, D. Wang, S. Chen, D. C. Ranasinghe, and S. Nepal, “STRIP: A defence against Trojan attacks on deep neural networks,” in Proc. 35th Annu. Com- put. Secur. Appl. Conf. (ACSAC), 2019, pp. 113–125, doi: 10.1145/3359789.3359790

    2019 doi

  15. [23]

    Spectral signatures in backdoor attacks,

    B. Tran, J. Li, and A. Madry, “Spectral signatures in backdoor attacks,” in Proc. Adv. Neural Inf. Process. Syst. (NeurIPS), 2018, pp. 8011–8021

    2018

  16. [24]

    A high-throughput and secure coded blockchain for IoT,

    A. Taherpour and X. Wang, “A high-throughput and secure coded blockchain for IoT,” IEEE Trans. Dependable Secure Comput., vol. 22, no. 4, pp. 3561–3579, Jul.–Aug. 2025, doi: 10.1109/TDSC.2025.3532850

    2025 doi

  17. [25]

    HybridChain: Fast, accurate, and secure transaction processing with distributed learning,

    A. Taherpour and X. Wang, “HybridChain: Fast, accurate, and secure transaction processing with distributed learning,” IEEE Trans. Parallel Distrib. Syst., vol. 35, no. 6, pp. 968–982, Jun. 2024, doi: 10.1109/TPDS.2024.3381593

    2024 doi

  18. [26]

    Blockchained on- device federated learning,

    H. Kim, J. Park, M. Bennis, and S.-L. Kim, “Blockchained on- device federated learning,” IEEE Commun. Lett., vol. 24, no. 6, pp. 1279–1283, Jun. 2020, doi: 10.1109/LCOMM.2019.2921755

    2020 doi

  19. [27]

    Swarm learning for decentralized and confidential clinical machine learning,

    S. Warnat-Herresthal et al., “Swarm learning for decentralized and confidential clinical machine learning,” Nature, vol. 594, no. 7862, pp. 265–270, Jun. 2021, doi: 10.1038/s41586-021- 03583-3

    2021 doi

  20. [28]

    Decentralized privacy using blockchain- enabled federated learning in fog computing,

    Y. Qu et al., “Decentralized privacy using blockchain- enabled federated learning in fog computing,” IEEE Inter- net Things J., vol. 7, no. 6, pp. 5171–5183, Jun. 2020, doi: 10.1109/JIOT.2020.2977383

    2020 doi

  21. [29]

    Blockchain assisted decentralized federated learn- ing (BLADE-FL): Performance analysis and resource alloca- tion,

    J. Li et al., “Blockchain assisted decentralized federated learn- ing (BLADE-FL): Performance analysis and resource alloca- tion,” IEEE Trans. Parallel Distrib. Syst., vol. 33, no. 10, pp. 2401–2415, Oct. 2022, doi: 10.1109/TPDS.2021.3138848

    2022 doi

  22. [30]

    Blockchain- empowered federated learning: Benefits, challenges, and solu- tions,

    Z. Cai, J. Chen, Y. Fan, Z. Zheng, and K. Li, “Blockchain- empowered federated learning: Benefits, challenges, and solu- tions,” IEEE Trans. Big Data, vol. 11, no. 5, pp. 2244–2263, Oct. 2025, doi: 10.1109/TBDATA.2025.3541560

    2025 doi

  23. [31]

    VFChain: Enabling verifiable and auditable federated learning via blockchain systems,

    Z. Peng et al., “VFChain: Enabling verifiable and auditable federated learning via blockchain systems,” IEEE Trans. Netw. Sci. Eng., vol. 9, no. 1, pp. 173–186, Jan.–Feb. 2022, doi: 10.1109/TNSE.2021.3050781

    2022 doi

  24. [32]

    Auditable and verifiable federated learning based on blockchain-enabled decentralization,

    A. P. Kalapaaking, I. Khalil, X. Yi, K.-Y. Lam, G.-B. Huang, and N. Wang, “Auditable and verifiable federated learning based on blockchain-enabled decentralization,” IEEE Trans. Neural Netw. Learn. Syst., vol. 36, no. 1, pp. 102–115, Jan. 2025, doi: 10.1109/TNNLS.2024.3407670

    2025 doi

  25. [33]

    Secure and efficient federated learning through layer- ing and sharding blockchain,

    S. Yuan, B. Cao, Y. Sun, Z. Wan, and M. Peng, “Secure and efficient federated learning through layer- ing and sharding blockchain,” IEEE Trans. Netw. Sci. Eng., vol. 11, no. 3, pp. 3120–3134, May–Jun. 2024, doi: 10.1109/TNSE.2024.3361458

    2024 doi

  26. [34]

    Toward on-device federated learning: A direct acyclic graph-based blockchain approach,

    M. Cao, L. Zhang, and B. Cao, “Toward on-device federated learning: A direct acyclic graph-based blockchain approach,” IEEE Trans. Neural Netw. Learn. Syst., vol. 34, no. 4, pp. 2028– 2042, Apr. 2023, doi: 10.1109/TNNLS.2021.3105810

    doi

  27. [35]

    DAG-EnseFL: DAG-based asynchronous federated learning with ensemble distillation,

    J. Chen, D. Wu, S. Guo, F. Qi, and X. Qiu, “DAG-EnseFL: DAG-based asynchronous federated learning with ensemble distillation,” IEEE Trans. Big Data, vol. 11, no. 6, pp. 3342– 3355, Dec. 2025, doi: 10.1109/TBDATA.2025.3594244

    2025 doi

  28. [36]

    A DAG-blockchain-assisted federated learning framework in wireless networks: Learning performance and throughput optimization schemes,

    Q. Wang, S. Xu, R. Xu, and B. Ai, “A DAG-blockchain-assisted federated learning framework in wireless networks: Learning performance and throughput optimization schemes,” IEEE Trans. Veh. Technol., vol. 74, no. 3, pp. 5097–5113, Mar. 2025, doi: 10.1109/TVT.2024.3502444

    2025 doi

  29. [37]

    IronForge: An open, secure, fair, decen- tralized federated learning,

    G. Yu et al., “IronForge: An open, secure, fair, decen- tralized federated learning,” IEEE Trans. Neural Netw. Learn. Syst., vol. 36, no. 1, pp. 354–368, Jan. 2025, doi: 10.1109/TNNLS.2023.3329249

    2025 doi

  30. [38]

    The Swirlds Hashgraph consensus algorithm: Fair, fast, Byzantine fault tolerance,

    L. Baird, “The Swirlds Hashgraph consensus algorithm: Fair, fast, Byzantine fault tolerance,” Swirlds, Tech. Rep. SWIRLDS- TR-2016-01, 2016. [Online]. A vailable: https://www.swirlds. com/downloads/SWIRLDS-TR-2016-01.pdf . Accessed: Jul. 9, 2026

    2016

  31. [39]

    Practical Byzantine fault tolerance,

    M. Castro and B. Liskov, “Practical Byzantine fault tolerance,” in Proc. 3rd Symp. Operating Syst. Design Implement. (OSDI), 1999, pp. 173–186

    1999

  32. [40]

    FLTrust: Byzantine-robust federated learning via trust bootstrapping,

    X. Cao, M. Fang, J. Liu, and N. Z. Gong, “FLTrust: Byzantine-robust federated learning via trust bootstrapping,” in Proc. Netw. Distrib. Syst. Secur. Symp. (NDSS), 2021, doi: 10.14722/ndss.2021.24434

    2021 doi

  33. [41]

    Zeno++: Robust fully asynchronous SGD,

    C. Xie, O. Koyejo, and I. Gupta, “Zeno++: Robust fully asynchronous SGD,” in Proc. Int. Conf. Mach. Learn. (ICML), ser. Proc. Mach. Learn. Res., vol. 119, 2020, pp. 10495–10503

    2020

  34. [42]

    Iglewicz and D

    B. Iglewicz and D. C. Hoaglin, How to Detect and Handle Outliers. Milwaukee, WI, USA: ASQC Quality Press, 1993

    1993

  35. [43]

    De- tecting outliers: Do not use standard deviation around the mean, use absolute deviation around the median,

    C. Leys, C. Ley, O. Klein, P. Bernard, and L. Licata, “De- tecting outliers: Do not use standard deviation around the mean, use absolute deviation around the median,” J. Exp. Soc. Psychol., vol. 49, no. 4, pp. 764–766, Jul. 2013, doi: 10.1016/j.jesp.2013.03.013

    2013 doi

  36. [44]

    Edwards-Curve Digital Sig- nature Algorithm (EdDSA),

    S. Josefsson and I. Liusvaara, “Edwards-Curve Digital Sig- nature Algorithm (EdDSA),” RFC 8032, Jan. 2017, doi: 10.17487/RFC8032

    2017 doi

  37. [45]

    High-speed high-security signatures,

    D. J. Bernstein, N. Duif, T. Lange, P. Schwabe, and B.-Y. Yang, “High-speed high-security signatures,” J. Cryptographic Eng., vol. 2, no. 2, pp. 77–89, Sep. 2012, doi: 10.1007/s13389-012- 0027-1

    2012 doi

  38. [46]

    dagsim: Hashgraph simulator,

    B. Schachenhofer, “dagsim: Hashgraph simulator,” GitHub repository. [Online]. A vailable: https://github.com/ BSchachenhofer/dagsim. Accessed: Jul. 9, 2026

    2026

  39. [47]

    JGraphT— A Java library for graph data structures and algorithms,

    D. Michail, J. Kinable, B. Naveh, and J. V. Sichi, “JGraphT— A Java library for graph data structures and algorithms,” ACM Trans. Math. Softw., vol. 46, no. 2, Art. no. 16, May 2020, doi: 10.1145/3381449

    2020 doi

  40. [48]

    Bouncy Castle Crypto APIs,

    The Legion of the Bouncy Castle Inc., “Bouncy Castle Crypto APIs,” [Online]. A vailable: https://www.bouncycastle.org/. Ac- cessed: Jul. 9, 2026

    2026

  41. [49]

    PyTorch: An imperative style, high- performance deep learning library,

    A. Paszke et al., “PyTorch: An imperative style, high- performance deep learning library,” in Proc. Adv. Neural Inf. Process. Syst. (NeurIPS), 2019, pp. 8024–8035

    2019

  42. [50]

    Array programming with NumPy,

    C. R. Harris et al., “Array programming with NumPy,” Nature, vol. 585, no. 7825, pp. 357–362, Sep. 2020, doi: 10.1038/s41586- 020-2649-2

    2020 doi

  43. [51]

    gRPC-Kotlin,

    The gRPC Authors, “gRPC-Kotlin,” GitHub repository. [Online]. A vailable: https://github.com/grpc/grpc-kotlin. Ac- cessed: Jul. 9, 2026

    2026

  44. [52]

    grpcio: gRPC for Python,

    The gRPC Authors, “grpcio: gRPC for Python,” PyPI. [Online]. A vailable: https://pypi.org/project/grpcio/. Accessed: Jul. 9, 2026

    2026

  45. [53]

    Protocol Buffers documentation,

    Google, “Protocol Buffers documentation,” [Online]. A vailable: https://protobuf.dev/. Accessed: Jul. 9, 2026

    2026

  46. [54]

    Matplotlib: A 2D graphics environment,

    J. D. Hunter, “Matplotlib: A 2D graphics environment,” Com- put. Sci. Eng., vol. 9, no. 3, pp. 90–95, May–Jun. 2007, doi: 10.1109/MCSE.2007.55

    2007 doi

  47. [55]

    stochastic_gradient_push: PyTorch im- plementation of Stochastic Gradient Push,

    Facebook Research, “stochastic_gradient_push: PyTorch im- plementation of Stochastic Gradient Push,” GitHub reposi- tory. [Online]. A vailable:https://github.com/facebookresearch/ stochastic_gradient_push. Accessed: Jul. 9, 2026

    2026

  48. [56]

    BLADE-FL: Blockchain Assisted Decentralized Federated Learning,

    Y.-M. Shao, “BLADE-FL: Blockchain Assisted Decentralized Federated Learning,” GitHub repository. [Online]. A vailable: 14 https://github.com/ElvisShaoYumeng/BLADE-FL. Accessed: Jul. 9, 2026

    2026

  49. [57]

    Ganache,

    Truffle Suite, “Ganache,” [Online]. A vailable: https://archive. trufflesuite.com/ganache/. Accessed: Jul. 9, 2026

    2026

  50. [58]

    ChainsFL: A blockchain-based federated learning implementation,

    S. Yuan, “ChainsFL: A blockchain-based federated learning implementation,” GitHub repository, 2021. [Online]. A vailable: https://github.com/shuoyuan/ChainsFL-implementation. Ac- cessed: Jul. 9, 2026

    2021

  51. [59]

    The MNIST database of handwritten digits,

    Y. LeCun, C. Cortes, and C. J. C. Burges, “The MNIST database of handwritten digits,” [Online]. A vailable: http:// yann.lecun.com/exdb/mnist/. Accessed: Jul. 9, 2026

    2026

  52. [60]

    MobileNetV2: Inverted residuals and linear bottlenecks,

    M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L.-C. Chen, “MobileNetV2: Inverted residuals and linear bottlenecks,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR), 2018, pp. 4510–4520, doi: 10.1109/CVPR.2018.00474

    2018 doi

  53. [61]

    Building a large annotated corpus of English: The Penn Treebank,

    M. P. Marcus, B. Santorini, and M. A. Marcinkiewicz, “Building a large annotated corpus of English: The Penn Treebank,” Comput. Linguistics, vol. 19, no. 2, pp. 313–330, 1993

    1993

  54. [62]

    Exploring network structure, dynamics, and function using NetworkX,

    A. A. Hagberg, D. A. Schult, and P. J. Swart, “Exploring network structure, dynamics, and function using NetworkX,” in Proc. Python Sci. Conf. (SciPy), 2008, pp. 11–15

    2008

Pith tools

Reviewed July 10, 2026 · model on record in the stance chip above.