Pith. sign in

REVIEW 2 major objections 5 minor 62 references

Perfect Privacy for Discriminator-Based Byzantine-Resilient Federated Learning

T0 review · 2 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read ByITFL and LoByITFL make federated learning Byzantine-resilient and information-theoretically private.

desk verdict The paper's central claim of perfect IT privacy is not proven: the normalization-validation step leaks each user's exact quantized squared norm, a direction-dependent statistic, and the proof's boundedness argument does not establish zero mutual information. read the letter →

arxiv 2506.13561 v1 pith:ASTHD4YP submitted 2025-06-16 cs.LG cs.DCcs.ITmath.IT

Yue Xia , Christoph Hofmeister , Maximilian Egger , Rawad Bitar This is my paper · ORCID
classification cs.LGcs.DCcs.ITmath.IT
keywords federatedlearningByzantineresilienceinformation-theoreticprivacysecureaggregationsecretsharingLagrangecodedcomputingBeavertriplestrustscores
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to show that federated learning can be robust to Byzantine users and perfectly private at the same time. It introduces ByITFL and LoByITFL, two schemes in which the federator keeps a small root dataset, computes its own reference update, and assigns each user a polynomial trust score based on cosine similarity with that reference. The users' normalized, quantized updates are secret-shared, and the aggregation is reconstructed from shares in such a way that an honest-but-curious federator and any colluding group of up to t users learn nothing beyond the aggregate. ByITFL does this with Lagrange coded computing and re-randomization; LoByITFL lowers communication cost by using Beaver triples and a one-time trusted initialization. The paper claims these are the first Byzantine-resilient federated-learning schemes with perfect information-theoretic privacy, and proves privacy, resilience, dropout tolerance, and convergence.

What carries the argument

The load-bearing object is a polynomial discriminator $h$ evaluated on secret-shared, normalized updates, together with the quotient aggregation $\nu = \Sigma_2/\Sigma_1 = \left(\sum_i h(\langle \bar{\mathbf{u}}_0, \bar{\mathbf{u}}_i\rangle) \bar{\mathbf{u}}_i\right) / \left(\sum_i h(\langle \bar{\mathbf{u}}_0, \bar{\mathbf{u}}_i\rangle)\right)$. Each local update is normalized, stochastically quantized, mapped into a finite field, split into sub-vectors, and secret-shared using Lagrange coded computing, a threshold secret-sharing method that lets polynomials be evaluated on shares. Information-theoretic verifiable secret sharing prevents Byzantine users from submitting inconsistent shares, and re-randomization prevents the federator from decoding anything except the quotient. A random scalar $\lambda$ multiplies both $\Sigma_1$ and $\Sigma_2$ before reconstruction, so the federator learns only $\nu$. LoByITFL replaces the expensive re-randomization with Beaver triples distributed once by a trusted third party, plus additively homomorphic message authentication codes that let the federator verify every linear computation.

What would settle it

Sample a fixed local update, rotate it in the model space, quantize and secret-share it exactly as the protocol does, and have the federator decode its squared norm; if the decoded norm changes with the rotation while the update still passes the validation threshold, the federator's view carries directional information and the zero-mutual-information guarantee in Eq. (2) is violated.

Watch

Extended reading notes

Core claim

The central claim is that perfect information-theoretic privacy, in the sense of zero mutual information between honest users' local updates and everything the federator and colluding users see, is compatible with Byzantine resilience and dropout tolerance. ByITFL achieves this under the user-count condition $n \geq 2b + (\tau+2)(m+t-1) + e + 1$, and LoByITFL under $n \geq b + m + t + e$; both schemes are proven to converge under the same strong-convexity assumptions used by the reference trust-scoring aggregation. The key move is to replace the reference method's ReLU trust score with a low-degree polynomial $h$ of the cosine similarity $\langle \bar{\mathbf{u}}_0, \bar{\mathbf{u}}_i \rangle$, so that the aggregated update $\nu = \Sigma_2 / \Sigma_1$ can be computed entirely on secret shares. A random field element $\lambda$ multiplies both sums before reconstruction, so the federator can recover only the quotient $\nu$. The experiments show test accuracy close to the reference method on three image datasets under several poisoning attacks, including label flipping, min-max, min-sum, ALIE, and scaling attacks.

Load-bearing premise

The privacy proof assumes that the value each user must reveal for normalization checking, the quantized squared norm of the update, is effectively the same for every possible update and therefore carries no information about the update's direction.

Editorial extensions

If this is right

  • An honest-but-curious federator that holds a small representative dataset can compute a robust aggregate while learning zero mutual information about any honest user's individual update in each iteration, even against a computationally unbounded adversary.
  • The two schemes tolerate the simultaneous presence of $b$ Byzantine users, $t$ colluding curious users, and $e$ dropouts: ByITFL requires $n \geq 2b + (\tau+2)(m+t-1) + e + 1$ users, while LoByITFL requires only $n \geq b + m + t + e$.
  • LoByITFL shows that a one-time trusted initialization with Beaver triples cuts per-user communication from $O((d/m)n^3 + n^4)$ to $O((d/m+\tau)n)$ without weakening the stated privacy guarantee.
  • Under strong convexity and Lipschitz-gradient assumptions, both schemes converge linearly to a neighborhood of the optimal model, with the convergence error containing a term proportional to the global learning rate and the reference-update error.
  • The polynomial discriminator of degree three is sufficient to preserve the practical resilience of the reference trust-scoring method, which suggests that exact ReLU behavior is not needed for Byzantine robustness.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • As an editorial inference, the same secret-shared trust-score machinery could be applied to other robust aggregation rules that are low-degree polynomial functions of the updates, not only cosine-similarity scoring.
  • The perfect-privacy guarantee is for the quantized finite-field embeddings of normalized updates; whether it extends to the original real-valued gradients depends on how much directional information stochastic quantization preserves, which the paper does not quantify.
  • The schemes concentrate trust in the federator's root dataset; a root dataset that misrepresents the users' data would miscalibrate trust scores and could weaken both robustness and the practical meaning of the privacy guarantee.
  • A direct test of the privacy claim would be to measure whether the decoded squared norm of a fixed update changes as the update is rotated; if it does while passing the validation threshold, the zero-mutual-information claim needs revision.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper proposes two federated learning protocols, ByITFL and LoByITFL, that combine FLTrust-style Byzantine resilience with information-theoretic (IT) privacy via threshold secret sharing, Lagrange coded computing, Beaver triples, and a polynomial discriminator that replaces the ReLU used in FLTrust. The main theorems state that both schemes guarantee IT privacy against any t colluding users and an honest-but-curious federator, Byzantine resilience against b users, dropout tolerance, and convergence, with complexity analyses and experiments on MNIST, Fashion-MNIST, and CIFAR-10 under several attacks.

Significance. If the claimed guarantees held, the schemes would represent a notable advance as the first Byzantine-resilient federated learning protocols with perfect IT privacy under bounded collusion and dropout. The paper provides explicit protocol descriptions, complexity analyses, and an experimental comparison against FLTrust across multiple attacks. However, the central privacy proof has a load-bearing gap: the normalization-validation step reveals each user's exact quantized squared norm to the federator, and the proof does not establish that this statistic is independent of the honest users' updates. In addition, the Byzantine-resilience and convergence guarantees are transferred from FLTrust without a derivation for the degree-3 polynomial discriminator and the quantization/normalization steps. These gaps undermine the main theorems, so the contribution as stated is not established.

major comments (2)
  1. [Section IV-C and Appendix A, item (a) on M_0] The federator reconstructs each user's quantized squared norm ||\bar u_j||_2^2 during the normalization validation. The proof in Appendix A dismisses this value because it 'lies within a certain range for all possible model updates (ideally equivalent to one)', but boundedness does not imply zero mutual information with u_H. Under the element-wise stochastic quantizer Q_q, ||\bar u_j||_2^2 depends on the direction of \bar u_j: for d=2, q=2, the normalized update (1,0) yields ||\bar u||^2=4 with probability 1, while (1/√2,1/√2) yields 2, 5, or 8 with nonzero probabilities. This exact per-user statistic is part of M_0 and is not a function of the conditioning tuple (u_T,u_0,D_T,D_0,w,ν). The same leak occurs in LoByITFL at Step C (Section V-C). Consequently, the zero-mutual-information claim in Eq. (2) and Theorems 1(1) and 2(1) are not established.
  2. [Appendix A.2 and Section VI-A] The Byzantine resilience guarantee is asserted by referring to FLTrust [13], but FLTrust's analysis applies to the ReLU discriminator. The paper replaces ReLU with the degree-3 polynomial h(x)=0.46897526x^3+0.56578977x^2+0.1860353x+0.01363545, which takes negative values for negative x (e.g., h(-1)≈-0.0756), unlike ReLU. No proof is given that the trust-score properties needed for FLTrust's convergence and robustness analysis hold for this polynomial or under the added quantization and normalization steps. Theorem 3 states that the proof 'follows the same steps as the proofs in Appendix A of [13]' without verifying that the assumptions in [13, Assumptions 1, 2 and 3] are satisfied by the modified aggregation rule. This is a load-bearing gap in Theorems 1(2), 2(2), and 3.
minor comments (5)
  1. [Section V-C] The text writes '{||\bar u_j||_2^2[i]} ∈ F^d_p', but the squared norm is a scalar; it should be an element of F_p, not F^d_p.
  2. [Section VI-B] The validation threshold ε is set to 0.02 without a sensitivity analysis; since the privacy proof treats the normalized norm as 'ideally one', the role of this threshold in the privacy argument should be made explicit.
  3. [Abstract and Introduction] The paper claims to be the 'first Byzantine-resilient FL scheme with perfect IT privacy', but the relationship to the authors' prior works [1] and [2] should be clarified, as those papers appear to present earlier versions of the same schemes.
  4. [Section VI-A] The coefficients of the degree-3 polynomial are given with high precision, but no rationale is provided for these specific values beyond a qualitative shape; a justification or a sensitivity study would help.
  5. [Table III] The footnote marker is '⋆' in the table but '*' in the surrounding text; use one symbol consistently.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the central privacy, resilience, and convergence claims are built on external cryptographic and FLTrust results, not on the paper's own outputs.

full rationale

Walking the derivation chain, no load-bearing step reduces to its own inputs. The privacy proofs in Appendices A and B invoke external threshold secret sharing, Lagrange coded computing, ITVSS, re-randomization, Beaver triples, and one-time MACs; these are independent cryptographic primitives with published guarantees. The convergence proof (Theorem 3, Appendix C) delegates the final steps to FLTrust [13], an external published analysis, with Lemma 1 supplying the ByITFL-specific transfer bound; this is a citation of independent support, not a self-citation chain. Self-citations [1] and [2] identify prior versions of the schemes and a minor experimental variant, but they are not load-bearing for Theorems 1-3. The hand-chosen degree-3 discriminator is justified by an explicit design rationale (Section VI-A) and evaluated against external attacks, so it is not a fitted parameter renamed as a prediction. The paper itself concedes in the Conclusion that cosine-similarity-based robustness is not fully understood; that is an acknowledged limitation rather than a circular step. The most serious concern is the normalization-validation privacy step: the paper asserts that the reconstructed ||\bar u_j||_2^2 reveals nothing because it lies in a bounded interval, but boundedness does not imply zero mutual information, so Eq. (2) may be unsupported. That is a correctness and rigor gap, not a circularity, because the claim does not reduce to its own definition or to a fitted input. Therefore no circular step is exhibited and the score is 0.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The central claims rest on a handful of background assumptions: a representative root dataset, the honest-but-curious threat model, a trusted third party for LoByITFL, standard MPC primitives, and an unverified transfer of FLTrust's convergence proof to the hand-chosen polynomial discriminator. No new physical entities are introduced.

free parameters (2)
  • Degree-3 discriminator polynomial coefficients = 0.46897526, 0.56578977, 0.1860353, 0.01363545
    Hand-chosen to approximate ReLU in Section VI-A; no proof that this polynomial preserves FLTrust's convergence or Byzantine-resilience guarantees.
  • Normalization validation threshold epsilon = 0.02
    Set empirically in Section VI-B for experiments; controls which updates pass validation and affects the privacy-resilience tradeoff.
assumptions (5)
  • domain assumption The federator's root dataset D_0 is sampled independently from the same distribution as each user's dataset D_i.
    Inherited from FLTrust [13] (Theorem 3, assumption (c)); required for the convergence proof and for the trust-score reference update to be representative.
  • domain assumption The federator is honest-but-curious, at most t users collude, and Byzantine users have access to all users' datasets.
    Defines the threat model in Section II-B; the privacy and resilience guarantees are only stated under these bounds.
  • domain assumption LoByITFL assumes a Trusted Third Party that performs a one-time initialization and does not collude.
    The TTP distributes Beaver triples and MAC keys; the protocol's reduced communication depends on this trusted setup.
  • standard math The underlying primitives (LCC, ITVSS, Beaver triples, one-time MAC) are unconditionally secure as claimed in [47], [52], [51], [48].
    The proofs import these results without re-deriving them; security of the overall scheme relies on them.
  • ad hoc to paper FLTrust's convergence proof (Appendix A of [13]) applies to ByITFL and LoByITFL with the polynomial discriminator and quantization.
    Theorem 3 is proven by reducing to FLTrust's proof via Lemma 1, but the paper does not verify that the degree-3 polynomial and finite-field quantization satisfy FLTrust's assumptions.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Perfect Privacy for Discriminator-Based Byzantine-Resilient Federated Learning." pith.science (2026). https://pith.science/paper/ASTHD4YP

@misc{pith2026250613561,
  author       = {Pith},
  title        = {Pith review of: Perfect Privacy for Discriminator-Based Byzantine-Resilient Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ASTHD4YP}},
  note         = {Machine review of arXiv:2506.13561}
}
read the original abstract

Federated learning (FL) shows great promise in large-scale machine learning but introduces new privacy and security challenges. We propose ByITFL and LoByITFL, two novel FL schemes that enhance resilience against Byzantine users while keeping the users' data private from eavesdroppers. To ensure privacy and Byzantine resilience, our schemes build on having a small representative dataset available to the federator and crafting a discriminator function allowing the mitigation of corrupt users' contributions. ByITFL employs Lagrange coded computing and re-randomization, making it the first Byzantine-resilient FL scheme with perfect Information-Theoretic (IT) privacy, though at the cost of a significant communication overhead. LoByITFL, on the other hand, achieves Byzantine resilience and IT privacy at a significantly reduced communication cost, but requires a Trusted Third Party, used only in a one-time initialization phase before training. We provide theoretical guarantees on privacy and Byzantine resilience, along with convergence guarantees and experimental results validating our findings.

Figures

Figures reproduced from arXiv: 2506.13561 by the authors.

Figure 1
Figure 1. Federated learning system. by the users, which negatively affects2 the utility of the model. Furthermore, IT privacy offers the strongest guarantee when only a limited number of entities collude to compromise privacy, withstanding even computationally unbounded adver￾saries and without compromising model accuracy. We introduce ByITFL and LoByITFL, two Byzantine￾resilient and IT private FL schemes. We utilize ideas f… view at source ↗
Figure 2
Figure 2. The main steps in each training iteration of ByITFL [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Comparison of different discriminator functions [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

62 extracted references · 54 canonical work pages

  1. [13]

    Fltrust: Byzantine-robust federated learning via trust bootstrapping,

    X. Cao, M. Fang, J. Liu, and N. Gong, “Fltrust: Byzantine-robust federated learning via trust bootstrapping,” inProc. NDSS, 2021

    work page 2021

  2. [1]

    Byzantine-resilient secure aggregation for federated learning without privacy compromises,

    Y . Xia, C. Hofmeister, M. Egger, and R. Bitar, “Byzantine-resilient secure aggregation for federated learning without privacy compromises,” inProc. IEEE ITW, 2024

    work page 2024

  3. [2]

    Lobyitfl: Low communication secure and private federated learn- ing,

    ——, “Lobyitfl: Low communication secure and private federated learn- ing,”Proc. FL-AsiaCCS, 2025

    work page 2025

  4. [3]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” inProc. AISTATS, 2017

    2017

  5. [4]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,”Adv. Neural Inf. Process. Syst., 2019

    work page 2019

  6. [5]

    Inverting gradients: How easy is it to break privacy in federated learning?

    J. Geiping, H. Bauermeister, H. Dr ¨oge, and M. Moeller, “Inverting gradients: How easy is it to break privacy in federated learning?”Adv. Neural Inf. Process. Syst., 2020

    work page 2020

  7. [6]

    Practical secure aggregation for privacy-preserving machine learning,

    K. Bonawitz, V . Ivanov, B. Kreuteret al., “Practical secure aggregation for privacy-preserving machine learning,” inProc. ACM CCS, 2017

    work page 2017

  8. [7]

    Privacy- preserving deep learning via additively homomorphic encryption,

    L. T. Phong, Y . Aono, T. Hayashi, L. Wang, and S. Moriai, “Privacy- preserving deep learning via additively homomorphic encryption,”IEEE Trans. Inf. F orensics Security, 2018

    work page 2018

Show all 62 references
  1. [8]

    Advances and open problems in federated learning,

    P. Kairouz, H. B. McMahan, B. Aventet al., “Advances and open problems in federated learning,”F ound. Trends Mach. Learn., 2021

    2021

  2. [9]

    The byzantine generals prob- lem,

    L. Lamport, R. Shostak, and M. Pease, “The byzantine generals prob- lem,”ACM Trans. Program. Lang. Syst., 1982

    1982

  3. [10]

    Machine learning with adversaries: Byzantine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,”Adv. Neural Inf. Process. Syst., 2017

    2017

  4. [11]

    Byzantine-robust dis- tributed learning: Towards optimal statistical rates,

    D. Yin, Y . Chen, R. Kannan, and P. Bartlett, “Byzantine-robust dis- tributed learning: Towards optimal statistical rates,” inProc. ICML, 2018

    2018

  5. [12]

    The hidden vulnerability of distributed learning in byzantium,

    R. Guerraoui, S. Rouaultet al., “The hidden vulnerability of distributed learning in byzantium,” inProc. ICML, 2018

    2018

  6. [14]

    Fedinv: Byzantine-robust federated learning by inversing local model updates,

    B. Zhao, P. Sun, T. Wang, and K. Jiang, “Fedinv: Byzantine-robust federated learning by inversing local model updates,” inProc. AAAI, 2022

    2022

  7. [15]

    Guerraoui, N

    R. Guerraoui, N. Gupta, and R. Pinot,Robust Machine Learning. Springer, 2024

    2024

  8. [16]

    Secure byzantine-robust distributed learning via clustering,

    R. K. Velicheti, D. Xia, and O. Koyejo, “Secure byzantine-robust distributed learning via clustering,”arXiv preprint arXiv:2110.02940, 2021

    2021 arXiv

  9. [17]

    Fedgt: Identification of malicious clients in federated learning with secure aggregation,

    M. Xhemrishi, J. ¨Ostman, A. Wachter-Zeh, and A. G. i Amat, “Fedgt: Identification of malicious clients in federated learning with secure aggregation,”IEEE Trans. Inf. F orensics Security, 2025

    2025

  10. [18]

    Secure byzantine-robust machine learning,

    L. He, S. P. Karimireddy, and M. Jaggi, “Secure byzantine-robust machine learning,”arXiv preprint arXiv:2006.04747, 2020

    2006 arXiv

  11. [19]

    Efficient, private and robust federated learning,

    M. Hao, H. Li, G. Xu, H. Chen, and T. Zhang, “Efficient, private and robust federated learning,” inProc. ACSAC, 2021

    2021

  12. [20]

    Shieldfl: Mitigating model poisoning attacks in privacy-preserving federated learning,

    Z. Ma, J. Ma, Y . Miao, Y . Li, and R. H. Deng, “Shieldfl: Mitigating model poisoning attacks in privacy-preserving federated learning,”IEEE Trans. Inf. F orensics Security, 2022

    2022

  13. [21]

    Privacy- preserving federated deep learning with irregular users,

    G. Xu, H. Li, Y . Zhang, S. Xu, J. Ning, and R. H. Deng, “Privacy- preserving federated deep learning with irregular users,”IEEE Trans. Dependable Secure Comput., 2022

    2022

  14. [22]

    Wvfl: Weighted verifiable secure aggregation in federated learning,

    Y . Zhong, W. Tan, Z. Xu, S. Chen, J. Weng, and J. Weng, “Wvfl: Weighted verifiable secure aggregation in federated learning,”IEEE Internet Things J., 2024

    2024

  15. [23]

    Flod: Oblivious defender for private byzantine-robust federated learning with dishonest- majority,

    Y . Dong, X. Chen, K. Li, D. Wang, and S. Zeng, “Flod: Oblivious defender for private byzantine-robust federated learning with dishonest- majority,” inProc. ESORICS, 2021

    2021

  16. [24]

    Rfed: Robustness-enhanced privacy-preserving federated learning against poi- soning attack,

    Y . Miao, X. Yan, X. Li, S. Xu, X. Liu, H. Li, and R. H. Deng, “Rfed: Robustness-enhanced privacy-preserving federated learning against poi- soning attack,”IEEE Trans. Inf. F orensics Security, 2024

    2024

  17. [25]

    Byzantine-resilient secure federated learning,

    J. So, B. G ¨uler, and A. S. Avestimehr, “Byzantine-resilient secure federated learning,”IEEE J. Sel. Areas Commun., 2020

    2020

  18. [26]

    Byzantine-resistant secure aggregation for federated learning based on coded computing and vector commitment,

    T. Jahani-Nezhad, M. A. Maddah-Ali, and G. Caire, “Byzantine-resistant secure aggregation for federated learning based on coded computing and vector commitment,”arXiv preprints, 2023

    2023

  19. [27]

    Eiffel: Ensuring integrity for federated learning,

    A. Roy Chowdhury, C. Guo, S. Jha, and L. van der Maaten, “Eiffel: Ensuring integrity for federated learning,” inProc. ACM CCS, 2022

    2022

  20. [28]

    Safefl: Mpc-friendly framework for private and robust federated learn- ing,

    T. Gehlhar, F. Marx, T. Schneider, A. Suresh, T. Wehrle, and H. Yalame, “Safefl: Mpc-friendly framework for private and robust federated learn- ing,” 2023

    2023

  21. [29]

    Safelearn: Secure aggregation for private federated learning,

    H. Fereidooni, S. Marchal, M. Miettinenet al., “Safelearn: Secure aggregation for private federated learning,” inIEEE Security and Privacy Workshops (SPW), 2021

    2021

  22. [30]

    Privacy-preserving and byzantine-robust federated learning,

    C. Dong, J. Weng, M. Liet al., “Privacy-preserving and byzantine-robust federated learning,”IEEE Trans. Dependable Secure Comput., 2023

    2023

  23. [31]

    Scionfl: Efficient and robust secure quantized aggregation,

    Y . Ben-Itzhak, H. M ¨ollering, B. Pinkaset al., “Scionfl: Efficient and robust secure quantized aggregation,” inProc. IEEE SaTML, 2024

    2024

  24. [32]

    Efficient byzantine-robust and privacy-preserving federated learning on compressive domain,

    G. Hu, H. Li, T. Wu, W. Fan, and Y . Zhang, “Efficient byzantine-robust and privacy-preserving federated learning on compressive domain,” IEEE Internet Things J., 2023

    2023

  25. [33]

    Nspfl: A novel secure and privacy-preserving fed- erated learning with data integrity auditing,

    Z. Zhang and Y . Li, “Nspfl: A novel secure and privacy-preserving fed- erated learning with data integrity auditing,”IEEE Trans. Inf. F orensics Security, 2024

    2024

  26. [34]

    Robust and verifiable privacy federated learning,

    Z. Lu, S. Lu, X. Tang, and J. Wu, “Robust and verifiable privacy federated learning,”IEEE Trans. Artif. Intell., 2023

    2023

  27. [35]

    Rofl: Robustness of secure federated learning,

    H. Lycklama, L. Burkhalter, A. Viand, N. K ¨uchler, and A. Hithnawi, “Rofl: Robustness of secure federated learning,” inProc. IEEE S&P, 2023

    2023

  28. [36]

    Privacy-preserving federated learning compatible with robust aggregators,

    Z. Alebouyeh and A. Jalaly Bidgoly, “Privacy-preserving federated learning compatible with robust aggregators,”Available at SSRN 4793556, 2024

    2024

  29. [37]

    Priroagg: Achieving robust model aggregation with minimum privacy leakage for federated learning,

    S. Hou, S. Li, T. Jahani-Nezhad, and G. Caire, “Priroagg: Achieving robust model aggregation with minimum privacy leakage for federated learning,”IEEE Trans. Inf. F orensics Security, 2025

    2025

  30. [38]

    No vandalism: Privacy-preserving and byzantine-robust federated learning,

    Z. Xing, Z. Zhang, Z. Zhang, J. Liu, L. Zhu, and G. Russello, “No vandalism: Privacy-preserving and byzantine-robust federated learning,” arXiv preprint arXiv:2406.01080, 2024

    2024 arXiv

  31. [39]

    A robust privacy-preserving federated learning model against model poisoning attacks,

    A. Yazdinejad, A. Dehghantanha, H. Karimipour, G. Srivastava, and R. M. Parizi, “A robust privacy-preserving federated learning model against model poisoning attacks,”IEEE Trans. Inf. F orensics Security, 2024

    2024

  32. [40]

    Local and central differential privacy for robustness and privacy in federated learning,

    M. Naseri, J. Hayes, and E. De Cristofaro, “Local and central differential privacy for robustness and privacy in federated learning,”arXiv preprint arXiv:2009.03561, 2020

    2009 arXiv

  33. [41]

    Differentially private byzantine-robust federated learning,

    X. Ma, X. Sun, Y . Wu, Z. Liu, X. Chen, and C. Dong, “Differentially private byzantine-robust federated learning,”IEEE Trans. Parallel Dis- trib. Syst., 2022

    2022

  34. [42]

    On the privacy-robustness-utility trilemma in distributed learning,

    Y . Allouah, R. Guerraoui, N. Gupta, R. Pinot, and J. Stephan, “On the privacy-robustness-utility trilemma in distributed learning,” inProc. ICML, 2023

    2023

  35. [43]

    Dp-brem: Differentially-private and byzantine-robust federated learning with client momentum,

    X. Gu, M. Li, and L. Xiong, “Dp-brem: Differentially-private and byzantine-robust federated learning with client momentum,”arXiv preprint arXiv:2306.12608, 2023

    2023 arXiv

  36. [44]

    The fun- damental price of secure aggregation in differentially private federated learning,

    W.-N. Chen, C. A. C. Choo, P. Kairouz, and A. T. Suresh, “The fun- damental price of secure aggregation in differentially private federated learning,” inProc. ICML, 2022, pp. 3056–3089

    2022

  37. [45]

    How to share a secret,

    A. Shamir, “How to share a secret,”Commun. ACM, 1979

    1979

  38. [46]

    On sharing secrets and reed-solomon codes,

    R. J. McEliece and D. V . Sarwate, “On sharing secrets and reed-solomon codes,”Commun. ACM, 1981

    1981

  39. [47]

    Lagrange coded computing: Optimal design for resiliency, security, and privacy,

    Q. Yu, S. Li, N. Raviv, S. M. M. Kalan, M. Soltanolkotabi, and S. A. Avestimehr, “Lagrange coded computing: Optimal design for resiliency, security, and privacy,” inProc. AISTATS, 2019. 13

    2019

  40. [48]

    Semi- homomorphic encryption and multiparty computation,

    R. Bendlin, I. Damg ˚ard, C. Orlandi, and S. Zakarias, “Semi- homomorphic encryption and multiparty computation,” inProc. EURO- CRYPT, 2011

    2011

  41. [49]

    Simplified vss and fast-track multiparty computations with applications to threshold cryptography,

    R. Gennaro, M. O. Rabin, and T. Rabin, “Simplified vss and fast-track multiparty computations with applications to threshold cryptography,” inProc. ACM PODC, 1998

    1998

  42. [50]

    A full proof of the bgw protocol for perfectly secure multiparty computation,

    G. Asharov and Y . Lindell, “A full proof of the bgw protocol for perfectly secure multiparty computation,”J. Cryptology, 2017

    2017

  43. [51]

    Efficient multiparty protocols using circuit randomization,

    D. Beaver, “Efficient multiparty protocols using circuit randomization,” inAdv. Cryptology—CRYPTO’91, 1992

    1992

  44. [52]

    Completeness theorems for non-cryptographic fault-tolerant distributed computation,

    M. Ben-Or, S. Goldwasser, and A. Wigderson, “Completeness theorems for non-cryptographic fault-tolerant distributed computation,” inProc. ACM STOC, 1988

    1988

  45. [53]

    Communication theory of secrecy systems,

    C. E. Shannon, “Communication theory of secrecy systems,”Bell Syst. Tech. J., 1949

    1949

  46. [54]

    The mnist database of handwritten digit images for machine learning research,

    L. Deng, “The mnist database of handwritten digit images for machine learning research,”IEEE Signal Process. Mag., 2012

    2012

  47. [55]

    Fashion-mnist: A novel image dataset for benchmarking machine learning algorithms,

    H. Xiao, K. Rasul, and R. V ollgraf, “Fashion-mnist: A novel image dataset for benchmarking machine learning algorithms,”arXiv preprint arXiv:1708.07747, 2017

    2017 arXiv

  48. [56]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky and G. Hinton, “Learning multiple layers of features from tiny images,” Univ. of Toronto, Tech. Rep., 2009

    2009

  49. [57]

    Manipulating the byzantine: Opti- mizing model poisoning attacks and defenses for federated learning,

    V . Shejwalkar and A. Houmansadr, “Manipulating the byzantine: Opti- mizing model poisoning attacks and defenses for federated learning,” in Proc. NDSS, 2021

    2021

  50. [58]

    A little is enough: Circum- venting defenses for distributed learning,

    G. Baruch, M. Baruch, and Y . Goldberg, “A little is enough: Circum- venting defenses for distributed learning,”Adv. Neural Inf. Process. Syst., 2019

    2019

  51. [59]

    Local model poisoning attacks to byzantine-robust federated learning,

    M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to byzantine-robust federated learning,” inProc. USENIX Sec. Symp., 2020

    2020

  52. [60]

    How to backdoor federated learning,

    E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” inProc. AISTATS, 2020

    2020

  53. [61]

    Private aggregation in wireless federated learning with heterogeneous clusters,

    M. Egger, C. Hofmeister, A. Wachter-Zeh, and R. Bitar, “Private aggregation in wireless federated learning with heterogeneous clusters,” inProc. IEEE ISIT, 2023

    2023

  54. [62]

    Fundamental limits of hierarchical secure aggregation with cyclic user association,

    X. Zhang, Z. Li, K. Wan, H. Sun, M. Ji, and G. Caire, “Fundamental limits of hierarchical secure aggregation with cyclic user association,” arXiv preprint arXiv:2503.04564, 2025

    2025

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.