Pith. sign in

REVIEW 3 major objections 6 minor 63 references

Efficient Full-Stack Private Federated Deep Learning with Post-Quantum Security

T0 review · 3 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that Beskar is the first federated learning framework to combine one-round, high-dropout-resilient secure aggregation with post-quantum cryptography and differential privacy, protecting user data during training and…

desk verdict Useful post-quantum upgrade of e-SeaFL with real efficiency gains, but the modified Dilithium variant lacks a specified Verify and a proof, leaving the core security claim unsubstantiated. read the letter →

arxiv 2505.05751 v1 pith:HFHDI36D submitted 2025-05-09 cs.CR

Yiwei Zhang , Rouzbeh Behnia , Attila A. Yavuz , Reza Ebrahimi , Elisa Bertino This is my paper · ORCID
classification cs.CR
keywords post-quantumcryptographysecureaggregationfederatedlearningdifferentialprivacyDilithiumprecomputationKyberkeyencapsulationdropoutresilience
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Beskar sets out to show that a federated learning system can have post-quantum secure aggregation, differential privacy, and one-round communication at the same time, rather than trading one against the other. The protocol masks every client gradient with precomputed shared-secret masks, so the aggregation server only ever sees the sum, and it adds DP noise on the client side (LDP) or the server side (CDP) depending on which adversary must be stopped. The paper argues this combination is the first to handle high user dropout rates without extra communication rounds while keeping security against quantum attackers. If the claims hold, an organization could deploy privacy-preserving FL with minimal client computation and choose the DP placement to match whether it distrusts the server, the clients, or both. A sympathetic reader would care because existing secure-aggregation schemes are usually classical and multi-round, while DP-only defenses leave individual updates exposed.

What carries the argument

The load-bearing mechanism is the precomputed mask table: each client and each assisting node evaluate a pseudorandom function on the shared secrets and iteration number T times during setup, so the runtime aggregation needs only table lookups, additions, and signature operations. The second mechanism is a precomputation strategy for Dilithium (Algorithm 5) that stores candidate masking vectors y and their commitments w1; signing then computes c=H(m||u||w1) from stored values and only runs the original signing loop when the precomputed list is exhausted. These two mechanisms are what make the one-round protocol efficient, and the whole privacy argument depends on them: the masks must be unpredictable to the server, and the signatures must be unforgeable.

What would settle it

Run the protocol with two honest clients, two assisting nodes, and a malicious server plus one malicious assisting node; if the server can recover either honest client's plaintext gradient from the masked updates and the honest node's mask sum, Theorem 1's privacy claim fails. A second check is to feed the modified signing algorithm a long sequence of messages and test whether any two published signatures reuse the same commitment value w1 or masking vector y; a reuse would immediately undermine unforgeability, which the paper's claims rule out.

Watch

Extended reading notes

Core claim

The central claim is that masking can be moved almost entirely offline: in a one-time setup, each client derives T mask vectors from PRF evaluations on secrets shared with k assisting nodes, and the assisting nodes precompute the corresponding sums, so at every training iteration a client sends only one masked update and a signed participation message. The server verifies signatures, checks that all participant lists match, sums the masked updates, and subtracts the assisting nodes' mask sums to obtain the global model exactly as in plain FL. The paper further claims this design, instantiated with the Kyber key-encapsulation mechanism and an optimized Dilithium signature, is the only one among compared schemes that combines a single aggregation round, high dropout resilience, post-quantum security, and protection of user data during and after training. Differential privacy is layered on top according to three threat models: LDP when the server is the adversary, CDP when clients are the adversary, and both when full-stack privacy is required.

Load-bearing premise

The load-bearing premise is that the altered signature routine that precomputes part of the hash still prevents an attacker from forging a signature on a new message; the proof treats signing as a black box and never analyzes this altered routine.

Editorial extensions

If this is right

  • A client's runtime work stays constant as the number of clients grows, since the client only masks, signs, and sends; all per-client verification falls on the server and assisting nodes.
  • Dropouts stop adding protocol rounds: as long as the fraction of online clients stays above alpha, aggregation proceeds by simply ignoring the dropped clients' masks.
  • Deployments can choose DP placement by threat model: LDP protects gradients from a malicious server, CDP protects intermediate and final models from malicious clients, and both together cover the full stack.
  • Post-quantum confidentiality and authenticity are inherited from the lattice-based KEM and signature schemes, so the protocol's privacy guarantees are aimed at adversaries with quantum computers.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The proof's black-box EU-CMA assumption leaves the modified Dilithium variant in Algorithm 5 unanalyzed; a natural next step is either a direct security proof for the precomputed hash chain or a return to the standard signing hash.
  • Because masks are derived from PRF outputs over shared secrets, the same design could trade the precomputed mask table for on-the-fly PRF evaluation on devices with more CPU than memory, shifting the paper's efficiency profile without changing its privacy argument.
  • The DP results suggest a deployment heuristic the paper does not state: for a fixed privacy budget on a hard dataset, CDP should be preferred when the server is trusted, while LDP's accuracy cost should be budgeted explicitly when the server is not.
  • The reported accuracy gap between LDP and CDP on CIFAR-100 hints that local noise scales poorly with input complexity, which a practitioner would need to verify on their own data before committing to an untrusted-server deployment.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The manuscript proposes Beskar, a federated learning framework that combines a one-round post-quantum secure aggregation protocol (based on Kyber KEM, Dilithium signatures, precomputed masks, and assisting nodes) with differential privacy applied at the client (LDP) and server (CDP) levels. It defines three threat models (TM1-TM3) and claims high dropout resilience, post-quantum security, and large efficiency gains from two precomputation strategies. The paper includes an analytical comparison, an implementation, and experiments on efficiency and model accuracy under various DP settings.

Significance. The protocol structure has clear practical motivation: one-round secure aggregation with only k assisting nodes, precomputed masks to avoid per-iteration PRF computation, and precomputed Dilithium parameters to reduce signing cost are sensible engineering ideas. The evaluation against Flamingo, PQSA, e-SeaFL, and MicroFedML provides a useful comparison, and the reproduction of DP trade-offs across five datasets is a helpful reference for practitioners. If the security proof were complete, the paper would be a solid systems contribution to post-quantum FL. The main obstacle is that the security of the actual, optimized signature scheme is not established.

major comments (3)
  1. [Appendix A, Algorithm 5; Section IV-F] The precomputation signing path in Algorithm 5 computes u = CRH(tr) and c = H(m||u||w1), whereas the fallback path and the standard Dilithium verification in Algorithm 4 are based on mu = CRH(tr||m) (in the fallback) or on H(m||w1') (in the printed Verify). No verification algorithm is specified for signatures generated by the precomputation path, so it is unclear how they pass verification in Algorithm 2. If verification is modified to accept the u-based challenge, the modified scheme is not covered by the EU-CMA security of Dilithium; if it is not modified, the precomputation path is functionally unusable. The proof of Theorem 1 invokes generic EU-CMA (Definition 8) and uses Pi.Sign, not the PSgn routine with LS actually executed by the protocol. The authors must either prove EU-CMA for the u-based variant (or design the optimization so that the standard Fiat-Shamir transform is preserved) and provide a matching, secure verification procedure.
  2. [Section I-A; Section V-B, Table III] The contribution states that the optimizations yield '134x, 1.1x, and 1233x' improvements in the aggregation phase with 1,000 clients. Table III for N=1000 gives client times 134 ms (without) and 2 ms (with), i.e., a 67x speedup, not 134x; the 134x figure appears to be the absolute precomputation-free time rather than a ratio. The server ratio is 417/377 about 1.1x and the assisting node ratio is 43144/35 about 1233x, so the client number should be corrected.
  3. [Section IV-C] The high dropout resilience claimed in Table I is only fully specified for client dropouts. For assisting-node dropout, the paper says a simple secret-sharing scheme can be used to distribute a node's secret among other assisting nodes, but no protocol, threshold, or security analysis is given. Since the aggregation server requires the aggregated masking terms from the assisting nodes, a dropout or compromise pattern not covered by this sketch could affect the one-round and privacy guarantees. Please specify the mechanism and account for it in the security analysis, or soften the claim.
minor comments (6)
  1. [Section III-C vs Appendix B] Definitions 6 and 7 in the main text are renumbered as Definitions 8 and 9 in the appendix and in the proof of Theorem 1; align the numbering to avoid confusion.
  2. [Section V-B] The practice of reporting the highest accuracy across five training runs, without mean or variance, makes it difficult to assess whether the differences in Table IV are significant; please report error bars or standard deviations.
  3. [Section V-D] The efficiency experiments use a gradient vector size of 16,000 while the deep models in Table IV have far more parameters; please note that the timing results are for synthetic gradients and may not translate directly to the evaluated models.
  4. [Algorithm 2, step 4] The sentence 'checks if |LS,t| = |L1,t| = ... = |Lk,t|, does not hold it aborts' should be rewritten as 'aborts if the equality does not hold.'
  5. [Acknowledgment and Section V-B] There is a stray 's' in the acknowledgment after the first sentence, and the word 'clinets' appears in Section V-B instead of 'clients.'
  6. [Definition 3] The expression 'P j e QL xj' is garbled; the intended summation over the subset should be written clearly.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: Beskar rests on standard mask cancellation, external PQ primitives, and external benchmarks; the modified-Dilithium EU-CMA issue is a proof gap, not a circular derivation.

full rationale

Beskar's derivation chain is not circular. The aggregation protocol is the standard mask-cancellation construction (Algorithm 2), where the server computes wt = sum_i y_i^Pi - sum_j a_j^t; the masks are PRF evaluations on shared secrets, so the cancelation is algebraic by construction rather than an output fitted to the security claim. The DP integration composes standard LDP and CDP mechanisms with Opacus-based accounting, and the accuracy results are empirically measured against external baselines (Flamingo, PQSA, e-SeaFL, MicroFedML). Theorem 1 is a standard hybrid argument that invokes IND-CCA security of Kyber and EU-CMA security of the signature scheme as assumptions, following the e-SeaFL framework [6]; these are external or previously published results, not redefinitions of Beskar's target claim. The one significant caveat is that Algorithm 5 modifies Dilithium's hash input (u = CRH(tr) instead of mu = CRH(tr||m)) and no modified Verify algorithm is specified, so the EU-CMA premise used in Hyb3 is not formally established for the exact PSgn instantiation. This is a genuine proof gap and correctness risk, but it is not circular: the paper does not define PSgn in terms of the theorem's conclusion, nor does it fit a parameter and rename it as a prediction. Benchmarks against external protocols are falsifiable and self-contained. Therefore no circular step is identified.

Assumptions & free parameters 2 free parameters · 9 assumptions · 0 invented entities

No fitted constants appear in the cryptographic derivation. The ledger contains standard cryptographic hardness assumptions, one unproven ad hoc assumption for the modified Dilithium signing algorithm, and operational assumptions about honest parties and channels. No new mathematical entities are introduced; assisting nodes and the aggregation architecture are inherited from prior secure aggregation designs.

free parameters (2)
  • alpha (minimum participation fraction) = not set in paper (deployer-chosen)
    Load-bearing threshold in the alpha-summation functionality and Algorithm 2; no specific value is given or fitted, yet the privacy claim only holds if the threshold is met.
  • N (precomputed Dilithium parameter groups) = implementation-dependent
    Storage and computation trade-off for Algorithm 5; chosen by implementer rather than fitted to data, but it drives the claimed efficiency gains.
assumptions (9)
  • standard math Kyber KEM is IND-CCA secure under Module-LWE
    Invoked in Theorem 1 proof to replace shared secrets with random keys (Hyb2).
  • standard math Dilithium signatures are EU-CMA secure
    Used for message authentication in Algorithms 1 and 2; Theorem 1 relies on EU-CMA.
  • ad hoc to paper Precomputed Dilithium variant in Algorithm 5 is EU-CMA secure
    The paper modifies Dilithium by precomputing u=CRH(tr) and computing c=H(m||u||w1); no security proof is given for this variant despite Algorithm 5 being a central optimization.
  • domain assumption At least one assisting node remains honest
    Theorem 1 and the simulator require at least one honest assisting node; stated in Section III-C and IV-F.
  • domain assumption At least alpha fraction of legitimate users participate in each iteration
    The alpha-summation ideal functionality and Algorithm 2 threshold check require sufficient participation to avoid leaking individual updates.
  • domain assumption Authenticated channels and a secure public key infrastructure exist
    Section III.B says, consistent with [26], that a secure and authenticated channel is assumed.
  • domain assumption Compromised parties follow the protocol
    Section III.B states: 'we assume that the compromised parties will follow the protocol' even though the adversary is called malicious.
  • domain assumption Central DP requires an honest aggregation server
    Corollary 2 explicitly notes that CDP is implemented on the server and assumes an honest server.
  • domain assumption Renyi differential privacy accountant and Opacus noise calibration are correct
    Section V.B relies on Opacus and Renyi DP to compute noise multipliers and privacy budgets.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Efficient Full-Stack Private Federated Deep Learning with Post-Quantum Security." pith.science (2026). https://pith.science/paper/HFHDI36D

@misc{pith2026250505751,
  author       = {Pith},
  title        = {Pith review of: Efficient Full-Stack Private Federated Deep Learning with Post-Quantum Security},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HFHDI36D}},
  note         = {Machine review of arXiv:2505.05751}
}
read the original abstract

Federated learning (FL) enables collaborative model training while preserving user data privacy by keeping data local. Despite these advantages, FL remains vulnerable to privacy attacks on user updates and model parameters during training and deployment. Secure aggregation protocols have been proposed to protect user updates by encrypting them, but these methods often incur high computational costs and are not resistant to quantum computers. Additionally, differential privacy (DP) has been used to mitigate privacy leakages, but existing methods focus on secure aggregation or DP, neglecting their potential synergies. To address these gaps, we introduce Beskar, a novel framework that provides post-quantum secure aggregation, optimizes computational overhead for FL settings, and defines a comprehensive threat model that accounts for a wide spectrum of adversaries. We also integrate DP into different stages of FL training to enhance privacy protection in diverse scenarios. Our framework provides a detailed analysis of the trade-offs between security, performance, and model accuracy, representing the first thorough examination of secure aggregation protocols combined with various DP approaches for post-quantum secure FL. Beskar aims to address the pressing privacy and security issues FL while ensuring quantum-safety and robust performance.

Figures

Figures reproduced from arXiv: 2505.05751 by the authors.

Figure 1
Figure 1. Beskar’s System Model and for any subset of output Y ⊆ Y, P(M(X) ∈ Y ) ≤ exp(ϵ) · P(M(X′ ) ∈ Y ) + δ holds. The parameter (ϵ, δ) is often called the privacy budget. Specifically, ϵ represents the privacy guarantee: a lower ϵ corresponds to a higher level of privacy; and δ indicates the probability that the upper-bound does not hold. III. MODELS In this section, we first introduce the system model for Beskar, then de… view at source ↗
Figure 2
Figure 2. An overview of Beskar’s architecture and how it fits in the existing FL workflow. A. High-level Idea The design of Beskar is based on two main observa￾tions: (1) The main overhead in privacy-preserving FL arises from the underlying cryptographic operations. This is further exacerbated when post-quantum security is considered. (2) The training takes place over a small number of iterations, typically between 20 and 50… view at source ↗
Figure 3
Figure 3. Computation Time of the Setup phase (The dimension of the weight list is set to 16K.) [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Computation Time of the Aggregation phase (The dimension of the weight list is set to 16K.) [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 5
Figure 5. Figure 5: Bandwidth in the Setup Phase (The dimension of the weight list is set to 16K.) [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]
Figure 6
Figure 6. Figure 6: Bandwidth in the Aggregation phase (The dimension of the weight list is set to 16K.) [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]
Figure 7
Figure 7. Figure 7: Effect of Epsilon, Iterations, and Clients on Noise. [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

63 extracted references · 37 canonical work pages

  1. [1]

    Extracting training data from large language models,

    N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert-V oss, K. Lee, A. Roberts, T. Brown, D. Song, U. Erlingsson et al., “Extracting training data from large language models,” in 30th USENIX Security Symposium (USENIX Security 21) , 2021, pp. 2633–2650

    2021

  2. [2]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE symposium on security and privacy (SP) . IEEE, 2017, pp. 3–18

    2017

  3. [3]

    The secret sharer: Evaluating and testing unintended memorization in neural net- works,

    N. Carlini, C. Liu, ´U. Erlingsson, J. Kos, and D. Song, “The secret sharer: Evaluating and testing unintended memorization in neural net- works,” in 28th USENIX security symposium (USENIX security 19) , 2019, pp. 267–284

    work page 2019

  4. [4]

    Practical secure aggregation for privacy-preserving machine learning,

    K. Bonawitz, V . Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, “Practical secure aggregation for privacy-preserving machine learning,” in Computer and Communi- cations Security, 2017, pp. 1175–1191

    work page 2017

  5. [5]

    ELSA: Secure aggrega- tion for federated learning with malicious actors,

    M. Rathee, C. Shen, S. Wagh, and R. A. Popa, “ELSA: Secure aggrega- tion for federated learning with malicious actors,” in IEEE symposium on security and privacy (SP) , 2023, pp. 1961–1979

    work page 2023

  6. [6]

    Efficient Secure Aggregation for Privacy-Preserving Federated Machine Learning

    R. Behnia, M. Ebrahimi, A. Riasi, S. S. Chow, B. Padmanabhan, and T. Hoang, “Efficient secure aggregation for privacy-preserving federated machine learning,” arXiv preprint arXiv:2304.03841 , 2023

    work page Pith review arXiv 2023

  7. [7]

    Secure single-server aggregation with (poly) logarithmic overhead,

    J. H. Bell, K. A. Bonawitz, A. Gasc ´on, T. Lepoint, and M. Raykova, “Secure single-server aggregation with (poly) logarithmic overhead,” in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, 2020, pp. 1253–1269

    2020

  8. [8]

    A hybrid approach to privacy-preserving federated learning,

    S. Truex, N. Baracaldo, A. Anwar, T. Steinke, H. Ludwig, R. Zhang, and Y . Zhou, “A hybrid approach to privacy-preserving federated learning,” in Proceedings of the 12th ACM workshop on artificial intelligence and security, 2019, pp. 1–11

    work page 2019

Show all 63 references
  1. [9]

    Privex: Private collection of traf- fic statistics for anonymous communication networks,

    T. Elahi, G. Danezis, and I. Goldberg, “Privex: Private collection of traf- fic statistics for anonymous communication networks,” in Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, 2014, pp. 1068–1079

    2014

  2. [10]

    A post-quantum secure aggregation for federated learning,

    S. Yang, Y . Chen, S. Tu, and Z. Yang, “A post-quantum secure aggregation for federated learning,” in Proceedings of the 2022 12th International Conference on Communication and Network Security , 2022, pp. 117–124

    2022

  3. [11]

    L. Chen, L. Chen, S. Jordan, Y .-K. Liu, D. Moody, R. Peralta, R. A. Perlner, and D. Smith-Tone,NIST Report on post-quantum cryptography. US Department of Commerce, National Institute of Standards and Technology . . . , 2016, vol. 12

    2016

  4. [12]

    Nist post-quantum cryptography standardization,

    “Nist post-quantum cryptography standardization,” https://csrc.nist.gov/projects/post-quantum-cryptography, 2024

    2024

  5. [13]

    Report on post-quantum cryptogrphy,

    “Report on post-quantum cryptogrphy,” https://www.whitehouse.gov/ wp-content/uploads/2024/07/REF PQC-Report FINAL Send.pdf, 2024

    2024

  6. [14]

    Nist selected post-quantum cryptography algorithms 2022,

    “Nist selected post-quantum cryptography algorithms 2022,” https://csrc.nist.gov/Projects/post-quantum-cryptography/selected- algorithms-2022, 2024

    2022

  7. [15]

    TACHYON: fast signatures from compact knapsack,

    R. Behnia, M. O. Ozmen, A. A. Yavuz, and M. Rosulek, “TACHYON: fast signatures from compact knapsack,” in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS) . ACM, 2018, pp. 1855–1867

    2018

  8. [16]

    Towards practical post-quantum signatures for resource-limited internet of things,

    R. Behnia and A. A. Yavuz, “Towards practical post-quantum signatures for resource-limited internet of things,” in Proceedings of the 37th Annual Computer Security Applications Conference , 2021, p. 119–130

    2021

  9. [17]

    Differential privacy,

    C. Dwork, “Differential privacy,” in International colloquium on au- tomata, languages, and programming . Springer, 2006, pp. 1–12

    2006

  10. [18]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. J. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, Vienna, Austria, October 24-28, 2016 , E. R. Weippl, S. ...

    2016

  11. [19]

    {V oltPillager}: Hardware-based fault injection attacks against intel{SGX} enclaves using the {SVID} voltage scaling interface,

    Z. Chen, G. Vasilakis, K. Murdock, E. Dean, D. Oswald, and F. D. Garcia, “{V oltPillager}: Hardware-based fault injection attacks against intel{SGX} enclaves using the {SVID} voltage scaling interface,” in 30th USENIX Security Symposium (USENIX Security 21) , 2021, pp. 699–716. 16

    2021

  12. [20]

    Foreshadow: Extracting the keys to the intel {SGX} kingdom with transient {Out- of-Order} execution,

    J. Van Bulck, M. Minkin, O. Weisse, D. Genkin, B. Kasikci, F. Piessens, M. Silberstein, T. F. Wenisch, Y . Yarom, and R. Strackx, “Foreshadow: Extracting the keys to the intel {SGX} kingdom with transient {Out- of-Order} execution,” in 27th USENIX Security Symposium (USENIX Se...

    2018

  13. [21]

    Local differential privacy for federated learn- ing,

    M. A. P. Chamikara, D. Liu, S. Camtepe, S. Nepal, M. Grobler, P. Bertok, and I. Khalil, “Local differential privacy for federated learn- ing,” arXiv preprint arXiv:2202.06053 , 2022

    2022 arXiv

  14. [22]

    Ldp-fed: Federated learning with local differential privacy,

    S. Truex, L. Liu, K.-H. Chow, M. E. Gursoy, and W. Wei, “Ldp-fed: Federated learning with local differential privacy,” in Proceedings of the third ACM international workshop on edge systems, analytics and networking, 2020, pp. 61–66

    2020

  15. [23]

    Advances and open problems in federated learning,

    P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. Bonawitz, Z. Charles, G. Cormode, R. Cummings et al. , “Advances and open problems in federated learning,” Foundations and trends® in machine learning , vol. 14, no. 1–2, pp. 1–210, 2021

    2021

  16. [24]

    Privacy amplification via random check-ins,

    B. Balle, P. Kairouz, B. McMahan, O. Thakkar, and A. Guha Thakurta, “Privacy amplification via random check-ins,” Advances in Neural Information Processing Systems , vol. 33, pp. 4623–4634, 2020

    2020

  17. [25]

    Training production language models without memorizing user data,

    S. Ramaswamy, O. Thakkar, R. Mathews, G. Andrew, H. B. McMa- han, and F. Beaufays, “Training production language models without memorizing user data,” arXiv preprint arXiv:2009.10031 , 2020

    2009 arXiv

  18. [26]

    Flamingo: Multi-round single-server secure aggregation with applications to private federated learning,

    Y . Ma, J. Woods, S. Angel, A. Polychroniadou, and T. Rabin, “Flamingo: Multi-round single-server secure aggregation with applications to private federated learning,” in 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023, pp. 477–496

    2023

  19. [27]

    Microfedml: Privacy preserving federated learning for small weights,

    Y . Guo, A. Polychroniadou, E. Shi, D. Byrd, and T. Balch, “Microfedml: Privacy preserving federated learning for small weights,” in The 4th Privacy-Preserving Machine Learning Workshop 2022 , 2022, p. avail- able: https://ia.cr/2022/714

    2022

  20. [28]

    Crystals-dilithium: A lattice-based digital signature scheme,

    L. Ducas, E. Kiltz, T. Lepoint, V . Lyubashevsky, P. Schwabe, G. Seiler, and D. Stehl ´e, “Crystals-dilithium: A lattice-based digital signature scheme,” IACR Transactions on Cryptographic Hardware and Embedded Systems, pp. 238–268, 2018

    2018

  21. [29]

    Crystals-kyber: a cca-secure module-lattice- based kem,

    J. Bos, L. Ducas, E. Kiltz, V . Lyubashevsky, J. M. Schanck, P. Schwabe, G. Seiler, and D. Stehl ´e, “Crystals-kyber: a cca-secure module-lattice- based kem,” in2018 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 2018, pp. 353–367

    2018

  22. [30]

    Eta: efficient and tiny and authentication for heteroge- neous wireless systems,

    A. A. Yavuz, “Eta: efficient and tiny and authentication for heteroge- neous wireless systems,” in Proceedings of the sixth ACM conference on Security and privacy in wireless and mobile networks , 2013, pp. 67–72

    2013

  23. [31]

    Tachyon: Fast signatures from compact knapsack,

    R. Behnia, M. O. Ozmen, A. A. Yavuz, and M. Rosulek, “Tachyon: Fast signatures from compact knapsack,” in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security , ser. CCS ’18. New York, NY , USA: ACM, 2018, pp. 1855–1867

    2018

  24. [32]

    Crystals – dilithium: Digital signatures from module lattices,

    L. Ducas, T. Lepoint, V . Lyubashevsky, P. Schwabe, G. Seiler, and D. Stehle, “Crystals – dilithium: Digital signatures from module lattices,” Cryptology ePrint Archive, Report 2017/633, 2017, http://eprint.iacr.org/ 2017/633

    2017

  25. [33]

    Ldp-fl: Practical private aggregation in federated learning with local differential privacy,

    L. Sun, J. Qian, and X. Chen, “Ldp-fl: Practical private aggregation in federated learning with local differential privacy,” arXiv preprint arXiv:2007.15789, 2020

    2007 arXiv

  26. [34]

    Differentially private federated learning: A client level perspective,

    R. C. Geyer, T. Klein, and M. Nabi, “Differentially private federated learning: A client level perspective,” arXiv preprint arXiv:1712.07557 , 2017

    2017 arXiv

  27. [35]

    {PrivateFL}: Accurate, differentially private federated learning via personalized data transfor- mation,

    Y . Yang, B. Hui, H. Yuan, N. Gong, and Y . Cao, “{PrivateFL}: Accurate, differentially private federated learning via personalized data transfor- mation,” in 32nd USENIX Security Symposium (USENIX Security 23) , 2023, pp. 1595–1612

    2023

  28. [36]

    Secure single-server aggregation with (poly)logarithmic overhead,

    J. H. Bell, K. A. Bonawitz, A. Gasc ´on, T. Lepoint, and M. Raykova, “Secure single-server aggregation with (poly)logarithmic overhead,” in Computer and Communications Security , ser. CCS ’20. New York, NY , USA: Association for Computing Machinery, 2020, p. 1253–1269. [Online...

    2020

  29. [37]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, 2016, pp. 308–318

    2016

  30. [38]

    Benchmarking post-quantum cryptography in tls,

    C. Paquin, D. Stebila, and G. Tamvada, “Benchmarking post-quantum cryptography in tls,” in Post-Quantum Cryptography: 11th International Conference, PQCrypto 2020, Paris, France, April 15–17, 2020, Pro- ceedings 11. Springer, 2020, pp. 72–91

    2020

  31. [39]

    Bounding training data recon- struction in dp-sgd,

    J. Hayes, B. Balle, and S. Mahloujifar, “Bounding training data recon- struction in dp-sgd,” Advances in neural information processing systems, vol. 36, pp. 78 696–78 722, 2023

    2023

  32. [40]

    How to share a secret,

    A. Shamir, “How to share a secret,” Commun. ACM , vol. 22, no. 11, p. 612–613, nov 1979. [Online]. Available: https://doi.org/10.1145/ 359168.359176

    1979

  33. [41]

    Sphincs: practical stateless hash-based signatures,

    D. J. Bernstein, D. Hopwood, A. H ¨ulsing, T. Lange, R. Niederha- gen, L. Papachristodoulou, M. Schneider, P. Schwabe, and Z. Wilcox- O’Hearn, “Sphincs: practical stateless hash-based signatures,” in Annual international conference on the theory and applications of cryptograph...

    2015

  34. [42]

    Enhancing quantum security over federated learning via post-quantum cryptography,

    P. Li, T. Chen, and J. Liu, “Enhancing quantum security over federated learning via post-quantum cryptography,” arXiv preprint arXiv:2409.04637, 2024

    2024 arXiv

  35. [43]

    On removing rejection conditions in practical lattice-based signatures,

    R. Behnia, Y . Chen, and D. Masny, “On removing rejection conditions in practical lattice-based signatures,” in Post-Quantum Cryptography: 12th International Workshop, PQCrypto 2021, Daejeon, South Korea, July 20–22, 2021, Proceedings 12 . Springer, 2021, pp. 380–398

    2021

  36. [44]

    Abides: Towards high-fidelity market simulation for ai research,

    D. Byrd, M. Hybinette, and T. H. Balch, “Abides: Towards high-fidelity market simulation for ai research,” arXiv preprint arXiv:1904.12066 , 2019

    1904 arXiv

  37. [45]

    Crystals-kyber python implementation,

    “Crystals-kyber python implementation,” https://github.com/GiacomoPope/kyber-py, 2024

    2024

  38. [46]

    Crystals-dilithium c implementation,

    “Crystals-dilithium c implementation,” https://github.com/pq- crystals/dilithium, 2024

    2024

  39. [47]

    Ascon v1. 2: Lightweight authenticated encryption and hashing,

    C. Dobraunig, M. Eichlseder, F. Mendel, and M. Schl ¨affer, “Ascon v1. 2: Lightweight authenticated encryption and hashing,” Journal of Cryptology, vol. 34, pp. 1–42, 2021

    2021

  40. [48]

    Flower: A friendly federated learning research framework,

    D. J. Beutel, T. Topal, A. Mathur, X. Qiu, J. Fernandez-Marques, Y . Gao, L. Sani, K. H. Li, T. Parcollet, P. P. B. de Gusm ˜ao et al. , “Flower: A friendly federated learning research framework,” arXiv preprint arXiv:2007.14390, 2020

    2007 arXiv

  41. [49]

    Pytorch opacus,

    “Pytorch opacus,” https://github.com/pytorch/opacus, 2024

    2024

  42. [50]

    R ´enyi differential privacy,

    I. Mironov, “R ´enyi differential privacy,” in 2017 IEEE 30th computer security foundations symposium (CSF) . IEEE, 2017, pp. 263–275

    2017

  43. [51]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,

    H. Xiao, K. Rasul, and R. V ollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” arXiv preprint arXiv:1708.07747, 2017

    2017 arXiv

  44. [52]

    Emnist: Extending mnist to handwritten letters,

    G. Cohen, S. Afshar, J. Tapson, and A. Van Schaik, “Emnist: Extending mnist to handwritten letters,” in 2017 international joint conference on neural networks (IJCNN) . IEEE, 2017, pp. 2921–2926

    2017

  45. [53]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton et al. , “Learning multiple layers of features from tiny images,” 2009

    2009

  46. [54]

    Multi-class texture analysis in colorectal cancer histology,

    J. N. Kather, C.-A. Weis, F. Bianconi, S. M. Melchers, L. R. Schad, T. Gaiser, A. Marx, and F. G. Z ¨ollner, “Multi-class texture analysis in colorectal cancer histology,” Scientific reports, vol. 6, no. 1, pp. 1–11, 2016

    2016

  47. [55]

    Aggregation service for federated learning: An efficient, secure, and more resilient realization,

    Y . Zheng, S. Lai, Y . Liu, X. Yuan, X. Yi, and C. Wang, “Aggregation service for federated learning: An efficient, secure, and more resilient realization,” IEEE Transactions on Dependable and Secure Computing , vol. 20, no. 2, pp. 988–1001, 2022

    2022

  48. [56]

    {ACORN}: input validation for secure aggregation,

    J. Bell, A. Gasc ´on, T. Lepoint, B. Li, S. Meiklejohn, M. Raykova, and C. Yun, “{ACORN}: input validation for secure aggregation,” in 32nd USENIX Security Symposium (USENIX Security 23) , 2023, pp. 4805– 4822

    2023

  49. [57]

    Eiffel: Ensuring integrity for federated learning,

    A. Roy Chowdhury, C. Guo, S. Jha, and L. van der Maaten, “Eiffel: Ensuring integrity for federated learning,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , 2022, pp. 2535–2549

    2022

  50. [58]

    Model extraction attack on mpc hardened vertical federated learning,

    X. Wang, X. Liu, and X. Yi, “Model extraction attack on mpc hardened vertical federated learning,” in International Conference on Provable Security. Springer, 2024, pp. 63–82

    2024

  51. [59]

    Efficient secure aggregation for privacy-preserving federated machine learning,

    R. Behnia, A. Riasi, R. Ebrahimi, S. S. M. Chow, B. Padmanabhan, and T. Hoang, “Efficient secure aggregation for privacy-preserving federated machine learning,” in 2024 Annual Computer Security Applications Conference (ACSAC), 2024, pp. 778–793

    2024

  52. [60]

    Rofl: Robustness of secure federated learning,

    H. Lycklama, L. Burkhalter, A. Viand, N. K ¨uchler, and A. Hithnawi, “Rofl: Robustness of secure federated learning,” in 2023 IEEE Sympo- sium on Security and Privacy (SP) . IEEE, 2023, pp. 453–476

    2023

  53. [61]

    Sear: Secure and efficient aggregation for byzantine-robust federated learning,

    L. Zhao, J. Jiang, B. Feng, Q. Wang, C. Shen, and Q. Li, “Sear: Secure and efficient aggregation for byzantine-robust federated learning,” IEEE Transactions on Dependable and Secure Computing , vol. 19, no. 5, pp. 3329–3342, 2021

    2021

  54. [62]

    Verifl: Communication-efficient and fast verifiable aggregation for federated learning,

    X. Guo, Z. Liu, J. Li, J. Gao, B. Hou, C. Dong, and T. Baker, “Verifl: Communication-efficient and fast verifiable aggregation for federated learning,” IEEE Transactions on Information Forensics and Security , vol. 16, pp. 1736–1751, 2020. 17 APPENDIX A DETAILED SIGNING ALGORI...

    2020

  55. [63]

    then return 1 3: else return 0 The optimized signing algorithms with precomputation (Al- gorithm 5) build upon the Dilithium algorithms [32] (Algo- rithm 4). The precomputation process aims to enhance signing efficiency by precomputing and storing parameters related to the pri...

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.