Pith. sign in

REVIEW 4 major objections 4 minor 45 references

Hi-SAFE: Hierarchical Secure Aggregation for Lightweight Federated Learning

T0 review · 4 major / 4 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Majority voting in 1-bit federated learning can be done as a low-degree polynomial that hides every sign.

desk verdict Sound core construction, but the headline efficiency numbers are not reproducible from the protocol as written, and the hierarchical variant silently changes the aggregation semantics. read the letter →

arxiv 2511.18887 v1 pith:I3QQYGLP submitted 2025-11-24 cs.LG

Hyeong-Gun Joo , Songnam Hong , Seunghwan Lee , Dong-Joon Shin This is my paper · ORCID
classification cs.LG
keywords federatedlearningsecureaggregationsignSGDmajorityvotecommunicationefficiencyprivacy-preservingmachinefinitefieldpolynomialhierarchicalsubgrouping
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Hi-SAFE claims that the majority vote of 1-bit gradient signs in federated learning can be written exactly as a low-degree polynomial over a finite prime field, making it possible to run SIGNSGD-MV under secure aggregation without exposing individual signs. The polynomial uses a classical number-theoretic indicator identity so that each possible sum selects exactly one term, reproducing the standard majority vote exactly. The paper then partitions users into subgroups so that each secure polynomial stays small, bounding per-user secure multiplications at six and latency at about two subrounds regardless of the total number of users, and cutting per-user communication by over 94 percent for n>=24. A convergence theorem shows the hierarchical vote's error decays exponentially with the number of subgroups when each subgroup's majority is correct with probability above 1/2, and a security theorem shows a semi-honest server learns only subgroup and global majority signs.

What carries the argument

The load-bearing object is the majority-vote polynomial F(x) = sum over m of sign(m)*(1-(x-m)^(p-1)) over F_p, where p is the smallest prime above n; the exponent p-1 maps x=m to 0 and every other field element to 1, so exactly one term survives. Its bounded degree lets the protocol evaluate the vote through correlated multiplication triples with additive secret sharing. In the hierarchical variant, the same polynomial is applied inside subgroups of size n1 and then subgroup votes are combined, bounding the degree, prime size, and per-user cost independently of the total number of users.

What would settle it

For a fixed n and a chosen tie-break rule, enumerate every possible coordinate sum in {-n,-n+2,...,n}, evaluate the proposed polynomial over F_p with p the smallest prime greater than n, and compare each output to the true majority sign; any mismatch falsifies the claimed exact equivalence. The privacy claim could be tested by attempting to recover a single user's sign from a full transcript plus the final vote, which would contradict the stated simulator-based security guarantee.

Watch

Extended reading notes

Core claim

The central claim is that the majority vote of n sign values can be represented exactly, over the prime field F_p with p>n, as a degree-(p-1) polynomial whose terms are indicator functions: each term vanishes for every sum except the one matching its target, so the polynomial returns the sign of the true sum. This is established in Lemma 1, and it means the nonlinear majority-vote operation of SIGNSGD-MV becomes a polynomial that can be evaluated by a sequence of field additions and multiplications. The paper then shows that evaluating this polynomial with additive secret sharing and correlated random multiplication triples reveals only the final vote, and that partitioning users into subgro

Load-bearing premise

The convergence proof assumes every subgroup's majority vote is correct with probability strictly above 1/2 and that these events are independent across subgroups; with very small subgroups near convergence, per-user sign accuracy can fall below 1/2, which would break the exponential error term.

Editorial extensions

If this is right

  • Users send only one bit per parameter, yet the server can compute the global sign vote securely, removing the need for ciphertext-heavy homomorphic encryption in sign-based federated learning.
  • The per-user secure-multiplication count stays at or below six for the optimal subgroup sizes, independent of total user count, making the protocol suitable for bandwidth- and compute-constrained IoT devices.
  • Per-user communication drops by more than 94 percent for n>=24, and total communication drops by up to 52 percent at n=24, compared with flat secure evaluation.
  • Reported experiments on MNIST, FMNIST, and CIFAR-10, including non-IID splits, show model accuracy comparable to plain SIGNSGD-MV.
  • Under a semi-honest server, the protocol discloses subgroup majority votes and the final majority vote, but not individual sign gradients or intermediate arithmetic values.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension not pursued by the paper is applying the same finite-field indicator construction to other finite-input aggregation rules, such as top-k selection or thresholded sums, whenever the output depends only on symbol counts.
  • The privacy-efficiency trade-off is explicitly tunable: shrinking subgroup size n1 cuts communication but increases the residual-leakage probability (2^{-(n1-1)})^d, so a deployment could choose n1 according to its threat tolerance.
  • Because the reported online secure-aggregation cost is under 0.03 seconds per round, the protocol could plausibly be combined with additional privacy mechanisms such as local differential privacy for stronger guarantees, though the paper does not test that combination.
  • The formal guarantee is relative to the leakage of subgroup majority votes; an adversary would likely use those aggregates to narrow down individual signs, so the practical privacy gain over masking depends on whether such aggregate-level inference is acceptable in the target application.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes Hi-SAFE, a secure aggregation framework for sign-based federated learning (SIGNSGD-MV). It constructs a majority-vote polynomial over a finite field using Fermat's Little Theorem, evaluates it securely with Beaver triples under additive secret sharing, and introduces a hierarchical subgrouping scheme intended to bound per-user communication and multiplicative depth. The flat (non-subgrouped) protocol is claimed to reproduce standard SIGNSGD-MV while revealing only the final majority vote. The hierarchical variant aggregates subgroup majority votes, and the paper provides a convergence theorem under a per-subgroup success-probability assumption, a simulation-based security theorem, and experiments on MNIST, FMNIST, and CIFAR-10 reporting large communication reductions.

Significance. If the claims held, the paper would be a useful contribution: the Fermat-based majority polynomial is an elegant construction, Lemma 1 is correct, and the flat secure-evaluation protocol is a sensible application of Beaver triples to sign aggregation. The paper also provides a concrete worked example (Appendix A), an explicit conditional convergence theorem, and a security proof with a stated leakage model. However, the main advertised advances—hierarchical equivalence to flat SIGNSGD-MV, constant bounded communication, and 'only final majority vote' privacy—are weakened by internal inconsistencies in the aggregation definition, the communication-cost accounting, and the privacy leakage. The core polynomial idea is sound, but the hierarchical and quantitative claims need substantial rework before the paper is publishable.

major comments (4)
  1. [§III-D, Eq. (8)] The hierarchical aggregation computes sign(Σ_j sign(Σ_i x_{i,j})), i.e., a majority of subgroup majorities. This is not equal to the flat majority sign(Σ_i x_i) in general. For example, with 3 subgroups of size 3 having votes (++-), (++-), (---), the hierarchical result is +1 while the flat majority is -1. The contribution bullet in §I-A and §III-A claim equivalence to standard SIGNSGD-MV; that equivalence holds only in the flat (ℓ=1) case. Section V compares hierarchical results with flat as if preserving the same aggregation rule. Please either remove the equivalence claim and present hierarchical majority as a distinct rule, or prove conditions under which it coincides with flat majority and align the experiments and claims.
  2. [§V-C, Tables VII–IX; Appendix A] R, the number of secure multiplications, is never derived and is inconsistent with the protocol. Appendix A evaluates F(x)=2x^3+4x with exactly two Beaver multiplications (for x^2 and x^3), i.e., R=2, yet Tables VII and VIII list R=4 for n1=3. For n1=4, deg(F)=4 requires at most three multiplications, but Table VIII lists R=6. Moreover, Algorithm 1 Step 4 requires each user to send two masked field elements per multiplication, and Algorithm 2 Step 7 requires an additional final share; the cost model Cu=R⌈log p1⌉ omits this factor of two, the downlink, the final share, and all offline Beaver-triple generation. The headline reductions of 94% per-user and 52% total communication are computed from these R values and are not reproducible from the manuscript. Please re-derive R, include all online messages (and state offline assumptions), and recompute the communication comparisons.
  3. [§IV-B, Theorem 2; §III-C] The abstract and §III-C state that the protocol reveals only the final majority vote, but Algorithm 3 Step 9 reconstructs each subgroup majority F(x_j) and Theorem 2 explicitly lists the leakage {s_1,...,s_ℓ,s}. This is a weaker privacy guarantee and contradicts the stated contribution. If subgroup-level leakage is an accepted part of the model, the privacy claims and the 'only final majority vote' bullet must be revised accordingly; otherwise an additional secure inter-subgroup aggregation step is needed to hide subgroup majorities.
  4. [§IV-A, Theorem 1; Appendix B] The theorem assumes each subgroup majority is correct with probability q>1/2, independently across subgroups, but this condition is not derived from Assumptions 3–4. For small subgroups (n1=3 or 4) near convergence, per-user sign accuracy can fall below 1/2, so q>1/2 may fail and the e^{-c2ℓ} bound in Eq. (14) does not control the global error. The convergence guarantee for the hierarchical protocol is therefore conditional on an unverified property of the data/noise distribution. Please provide an analytic or empirical justification of q>1/2 in the regimes used in Section V, or state explicitly that convergence is conditional on this additional assumption.
minor comments (4)
  1. [§III-B2, Eq. (2)] The notation v_k, δ^k_{k-v_k}, and ϵ^k_{v_k} is not defined carefully, and the relationship between the loop index k and the Beaver-triple index r is unclear. Please clarify with a consistent index convention.
  2. [Appendix A vs. Algorithm 1] In subround 1 of Appendix A, only User 1 computes and broadcasts (x−a1)(x−b1), whereas Algorithm 1 Step 4 has each user send masked differences to the server. This inconsistency should be resolved by specifying whether the product is public or computed by all users.
  3. [Tables VII–IX] The table headers list both ⌈log p1⌉ and ⌈log p1 −1⌉, but the definitions in §V-C mention only ⌈log p1⌉. The values in the 'R' column do not follow from any stated formula or from the polynomial degrees. Add a precise definition of R and recompute the entries.
  4. [References] Reference [42] is cited as 'J. Smith, Applications of Fermat’s Little Theorem in Cryptography, Journal of Theoretical Cryptography' but has no volume, page, or standard venue information. Please replace it with an established textbook or article on finite-field arithmetic and Fermat's Little Theorem.

Circularity Check

0 steps flagged · score 0.0 of 10

No load-bearing circularity: the majority-vote polynomial is an exact algebraic construction, and the security/convergence arguments do not reduce to their own inputs.

full rationale

The paper's central derivation is not circular. Eq. (1) explicitly constructs F(x) as an indicator-based interpolation over the possible values m of the aggregate sign sum, using Fermat's Little Theorem, and Lemma 1 proves F(x)=sign(x) directly from that theorem. This is an exact algebraic identity, not a fitted prediction: no parameter is tuned to data and no target result is fed back into the construction. The secure-evaluation protocol then evaluates this fixed polynomial using standard Beaver-triple multiplication, so its correctness follows from the polynomial identity plus the standard Beaver correctness relation, and its privacy follows from the usual simulation argument in Theorem 2. The convergence theorem imposes q>1/2 and subgroup independence as explicit assumptions; these are domain hypotheses, not circular references to the protocol's outputs. No uniqueness theorem is imported from the authors' prior work, and self-citations such as [5], [6], and [29] are background references, not load-bearing premises. I note that the communication-cost tables in Sec. V-C appear internally inconsistent with Appendix A (e.g., R=4 for n1=3 while the worked example uses two Beaver multiplications for x^2 and x^3), but that is an accounting/correctness concern, not circularity: the cost model is a definition, not a fitted prediction. Therefore the appropriate circularity finding is no significant circularity, score 0.

Assumptions & free parameters 0 free parameters · 6 assumptions · 0 invented entities

The central protocol relies on standard finite-field math and standard cryptographic/MPC assumptions; no new particles, forces, or fitted physical constants are introduced. The two nonstandard assumptions are the per-subgroup success probability q>1/2 and the availability of a secure offline Beaver-triple generation service whose cost is excluded from communication accounting.

assumptions (6)
  • standard math Fermat's Little Theorem: for prime p and integer a, a^{p-1} ≡ 1 if a not ≡ 0 (mod p), and 0 otherwise.
    Used in Eq. (1) to build the indicator (1-(x-m)^{p-1}) for the majority-vote polynomial.
  • standard math p is the smallest prime greater than n, and all inputs xi lie in {-1,+1}, so the Fermat indicator has no collisions.
    Needed so that (x-m)^{p-1} is 0 exactly when x=m; since x and m have the same parity, x-m is even and cannot be a nonzero multiple of an odd prime p.
  • domain assumption Semi-honest adversaries corrupting at most t ≤ n−1 users, with Beaver triples generated by a secure offline MPC protocol independent of inputs.
    Security Theorem 2 and Lemma 2 in Appendix C depend on this; the cost of the offline triple-generation MPC is not included in the communication model.
  • domain assumption Assumptions 1-4: f is lower bounded, coordinate-wise L-smooth, unbiased stochastic gradients with bounded variance, symmetric and unimodal noise.
    These are inherited from the signSGD convergence analysis of [25] and are invoked in the proof of Theorem 1.
  • ad hoc to paper Each subgroup's majority vote is correct with probability q > 1/2, independently across subgroups.
    Stated as a supposition before Theorem 1 and not derived from the noise model. It is the load-bearing premise for the hierarchical convergence bound and can fail for small subgroups near convergence.
  • domain assumption All users in a subgroup remain online throughout the sequential Beaver subrounds.
    Algorithm 1 requires every user to send masked values in every subround; unlike plain SIGNSGD-MV, the protocol as described is not dropout-tolerant.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Hi-SAFE: Hierarchical Secure Aggregation for Lightweight Federated Learning." pith.science (2026). https://pith.science/paper/I3QQYGLP

@misc{pith2026251118887,
  author       = {Pith},
  title        = {Pith review of: Hi-SAFE: Hierarchical Secure Aggregation for Lightweight Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/I3QQYGLP}},
  note         = {Machine review of arXiv:2511.18887}
}
read the original abstract

Federated learning (FL) faces challenges in ensuring both privacy and communication efficiency, particularly in resource-constrained environments such as Internet of Things (IoT) and edge networks. While sign-based methods, such as sign stochastic gradient descent with majority voting (SIGNSGD-MV), offer substantial bandwidth savings, they remain vulnerable to inference attacks due to exposure of gradient signs. Existing secure aggregation techniques are either incompatible with sign-based methods or incur prohibitive overhead. To address these limitations, we propose Hi-SAFE, a lightweight and cryptographically secure aggregation framework for sign-based FL. Our core contribution is the construction of efficient majority vote polynomials for SIGNSGD-MV, derived from Fermat's Little Theorem. This formulation represents the majority vote as a low-degree polynomial over a finite field, enabling secure evaluation that hides intermediate values and reveals only the final result. We further introduce a hierarchical subgrouping strategy that ensures constant multiplicative depth and bounded per-user complexity, independent of the number of users n.

Figures

Figures reproduced from arXiv: 2511.18887 by the authors.

Figure 1
Figure 1. Hi-SAFE: Hierarchical Secure Aggregation Frame￾work. the best of our knowledge, this is the first work to provide end-to-end privacy within sign-based FL frameworks. • Efficient Majority Vote Polynomial: Based on Fermat’s Little Theorem, we construct the majority vote as a low￾degree polynomial over a finite field and show that its secure evaluation is equivalent to the standard (non-private) SIGNSGD-MV, guaranteein… view at source ↗
Figure 2
Figure 2. Performance comparison of different tie-breaking poli [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Performance comparison of tie-breaking policies on the [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (1 more)
Figure 6
Figure 6. Figure 6: Impact of optimal subgrouping on secure multiplication [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 6 linked inside Pith

  1. [1]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” inArtificial intelligence and statistics. PMLR, 2017, pp. 1273– 1282

    2017

  2. [2]

    Recent advances on federated learning for cybersecurity and cybersecurity for federated learning for internet of things,

    B. Ghimire and D. B. Rawat, “Recent advances on federated learning for cybersecurity and cybersecurity for federated learning for internet of things,”IEEE Internet of Things Journal, vol. 9, no. 11, pp. 8229–8249, 2022

    2022

  3. [3]

    Federated learning for medical applications: A taxonomy, current trends, challenges, and future research directions,

    A. Rauniyar, D. H. Hagos, D. Jha, J. E. H ˚akeg˚ard, U. Bagci, D. B. Rawat, and V . Vlassov, “Federated learning for medical applications: A taxonomy, current trends, challenges, and future research directions,” IEEE Internet of Things Journal, vol. 11, no. 5, pp. 7374–7398, 2023

    2023

  4. [4]

    Federated learning: Challenges, methods, and future directions,

    T. Li, A. K. Sahu, A. Talwalkar, and V . Smith, “Federated learning: Challenges, methods, and future directions,”IEEE Signal Processing Magazine, vol. 37, no. 3, pp. 50–60, 2020

    2020

  5. [5]

    Communication-efficient randomized algorithm for multi-kernel online federated learning,

    S. Hong and J. Chae, “Communication-efficient randomized algorithm for multi-kernel online federated learning,”IEEE transactions on pattern analysis and machine intelligence, vol. 44, no. 12, pp. 9872–9886, 2021

    2021

  6. [6]

    Tighter regret analysis and optimization of online federated learning,

    D. Kwon, J. Park, and S. Hong, “Tighter regret analysis and optimization of online federated learning,”IEEE Transactions on Pattern Analysis and Machine Intelligence, 2023

    2023

  7. [7]

    Federated learning in mobile edge networks: A comprehensive survey,

    W. Y . B. Lim, N. C. Luong, D. T. Hoang, Y . Jiao, Y .-C. Liang, Q. Yang, D. Niyato, and C. Miao, “Federated learning in mobile edge networks: A comprehensive survey,”IEEE communications surveys & tutorials, vol. 22, no. 3, pp. 2031–2063, 2020

  8. [8]

    A survey on vertical federated learning: From theory to applications,

    Q. Yang, T. Chen, Y . Liuet al., “A survey on vertical federated learning: From theory to applications,”IEEE Transactions on Neural Networks and Learning Systems, 2023, to appear

    2023

Show all 45 references
  1. [9]

    Privacy and robustness in federated learning: Attacks and defenses,

    L. Lyu, H. Yu, X. Ma, C. Chen, L. Sun, J. Zhao, Q. Yang, and S. Y . Philip, “Privacy and robustness in federated learning: Attacks and defenses,”IEEE transactions on neural networks and learning systems, 2022

    2022

  2. [10]

    A survey on federated learning: The journey from centralized machine learning to privacy-preserving edge learning,

    D. H. Nguyen, P. N. Pathirana, M. Ding, and A. Seneviratne, “A survey on federated learning: The journey from centralized machine learning to privacy-preserving edge learning,”IEEE Internet of Things Journal, vol. 8, no. 7, pp. 5476–5497, 2021

    2021

  3. [11]

    Federated learning: A survey on enabling technologies, challenges, and open issues,

    M. Aledhari, I. Razzak, I. A. Hameed, and S. Z. Khan, “Federated learning: A survey on enabling technologies, challenges, and open issues,”IEEE Access, vol. 10, pp. 56 322–56 344, 2022

    2022

  4. [12]

    Advances and open problems in federated learning,

    P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. Bonawitz, Z. Charles, G. Cormode, R. Cummingset al., “Advances and open problems in federated learning,”Foundations and trends® in machine learning, vol. 14, no. 1–2, pp. 1–210, 2021

    2021

  5. [13]

    Deep leakage from gradients,

    L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,”Advances in Neural Information Processing Systems (NeurIPS), vol. 32, 2019

    2019

  6. [14]

    Deep models under the gan: information leakage from collaborative deep learning,

    B. Hitaj, G. Ateniese, and F. Perez-Cruz, “Deep models under the gan: information leakage from collaborative deep learning,” inProceedings of the 2017 ACM SIGSAC conference on computer and communications security, 2017, pp. 603–618

    2017

  7. [15]

    Inverting gradients-how easy is it to break privacy in federated learning?

    J. Geiping, H. Bauermeister, H. Dr ¨oge, and M. Moeller, “Inverting gradients-how easy is it to break privacy in federated learning?”Ad- vances in neural information processing systems, vol. 33, pp. 16 937– 16 947, 2020

    2020

  8. [16]

    Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,

    M. Nasr, R. Shokri, and A. Houmansadr, “Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,” in2019 IEEE symposium on security and privacy (SP). IEEE, 2019, pp. 739–753

    2019

  9. [17]

    Gradient leakage attack resilient deep learning,

    W. Wei and L. Liu, “Gradient leakage attack resilient deep learning,” IEEE Transactions on Information Forensics and Security, vol. 17, pp. 303–316, 2021

    2021

  10. [18]

    Practical secure aggregation for privacy-preserving machine learning,

    K. Bonawitz, V . Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, “Practical secure aggregation for privacy-preserving machine learning,” inproceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, 2017, ...

    2017

  11. [19]

    Lightsecagg: a lightweight and versatile design for secure aggregation in federated learning,

    J. So, C. He, C.-S. Yang, S. Li, Q. Yu, R. E Ali, B. Guler, and S. Avestimehr, “Lightsecagg: a lightweight and versatile design for secure aggregation in federated learning,”Proceedings of Machine Learning and Systems, vol. 4, pp. 694–720, 2022

    2022

  12. [20]

    A hybrid approach to privacy-preserving federated learning,

    S. Truex, N. Baracaldo, A. Anwar, T. Steinke, H. Ludwig, R. Zhang, and Y . Zhou, “A hybrid approach to privacy-preserving federated learning,” inProceedings of the 12th ACM workshop on artificial intelligence and security, 2019, pp. 1–11

    2019

  13. [21]

    DP-SIGNSGD: When efficiency meets privacy and robustness,

    L. Lyu, “DP-SIGNSGD: When efficiency meets privacy and robustness,” arXiv preprint arXiv:2105.04808, 2021

    2021 arXiv

  14. [22]

    Homomorphic encryption for arithmetic of approximate numbers,

    J. H. Cheon, A. Kim, M. Kim, and Y . Song, “Homomorphic encryption for arithmetic of approximate numbers,” inInternational conference on the theory and application of cryptology and information security. Springer, 2017, pp. 409–437

    2017

  15. [23]

    Privacy preserving machine learning with ho- momorphic encryption and federated learning,

    H. Fang and Q. Qian, “Privacy preserving machine learning with ho- momorphic encryption and federated learning,”Future Internet, vol. 13, no. 4, p. 94, 2021

    2021

  16. [24]

    1-bit stochastic gradient descent and its application to data-parallel distributed training of speech dnns,

    F. Seide, H. Fu, J. Droppo, G. Li, and D. Yu, “1-bit stochastic gradient descent and its application to data-parallel distributed training of speech dnns,” inFifteenth annual conference of the international speech communication association, 2014

    2014

  17. [25]

    signSGD: Compressed optimisation for non-convex problems,

    J. Bernstein, Y .-X. Wang, K. Azizzadenesheli, and A. Anandkumar, “signSGD: Compressed optimisation for non-convex problems,” inInter- national Conference on Machine Learning. PMLR, 2018, pp. 560–569

    2018

  18. [26]

    signsgd with majority vote is communication efficient and fault tolerant,

    J. Bernstein, J. Zhao, K. Azizzadenesheli, and A. Anandkumar, “signsgd with majority vote is communication efficient and fault tolerant,”arXiv preprint arXiv:1810.05291, 2018

    2018 arXiv

  19. [27]

    Sparse-signsgd with majority vote for communication-efficient distributed learning,

    C. Park and N. Lee, “Sparse-signsgd with majority vote for communication-efficient distributed learning,”arXiv preprint arXiv:2302.07475, 2023

    2023 arXiv

  20. [28]

    Sign-based gradient descent with heterogeneous data: Convergence and byzantine resilience,

    R. Jin, Y . Liu, Y . Huang, X. He, T. Wu, and H. Dai, “Sign-based gradient descent with heterogeneous data: Convergence and byzantine resilience,” IEEE Transactions on Neural Networks and Learning Systems, 2024

    2024

  21. [29]

    FedLSC: Improving communi- cation efficiency and robustness in federated learning with stragglers and adversaries,

    H.-G. Joo, S. Hong, and D.-J. Shin, “FedLSC: Improving communi- cation efficiency and robustness in federated learning with stragglers and adversaries,”IEEE Transactions on Neural Networks and Learning Systems, 2025

    2025

  22. [30]

    Differentially private secure multi- party computation for federated learning in financial applications,

    D. Byrd and A. Polychroniadou, “Differentially private secure multi- party computation for federated learning in financial applications,” inProceedings of the First ACM International Conference on AI in Finance, 2020, pp. 1–9

    2020

  23. [31]

    Batchcrypt: Efficient homomorphic encryption for cross-silo federated learning,

    C. Zhang, S. Li, J. Xia, W. Wang, F. Yan, and Y . Liu, “Batchcrypt: Efficient homomorphic encryption for cross-silo federated learning,” in 2020 USENIX annual technical conference (USENIX ATC 20), 2020, pp. 493–506

    2020

  24. [32]

    Flashe: Additively symmetric homo- morphic encryption for cross-silo federated learning,

    Z. Jiang, W. Wang, and Y . Liu, “Flashe: Additively symmetric homo- morphic encryption for cross-silo federated learning,”arXiv preprint arXiv:2109.00675, 2021

    2021 arXiv

  25. [33]

    Privacy-preserving federated learning based on multi-key homomorphic encryption,

    J. Ma, S.-A. Naas, S. Sigg, and X. Lyu, “Privacy-preserving federated learning based on multi-key homomorphic encryption,”International Journal of Intelligent Systems, vol. 37, no. 9, pp. 5880–5901, 2022

    2022

  26. [34]

    Fully homomorphic encryption using ideal lattices,

    C. Gentry, “Fully homomorphic encryption using ideal lattices,”Pro- ceedings of the 41st annual ACM symposium on Theory of computing, pp. 169–178, 2009

    2009

  27. [35]

    Ahsecagg and tskg: Lightweight secure aggregation for federated learning without compromise,

    S. Zhang, Y . Liao, and P. Zhou, “Ahsecagg and tskg: Lightweight secure aggregation for federated learning without compromise,”IEEE Transactions on Information Forensics and Security, 2023, to appear

    2023

  28. [36]

    Secure aggregation of semi-honest clients and servers in federated learning with secret-shared homomorphism,

    D. Zhao, “Secure aggregation of semi-honest clients and servers in federated learning with secret-shared homomorphism,”ArXiv preprint arXiv:2303.10123, 2023

    2023 arXiv

  29. [37]

    Pqsf: Post-quantum secure privacy-preserving federated learning,

    H. Jiang, Y . Wang, Q. Luo, and X. Zhang, “Pqsf: Post-quantum secure privacy-preserving federated learning,”Scientific Reports, vol. 14, no. 1, pp. 1–15, 2024

    2024

  30. [38]

    Secure and flexible privacy- preserving federated learning based on multi-key fully homomorphic encryption,

    C. Liu, Y . Wang, X. Chen, and H. Tan, “Secure and flexible privacy- preserving federated learning based on multi-key fully homomorphic encryption,”Electronics, vol. 13, no. 3, p. 567, 2024

    2024

  31. [39]

    Efficient multiparty protocols using circuit randomization,

    D. Beaver, “Efficient multiparty protocols using circuit randomization,” inProceedings of the 11th Annual International Cryptology Conference (CRYPTO), 1991, pp. 420–432

    1991

  32. [40]

    Scalable and unconditionally secure multiparty computation,

    I. Damg ˚ard and J. B. Nielsen, “Scalable and unconditionally secure multiparty computation,” inAdvances in Cryptology–CRYPTO 2007. Springer, 2007, pp. 572–590

    2007

  33. [41]

    ATLAS: efficient and scalable mpc in the honest majority setting,

    V . Goyal, H. Li, R. Ostrovsky, A. Polychroniadou, and Y . Song, “ATLAS: efficient and scalable mpc in the honest majority setting,” in Annual International Cryptology Conference. Springer, 2021, pp. 244– 274. 16

    2021

  34. [42]

    Applications of fermat’s little theorem in cryptography,

    J. Smith, “Applications of fermat’s little theorem in cryptography,” Journal of Theoretical Cryptography, 2020

    2020

  35. [43]

    Gradient-based learning applied to document recognition,

    Y . LeCun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,”Proceedings of the IEEE, vol. 86, no. 11, pp. 2278–2324, 1998

    1998

  36. [44]

    Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,

    H. Xiao, K. Rasul, and R. V ollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,”arXiv preprint arXiv:1708.07747, 2017

    2017 arXiv

  37. [45]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hintonet al., “Learning multiple layers of features from tiny images,” 2009

    2009

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.